Detect binder origins in SMT value definitions - #9162
Open
chaizhenhua wants to merge 1 commit into
Open
chaizhenhua wants to merge 1 commit into
chaizhenhua wants to merge 1 commit into
Conversation
Z3 rejects get-value queries whose expanded definitions contain quantifiers or lambdas. Extend the existing quantifier traversal to recognize array comprehensions when they lower to lambdas, and use it at both Boolean and typed value origins. This preserves define-fun for ordinary Z3 values while keeping binders behind declare-fun plus an equality assertion. Tests cover Boolean binder origins, typed binder origins, the binder-free control, the existing lambda-unflatten regression, real Z3 solving, and the CBMC and SMT2 solver CORE suites.
chaizhenhua
requested review from
TGWDB,
kroening,
martin-cs,
peterschrammel and
tautschnig
as code owners
September 10, 2026 01:09
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Z3 rejects
get-valuequeries when a referenced definition expands to aquantifier or lambda. The existing lambda workaround routed every typed Z3
assignment through
declare-funplus an equality assertion, while Booleanhandles only detected quantifiers. As a result, Boolean expressions containing
array comprehensions could still create rejected definitions, and binder-free
typed assignments unnecessarily changed form.
This change extends the existing recursive quantifier check into the single
binder-origin check used by both Boolean handles and typed assignments. Array
comprehensions count as binders only for a backend that emits them as lambdas.
Definitions containing binders use
declare-funplusassert; ordinary typedZ3 definitions retain
define-fun. The existingz3-lambda-unflattenregression remains the end-to-end output contract.
Validation:
New decision-table unit test: 1 case, 10 assertions passed.
Exact old-production mutant: 5 of 10 assertions failed, covering the missed
Boolean binder origin and the over-broad binder-free typed path.
[smt2]: 40 cases, 201 assertions passed.[z3]: 6 cases, 22 assertions passed with Z3 4.15.4.[core]: 590 cases; 588 passed and 2 existing expected failures; 18,737assertions.
z3-lambda-unflatten: passed.Real Z3
z3-lambda-unflattenverification: 16 of 16 properties passed.cbmc-CORE: 1,128 passed, 67 existing skips.smt2_solver-CORE: 42 passed, 2 existing skips.clang-format 15 changed-line check, diff-filtered cpplint, and
git diff --check: passed.Each commit message has a non-empty body, explaining why the change was made.
The added helper is private and its purpose is documented at its call sites.
No user-visible language or command-line behavior requires a User Guide update.
Unit and regression coverage is included.
No performance improvement is claimed.
The PR is restricted to one SMT value-definition bugfix.
There are no unrelated whitespace or formatting changes.