SMT2: tolerate non-constant array indices when parsing array models - #9063
Merged
Conversation
tautschnig
requested review from
TGWDB,
kroening,
martin-cs and
peterschrammel
as code owners
June 18, 2026 20:01
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Updates SMT2 array model parsing to avoid aborting when encountering store terms with non-constant indices, instead skipping those entries during model reconstruction.
Changes:
- Detect non-constant
storeindices duringwalk_array_treeand skip processing those stores - Prevent
to_constant_exprprecondition violations caused by solver-returned models containing symbolic indices
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## develop #9063 +/- ##
========================================
Coverage 80.83% 80.83%
========================================
Files 1715 1715
Lines 189948 189989 +41
Branches 73 73
========================================
+ Hits 153540 153577 +37
- Misses 36408 36412 +4 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
tautschnig
force-pushed
the
strata/smt2-array-model-nonconst-index
branch
from
June 24, 2026 15:42
4cb733b to
69cf780
Compare
kroening
approved these changes
Jul 6, 2026
tautschnig
force-pushed
the
strata/smt2-array-model-nonconst-index
branch
from
July 28, 2026 13:35
69cf780 to
68e69c0
Compare
smt2_convt::walk_array_tree assumes every (store array index value) term in a solver-returned array model has a constant index, calling to_constant_expr on it unconditionally. Models for unbounded or non-integer-keyed arrays can contain a non-constant index, which trips the to_constant_expr precondition. Skip such store entries during model reconstruction instead of aborting. Add a unit test that drives walk_array_tree directly (via a subclass exposing the protected method) with a store term whose index is a plain symbol, and asserts that reconstruction does not abort and drops only the offending entry while keeping the well-formed default. The test puts invariants into throwing mode (cbmc_invariants_should_throwt) so that, without the guard, the to_constant_expr precondition surfaces as a clean test failure rather than aborting the unit binary. Note on test shape: parse_rec dispatches on the index type (the array's size type) and coerces arithmetic types to constants, so a non-constant index can only be produced by a non-arithmetic index type (which parses to a nil expression). Such a type is not integer-convertible, so a surviving constant-integer-indexed store cannot coexist with a dropped non-constant one in the same model at the irept level; the preserved well-formed entry in the test is therefore the (as const ...) default, which is collected without going through index parsing. The extern6 test declares 'extern int stuff[]' -- an unbounded array whose SMT array model carries a non-constant store index. Model reconstruction in smt2_convt::walk_array_tree previously aborted on the to_constant_expr precondition, which is why the test was tagged broken-smt-backend. With the non-constant-index guard in place, cbmc --cprover-smt2 (and --smt2 with Z3) now produces the expected VERIFICATION FAILED / EXIT=10, so the tag no longer applies; the KNOWNBUG CI job rightly flags the test as fixed. The no-new-smt tag is retained: the incremental SMT2 backend takes a different code path and still aborts on this test. Co-authored-by: Kiro <kiro-agent@users.noreply.github.com>
tautschnig
force-pushed
the
strata/smt2-array-model-nonconst-index
branch
from
July 28, 2026 17:13
68e69c0 to
743eb66
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
smt2_convt::walk_array_tree assumes every (store array index value) term in a solver-returned array model has a constant index, calling to_constant_expr on it unconditionally. Models for unbounded or non-integer-keyed arrays can contain a non-constant index, which trips the to_constant_expr precondition. Skip such store entries during model reconstruction instead of aborting.