Crash on parseSMTLib2String about haskell-z3

[IagoAbal]

Fixed by @maurobringolf in 140e3e7 (PR #44), thanks a lot!

[IagoAbal]

Hi @rcdickerson, the bindings are rather low-level, and the "higher-level" Monad API is just offered for convenience but it doesn't really add any safety. In particular, if you look at the code, evalZ3 creates a new Z3 Context, and any Z3 object created inside evalZ3 is only valid for that particular Context. What you are doing here is illegal:

ast <- evalZ3 $ parseSMTLib2String "(assert true)" [] [] [] []
s <- evalZ3 $ astToString ast
...

I don't know exactly where this crashes and why it doesn't crash on some platforms or with earlier versions. That is a detail of the C++ implementation. At the high-level, the issue is that the ast belongs to the Context created by the first evalZ3, the second evalZ3 expects it to belong to its own Context. (Edited: I previously said that the first Context may have been finalized, but that shouldn't happen, it should wait for the ast to be GCed.)

You should do instead:

evalZ3 $ do
    ast <- parseSMTLib2String "(assert true)" [] [] [] []
    s    <- astToString ast
    ...

If you want that kind of flexibility then you should use Z3.Base and keep around the Context object yourself. (Note that Z3.Monad is essentially a Reader monad that stores the Context.) You don't need to call any finalizers manually though, that should be handled for you by the GC.

[rcdickerson]

Thanks for the response! I didn't realize there was one Context per evalZ3 -- I will restructure my code accordingly. :)

[rcdickerson]

So actually the same thing happens to me even with a single top-level evalZ3:

$ ghci
GHCi, version 8.4.4: http://www.haskell.org/ghc/  :? for help
Prelude> import Z3.Monad
Prelude Z3.Monad> evalZ3 $ astToString =<< parseSMTLib2String "(assert true)" [] [] [] []
double free or corruption (out)
Aborted (core dumped)

[rcdickerson]

I see the same thing directly using Z3.Base as well:

$ ghci
GHCi, version 8.4.4: http://www.haskell.org/ghc/  :? for help
Prelude> import Z3.Base
Prelude Z3.Base> cfg <- mkConfig
Prelude Z3.Base> ctx <- mkContext cfg
Prelude Z3.Base> ast <- parseSMTLib2String ctx "(assert (= 1 1))" [] [] [] []
Prelude Z3.Base> astToString ctx ast
double free or corruption (out)
Aborted (core dumped)

[rcdickerson]

As another data point, I tried this with the Python bindings as well to see if my Z3 install was the problem. Seems to work:

$ python
Python 2.7.16 (default, Apr  6 2019, 01:42:57) 
[GCC 8.3.0] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> from z3 import *
>>> str(parse_smt2_string("(assert (= 1 1))"))
'[1 == 1]'

[IagoAbal]

Sorry for taking a year or so to reply. :-) It seems to be because the Z3 folks changed the return type of the function. It used to return a Z3_ast but it now returns a Z3_ast_vector. If that is all then it should be easy to fix. Patches are welcome!

[maurobringolf]

I am currently trying to fix this ✌️