Fix use-after-free in eager bitblaster (#1772)
authorAndres Noetzli <andres.noetzli@gmail.com>
Sat, 14 Apr 2018 01:22:11 +0000 (18:22 -0700)
committerGitHub <noreply@github.com>
Sat, 14 Apr 2018 01:22:11 +0000 (18:22 -0700)
commit84ead159cfbb76c8a6195ed2a64102529a84bdac
tree740621df486464fc6284f4d19326c79705d9080d
parent10c36f53033aadb6e2f3bf16f2d7305b793fd0e4
Fix use-after-free in eager bitblaster (#1772)

There was a use-after-free in the eager bitblaster: the context used by
the SAT solver was destroyed before the solver. This lead to a
use-after-free in the destructor of the SAT solver when destroying
context-dependent objects. This commit fixes the issue by changing the
desctruction order such that the context is destroyed after the SAT
solver.

Note: This issue was introduced in commit
a917cc2ab4956b542b1f565abf0e62b197692f8d because d_nullContext and
d_satSolver were changed to be std::unique_ptrs.
src/theory/bv/bitblast/eager_bitblaster.cpp
src/theory/bv/bitblast/eager_bitblaster.h