[Issue Backlog] Backlog Analysis - 2026-02-24

[github-actions[bot]]

Issue Backlog Analysis - 2026-02-24

Executive Summary

• Total open issues analyzed: 179 (pages 1 and 2)
• Issues recommended for closure: 0 (conservative — no high-confidence closure candidates)
• Potential duplicates / merge candidates: 5 issues across 2 clusters
• Issues with suggested fixes: 7
• Issues with notable status / needing attention: 12
• Issues commented on: 1

---

Potential Duplicates / Merge Candidates

These issues appear to describe the same underlying problem.

Cluster 1 — NodeJS/WASM worker thread non-termination

The z3-solver npm package leaves WASM worker threads running after solving, preventing Node.js processes from exiting naturally.

Issue	Title	Notes
#6512	NodeJs process won't stop after using 'solve' or 'solver.check()'	Oldest, 8 👍 reactions
#6701	Javascript & Typescript API Runs Forever	Most activity (3 comments), labeled javascript
#7070	[NodeJS] Z3 doesn't seem to clean up threads/workers after finishing its job	Most recently filed of the three

Suggested action: Treat #6512 as canonical (oldest, most upvotes); link #6701 and #7070 to it and consider closing the newer two once the underlying WASM thread lifecycle issue is resolved. Root fix is in src/api/js/.

Cluster 2 — arith.solver=6 performance regressions

Multiple performance regression reports relate to the switch from arith.solver=2 to arith.solver=6.

Issue	Title	Notes
#5614	Performance regression from arith.solver=2 to arith.solver=6	2021
#4934	[Consolidated] Performance regressions of arith.solver=6 vs. arith.solver=2	2021, already a consolidation issue
#7502	regression with arith.solver=6	2025, HACL* upgrade context, assigned to NikolajBjorner and levnach

Suggested action: Link #5614 and #7502 to #4934 (which is already a consolidation issue). The 2025 report in #7502 may represent a new regression distinct from the 2021 reports; keeping them separate is appropriate but cross-linking would help.

---

Issues with Suggested Fixes

#8740 — Z3 Regression: solver.check() returns 'unknown' instead of 'sat'

• Component: Arithmetic solver
• Relevant source files: src/smt/theory_arith*.cpp, src/smt/theory_lra.cpp
• Analysis: Reporter confirmed the regression was bisected to commit 739515263 (noted by contributor @levnach in a comment). Working in 4.15.4, broken in 4.15.8+. The formula is a pure linear integer arithmetic problem.
• Suggested fix direction: Inspect the arithmetic theory changes in commit 739515263 for altered completeness guarantees in the LRA/LIA solver path.

#8023 — Soundness issue in string logic ⚠️ Critical

• Component: String theory solver
• Relevant source files: src/smt/theory_str*.cpp, src/ast/seq_decl_plugin.cpp, src/smt/seq_axioms.cpp
• Analysis: Actively tracked by reporter with 8+ distinct minimized test cases across multiple commits. The latest (as of 2026-02-23) still triggers an invalid model or segfault. Common pattern: nested str.substr / str.indexof with self-referential or complex string variables triggers incorrect unsat or invalid model.
• Suggested fix direction: Investigate axiom instantiation correctness for nested sequence operations in the seq/string solver, particularly around str.substr when its length or offset argument involves other sequence operations.

#8183 — Refutational Soundness Bug: Incorrect UNSAT in Real-to-FP conversion ⚠️ Critical

• Component: Floating-point theory
• Relevant source files: src/smt/theory_fpa.cpp, src/ast/fpa/fpa_rewriter.cpp
• Analysis: Z3 incorrectly returns unsat for a satisfiable formula requiring that to_fp(RNE, x) overflows to -∞ for large negative reals. The issue is specific to RNE and RNA rounding modes. RTN is handled correctly. Per IEEE 754 §7.4, RNE and RNA should both overflow to ±∞.
• Suggested fix direction: Audit the Real-to-FP overflow boundary handling for roundTiesToEven and roundTiesToAway in the FP rewriter/theory; the overflow-to-infinity case for these modes is not being triggered.

#8185 — Incorrect model in mixed FP/Real logic

• Component: Floating-point theory, string theory interaction
• Relevant source files: src/smt/theory_fpa.cpp, src/smt/seq_axioms.cpp
• Analysis: Adding an irrelevant (assert (and x (= (str.from_int 0) "0"))) to a Float/Real formula changes the result from unknown to sat with an invalid model. Also triggered by (set-option :produce-proofs true). Suggests a solver interaction/combination bug when string and FP theories are both active.
• Suggested fix direction: Investigate theory combination when the string solver is loaded alongside the FP solver; the string constraint may affect solver state in an unintended way.

#7684 — OCaml bindings don't install with cmake build system

• Component: CMake build system
• Relevant source files: cmake/CMakeLists.txt, CMakeLists.txt
• Analysis: When Z3_BUILD_OCAML_BINDINGS=ON, the OCaml output is built but not installed by the CMake install target. This blocks NixOS and other package managers that switched from the Python/Make build to CMake.
• Suggested fix direction: Add CMake install() rules for the OCaml binding artifacts (.cma, .cmxa, .cmi files and the stub library). Look at how the Java bindings are installed in CMake as a model.

#6346 — Invalid model issue on an incremental string formula

• Component: String theory solver, incremental mode
• Relevant source files: src/smt/seq_axioms.cpp, src/smt/theory_str*.cpp
• Analysis: 11 comments over 2+ years; incrementally constructed string formula produces invalid model. The incremental aspect (push/pop or assert sequence) is likely relevant to axiom propagation state.
• Suggested fix direction: Check whether sequence axioms are correctly repropagated after backtracking in incremental mode.

#7957 — z3 behavior depends on the names of the functions

• Component: Heuristics / hash-based term ordering
• Relevant source files: src/ast/ast.cpp, src/smt/smt_context.cpp
• Analysis: The same logical formula behaves differently (terminates vs. OOM loop) depending solely on function names. This points to name-dependent hashing affecting heuristic search order in the solver. The variation is only seen via the C API (Z3_eval_smtlib2_string), not the z3 binary.
• Suggested fix direction: Investigate whether symbol hash values affect tactic/heuristic selection in a way that leads to drastically different search paths. This may be a randomization/seed issue.

---

Issues Needing More Information

Issue	Title	Missing Information
#7990	Wrong verdict with (set-option :sat.smt true)	No comments; needs SMT2 repro and Z3 version info
#7592	PartialOrder hangs when reasoning about bottom element	No comments, no SMT2 file; needs minimal repro
#7538	produce-unsat-cores affects convergence	No comments; needs more detail on the formula and Z3 version
#7151	Unknown when working with String Sequences	No comments; needs Z3 version and whether issue persists on latest
#7055	A simple regex constraint for which dZ3 returns unknown	Needs verification on latest Z3 and current dZ3
#7113	Completeness regression on LIRA	No comments, no version info
#7132	Unsound model with ABV logic	No comments — needs SMT2 file or Z3 version to track
#6303	Z3 switching between unknown/unsat by just changing range sort	1 comment, no follow-up; needs minimal repro on current Z3

---

Notable Issues Deserving Attention

Issue	Title	Age	Notes
#2650	Incorrect result in NRA formula 2	~6.4 years	36 comments, nlsat label, long-standing NRA soundness issue
#1241	spacer and pdr report incomplete/spurious models on HORN	~8.4 years	23 comments, Horn label, foundational Spacer completeness concern
#7027	[consolidated] new core	~2.2 years	34 comments, owned by NikolajBjorner, tracks new core feature set
#8023	Soundness issue in string logic	~3.4 months	8 comments, active new test cases added weekly, critical
#5648	Regex performance cliff when using InRe	~4.3 years	17 comments, string label, affects common use cases
#7684	OCaml bindings don't install with cmake	~8.5 months	18 comments, build/release label, blocking NixOS packaging
#8740	Z3 Regression: solver.check() returns 'unknown'	1 day	Bisected to commit 7395152, assigned, recent regression
#7418	Build Python distributions targeting wasm	~1.4 years	32 comments, reopened, community interest for browser use cases
#7502	regression with arith.solver=6	~1.2 months	9 comments, HACL* / F* affected, assigned
#3962	Spacer: error "query failed: Uninterpreted 'mod'"	~5.9 years	15 comments, Horn label, long-standing modulo limitation in Spacer
#7677	Potential issue in arithmetic optimization	~8.7 months	17 comments, bug + Arithmetic labels, reopened after prior closure
#6788	Finite sets	~2.6 years	3 comments, feature request for finite set reasoning

---

Floating-Point Issues Cluster (same reporter)

Reporter @wingsyuyi-satori has filed several well-documented FP soundness issues in Jan 2026. These are distinct bugs but may share a common root in the FP theory combination or proof-mode interaction:

Issue	Title	Key Trigger
#8169	Incorrect model with (_ FloatingPoint 2 24) and fp.to_real	Non-standard FP sort + fp.to_real
#8183	Incorrect UNSAT in Real-to-FP conversion with RNE/RNA overflow	to_fp overflow with RNE/RNA rounding
#8185	Incorrect model in mixed FP/Real logic triggered by extra string const	FP + String interaction, or produce-proofs
#8194	Incorrect model with :produce-proofs true involving String Theory and UF	produce-proofs + String + UF

All four are assigned to @NikolajBjorner and @Copilot. They merit coordinated investigation of the FP theory, especially in proof mode and when combined with string or UF theories.

---

Automated by Issue Backlog Processor — 2026-02-24T17:10 UTC

AI generated by Issue Backlog Processor

• expires on Mar 3, 2026, 5:16 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-03-03T17:16:01.912Z.

Closed by Workflow