[tautschnig]

simplify_minus folded a pointer difference p - q only when both operands resolved to the same address_of expression. Two syntactically identical pointer operands -- in particular two null pointers -- were left as a symbolic pointer-difference expression even though the value is unconditionally 0.

This mattered well beyond a missing constant fold. An empty libstdc++ container computes size() as _M_finish - _M_start with both pointers null; left unfolded, that size stays symbolic, so the first allocation's element count is symbolic, so symex_allocate mints a dynamic_object_size symbol and creates a symbolic-size array -- and the capacity chain that follows stays symbolic too. Symbolic-size arrays bit-blast into a quadratic number of clauses, which is what made std::vector verification blow up (e.g. cpp20_erase_if: ~168M clauses and MiniSat OOM at --unwind 7).

Fold p - p to 0 for syntactically identical pointer operands (sound: the difference of a pointer with itself is 0 regardless of what it points to, including null). For cpp20_erase_if this removes all dynamic_object_size symbols -- every allocation becomes a constant-size int[k] -- and the formula becomes tractable (terminates at --unwind 10 instead of running the solver out of memory). New unit test "Simplify the difference of a pointer and itself".

• Each commit message has a non-empty body, explaining why the change was made.
• n/a Methods or procedures I have added are documented, following the guidelines provided in CODING_STANDARD.md.
• n/a The feature or user visible behaviour I have added or modified has been documented in the User Guide in doc/cprover-manual/
• Regression or unit tests are included, or existing tests cover the modified code (in this case I have detailed which ones those are in the commit message).
• n/a My commit message includes data points confirming performance improvements (if claimed).
• My PR is restricted to a single feature or bugfix.
• n/a White-space or formatting changes outside the feature-related changed lines are in commits of their own.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing. Review the Copilot code review billing settings.

[codecov]

Codecov Report

❌ Patch coverage is 94.44444% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 81.03%. Comparing base (826c1c7) to head (d99b4c9).
⚠️ Report is 2 commits behind head on develop.

Files with missing lines	Patch %	Lines
unit/util/simplify_expr.cpp	93.75%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #9427   +/-   ##
========================================
  Coverage    81.02%   81.03%           
========================================
  Files         1723     1723           
  Lines       191314   191332   +18     
  Branches        73       73           
========================================
+ Hits        155020   155037   +17     
- Misses       36294    36295    +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.