[SMTChecker] Use path condition when creating CHC targets

Without path condition, verification targets created inside ternary
operator ignore the condition of the operator inside the branches.
This led to false positives.

Further updates:

- Function calls should consider the conditions under which they are
called, otherwise the analysis may report false positives.
The fix proposed here is to add the current path condition to the edge
that propagates error from a function call.

- Increment error index after function call

This is necessary for the analysis of the ternary operator to work
correctly. No information should leak from a function call inside a
ternary operator in the first branch to the second branch, including
whether or not an error would have occured in the first branch.

However, for the execution that continues after the function call,
we still need to ensure that under the current path condition
the error has not occurred in that function call.

It would be better to isolate the analysis of the branches to separate
clauses, but I do not see an easy way for that now. In this way, even
though the function call in first branch is included in the clause of
the second branch, no information leaks.

- Additonal test for ternary operator

This tests the behaviour of SMTChecker on ternary operator with function
calls inside both branches. Specifically, it tests that SMTChecker
successfully detects a violation of a verification target in the second
branch when the same target is present also in the first branch, but
there it cannot be triggered because of the operator's condition.

test/libsolidity/smtCheckerTests/operators/conditional_assignment_statevar_1.sol

@@ -14,8 +14,6 @@ contract C {
 // ====
 // SMTEngine: all
 // ----
-// Warning 4984: (134-140): CHC: Overflow (resulting value larger than 2**256 - 1) might happen here.
 // Warning 4984: (143-146): CHC: Overflow (resulting value larger than 2**256 - 1) might happen here.
-// Info 1391: CHC: 1 verification condition(s) proved safe! Enable the model checker option "show proved safe" to see all of them.
-// Warning 2661: (134-140): BMC: Overflow (resulting value larger than 2**256 - 1) happens here.
+// Info 1391: CHC: 2 verification condition(s) proved safe! Enable the model checker option "show proved safe" to see all of them.
 // Warning 2661: (143-146): BMC: Overflow (resulting value larger than 2**256 - 1) happens here.

test/libsolidity/smtCheckerTests/operators/ternary_operator_1.sol

@@ -0,0 +1,9 @@
+contract C {
+	function f(uint x) public pure returns (uint) {
+		return x > 0 ? x - 1 : 0; // Underflow cannot happen
+	}
+}
+// ====
+// SMTEngine: chc
+// ----
+// Info 1391: CHC: 1 verification condition(s) proved safe! Enable the model checker option "show proved safe" to see all of them.

test/libsolidity/smtCheckerTests/operators/ternary_operator_2.sol

@@ -0,0 +1,14 @@
+contract C {
+
+	function decrement(uint x) private pure returns (uint) {
+		return x - 1; // No underflow, the method can be called only with positive value
+	}
+
+	function f(uint x) public pure returns (uint) {
+		return x > 0 ? decrement(x) : 0;
+	}
+}
+// ====
+// SMTEngine: chc
+// ----
+// Info 1391: CHC: 1 verification condition(s) proved safe! Enable the model checker option "show proved safe" to see all of them.

test/libsolidity/smtCheckerTests/operators/ternary_operator_3.sol

@@ -0,0 +1,31 @@
+abstract contract D {
+	function d() external virtual returns (uint);
+}
+
+contract C {
+
+	D d;
+	uint v;
+	bool guard = true;
+
+	function inc() public {
+		++v;
+	}
+
+	function dec() public {
+		if (guard) return;
+		--v;
+	}
+
+	function f() public returns (uint) {
+		guard = false;
+		uint ret = v > 0 ? d.d() : 0;
+		guard = true;
+		return ret;
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTTargets: underflow
+// ----
+// Warning 3944: (206-209): CHC: Underflow (resulting value less than 0) happens here.

test/libsolidity/smtCheckerTests/operators/ternary_operator_double_function_call.sol

@@ -0,0 +1,4 @@
+contract C { function decrement(uint x) private pure returns (uint) { return x - 1; } function decrement2(uint x) private pure returns (uint) { return x - 1; } function f(uint x) public pure returns (uint) { return x > 0 ? decrement(x) : decrement2(x); } }
+// ----
+// Warning 3944: (151-156): CHC: Underflow (resulting value less than 0) happens here.
+// Info 1391: CHC: 1 verification condition(s) proved safe! Enable the model checker option "show proved safe" to see all of them.

test/libsolidity/smtCheckerTests/operators/ternary_operator_external_code_1.sol

@@ -0,0 +1,32 @@
+abstract contract D {
+	function d() external virtual returns (uint);
+}
+
+contract C {
+
+	D d;
+	uint v;
+	bool guard = true;
+
+	function inc() public {
+		++v;
+	}
+
+	function dec() public {
+		if (guard) return;
+		--v;
+		guard = true;
+	}
+
+	function f() public returns (uint) {
+		guard = false;
+		uint ret = v > 0 ? d.d() : 0;
+		guard = true;
+		return ret;
+	}
+}
+// ====
+// SMTEngine: chc
+// SMTTargets: underflow
+// ----
+// Info 1391: CHC: 1 verification condition(s) proved safe! Enable the model checker option "show proved safe" to see all of them.

test/libsolidity/smtCheckerTests/operators/ternary_operator_nested_1.sol

@@ -0,0 +1,15 @@
+contract C {
+
+	function unreachable() private pure returns (uint) {
+		assert(false);
+		return 0;
+	}
+
+	function f(uint x) public pure returns (uint) {
+		return x <= 1 ? 0 : x < 2 ? unreachable() : 0;
+	}
+}
+// ====
+// SMTEngine: chc
+// ----
+// Info 1391: CHC: 1 verification condition(s) proved safe! Enable the model checker option "show proved safe" to see all of them.

test/libsolidity/smtCheckerTests/operators/ternary_operator_nested_2.sol

@@ -0,0 +1,27 @@
+contract C {
+
+	function decrement(uint x) private pure returns (uint) {
+		return x - 1;
+	}
+
+	function decrement2(uint x) private pure returns (uint) {
+		return x - 1;
+	}
+
+	function increment(uint x) private pure returns (uint) {
+		return x + 1;
+	}
+
+	function increment2(uint x) private pure returns (uint) {
+		return x + 1;
+	}
+
+	function f(uint x) public pure returns (uint) {
+		return x < 10 ? (x > 0 ? decrement(x) : increment(x)) : (x > 100 ? increment2(x) : decrement2(x));
+	}
+}
+// ====
+// SMTEngine: chc
+// ----
+// Warning 4984: (317-322): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
+// Info 1391: CHC: 3 verification condition(s) proved safe! Enable the model checker option "show proved safe" to see all of them.

test/libsolidity/smtCheckerTests/operators/ternary_operator_nested_3.sol

@@ -0,0 +1,19 @@
+contract C {
+
+	function increment(uint x) private pure returns (uint) {
+		return x + 1;
+	}
+
+	function increment2(uint x) private pure returns (uint) {
+		return x + 1;
+	}
+
+	function f(uint x) public pure returns (uint) {
+		return x < 10 ? (x > 0 ? 0 : increment(x)) : (x > 100 ? increment2(x) : 0);
+	}
+}
+// ====
+// SMTEngine: chc
+// ----
+// Warning 4984: (160-165): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
+// Info 1391: CHC: 1 verification condition(s) proved safe! Enable the model checker option "show proved safe" to see all of them.

test/libsolidity/smtCheckerTests/operators/ternary_operator_nested_4.sol

@@ -0,0 +1,24 @@
+contract C {
+
+	uint s = 1;
+
+	function decrement() private returns (uint) {
+		return --s;
+	}
+
+	function increment() private returns (uint) {
+		return ++s;
+	}
+
+	function f(uint x) public returns (uint) {
+		require(s > 0 && s < 10);
+		uint olds = s;
+		uint ret = x < 1 ? increment() : decrement();
+		assert(s != olds);
+		return ret;
+	}
+}
+// ====
+// SMTEngine: chc
+// ----
+// Info 1391: CHC: 3 verification condition(s) proved safe! Enable the model checker option "show proved safe" to see all of them.

test/libsolidity/smtCheckerTests/types/array_mapping_aliasing_2.sol

@@ -45,5 +45,4 @@ contract C
 // Warning 6368: (850-866): CHC: Out of bounds access happens here.
 // Warning 6368: (850-869): CHC: Out of bounds access happens here.
 // Warning 6328: (936-956): CHC: Assertion violation happens here.
-// Warning 6368: (1029-1043): CHC: Out of bounds access might happen here.
-// Info 1391: CHC: 3 verification condition(s) proved safe! Enable the model checker option "show proved safe" to see all of them.
+// Info 1391: CHC: 4 verification condition(s) proved safe! Enable the model checker option "show proved safe" to see all of them.