[SMTChecker] Fixed crash on push to bytes on lhs of an assignment

test/libsolidity/smtCheckerTests/array_members/push_as_lhs_and_rhs_bytes.sol

@@ -0,0 +1,16 @@
+pragma experimental SMTChecker;
+
+contract C {
+	bytes b;
+	function f() public {
+		b.push() = b.push();
+		uint length = b.length;
+		assert(length >= 2);
+		assert(b[length - 1] == 0);
+		assert(b[length - 1] == b[length - 2]);
+		// Fails
+		assert(b[length - 1] == byte(uint8(1)));
+	}
+}
+// ----
+// Warning 6328: (236-275): CHC: Assertion violation happens here.\nCounterexample:\nb = [0, 0]\n\n\n\nTransaction trace:\nconstructor()\nState: b = []\nf()

test/libsolidity/smtCheckerTests/array_members/push_as_lhs_bytes.sol

@@ -0,0 +1,22 @@
+pragma experimental SMTChecker;
+
+contract C {
+	bytes b;
+
+	function f() public {
+		require(b.length == 0);
+		b.push() = byte(uint8(1));
+		assert(b[0] == byte(uint8(1)));
+	}
+
+	function g() public {
+		byte one = byte(uint8(1));
+		b.push() = one;
+		assert(b[b.length - 1] == one);
+		// Fails
+		assert(b[b.length - 1] == byte(uint8(100)));
+	}
+
+}
+// ----
+// Warning 6328: (290-333): CHC: Assertion violation happens here.\nCounterexample:\nb = [1]\n\n\n\nTransaction trace:\nconstructor()\nState: b = []\ng()

test/libsolidity/smtCheckerTests/array_members/push_as_lhs_bytes_2d.sol

@@ -0,0 +1,26 @@
+pragma experimental SMTChecker;
+
+contract C {
+	bytes[] c;
+
+	function f() public {
+		bytes1 val = bytes1(uint8(2));
+		require(c.length == 0);
+		c.push().push() = val;
+		assert(c.length == 1);
+		assert(c[0].length == 1);
+		assert(c[0][0] == val);
+	}
+
+	function g() public {
+		bytes1 val = bytes1(uint8(2));
+		c.push().push() = val;
+		assert(c.length > 0);
+		assert(c[c.length - 1].length == 1);
+		assert(c[c.length - 1][c[c.length - 1].length - 1] == val);
+		// Fails
+		assert(c[c.length - 1][c[c.length - 1].length - 1] == bytes1(uint8(100)));
+	}
+}
+// ----
+// Warning 6328: (468-541): CHC: Assertion violation happens here.\nCounterexample:\nc = [[2]]\n\n\n\nTransaction trace:\nconstructor()\nState: c = []\ng()