Merge remote-tracking branch 'origin/develop' into breaking

test/externalTests.sh

@@ -42,10 +42,10 @@ source test/externalTests/common.sh
 
 printTask "Running external tests..."
 
-$REPO_ROOT/externalTests/zeppelin.sh "$SOLJSON"
-$REPO_ROOT/externalTests/gnosis.sh "$SOLJSON"
-$REPO_ROOT/externalTests/colony.sh "$SOLJSON"
-$REPO_ROOT/externalTests/ens.sh "$SOLJSON"
+"$REPO_ROOT/externalTests/zeppelin.sh" "$SOLJSON"
+"$REPO_ROOT/externalTests/gnosis.sh" "$SOLJSON"
+"$REPO_ROOT/externalTests/colony.sh" "$SOLJSON"
+"$REPO_ROOT/externalTests/ens.sh" "$SOLJSON"
 
 # Disabled temporarily as it needs to be updated to latest Truffle first.
 #test_truffle Gnosis https://github.com/axic/pm-contracts.git solidity-050

test/externalTests/colony.sh

@@ -31,18 +31,17 @@ function test_fn { yarn run test:contracts; }
 function colony_test
 {
     OPTIMIZER_LEVEL=3
-    FORCE_ABIv2=false
     CONFIG="truffle.js"
 
-    truffle_setup https://github.com/solidity-external-tests/colonyNetwork.git develop_080
-    run_install install_fn
+    truffle_setup "$SOLJSON" https://github.com/solidity-external-tests/colonyNetwork.git develop_080
+    run_install "$SOLJSON" install_fn
 
     cd lib
     rm -Rf dappsys
     git clone https://github.com/solidity-external-tests/dappsys-monolithic.git -b master_080 dappsys
     cd ..
 
-    truffle_run_test compile_fn test_fn
+    truffle_run_test "$SOLJSON" compile_fn test_fn "NO-FORCE-ABI-V2"
 }
 
 external_test ColonyNetworks colony_test

test/externalTests/common.sh

@@ -40,9 +40,10 @@ function verify_version_input
 
 function setup
 {
-    local branch="$1"
+    local soljson="$1"
+    local branch="$2"
 
-    setup_solcjs "$DIR" "$SOLJSON" "$branch" "solc"
+    setup_solcjs "$DIR" "$soljson" "$branch" "solc"
     cd solc
 }
 
@@ -80,7 +81,7 @@ function download_project
     printLog "Cloning $branch of $repo..."
     git clone --depth 1 "$repo" -b "$branch" "$dir/ext"
     cd ext
-    echo "Current commit hash: `git rev-parse HEAD`"
+    echo "Current commit hash: $(git rev-parse HEAD)"
 }
 
 function force_truffle_version
@@ -92,10 +93,11 @@ function force_truffle_version
 
 function truffle_setup
 {
-    local repo="$1"
-    local branch="$2"
+    local soljson="$1"
+    local repo="$2"
+    local branch="$3"
 
-    setup_solcjs "$DIR" "$SOLJSON" "master" "solc"
+    setup_solcjs "$DIR" "$soljson" "master" "solc"
     download_project "$repo" "$branch" "$DIR"
 }
 
@@ -207,11 +209,12 @@ function clean
 
 function run_install
 {
-    local init_fn="$1"
+    local soljson="$1"
+    local init_fn="$2"
     printLog "Running install function..."
 
     replace_version_pragmas
-    force_solc "$CONFIG" "$DIR" "$SOLJSON"
+    force_solc "$CONFIG" "$DIR" "$soljson"
 
     $init_fn
 }
@@ -232,11 +235,15 @@ function run_test
 
 function truffle_run_test
 {
-    local compile_fn="$1"
-    local test_fn="$2"
+    local soljson="$1"
+    local compile_fn="$2"
+    local test_fn="$3"
+    local force_abi_v2_flag="$4"
+
+    test "$force_abi_v2_flag" = "FORCE-ABI-V2" || test "$force_abi_v2_flag" = "NO-FORCE-ABI-V2"
 
     replace_version_pragmas
-    force_solc "$CONFIG" "$DIR" "$SOLJSON"
+    force_solc "$CONFIG" "$DIR" "$soljson"
 
     printLog "Checking optimizer level..."
     if [ -z "$OPTIMIZER_LEVEL" ]; then
@@ -258,7 +265,7 @@ function truffle_run_test
         clean
         force_solc_settings "$CONFIG" "$optimize" "istanbul"
         # Force abi coder v2 in the last step. Has to be the last because code is modified.
-        if [ "$FORCE_ABIv2" = true ]; then
+        if [ "$force_abi_v2_flag" = "FORCE-ABI-V2" ]; then
             [[ "$optimize" =~ yul ]] && force_abi_v2
         fi
 

test/externalTests/ens.sh

@@ -18,9 +18,7 @@
 #
 # (c) 2019 solidity contributors.
 #------------------------------------------------------------------------------
-# shellcheck disable=SC1091
 source scripts/common.sh
-# shellcheck disable=SC1091
 source test/externalTests/common.sh
 
 verify_input "$1"
@@ -35,14 +33,14 @@ function ens_test
     export OPTIMIZER_LEVEL=1
     export CONFIG="truffle-config.js"
 
-    truffle_setup https://github.com/solidity-external-tests/ens.git upgrade-0.8.0
+    truffle_setup "$SOLJSON" https://github.com/solidity-external-tests/ens.git upgrade-0.8.0
 
     # Use latest Truffle. Older versions crash on the output from 0.8.0.
     force_truffle_version ^5.1.55
 
-    run_install install_fn
+    run_install "$SOLJSON" install_fn
 
-    truffle_run_test compile_fn test_fn
+    truffle_run_test "$SOLJSON" compile_fn test_fn "NO-FORCE-ABI-V2"
 }
 
 external_test Ens ens_test

test/externalTests/gnosis.sh

@@ -33,17 +33,17 @@ function gnosis_safe_test
     OPTIMIZER_LEVEL=1
     CONFIG="truffle.js"
 
-    truffle_setup https://github.com/solidity-external-tests/safe-contracts.git development_080
+    truffle_setup "$SOLJSON" https://github.com/solidity-external-tests/safe-contracts.git development_080
 
     force_truffle_version ^5.0.42
     sed -i 's|github:gnosis/mock-contract#sol_0_5_0|github:solidity-external-tests/mock-contract#master_080|g' package.json
     rm -f package-lock.json
     rm -rf node_modules/
 
-    run_install install_fn
+    run_install "$SOLJSON" install_fn
     replace_libsolc_call
 
-    truffle_run_test compile_fn test_fn
+    truffle_run_test "$SOLJSON" compile_fn test_fn "NO-FORCE-ABI-V2"
 }
 
 external_test Gnosis-Safe gnosis_safe_test

test/externalTests/solc-js/solc-js.sh

@@ -35,16 +35,16 @@ function solcjs_test
     SOLCJS_INPUT_DIR="$TEST_DIR"/test/externalTests/solc-js
 
     # set up solc-js on the branch specified
-    setup master
+    setup "$SOLJSON" master
 
     printLog "Updating index.js file..."
     echo "require('./determinism.js');" >> test/index.js
 
     printLog "Copying determinism.js..."
-    cp -f $SOLCJS_INPUT_DIR/determinism.js test/
+    cp -f "$SOLCJS_INPUT_DIR/determinism.js" test/
 
     printLog "Copying contracts..."
-    cp -Rf $SOLCJS_INPUT_DIR/DAO test/
+    cp -Rf "$SOLCJS_INPUT_DIR/DAO" test/
 
     printLog "Copying SMTChecker tests..."
     cp -Rf "$TEST_DIR"/test/libsolidity/smtCheckerTests test/
@@ -52,7 +52,7 @@ function solcjs_test
 
     # Update version (needed for some tests)
     echo "Updating package.json to version $VERSION"
-    npm version --allow-same-version --no-git-tag-version $VERSION
+    npm version --allow-same-version --no-git-tag-version "$VERSION"
 
     run_test compile_fn test_fn
 }

test/externalTests/zeppelin.sh

@@ -33,10 +33,10 @@ function zeppelin_test
     OPTIMIZER_LEVEL=1
     CONFIG="truffle-config.js"
 
-    truffle_setup https://github.com/solidity-external-tests/openzeppelin-contracts.git upgrade-0.8.0
-    run_install install_fn
+    truffle_setup "$SOLJSON" https://github.com/solidity-external-tests/openzeppelin-contracts.git upgrade-0.8.0
+    run_install "$SOLJSON" install_fn
 
-    truffle_run_test compile_fn test_fn
+    truffle_run_test "$SOLJSON" compile_fn test_fn "NO-FORCE-ABI-V2"
 }
 
 external_test Zeppelin zeppelin_test

test/libsolidity/constructor_inheritance_init_order_3.sol

@@ -0,0 +1,12 @@
+contract A {
+    uint public x;
+    constructor(uint) {}
+    function f() public { x = 4; }
+}
+contract B is A {
+    constructor() A(f()) {}
+}
+// ====
+// compileViaYul: also
+// ----
+// x() -> 4

test/libsolidity/semanticTests/reverts/revert_return_area.sol

@@ -0,0 +1,20 @@
+contract C {
+    fallback() external {
+        revert("abc");
+    }
+
+    function f() public returns (uint s, uint r) {
+        address x = address(this);
+        assembly {
+            mstore(0, 7)
+            s := call(sub(0, 1), x, 0, 0, 0, 0, 32)
+            r := mload(0)
+        }
+    }
+}
+
+// ====
+// compileViaYul: also
+// EVMVersion: >=byzantium
+// ----
+// f() -> 0x00, 0x08c379a000000000000000000000000000000000000000000000000000000000

test/libsolidity/smtCheckerTests/functions/constructor_hierarchy_3.sol

@@ -19,6 +19,6 @@ contract A is B {
 	}
 }
 // ----
-// Warning 4984: (203-208): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
 // Warning 4984: (244-249): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
 // Warning 6328: (232-250): CHC: Assertion violation happens here.
+// Warning 4984: (203-208): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.

test/libsolidity/smtCheckerTests/functions/constructor_hierarchy_4.sol

@@ -18,6 +18,6 @@ contract A is B {
 	}
 }
 // ----
+// Warning 4984: (230-235): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
 // Warning 4984: (207-212): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
 // Warning 4984: (198-203): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
-// Warning 4984: (230-235): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.

test/libsolidity/smtCheckerTests/functions/constructor_hierarchy_diamond_3.sol

@@ -28,6 +28,6 @@ contract A is B2, B1 {
 }
 // ----
 // Warning 4984: (160-165): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
-// Warning 4984: (225-230): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
 // Warning 4984: (241-246): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
+// Warning 4984: (225-230): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
 // Warning 6328: (334-350): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/functions/getters/nested_arrays_mappings_3.sol

@@ -19,8 +19,8 @@ contract C {
 	function f() public view {
 		uint y = this.m(0,1,2,3);
 		assert(y == m[0][1][2][3]); // should hold
-		assert(y == 1); // should fail
+		// Disabled because of Spacer seg fault
+		//assert(y == 1); // should fail
 	}
 }
 // ----
-// Warning 6328: (401-415): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/functions/getters/nested_arrays_mappings_6.sol

@@ -14,8 +14,8 @@ contract C {
 	function f() public view {
 		uint y = this.m(0,1,2,3);
 		assert(y == m[0][1][2][3]); // should hold
-		assert(y == 1); // should fail
+		// Disabled because Spacer seg faults
+		//assert(y == 1); // should fail
 	}
 }
 // ----
-// Warning 6328: (349-363): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/inheritance/constructor_hierarchy_base_calls_inheritance_specifier_1.sol

@@ -0,0 +1,36 @@
+pragma experimental SMTChecker;
+
+contract A {
+	uint public x;
+	constructor(uint a) { x = a; }
+}
+
+contract B is A {
+	constructor(uint b) A(b) {
+	}
+
+	function f() internal returns (uint) {
+		x = x + 1;
+		return x;
+	}
+
+	function g() internal returns (uint) {
+		x = 42;
+		return x;
+	}
+}
+
+contract Z is B {
+	constructor(uint z) B(z + f()) {
+	}
+}
+
+contract C is Z(5) {
+	constructor() {
+		assert(x == 6);
+		assert(x > 9); // should fail
+	}
+}
+// ----
+// Warning 4984: (325-332): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
+// Warning 6328: (400-413): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/inheritance/constructor_hierarchy_base_calls_inheritance_specifier_2.sol

@@ -0,0 +1,38 @@
+pragma experimental SMTChecker;
+
+contract A {
+	uint public x;
+	constructor(uint a) { x = a; }
+}
+
+contract B is A(9) {
+	constructor(uint b) {
+		x += b;
+	}
+
+	function f() internal returns (uint) {
+		x = x + 1;
+		return x;
+	}
+
+	function g() internal returns (uint) {
+		x = 42;
+		return x;
+	}
+}
+
+contract Z is B {
+	constructor(uint z) B(z + f()) {
+	}
+}
+
+contract C is Z(5) {
+	constructor() {
+		assert(x == 15);
+		assert(x > 90); // should fail
+	}
+}
+// ----
+// Warning 4984: (143-149): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
+// Warning 4984: (333-340): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
+// Warning 6328: (409-423): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/inheritance/constructor_hierarchy_base_calls_with_side_effects_1.sol

@@ -0,0 +1,34 @@
+pragma experimental SMTChecker;
+
+contract A {
+	uint public x;
+	constructor(uint a) { x = a; }
+}
+
+contract B is A {
+	constructor(uint b) A(b + f()) {
+	}
+
+	function f() internal returns (uint) {
+		x = x + 1;
+		return x;
+	}
+}
+
+abstract contract Z is A {
+	uint k;
+	constructor(uint z) {
+		k = z;
+	}
+}
+
+contract C is Z, B {
+	constructor() B(x) Z(x) {
+		assert(x == 1);
+		assert(k == 0);
+		assert(x == k); // should fail
+	}
+}
+// ----
+// Warning 4984: (138-145): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
+// Warning 6328: (384-398): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/inheritance/constructor_hierarchy_base_calls_with_side_effects_2.sol

@@ -0,0 +1,33 @@
+pragma experimental SMTChecker;
+
+contract A {
+	uint public x;
+	constructor(uint a) { x = a; }
+}
+
+contract B is A {
+	constructor(uint b) A(b) {
+	}
+
+	function f() internal returns (uint) {
+		x = x + 1;
+		return x;
+	}
+}
+
+abstract contract Z is A {
+	uint k;
+	constructor(uint z) {
+		k = z;
+	}
+}
+
+contract C is Z, B {
+	constructor() B(f()) Z(f()) {
+		assert(x == 1);
+		assert(k == 2);
+		assert(x == k); // should fail
+	}
+}
+// ----
+// Warning 6328: (382-396): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/inheritance/constructor_hierarchy_base_calls_with_side_effects_3.sol

@@ -0,0 +1,35 @@
+pragma experimental SMTChecker;
+
+contract A {
+	uint public x;
+	constructor(uint a) { x = a; }
+}
+
+contract B is A {
+	constructor(uint b) A(b + f()) {
+	}
+
+	function f() internal returns (uint) {
+		x = x + 1;
+		return x;
+	}
+}
+
+abstract contract Z is A {
+	uint k;
+	constructor(uint z) {
+		k = z;
+	}
+}
+
+contract C is Z, B {
+	constructor(uint c) B(c) Z(x) {
+		assert(x == c + 1);
+		assert(k == 0);
+		assert(x == k); // should fail
+	}
+}
+// ----
+// Warning 4984: (138-145): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
+// Warning 4984: (366-371): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
+// Warning 6328: (394-408): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/inheritance/constructor_hierarchy_base_calls_with_side_effects_4.sol

@@ -0,0 +1,35 @@
+pragma experimental SMTChecker;
+
+contract A {
+	uint public x;
+	constructor(uint a) { x = a; }
+}
+
+contract B is A {
+	constructor(uint b) A(b + f()) {
+	}
+
+	function f() internal returns (uint) {
+		x = x + 1;
+		return x;
+	}
+}
+
+abstract contract Z is A {
+	uint k;
+	constructor(uint z) {
+		k = z;
+	}
+}
+
+contract C is Z, B {
+	constructor(uint c) Z(x) B(c) {
+		assert(x == c + 1);
+		assert(k == 0);
+		assert(x == k); // should fail
+	}
+}
+// ----
+// Warning 4984: (138-145): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
+// Warning 4984: (366-371): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
+// Warning 6328: (394-408): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/inheritance/constructor_hierarchy_base_calls_with_side_effects_5.sol

@@ -0,0 +1,39 @@
+pragma experimental SMTChecker;
+
+contract A {
+	uint public x;
+	constructor(uint a) { x = a; }
+}
+
+contract B is A {
+	constructor(uint b) A(b + f()) {
+	}
+
+	function f() internal returns (uint) {
+		x = x + 1;
+		return x;
+	}
+
+	function g() internal returns (uint) {
+		x = 42;
+		return x;
+	}
+}
+
+abstract contract Z is A {
+	uint k;
+	constructor(uint z) {
+		k = z;
+	}
+}
+
+contract C is Z, B {
+	constructor() Z(g()) B(f()) {
+		assert(x == 44);
+		assert(k == 42);
+		assert(x == k); // should fail
+	}
+}
+// ----
+// Warning 4984: (138-145): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
+// Warning 6328: (456-470): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/inheritance/constructor_hierarchy_base_calls_with_side_effects_6.sol

@@ -0,0 +1,38 @@
+pragma experimental SMTChecker;
+
+contract A {
+	uint public x;
+	constructor(uint a) { x = a; }
+}
+
+contract B is A {
+	constructor(uint b) A(b) {
+	}
+
+	function f() internal returns (uint) {
+		x = x + 1;
+		return x;
+	}
+
+	function g() internal returns (uint) {
+		x = 42;
+		return x;
+	}
+}
+
+abstract contract Z is A {
+	uint k;
+	constructor(uint z) {
+		k = z;
+	}
+}
+
+contract C is Z, B {
+	constructor() Z(g()) B(f()) {
+		assert(x == 1);
+		assert(k == 42);
+		assert(x == k); // should fail
+	}
+}
+// ----
+// Warning 6328: (449-463): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/inheritance/constructor_hierarchy_base_calls_with_side_effects_7.sol

@@ -0,0 +1,35 @@
+pragma experimental SMTChecker;
+
+contract A {
+	uint public x;
+	constructor(uint a) { x = a; }
+}
+
+contract B is A {
+	constructor(uint b) A(b) {
+	}
+
+	function f() internal returns (uint) {
+		x = x + 1;
+		return x;
+	}
+
+	function g() internal returns (uint) {
+		x = 42;
+		return x;
+	}
+}
+
+contract Z is B {
+	constructor() B(f()) {
+	}
+}
+
+contract C is Z {
+	constructor() {
+		assert(x == 1);
+		assert(x > 2); // should fail
+	}
+}
+// ----
+// Warning 6328: (387-400): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/inheritance/constructor_hierarchy_base_calls_with_side_effects_8.sol

@@ -0,0 +1,22 @@
+pragma experimental SMTChecker;
+
+contract A {
+	uint public x;
+	constructor(uint) {}
+
+	function f() internal returns (uint) {
+		x = x + 1;
+		return x;
+	}
+}
+
+contract C is A {
+	constructor() A(f()) {
+		assert(x == 1);
+		assert(x == 0); // should fail
+		assert(x > 2000); // should fail
+	}
+}
+// ----
+// Warning 6328: (218-232): CHC: Assertion violation happens here.
+// Warning 6328: (251-267): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/inheritance/constructor_hierarchy_base_calls_with_side_effects_9.sol

@@ -0,0 +1,24 @@
+pragma experimental SMTChecker;
+
+contract A {
+	uint public x = 42;
+	constructor(uint) {}
+
+	function f() internal returns (uint) {
+		x = x + 1;
+		return x;
+	}
+}
+
+contract C is A {
+	constructor() A(f()) {
+		assert(x == 42);
+		assert(x == 0); // should fail
+		assert(x == 1); // should fail
+		assert(x > 2000); // should fail
+	}
+}
+// ----
+// Warning 6328: (224-238): CHC: Assertion violation happens here.
+// Warning 6328: (257-271): CHC: Assertion violation happens here.
+// Warning 6328: (290-306): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/inheritance/constructor_state_variable_init_asserts.sol

@@ -0,0 +1,39 @@
+pragma experimental SMTChecker;
+
+contract A {
+	int x;
+	constructor (int a) { x = a;}
+}
+
+contract B is A {
+	int y;
+	constructor(int a) A(-a) {
+		if (a > 0) {
+			y = 2;
+		}
+		else {
+			y = 4;
+		}
+	}
+}
+
+contract C is B {
+	constructor(int a) B(a) {
+		assert(y != 3); // should hold
+		assert(y == 4); // should fail
+		if (a > 0) {
+			assert(x < 0 && y == 2); // should hold
+			assert(x < 0 && y == 4); // should fail
+		}
+		else {
+			assert(x >= 0 && y == 4); // should hold
+			assert(x >= 0 && y == 2); // should fail
+			assert(x > 0); // should fail
+		}
+	}
+}
+// ----
+// Warning 6328: (280-294): CHC: Assertion violation happens here.
+// Warning 6328: (372-395): CHC: Assertion violation happens here.
+// Warning 6328: (472-496): CHC: Assertion violation happens here.
+// Warning 6328: (516-529): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/inheritance/constructor_state_variable_init_chain_run_all.sol

@@ -23,9 +23,9 @@ contract A is B {
 
 // ----
 // Warning 4984: (157-162): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
-// Warning 4984: (216-221): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
 // Warning 4984: (239-244): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
 // Warning 4984: (261-266): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
 // Warning 4984: (261-270): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
 // Warning 4984: (287-292): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
 // Warning 6328: (275-293): CHC: Assertion violation happens here.
+// Warning 4984: (216-221): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.

test/libsolidity/smtCheckerTests/inheritance/constructor_state_variable_init_chain_run_all_2.sol

@@ -23,8 +23,8 @@ contract A is B {
 
 // ----
 // Warning 4984: (157-163): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
-// Warning 4984: (217-222): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
 // Warning 4984: (240-245): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
 // Warning 4984: (262-268): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
 // Warning 4984: (285-290): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.
 // Warning 6328: (273-291): CHC: Assertion violation happens here.
+// Warning 4984: (217-222): CHC: Overflow (resulting value larger than 2**256 - 1) happens here.

test/libsolidity/smtCheckerTests/inheritance/constructor_state_variable_init_chain_tree.sol

@@ -0,0 +1,43 @@
+pragma experimental SMTChecker;
+
+contract A {
+	int x;
+	constructor (int a) { x = a; }
+}
+
+contract Z {
+	int z;
+	constructor(int _z) {
+		z = _z;
+	}
+}
+
+contract B is A, Z {
+	constructor(int b) A(b) Z(x) {
+		assert(x == b);
+		assert(z == 0);
+	}
+}
+
+contract F is Z, A {
+	constructor(int b) Z(x) A(b) {
+		assert(x == b);
+		assert(z == 0);
+	}
+}
+
+contract C is B {
+	constructor(int c) B(-c) {
+		if (x > 0) {
+			assert(c < 0); // should hold
+			assert(c >= 0); // should fail
+		}
+		else {
+			assert(c < 0); // should fail
+			assert(c >= 0); // should hold
+		}
+	}
+}
+// ----
+// Warning 6328: (436-450): CHC: Assertion violation happens here.
+// Warning 6328: (483-496): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/inheritance/constructor_state_variable_init_diamond_middle.sol

@@ -5,11 +5,17 @@ contract A {
 }
 
 contract B is A {
-	constructor() { x = 2; }
+	constructor() {
+		assert(x == 1);
+		x = 2;
+	}
 }
 
 contract C is A {
-	constructor() { x = 3; }
+	constructor() {
+		assert(x == 1);
+		x = 3;
+	}
 }
 
 contract D is B, C {
@@ -19,4 +25,5 @@ contract D is B, C {
 	}
 }
 // ----
-// Warning 6328: (214-228): CHC: Assertion violation happens here.
+// Warning 6328: (167-181): CHC: Assertion violation happens here.
+// Warning 6328: (256-270): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/inheritance/constructor_uses_function_base.sol

@@ -0,0 +1,19 @@
+pragma experimental SMTChecker;
+
+contract A {
+	uint x;
+	constructor() {
+		x = 42;
+	}
+	function f() public view returns(uint256) {
+		return x;
+	}
+}
+contract B is A {
+	uint y = f();
+}
+contract C is B {
+	function g() public view {
+		assert(y == 42);
+	}
+}

test/libsolidity/smtCheckerTests/types/array_aliasing_memory_3.sol

@@ -15,10 +15,10 @@ contract C
 		// Erasing knowledge about memory references should not
 		// erase knowledge about storage references.
 		assert(c[0] == 42);
-		assert(a[0] == 2);
+		// Removed because current Spacer seg faults in cex generation.
+		//assert(a[0] == 2);
 		// Removed because current Spacer seg faults in cex generation.
 		//assert(b[0] == 1);
 	}
 }
 // ----
-// Warning 6328: (476-493): CHC: Assertion violation happens here.

test/libsolidity/smtCheckerTests/types/struct/struct_array_struct_array_memory_unsafe_2.sol

@@ -21,7 +21,8 @@ contract C {
 		// Removed because current Spacer seg faults in cex generation.
 		//assert(s1.t.y == s2.t.y);
 		s1.a[2] = 4;
-		assert(s1.a[2] == s2.a[2]);
+		// Removed because current Spacer seg faults in cex generation.
+		//assert(s1.a[2] == s2.a[2]);
 		s1.ts[3].y = 5;
 		// Removed because current Spacer seg faults in cex generation.
 		//assert(s1.ts[3].y == s2.ts[3].y);
@@ -30,5 +31,4 @@ contract C {
 	}
 }
 // ----
-// Warning 6328: (456-482): CHC: Assertion violation happens here.
-// Warning 6328: (629-667): CHC: Assertion violation happens here.
+// Warning 6328: (697-735): CHC: Assertion violation happens here.

test/libyul/EwasmTranslationTest.cpp

@@ -102,6 +102,7 @@ string EwasmTranslationTest::interpret()
 	InterpreterState state;
 	state.maxTraceSize = 10000;
 	state.maxSteps = 1000000;
+	state.maxExprNesting = 64;
 	try
 	{
 		Interpreter::run(state, WasmDialect{}, *m_object->code);

test/libyul/YulInterpreterTest.cpp

@@ -89,6 +89,7 @@ string YulInterpreterTest::interpret()
 	InterpreterState state;
 	state.maxTraceSize = 32;
 	state.maxSteps = 512;
+	state.maxExprNesting = 64;
 	try
 	{
 		Interpreter::run(state, EVMDialect::strictAssemblyForEVMObjects(langutil::EVMVersion{}), *m_ast);

test/libyul/yulInterpreterTests/expr_nesting_depth_exceeded.yul

@@ -0,0 +1,14 @@
+{
+  function f(x) -> y
+  {
+    // 32 nested additions are computed in
+    // exactly 66 expression evaluation steps
+    y := add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,x))))))))))))))))))))))))))))))))
+  }
+  mstore(0,f(0))
+}
+// ----
+// Trace:
+//   Maximum expression nesting level reached.
+// Memory dump:
+// Storage dump:

test/libyul/yulInterpreterTests/expr_nesting_depth_not_exceeded.yul

@@ -0,0 +1,14 @@
+{
+  function f(x) -> y
+  {
+    // 31 nested additions are computed in
+    // exactly 64 expression evaluation steps
+    y := add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,add(0x1,x)))))))))))))))))))))))))))))))
+  }
+  mstore(0,f(0))
+}
+// ----
+// Trace:
+// Memory dump:
+//      0: 000000000000000000000000000000000000000000000000000000000000001f
+// Storage dump:

test/tools/ossfuzz/abiV2FuzzerCommon.cpp

@@ -40,3 +40,46 @@ solidity::bytes SolidityCompilationFramework::compileContract(
 	);
 	return obj.bytecode;
 }
+
+bool AbiV2Utility::isOutputExpected(
+	uint8_t const* _result,
+	size_t _length,
+	std::vector<uint8_t> const& _expectedOutput
+)
+{
+	if (_length != _expectedOutput.size())
+		return false;
+
+	return (memcmp(_result, _expectedOutput.data(), _length) == 0);
+}
+
+evmc_message AbiV2Utility::initializeMessage(bytes const& _input)
+{
+	// Zero initialize all message fields
+	evmc_message msg = {};
+	// Gas available (value of type int64_t) is set to its maximum
+	// value.
+	msg.gas = std::numeric_limits<int64_t>::max();
+	msg.input_data = _input.data();
+	msg.input_size = _input.size();
+	return msg;
+}
+
+evmc::result AbiV2Utility::executeContract(
+	EVMHost& _hostContext,
+	bytes const& _functionHash,
+	evmc_address _deployedAddress
+)
+{
+	evmc_message message = initializeMessage(_functionHash);
+	message.destination = _deployedAddress;
+	message.kind = EVMC_CALL;
+	return _hostContext.call(message);
+}
+
+evmc::result AbiV2Utility::deployContract(EVMHost& _hostContext, bytes const& _code)
+{
+	evmc_message message = initializeMessage(_code);
+	message.kind = EVMC_CREATE;
+	return _hostContext.call(message);
+}

test/tools/ossfuzz/abiV2FuzzerCommon.h

@@ -1,14 +1,17 @@
 #pragma once
 
+#include <test/EVMHost.h>
+
 #include <libsolidity/interface/CompilerStack.h>
 
 #include <libyul/AssemblyStack.h>
 
 #include <libsolutil/Keccak256.h>
 
+#include <evmone/evmone.h>
+
 namespace solidity::test::abiv2fuzzer
 {
-
 class SolidityCompilationFramework
 {
 public:
@@ -29,4 +32,36 @@ protected:
 	langutil::EVMVersion m_evmVersion;
 };
 
+struct AbiV2Utility
+{
+	/// Compares the contents of the memory address pointed to
+	/// by `_result` of `_length` bytes to the expected output.
+	/// Returns true if `_result` matches expected output, false
+	/// otherwise.
+	static bool isOutputExpected(
+		uint8_t const* _result,
+		size_t _length,
+		std::vector<uint8_t> const& _expectedOutput
+	);
+	/// Accepts a reference to a user-specified input and returns an
+	/// evmc_message with all of its fields zero initialized except
+	/// gas and input fields.
+	/// The gas field is set to the maximum permissible value so that we
+	/// don't run into out of gas errors. The input field is copied from
+	/// user input.
+	static evmc_message initializeMessage(bytes const& _input);
+	/// Accepts host context implementation, and keccak256 hash of the function
+	/// to be called at a specified address in the simulated blockchain as
+	/// input and returns the result of the execution of the called function.
+	static evmc::result executeContract(
+		EVMHost& _hostContext,
+		bytes const& _functionHash,
+		evmc_address _deployedAddress
+	);
+	/// Accepts a reference to host context implementation and byte code
+	/// as input and deploys it on the simulated blockchain. Returns the
+	/// result of deployment.
+	static evmc::result deployContract(EVMHost& _hostContext, bytes const& _code);
+};
+
 }

test/tools/ossfuzz/abiV2ProtoFuzzer.cpp

@@ -16,89 +16,26 @@
 */
 // SPDX-License-Identifier: GPL-3.0
 
-#include <test/EVMHost.h>
 #include <test/tools/ossfuzz/abiV2FuzzerCommon.h>
 #include <test/tools/ossfuzz/protoToAbiV2.h>
 
-#include <evmone/evmone.h>
 #include <src/libfuzzer/libfuzzer_macro.h>
 
 #include <fstream>
 
-static evmc::VM evmone = evmc::VM{evmc_create_evmone()};
-
 using namespace solidity::test::abiv2fuzzer;
 using namespace solidity::test;
 using namespace solidity::util;
 using namespace solidity;
 using namespace std;
 
-namespace
-{
-/// Test function returns a uint256 value
-static size_t const expectedOutputLength = 32;
+static evmc::VM evmone = evmc::VM{evmc_create_evmone()};
 /// Expected output value is decimal 0
-static uint8_t const expectedOutput[expectedOutputLength] = {
+static vector<uint8_t> const expectedOutput = {
 	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
 };
 
-/// Compares the contents of the memory address pointed to
-/// by `_result` of `_length` bytes to the expected output.
-/// Returns true if `_result` matches expected output, false
-/// otherwise.
-bool isOutputExpected(uint8_t const* _result, size_t _length)
-{
-	if (_length != expectedOutputLength)
-		return false;
-
-	return (memcmp(_result, expectedOutput, expectedOutputLength) == 0);
-}
-
-/// Accepts a reference to a user-specified input and returns an
-/// evmc_message with all of its fields zero initialized except
-/// gas and input fields.
-/// The gas field is set to the maximum permissible value so that we
-/// don't run into out of gas errors. The input field is copied from
-/// user input.
-evmc_message initializeMessage(bytes const& _input)
-{
-	// Zero initialize all message fields
-	evmc_message msg = {};
-	// Gas available (value of type int64_t) is set to its maximum
-	// value.
-	msg.gas = std::numeric_limits<int64_t>::max();
-	msg.input_data = _input.data();
-	msg.input_size = _input.size();
-	return msg;
-}
-
-/// Accepts host context implementation, and keccak256 hash of the function
-/// to be called at a specified address in the simulated blockchain as
-/// input and returns the result of the execution of the called function.
-evmc::result executeContract(
-	EVMHost& _hostContext,
-	bytes const& _functionHash,
-	evmc_address _deployedAddress
-)
-{
-	evmc_message message = initializeMessage(_functionHash);
-	message.destination = _deployedAddress;
-	message.kind = EVMC_CALL;
-	return _hostContext.call(message);
-}
-
-/// Accepts a reference to host context implementation and byte code
-/// as input and deploys it on the simulated blockchain. Returns the
-/// result of deployment.
-evmc::result deployContract(EVMHost& _hostContext, bytes const& _code)
-{
-	evmc_message message = initializeMessage(_code);
-	message.kind = EVMC_CREATE;
-	return _hostContext.call(message);
-}
-}
-
 DEFINE_PROTO_FUZZER(Contract const& _input)
 {
 	string contract_source = ProtoConverter{}.contractToString(_input);
@@ -147,7 +84,7 @@ DEFINE_PROTO_FUZZER(Contract const& _input)
 	EVMHost hostContext(version, evmone);
 
 	// Deploy contract and signal failure if deploy failed
-	evmc::result createResult = deployContract(hostContext, byteCode);
+	evmc::result createResult = AbiV2Utility::deployContract(hostContext, byteCode);
 	solAssert(
 		createResult.status_code == EVMC_SUCCESS,
 		"Proto ABIv2 Fuzzer: Contract creation failed"
@@ -155,7 +92,7 @@ DEFINE_PROTO_FUZZER(Contract const& _input)
 
 	// Execute test function and signal failure if EVM reverted or
 	// did not return expected output on successful execution.
-	evmc::result callResult = executeContract(
+	evmc::result callResult = AbiV2Utility::executeContract(
 		hostContext,
 		fromHex(hexEncodedInput),
 		createResult.create_address
@@ -165,7 +102,7 @@ DEFINE_PROTO_FUZZER(Contract const& _input)
 	solAssert(callResult.status_code != EVMC_REVERT, "Proto ABIv2 fuzzer: EVM One reverted");
 	if (callResult.status_code == EVMC_SUCCESS)
 		solAssert(
-			isOutputExpected(callResult.output_data, callResult.output_size),
+			AbiV2Utility::isOutputExpected(callResult.output_data, callResult.output_size, expectedOutput),
 			"Proto ABIv2 fuzzer: ABIv2 coding failure found"
 		);
 }

test/tools/ossfuzz/yulFuzzerCommon.cpp

@@ -27,12 +27,14 @@ yulFuzzerUtil::TerminationReason yulFuzzerUtil::interpret(
 	shared_ptr<yul::Block> _ast,
 	Dialect const& _dialect,
 	size_t _maxSteps,
-	size_t _maxTraceSize
+	size_t _maxTraceSize,
+	size_t _maxExprNesting
 )
 {
 	InterpreterState state;
 	state.maxTraceSize = _maxTraceSize;
 	state.maxSteps = _maxSteps;
+	state.maxExprNesting = _maxExprNesting;
 	// Add 64 bytes of pseudo-randomly generated calldata so that
 	// calldata opcodes perform non trivial work.
 	state.calldata = {
@@ -59,6 +61,10 @@ yulFuzzerUtil::TerminationReason yulFuzzerUtil::interpret(
 	{
 		reason = TerminationReason::TraceLimitReached;
 	}
+	catch (ExpressionNestingLimitReached const&)
+	{
+		reason = TerminationReason::ExpresionNestingLimitReached;
+	}
 	catch (ExplicitlyTerminated const&)
 	{
 		reason = TerminationReason::ExplicitlyTerminated;

test/tools/ossfuzz/yulFuzzerCommon.h

@@ -28,6 +28,7 @@ struct yulFuzzerUtil
 		ExplicitlyTerminated,
 		StepLimitReached,
 		TraceLimitReached,
+		ExpresionNestingLimitReached,
 		None
 	};
 
@@ -36,10 +37,12 @@ struct yulFuzzerUtil
 		std::shared_ptr<yul::Block> _ast,
 		Dialect const& _dialect,
 		size_t _maxSteps = maxSteps,
-		size_t _maxTraceSize = maxTraceSize
+		size_t _maxTraceSize = maxTraceSize,
+		size_t _maxExprNesting = maxExprNesting
 	);
 	static size_t constexpr maxSteps = 100;
 	static size_t constexpr maxTraceSize = 75;
+	static size_t constexpr maxExprNesting = 64;
 };
 
 }

test/tools/ossfuzz/yulProto_diff_ossfuzz.cpp

@@ -99,7 +99,8 @@ DEFINE_PROTO_FUZZER(Program const& _input)
 
 	if (
 		termReason == yulFuzzerUtil::TerminationReason::StepLimitReached ||
-		termReason == yulFuzzerUtil::TerminationReason::TraceLimitReached
+		termReason == yulFuzzerUtil::TerminationReason::TraceLimitReached ||
+		termReason == yulFuzzerUtil::TerminationReason::ExpresionNestingLimitReached
 	)
 		return;
 
@@ -109,10 +110,10 @@ DEFINE_PROTO_FUZZER(Program const& _input)
 		stack.parserResult()->code,
 		EVMDialect::strictAssemblyForEVMObjects(version)
 	);
-
 	if (
 		termReason == yulFuzzerUtil::TerminationReason::StepLimitReached ||
-		termReason == yulFuzzerUtil::TerminationReason::TraceLimitReached
+		termReason == yulFuzzerUtil::TerminationReason::TraceLimitReached ||
+		termReason == yulFuzzerUtil::TerminationReason::ExpresionNestingLimitReached
 	)
 		return;
 

test/tools/yulInterpreter/Interpreter.cpp

@@ -247,6 +247,7 @@ void Interpreter::incrementStep()
 
 void ExpressionEvaluator::operator()(Literal const& _literal)
 {
+	incrementStep();
 	static YulString const trueString("true");
 	static YulString const falseString("false");
 
@@ -256,6 +257,7 @@ void ExpressionEvaluator::operator()(Literal const& _literal)
 void ExpressionEvaluator::operator()(Identifier const& _identifier)
 {
 	solAssert(m_variables.count(_identifier.name), "");
+	incrementStep();
 	setValue(m_variables.at(_identifier.name));
 }
 
@@ -326,6 +328,7 @@ void ExpressionEvaluator::evaluateArgs(
 	vector<optional<LiteralKind>> const* _literalArguments
 )
 {
+	incrementStep();
 	vector<u256> values;
 	size_t i = 0;
 	/// Function arguments are evaluated in reverse.
@@ -341,3 +344,13 @@ void ExpressionEvaluator::evaluateArgs(
 	m_values = std::move(values);
 	std::reverse(m_values.begin(), m_values.end());
 }
+
+void ExpressionEvaluator::incrementStep()
+{
+	m_nestingLevel++;
+	if (m_state.maxExprNesting > 0 && m_nestingLevel > m_state.maxExprNesting)
+	{
+		m_state.trace.emplace_back("Maximum expression nesting level reached.");
+		throw ExpressionNestingLimitReached();
+	}
+}

test/tools/yulInterpreter/Interpreter.h

@@ -55,6 +55,10 @@ class TraceLimitReached: public InterpreterTerminatedGeneric
 {
 };
 
+class ExpressionNestingLimitReached: public InterpreterTerminatedGeneric
+{
+};
+
 enum class ControlFlowState
 {
 	Default,
@@ -92,6 +96,7 @@ struct InterpreterState
 	size_t maxTraceSize = 0;
 	size_t maxSteps = 0;
 	size_t numSteps = 0;
+	size_t maxExprNesting = 0;
 	ControlFlowState controlFlowState = ControlFlowState::Default;
 
 	void dumpTraceAndState(std::ostream& _out) const;
@@ -202,6 +207,11 @@ private:
 		std::vector<std::optional<LiteralKind>> const* _literalArguments
 	);
 
+	/// Increment evaluation count, throwing exception if the
+	/// nesting level is beyond the upper bound configured in
+	/// the interpreter state.
+	void incrementStep();
+
 	InterpreterState& m_state;
 	Dialect const& m_dialect;
 	/// Values of variables.
@@ -209,6 +219,8 @@ private:
 	Scope& m_scope;
 	/// Current value of the expression
 	std::vector<u256> m_values;
+	/// Current expression nesting level
+	unsigned m_nestingLevel = 0;
 };
 
 }