Merge pull request #8916 from ethereum/smt_array_push_pop

[SMTChecker] Support array push/pop

test/libsolidity/smtCheckerTests/array_members/pop_1_safe.sol

@@ -0,0 +1,9 @@
+pragma experimental SMTChecker;
+
+contract C {
+	uint[] a;
+	function f() public {
+		a.push();
+		a.pop();
+	}
+}

test/libsolidity/smtCheckerTests/array_members/pop_1_unsafe.sol

@@ -0,0 +1,10 @@
+pragma experimental SMTChecker;
+
+contract C {
+	uint[] a;
+	function f() public {
+		a.pop();
+	}
+}
+// ----
+// Warning: (82-89): Empty array "pop" detected here.

test/libsolidity/smtCheckerTests/array_members/pop_2d_safe.sol

@@ -0,0 +1,10 @@
+pragma experimental SMTChecker;
+
+contract C {
+	uint[][] a;
+	function f() public {
+		a.push();
+		a[0].push();
+		a[0].pop();
+	}
+}

test/libsolidity/smtCheckerTests/array_members/pop_2d_unsafe.sol

@@ -0,0 +1,12 @@
+pragma experimental SMTChecker;
+
+contract C {
+	uint[][] a;
+	function f() public {
+		a.push();
+		a[0].push();
+		a[1].pop();
+	}
+}
+// ----
+// Warning: (111-121): Empty array "pop" detected here.

test/libsolidity/smtCheckerTests/array_members/pop_constructor_safe.sol

@@ -0,0 +1,9 @@
+pragma experimental SMTChecker;
+
+contract C {
+	uint[] a;
+	constructor() public {
+		a.push();
+		a.pop();
+	}
+}

test/libsolidity/smtCheckerTests/array_members/pop_constructor_unsafe.sol

@@ -0,0 +1,10 @@
+pragma experimental SMTChecker;
+
+contract C {
+	uint[] a;
+	constructor() public {
+		a.pop();
+	}
+}
+// ----
+// Warning: (83-90): Empty array "pop" detected here.

test/libsolidity/smtCheckerTests/array_members/pop_loop_safe.sol

@@ -0,0 +1,11 @@
+pragma experimental SMTChecker;
+
+contract C {
+	uint[] a;
+	function f(uint l) public {
+		for (uint i = 0; i < l; ++i) {
+			a.push();
+			a.pop();
+		}
+	}
+}

test/libsolidity/smtCheckerTests/array_members/pop_loop_unsafe.sol

@@ -0,0 +1,14 @@
+pragma experimental SMTChecker;
+
+contract C {
+	uint[] a;
+	function f(uint l) public {
+		for (uint i = 0; i < l; ++i) {
+			a.push();
+			a.pop();
+		}
+		a.pop();
+	}
+}
+// ----
+// Warning: (150-157): Empty array "pop" detected here.

test/libsolidity/smtCheckerTests/array_members/push_2d_arg_1_safe.sol

@@ -0,0 +1,10 @@
+pragma experimental SMTChecker;
+
+contract C {
+	uint[][] a;
+	function f(uint[] memory x, uint y) public {
+		a.push(x);
+		a[0].push(y);
+		assert(a[0][a[0].length - 1] == y);
+	}
+}

test/libsolidity/smtCheckerTests/array_members/push_2d_arg_1_unsafe.sol

@@ -0,0 +1,14 @@
+pragma experimental SMTChecker;
+
+contract C {
+	uint[][] a;
+	function f(uint[] memory x, uint y) public {
+		a.push(x);
+		a[0].push(y);
+		a[0].pop();
+		assert(a[0][a[0].length - 1] == y);
+	}
+}
+// ----
+// Warning: (162-177): Underflow (resulting value less than 0) happens here
+// Warning: (150-184): Assertion violation happens here

test/libsolidity/smtCheckerTests/array_members/push_arg_1.sol

@@ -0,0 +1,9 @@
+pragma experimental SMTChecker;
+
+contract C {
+	uint[] a;
+	function f(uint x) public {
+		a.push(x);
+		assert(a[a.length - 1] == x);
+	}
+}

test/libsolidity/smtCheckerTests/array_members/push_overflow_1_safe.sol

@@ -0,0 +1,10 @@
+pragma experimental SMTChecker;
+
+contract C {
+	uint256[] x;
+	constructor() public { x.push(42); }
+	function f() public {
+		x.push(23);
+		assert(x[0] == 42 || x[0] == 23);
+	}
+}

test/libsolidity/smtCheckerTests/array_members/push_overflow_1_safe_no_overflow_assumption.sol

@@ -0,0 +1,10 @@
+pragma experimental SMTChecker;
+
+contract C {
+	uint256[] x;
+	constructor() public { x.push(42); }
+	function f() public {
+		x.push(23);
+		assert(x[0] == 42);
+	}
+}

test/libsolidity/smtCheckerTests/array_members/push_overflow_2_safe.sol

@@ -0,0 +1,12 @@
+contract C {
+	uint256[] x;
+	function f(uint256 l) public {
+		require(x.length == 0);
+		x.push(42);
+		x.push(84);
+		for(uint256 i = 0; i < l; ++i)
+			x.push(23);
+		assert(x[0] == 42 || x[0] == 23);
+	}
+}
+

test/libsolidity/smtCheckerTests/array_members/push_overflow_2_safe_no_overflow_assumption.sol

@@ -0,0 +1,13 @@
+pragma experimental SMTChecker;
+
+contract C {
+	uint256[] x;
+	function f(uint256 l) public {
+		require(x.length == 0);
+		x.push(42);
+		x.push(84);
+		for(uint256 i = 0; i < l; ++i)
+			x.push(23);
+		assert(x[0] == 42);
+	}
+}

test/libsolidity/smtCheckerTests/array_members/push_storage_ref_safe_aliasing.sol

@@ -0,0 +1,16 @@
+pragma experimental SMTChecker;
+
+contract C {
+	uint[][] a;
+	function f() public {
+		a.push();
+		uint[] storage b = a[0];
+		b.push(8);
+		assert(b[b.length - 1] == 8);
+		// Safe but fails due to aliasing.
+		assert(a[0][a[0].length - 1] == 8);
+	}
+}
+// ----
+// Warning: (217-232): Underflow (resulting value less than 0) happens here
+// Warning: (205-239): Assertion violation happens here

test/libsolidity/smtCheckerTests/array_members/push_storage_ref_unsafe_aliasing.sol

@@ -0,0 +1,15 @@
+pragma experimental SMTChecker;
+
+contract C {
+	uint[][] a;
+	function f() public {
+		a.push();
+		a[0].push();
+		a[0][0] = 16;
+		uint[] storage b = a[0];
+		b[0] = 32;
+		assert(a[0][0] == 16);
+	}
+}
+// ----
+// Warning: (167-188): Assertion violation happens here

test/libsolidity/smtCheckerTests/array_members/push_zero_2d_safe.sol

@@ -0,0 +1,10 @@
+pragma experimental SMTChecker;
+
+contract C {
+	uint[][] a;
+	function f() public {
+		a.push();
+		a[0].push();
+		assert(a[a.length - 1][0] == 0);
+	}
+}

test/libsolidity/smtCheckerTests/array_members/push_zero_2d_unsafe.sol

@@ -0,0 +1,12 @@
+pragma experimental SMTChecker;
+
+contract C {
+	uint[][] a;
+	function f() public {
+		a.push();
+		a[0].push();
+		assert(a[a.length - 1][0] == 100);
+	}
+}
+// ----
+// Warning: (111-144): Assertion violation happens here

test/libsolidity/smtCheckerTests/array_members/push_zero_safe.sol

@@ -0,0 +1,9 @@
+pragma experimental SMTChecker;
+
+contract C {
+	uint[] a;
+	function f() public {
+		a.push();
+		assert(a[a.length - 1] == 0);
+	}
+}

test/libsolidity/smtCheckerTests/array_members/push_zero_unsafe.sol

@@ -0,0 +1,11 @@
+pragma experimental SMTChecker;
+
+contract C {
+	uint[] a;
+	function f() public {
+		a.push();
+		assert(a[a.length - 1] == 100);
+	}
+}
+// ----
+// Warning: (94-124): Assertion violation happens here