Merge pull request #7442 from ethereum/develop

Merge develop into develop_060

test/libsolidity/semanticTests/storage/mappings_array2d_pop_delete.sol

@@ -0,0 +1,39 @@
+contract C {
+	mapping (uint => uint)[][] a;
+
+	function n1(uint key, uint value) public {
+		a.length++;
+		mapping (uint => uint)[] storage b = a[a.length - 1];
+		b.length++;
+		b[b.length - 1][key] = value;
+	}
+
+	function n2() public {
+		a.length++;
+		mapping (uint => uint)[] storage b = a[a.length - 1];
+		b.length++;
+	}
+
+	function map(uint key) public view returns (uint) {
+		mapping (uint => uint)[] storage b = a[a.length - 1];
+		return b[b.length - 1][key];
+	}
+
+	function p() public {
+		a.pop();
+	}
+
+	function d() public returns (uint) {
+		delete a;
+		return a.length;
+	}
+}
+// ----
+// n1(uint256,uint256): 42, 64 ->
+// map(uint256): 42 -> 64
+// p() ->
+// n2() ->
+// map(uint256): 42 -> 64
+// d() -> 0
+// n2() ->
+// map(uint256): 42 -> 64

test/libsolidity/semanticTests/storage/mappings_array_pop_delete.sol

@@ -0,0 +1,34 @@
+contract C {
+	mapping (uint => uint)[] a;
+
+	function n1(uint key, uint value) public {
+		a.length++;
+		a[a.length - 1][key] = value;
+	}
+
+	function n2() public {
+		a.length++;
+	}
+
+	function map(uint key) public view returns (uint) {
+		return a[a.length - 1][key];
+	}
+
+	function p() public {
+		a.pop();
+	}
+
+	function d() public returns (uint) {
+		delete a;
+		return a.length;
+	}
+}
+// ----
+// n1(uint256,uint256): 42, 64 ->
+// map(uint256): 42 -> 64
+// p() ->
+// n2() ->
+// map(uint256): 42 -> 64
+// d() -> 0
+// n2() ->
+// map(uint256): 42 -> 64

test/libsolidity/smtCheckerTests/invariants/loop_array.sol

@@ -0,0 +1,19 @@
+pragma experimental SMTChecker;
+
+contract Simple {
+	uint[] a;
+	function f(uint n) public {
+		uint i;
+		while (i < n)
+		{
+			a[i] = i;
+			++i;
+		}
+		require(n > 1);
+		// Assertion is safe but current solver version cannot solve it.
+		// Keep test for next solver release.
+		assert(a[n-1] > a[n-2]);
+	}
+}
+// ----
+// Warning: (273-296): Assertion violation happens here

test/libsolidity/smtCheckerTests/invariants/loop_array_for.sol

@@ -0,0 +1,16 @@
+pragma experimental SMTChecker;
+
+contract Simple {
+	uint[] a;
+	function f(uint n) public {
+		uint i;
+		for (i = 0; i < n; ++i)
+			a[i] = i;
+		require(n > 1);
+		// Assertion is safe but current solver version cannot solve it.
+		// Keep test for next solver release.
+		assert(a[n-1] > a[n-2]);
+	}
+}
+// ----
+// Warning: (267-290): Assertion violation happens here

test/libsolidity/smtCheckerTests/invariants/loop_basic.sol

@@ -0,0 +1,11 @@
+pragma experimental SMTChecker;
+
+contract Simple {
+	function f(uint x) public pure {
+		uint y;
+		require(x > 0);
+		while (y < x)
+			++y;
+		assert(y == x);
+	}
+}

test/libsolidity/smtCheckerTests/invariants/loop_basic_for.sol

@@ -0,0 +1,10 @@
+pragma experimental SMTChecker;
+
+contract Simple {
+	function f(uint x) public pure {
+		uint y;
+		for (y = 0; y < x; ++y) {}
+		assert(y == x);
+	}
+}
+// ----

test/libsolidity/smtCheckerTests/invariants/loop_nested.sol

@@ -0,0 +1,17 @@
+pragma experimental SMTChecker;
+
+contract Simple {
+	function f() public pure {
+		uint x = 10;
+		uint y;
+		while (y < x)
+		{
+			++y;
+			x = 0;
+			while (x < 10)
+				++x;
+			assert(x == 10);
+		}
+		assert(y == x);
+	}
+}

test/libsolidity/smtCheckerTests/invariants/loop_nested_for.sol

@@ -0,0 +1,14 @@
+pragma experimental SMTChecker;
+
+contract Simple {
+	function f() public pure {
+		uint x;
+		uint y;
+		for (x = 10; y < x; ++y)
+		{
+			for (x = 0; x < 10; ++x) {}
+			assert(x == 10);
+		}
+		assert(y == x);
+	}
+}

test/libsolidity/smtCheckerTests/loops/do_while_1_false_positives.sol

@@ -15,4 +15,3 @@ contract C
 }
 // ----
 // Warning: (150-155): Overflow (resulting value larger than 2**256 - 1) happens here
-// Warning: (269-282): Assertion violation happens here

test/libsolidity/smtCheckerTests/loops/for_1_false_positive.sol

@@ -8,10 +8,12 @@ contract C
 			// Overflows due to resetting x.
 			x = x + 1;
 		}
-		// The assertion is true but x is touched and reset.
+		// Assertion is safe but current solver version cannot solve it.
+		// Keep test for next solver release.
 		assert(x > 0);
 	}
 }
 // ----
+// Warning: (296-309): Error trying to invoke SMT solver.
 // Warning: (176-181): Overflow (resulting value larger than 2**256 - 1) happens here
-// Warning: (244-257): Assertion violation happens here
+// Warning: (296-309): Assertion violation happens here

test/libsolidity/smtCheckerTests/loops/for_loop_6.sol

@@ -10,4 +10,3 @@ contract C {
     }
 }
 // ----
-// Warning: (213-226): Assertion violation happens here

test/libsolidity/smtCheckerTests/loops/for_loop_array_assignment_storage_memory.sol

@@ -18,5 +18,4 @@ contract LoopFor2 {
 	}
 }
 // ----
-// Warning: (265-285): Assertion violation happens here
 // Warning: (312-331): Assertion violation happens here

test/libsolidity/smtCheckerTests/loops/for_loop_array_assignment_storage_storage.sol

@@ -18,6 +18,5 @@ contract LoopFor2 {
 	}
 }
 // ----
-// Warning: (266-286): Assertion violation happens here
 // Warning: (290-309): Assertion violation happens here
 // Warning: (313-332): Assertion violation happens here

test/libsolidity/smtCheckerTests/loops/for_loop_trivial_condition_3.sol

@@ -15,4 +15,3 @@ contract C {
 }
 // ----
 // Warning: (115-121): Unused local variable.
-// Warning: (356-370): Assertion violation happens here

test/libsolidity/smtCheckerTests/loops/while_1.sol

@@ -14,4 +14,3 @@ contract C
 	}
 }
 // ----
-// Warning: (177-190): Assertion violation happens here

test/libsolidity/smtCheckerTests/loops/while_1_break.sol

@@ -0,0 +1,21 @@
+pragma experimental SMTChecker;
+
+contract C
+{
+	function f(uint x, bool b) public pure {
+		require(x < 10);
+		while (x < 10) {
+			if (b)
+				++x;
+			else {
+				x = 20;
+				break;
+			}
+		}
+		// Assertion is safe but break is unsupported for now
+		// so knowledge is erased.
+		assert(x >= 10);
+	}
+}
+// ----
+// Warning: (274-289): Assertion violation happens here

test/libsolidity/smtCheckerTests/loops/while_1_break_fail.sol

@@ -0,0 +1,19 @@
+pragma experimental SMTChecker;
+
+contract C
+{
+	function f(uint x, bool b) public pure {
+		require(x < 10);
+		while (x < 10) {
+			if (b)
+				++x;
+			else {
+				break;
+			}
+		}
+		// Fails because the loop might break.
+		assert(x >= 10);
+	}
+}
+// ----
+// Warning: (218-233): Assertion violation happens here

test/libsolidity/smtCheckerTests/loops/while_1_continue.sol

@@ -0,0 +1,22 @@
+pragma experimental SMTChecker;
+
+contract C
+{
+	function f(uint x, bool b) public pure {
+		require(x < 100);
+		while (x < 10) {
+			if (b) {
+				x = 15;
+				continue;
+			}
+			else
+				x = 20;
+
+		}
+		// Should be safe, but fails due to continue being unsupported
+		// and erasing all knowledge.
+		assert(x >= 15);
+	}
+}
+// ----
+// Warning: (294-309): Assertion violation happens here

test/libsolidity/smtCheckerTests/loops/while_1_continue_fail.sol

@@ -0,0 +1,21 @@
+pragma experimental SMTChecker;
+
+contract C
+{
+	function f(uint x, bool b) public pure {
+		require(x < 100);
+		while (x < 10) {
+			if (b) {
+				x = 15;
+				continue;
+			}
+			else
+				x = 20;
+
+		}
+		// Fails due to the if.
+		assert(x >= 17);
+	}
+}
+// ----
+// Warning: (223-238): Assertion violation happens here

test/libsolidity/smtCheckerTests/loops/while_1_infinite.sol

@@ -0,0 +1,21 @@
+pragma experimental SMTChecker;
+
+contract C
+{
+	function f(uint x, bool b) public pure {
+		require(x < 100);
+		while (x < 10) {
+			if (b)
+				x = x + 1;
+			else
+				x = 0;
+		}
+		// CHC proves it safe because
+		// 1- if it doesn't go in the loop in the first place, x >= 10
+		// 2- if it goes in the loop and b == true, x increases until >= 10
+		// 3- if it goes in the loop and b == false, it's an infinite loop, therefore
+		//    the assertion and the error are unreachable.
+		assert(x > 0);
+	}
+}
+// ----

test/libsolidity/smtCheckerTests/loops/while_2.sol

@@ -0,0 +1,13 @@
+pragma experimental SMTChecker;
+contract C {
+	function f(uint x) public pure {
+		x = 2;
+		while (x > 1) {
+			if (x > 10)
+				x = 2;
+			else
+				--x;
+		}
+		assert(x < 2);
+	}
+}

test/libsolidity/smtCheckerTests/loops/while_2_break.sol

@@ -0,0 +1,19 @@
+pragma experimental SMTChecker;
+
+contract C
+{
+	function f() public pure {
+		uint x = 0;
+		while (x == 0) {
+			++x;
+			break;
+			++x;
+		}
+		// Assertion is safe but break is unsupported for now
+		// so knowledge is erased.
+		assert(x == 1);
+	}
+}
+// ----
+// Warning: (128-131): Unreachable code.
+// Warning: (224-238): Assertion violation happens here

test/libsolidity/smtCheckerTests/loops/while_2_break_fail.sol

@@ -0,0 +1,16 @@
+pragma experimental SMTChecker;
+
+contract C
+{
+	function f(uint x) public pure {
+		while (x == 0) {
+			++x;
+			break;
+			++x;
+		}
+		assert(x == 2);
+	}
+}
+// ----
+// Warning: (120-123): Unreachable code.
+// Warning: (131-145): Assertion violation happens here

test/libsolidity/smtCheckerTests/loops/while_2_fail.sol

@@ -12,4 +12,3 @@ contract C {
 	}
 }
 // ----
-// Warning: (158-172): Assertion violation happens here

test/libsolidity/smtCheckerTests/loops/while_loop_array_assignment_memory_storage.sol

@@ -13,11 +13,13 @@ contract LoopFor2 {
 			c[i] = b[i];
 			++i;
 		}
+		// Fails due to aliasing, since both b and c are
+		// memory references of same type.
 		assert(b[0] == c[0]);
 		assert(a[0] == 900);
 		assert(b[0] == 900);
 	}
 }
 // ----
-// Warning: (274-294): Assertion violation happens here
-// Warning: (321-340): Assertion violation happens here
+// Warning: (362-382): Assertion violation happens here
+// Warning: (409-428): Assertion violation happens here

test/libsolidity/smtCheckerTests/loops/while_loop_array_assignment_storage_memory.sol

@@ -20,5 +20,4 @@ contract LoopFor2 {
 	}
 }
 // ----
-// Warning: (265-285): Assertion violation happens here
 // Warning: (312-331): Assertion violation happens here

test/libsolidity/smtCheckerTests/loops/while_loop_array_assignment_storage_storage.sol

@@ -20,6 +20,5 @@ contract LoopFor2 {
 	}
 }
 // ----
-// Warning: (266-286): Assertion violation happens here
 // Warning: (290-309): Assertion violation happens here
 // Warning: (313-332): Assertion violation happens here

test/libsolidity/smtCheckerTests/loops/while_loop_simple_4.sol

@@ -8,4 +8,3 @@ contract C {
     }
 }
 // ----
-// Warning: (199-213): Assertion violation happens here

test/libsolidity/smtCheckerTestsJSON/multi.json

@@ -4,7 +4,6 @@
 		"smtlib2responses":
 		{
 			"0x047d0c67d7e03c5ac96ca227d1e19ba63257f4ab19cef30029413219ec8963af": "sat\n((|EVALEXPR_0| 0))\n",
-			"0x21d5b49d1416d788fe34b1d2a10a99ea92b007e17a977604afd7b2ff01a055cd": "unsat\n",
 			"0xada7569fb01a9b3e2823517ed40dcc99b11fb1e433e6e3ec8a8713f6f95753d3": "sat\n((|EVALEXPR_0| 1))\n"
 		}
 	}

test/libyul/yulOptimizerTests/ssaAndBack/for_loop.yul

@@ -23,8 +23,8 @@
 //     let b := mload(1)
 //     for { } lt(mload(a), mload(b)) { a := mload(b) }
 //     {
-//         let b_3 := mload(a)
-//         let a_6 := mload(b_3)
-//         b := mload(a_6)
+//         let b_4 := mload(a)
+//         let a_7 := mload(b_4)
+//         b := mload(a_7)
 //     }
 // }

test/libyul/yulOptimizerTests/ssaTransform/for_simple.yul

@@ -36,12 +36,12 @@
 //     }
 //     a
 //     {
-//         let a_7 := add(a, 6)
-//         a := a_7
+//         let a_6 := add(a, 6)
+//         a := a_6
 //     }
 //     {
-//         let a_6 := add(a, 12)
-//         a := a_6
+//         let a_7 := add(a, 12)
+//         a := a_7
 //     }
 //     let a_8 := add(a, 8)
 //     a := a_8

test/tools/ossfuzz/protoToAbiV2.cpp

@@ -653,28 +653,36 @@ void ProtoConverter::visit(ArrayType const& _x)
 	if (_x.info_size() == 0 || _x.info_size() > (int)s_maxArrayDimensions)
 		return;
 
+	// Array type is dynamically encoded if one of the following is true
+	//   - array base type is "bytes" or "string"
+	//   - at least one array dimension is dynamically sized.
+	if (_x.base_type_oneof_case() == ArrayType::kDynbytesty)
+		m_isLastDynParamRightPadded = true;
+	else
+		for (auto const& dim: _x.info())
+			if (!dim.is_static())
+			{
+				m_isLastDynParamRightPadded = true;
+				break;
+			}
+
 	string baseType = {};
 	switch (_x.base_type_oneof_case())
 	{
 	case ArrayType::kInty:
 		baseType = getIntTypeAsString(_x.inty());
-		m_isLastDynParamRightPadded = false;
 		break;
 	case ArrayType::kByty:
 		baseType = getFixedByteTypeAsString(_x.byty());
-		m_isLastDynParamRightPadded = false;
 		break;
 	case ArrayType::kAdty:
 		baseType = getAddressTypeAsString(_x.adty());
-		m_isLastDynParamRightPadded = false;
 		break;
 	case ArrayType::kBoolty:
 		baseType = getBoolTypeAsString();
-		m_isLastDynParamRightPadded = false;
 		break;
 	case ArrayType::kDynbytesty:
 		baseType = bytesArrayTypeAsString(_x.dynbytesty());
-		m_isLastDynParamRightPadded = true;
 		break;
 	case ArrayType::kStty:
 	case ArrayType::BASE_TYPE_ONEOF_NOT_SET: