[SMTChecker] Reset reference variables on assignment to a variable of reference type

This commit is contained in:
Martin Blicha 2021-03-12 19:33:45 +01:00
parent ccd9de137a
commit 6aa6c5f5f9
3 changed files with 27 additions and 0 deletions

View File

@ -2034,7 +2034,11 @@ void SMTEncoder::assignment(
m_context.newValue(*varDecl);
}
else if (auto varDecl = identifierToVariable(*left))
{
if (varDecl->hasReferenceOrMappingType())
resetReferences(*varDecl);
assignment(*varDecl, _right);
}
else if (
dynamic_cast<IndexAccess const*>(left) ||
dynamic_cast<MemberAccess const*>(left)

View File

@ -0,0 +1,21 @@
pragma experimental SMTChecker;
contract A {
int[] a;
function f() public {
require(a.length == 1 && a[0] == 1);
int[] storage u = a;
assert(u[0] == 1); // should hold
int[] memory b = new int[](2);
a = b;
assert(u[0] == 1); // should fail
A.a = b;
assert(u[0] == 1); // should fail
}
function push_v(int x) public {
a.push(x);
}
}
// ----
// Warning 6328: (220-237): CHC: Assertion violation happens here.
// Warning 6328: (267-284): CHC: Assertion violation happens here.

View File

@ -7,3 +7,5 @@ contract C
assert(b1[1] == b2[1]);
}
}
// ----
// Warning 6328: (119-141): CHC: Assertion violation happens here.\nCounterexample:\n\n\nTransaction trace:\nC.constructor()\nC.f(b1, b2)