From a63f7ca9df997334f4183bf2546505c247b18167 Mon Sep 17 00:00:00 2001
From: Mathias Baumann <marenz@supradigital.org>
Date: Tue, 19 Feb 2019 12:16:15 +0100
Subject: [PATCH] Fix crash due to missing type info

---
 Changelog.md                                             | 1 +
 libsolidity/analysis/ReferencesResolver.cpp              | 2 +-
 test/libsolidity/smtCheckerTests/simple/static_array.sol | 8 ++++++++
 3 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100644 test/libsolidity/smtCheckerTests/simple/static_array.sol

diff --git a/Changelog.md b/Changelog.md
index a5b2d5327..0f8460919 100644
--- a/Changelog.md
+++ b/Changelog.md
@@ -12,6 +12,7 @@ Bugfixes:
  * ABIEncoderV2: Fix internal error related to bare delegatecall.
  * ABIEncoderV2: Fix internal error related to ecrecover.
  * ABIEncoderV2: Fix internal error related to mappings as library parameters.
+ * SMTChecker: Fixed crash when used with fixed-sized arrays.
  * Yul: Properly detect name clashes with functions before their declaration.
 
 
diff --git a/libsolidity/analysis/ReferencesResolver.cpp b/libsolidity/analysis/ReferencesResolver.cpp
index b8c487ada..26890b569 100644
--- a/libsolidity/analysis/ReferencesResolver.cpp
+++ b/libsolidity/analysis/ReferencesResolver.cpp
@@ -246,7 +246,7 @@ void ReferencesResolver::endVisit(ArrayTypeName const& _typeName)
 		fatalTypeError(_typeName.baseType().location(), "Illegal base type of storage size zero for array.");
 	if (Expression const* length = _typeName.length())
 	{
-		TypePointer lengthTypeGeneric = length->annotation().type;
+		TypePointer& lengthTypeGeneric = length->annotation().type;
 		if (!lengthTypeGeneric)
 			lengthTypeGeneric = ConstantEvaluator(m_errorReporter).evaluate(*length);
 		RationalNumberType const* lengthType = dynamic_cast<RationalNumberType const*>(lengthTypeGeneric.get());
diff --git a/test/libsolidity/smtCheckerTests/simple/static_array.sol b/test/libsolidity/smtCheckerTests/simple/static_array.sol
new file mode 100644
index 000000000..394ace74e
--- /dev/null
+++ b/test/libsolidity/smtCheckerTests/simple/static_array.sol
@@ -0,0 +1,8 @@
+pragma experimental SMTChecker;
+contract C
+{
+	// Used to crash because Literal had no type
+	int[3] d;
+}
+// ----
+// Warning: (92-100): Assertion checker does not yet support the type of this variable.