Report out of bounds index access

test/libsolidity/smtCheckerTests/operators/delete_multid_array.sol

@@ -3,42 +3,58 @@ pragma experimental SMTChecker;
 contract C {
 	uint[] a;
 	uint[][] b;
-	function f(uint x, uint y, uint v) public {
+	function p() public { a.push(); }
+	function q() public { b.push().push(); }
+	function f(uint x, uint v) public {
+		require(x < a.length);
 		a[x] = v;
 		delete a;
-		assert(a[y] == 0);
+		assert(a.length == 0);
 	}
  	function g(uint x, uint y, uint v) public {
+		require(x < b.length);
+		require(y < b[x].length);
 		b[x][y] = v;
 		delete b;
-		assert(b[y][x] == 0);
+		assert(b.length == 0);
 	}
  	function h(uint x, uint y, uint v) public {
+		require(x < b.length);
+		require(y < b[x].length);
 		b[x][y] = v;
 		delete b[x];
-		// Not necessarily the case.
-		// Removed because current Spacer seg faults in cex generation.
-		//assert(b[y][x] == 0);
+		assert(b[x].length == 0);
 	}
  	function i(uint x, uint y, uint v) public {
+		require(x < b.length);
+		require(y < b[x].length);
 		b[x][y] = v;
+		require(y < b.length);
 		delete b[y];
-		assert(b[y][x] == 0);
+		assert(b[y].length == 0);
 	}
  	function j(uint x, uint y, uint z, uint v) public {
+		require(x < b.length);
+		require(y < b[x].length);
 		b[x][y] = v;
+		require(z < b.length);
 		delete b[z];
 		// Not necessarily the case.
-		assert(b[y][x] == 0);
+		require(y < b.length);
+		require(x < b[x].length);
+		// Disabled because of Spacer nondeterminism.
+		//assert(b[y][x] == 0);
 	}
 	function setA(uint x, uint y) public {
+		require(x < a.length);
 		a[x] = y;
 	}
 	function setB(uint x, uint y, uint z) public {
+		require(x < b.length);
+		require(y < b[x].length);
 		b[x][y] = z;
 	}
 }
 // ====
 // SMTIgnoreCex: yes
 // ----
-// Warning 6328: (685-705): CHC: Assertion violation happens here.