Merge pull request #9451 from ethereum/smt_fix_push_push

[SMTChecker] Fix push().push()

test/libsolidity/smtCheckerTests/array_members/push_push_no_args_1.sol

@@ -0,0 +1,9 @@
+pragma experimental SMTChecker;
+contract C {
+	int[][] array2d;
+	function l() public {
+		array2d.push().push();
+		assert(array2d.length > 0);
+		assert(array2d[array2d.length - 1].length > 0);
+	}
+}

test/libsolidity/smtCheckerTests/array_members/push_push_no_args_1_fail.sol

@@ -0,0 +1,12 @@
+pragma experimental SMTChecker;
+contract C {
+	int[][] array2d;
+	function l() public {
+		array2d.push().push();
+		assert(array2d.length > 2);
+		assert(array2d[array2d.length - 1].length > 3);
+	}
+}
+// ----
+// Warning 4661: (113-139): Assertion violation happens here
+// Warning 4661: (143-189): Assertion violation happens here

test/libsolidity/smtCheckerTests/array_members/push_push_no_args_2.sol

@@ -0,0 +1,11 @@
+pragma experimental SMTChecker;
+contract C {
+	int[][][] array2d;
+	function l() public {
+		array2d.push().push().push();
+		assert(array2d.length > 0);
+		uint last = array2d[array2d.length - 1].length;
+		assert(last > 0);
+		assert(array2d[array2d.length - 1][last - 1].length > 0);
+	}
+}

test/libsolidity/smtCheckerTests/array_members/push_push_no_args_2_fail.sol

@@ -0,0 +1,15 @@
+pragma experimental SMTChecker;
+contract C {
+	int[][][] array2d;
+	function l() public {
+		array2d.push().push().push();
+		assert(array2d.length > 2);
+		uint last = array2d[array2d.length - 1].length;
+		assert(last > 3);
+		assert(array2d[array2d.length - 1][last - 1].length > 4);
+	}
+}
+// ----
+// Warning 4661: (122-148): Assertion violation happens here
+// Warning 4661: (202-218): Assertion violation happens here
+// Warning 4661: (222-278): Assertion violation happens here

test/libsolidity/smtCheckerTests/array_members/storage_pointer_push_1.sol

@@ -0,0 +1,18 @@
+pragma experimental SMTChecker;
+contract C {
+	int[][] array2d;
+	function l() public {
+		s().push();
+		// False positive.
+		// Knowledge is erased because `s()` is a storage pointer.
+		assert(array2d[2].length > 0);
+	}
+	function s() internal returns (int[] storage) {
+		array2d.push();
+		array2d.push();
+		array2d.push();
+		return array2d[2];
+	}
+}
+// ----
+// Warning 4661: (184-213): Assertion violation happens here

test/libsolidity/smtCheckerTests/array_members/storage_pointer_push_1_safe.sol

@@ -0,0 +1,15 @@
+pragma experimental SMTChecker;
+contract C {
+	int[][] array2d;
+	function l() public {
+		s();
+		array2d[2].push();
+		assert(array2d[2].length > 0);
+	}
+	function s() internal returns (int[] storage) {
+		array2d.push();
+		array2d.push();
+		array2d.push();
+		return array2d[2];
+	}
+}