From eb7b3862ac5089615710d07c9a56b8edc0472394 Mon Sep 17 00:00:00 2001
From: Alex Beregszaszi <alex@rtfs.hu>
Date: Tue, 7 Aug 2018 12:13:52 +0100
Subject: [PATCH] Properly handle invalid references used together with _slot
 and _offset.

---
 Changelog.md                                             | 1 +
 libsolidity/analysis/ReferencesResolver.cpp              | 2 ++
 .../inlineAssembly/storage_reference_on_function.sol     | 9 +++++++++
 3 files changed, 12 insertions(+)
 create mode 100644 test/libsolidity/syntaxTests/inlineAssembly/storage_reference_on_function.sol

diff --git a/Changelog.md b/Changelog.md
index e00f74b32..037451ed8 100644
--- a/Changelog.md
+++ b/Changelog.md
@@ -83,6 +83,7 @@ Bugfixes:
  * Fix NatSpec json output for `@notice` and `@dev` tags on contract definitions.
  * References Resolver: Do not crash on using ``_slot`` and ``_offset`` suffixes on their own.
  * References Resolver: Enforce ``storage`` as data location for mappings.
+ * References Resolver: Properly handle invalid references used together with ``_slot`` and ``_offset``.
  * References Resolver: Report error instead of assertion fail when FunctionType has an undeclared type as parameter.
  * Type Checker: Disallow assignments to mappings within tuple assignments as well.
  * Type Checker: Allow assignments to local variables of mapping types.
diff --git a/libsolidity/analysis/ReferencesResolver.cpp b/libsolidity/analysis/ReferencesResolver.cpp
index 5458c1b0c..b888ecd6b 100644
--- a/libsolidity/analysis/ReferencesResolver.cpp
+++ b/libsolidity/analysis/ReferencesResolver.cpp
@@ -262,6 +262,8 @@ bool ReferencesResolver::visit(InlineAssembly const& _inlineAssembly)
 				return size_t(-1);
 			}
 			declarations = m_resolver.nameFromCurrentScope(realName);
+			if (!dynamic_cast<VariableDeclaration const*>(declarations.front()))
+				return size_t(-1);
 		}
 		if (declarations.size() != 1)
 			return size_t(-1);
diff --git a/test/libsolidity/syntaxTests/inlineAssembly/storage_reference_on_function.sol b/test/libsolidity/syntaxTests/inlineAssembly/storage_reference_on_function.sol
new file mode 100644
index 000000000..6838e7a4c
--- /dev/null
+++ b/test/libsolidity/syntaxTests/inlineAssembly/storage_reference_on_function.sol
@@ -0,0 +1,9 @@
+contract C {
+    function f() pure public {
+        assembly {
+            let x := f_slot
+        }
+    }
+}
+// ----
+// DeclarationError: (84-90): Identifier not found.