@@ -651,11 +651,44 @@ static smt_termt convert_expr_to_smt(
651651 can_cast_type<integer_bitvector_typet>(minus.lhs ().type ()) &&
652652 can_cast_type<integer_bitvector_typet>(minus.rhs ().type ());
653653
654+ const bool lhs_is_pointer = can_cast_type<pointer_typet>(minus.lhs ().type ());
655+ const bool rhs_is_pointer = can_cast_type<pointer_typet>(minus.rhs ().type ());
656+
657+ const bool both_operands_pointers = lhs_is_pointer && rhs_is_pointer;
658+
659+ // We don't really handle this - we just compute this to fall
660+ // into an if-else branch that gives proper error handling information.
661+ const bool one_operand_pointer = lhs_is_pointer || rhs_is_pointer;
662+
654663 if (both_operands_bitvector)
655664 {
656665 return smt_bit_vector_theoryt::subtract (
657666 converted.at (minus.lhs ()), converted.at (minus.rhs ()));
658667 }
668+ else if (both_operands_pointers)
669+ {
670+ const auto lhs_base_type = to_pointer_type (minus.lhs ().type ()).base_type ();
671+ const auto rhs_base_type = to_pointer_type (minus.rhs ().type ()).base_type ();
672+ INVARIANT (
673+ lhs_base_type == rhs_base_type,
674+ " only pointers of the same object type can be subtracted." );
675+ return smt_bit_vector_theoryt::signed_divide (
676+ smt_bit_vector_theoryt::subtract (
677+ converted.at (minus.lhs ()), converted.at (minus.rhs ())),
678+ pointer_sizes.at (lhs_base_type));
679+ }
680+ else if (one_operand_pointer)
681+ {
682+ UNIMPLEMENTED_FEATURE (
683+ " convert_expr_to_smt::minus_exprt doesn't handle expressions where"
684+ " only one operand is a pointer - this is because these expressions"
685+ " are normally handled by convert_expr_to_smt::plus_exprt due to"
686+ " transformations of the expressions by previous passes bringing"
687+ " them into a form more suitably handled by that version of the function."
688+ " If you are here, this is a mistake or something went wrong before."
689+ " The expression that caused the problem is: " +
690+ minus.pretty ());
691+ }
659692 else
660693 {
661694 UNIMPLEMENTED_FEATURE (
@@ -1459,7 +1492,7 @@ static smt_termt dispatch_expr_to_smt_conversion(
14591492 }
14601493 if (const auto minus = expr_try_dynamic_cast<minus_exprt>(expr))
14611494 {
1462- return convert_expr_to_smt (*minus, converted);
1495+ return convert_expr_to_smt (*minus, converted, pointer_sizes );
14631496 }
14641497 if (const auto divide = expr_try_dynamic_cast<div_exprt>(expr))
14651498 {
0 commit comments