SMTChecker: Loop is unrolled after it completes

[pgebal]

Description

For some cases model checker unrolls a loop even after it should complete.

Environment

• Compiler version: commit 83fe3d4

Steps to Reproduce

run compiler with --model-checker-engine bmc --model-checker-bmc-loop-iterations 5 --model-checker-solvers z3 on the following contract:

// SPDX-License-Identifier: GPL-3.0
pragma solidity >=0.0;
contract C
{
	uint x;
	uint y;

	function condition() private returns(bool) {
		x = (x + 1) % 2;
		return (x == 1);
	}

	function f() public {
		require(x == 0);
		require(y == 0);
		for (; condition();) {
			++y;
		}
		assert(y == 1);
	}
}

I expect the assertion y == 1 to hold but it fails, y > 1 holds and it shouldn't.
There is a similar bug in while and do while loops.

[agnxsh]

hi can anyone assign me this? I can look into it!

[pgebal]

hi can anyone assign me this? I can look into it!

Hi @agnxsh. There is already a PR fixing this: #14448

[agnxsh]

sure