@@ -651,11 +651,44 @@ static smt_termt convert_expr_to_smt(
651
651
can_cast_type<integer_bitvector_typet>(minus.lhs ().type ()) &&
652
652
can_cast_type<integer_bitvector_typet>(minus.rhs ().type ());
653
653
654
+ const bool lhs_is_pointer = can_cast_type<pointer_typet>(minus.lhs ().type ());
655
+ const bool rhs_is_pointer = can_cast_type<pointer_typet>(minus.rhs ().type ());
656
+
657
+ const bool both_operands_pointers = lhs_is_pointer && rhs_is_pointer;
658
+
659
+ // We don't really handle this - we just compute this to fall
660
+ // into an if-else branch that gives proper error handling information.
661
+ const bool one_operand_pointer = lhs_is_pointer || rhs_is_pointer;
662
+
654
663
if (both_operands_bitvector)
655
664
{
656
665
return smt_bit_vector_theoryt::subtract (
657
666
converted.at (minus.lhs ()), converted.at (minus.rhs ()));
658
667
}
668
+ else if (both_operands_pointers)
669
+ {
670
+ const auto lhs_base_type = to_pointer_type (minus.lhs ().type ()).base_type ();
671
+ const auto rhs_base_type = to_pointer_type (minus.rhs ().type ()).base_type ();
672
+ INVARIANT (
673
+ lhs_base_type == rhs_base_type,
674
+ " only pointers of the same object type can be subtracted." );
675
+ return smt_bit_vector_theoryt::signed_divide (
676
+ smt_bit_vector_theoryt::subtract (
677
+ converted.at (minus.lhs ()), converted.at (minus.rhs ())),
678
+ pointer_sizes.at (lhs_base_type));
679
+ }
680
+ else if (one_operand_pointer)
681
+ {
682
+ UNIMPLEMENTED_FEATURE (
683
+ " convert_expr_to_smt::minus_exprt doesn't handle expressions where"
684
+ " only one operand is a pointer - this is because these expressions"
685
+ " are normally handled by convert_expr_to_smt::plus_exprt due to"
686
+ " transformations of the expressions by previous passes bringing"
687
+ " them into a form more suitably handled by that version of the function."
688
+ " If you are here, this is a mistake or something went wrong before."
689
+ " The expression that caused the problem is: " +
690
+ minus.pretty ());
691
+ }
659
692
else
660
693
{
661
694
UNIMPLEMENTED_FEATURE (
@@ -1459,7 +1492,7 @@ static smt_termt dispatch_expr_to_smt_conversion(
1459
1492
}
1460
1493
if (const auto minus = expr_try_dynamic_cast<minus_exprt>(expr))
1461
1494
{
1462
- return convert_expr_to_smt (*minus, converted);
1495
+ return convert_expr_to_smt (*minus, converted, pointer_sizes );
1463
1496
}
1464
1497
if (const auto divide = expr_try_dynamic_cast<div_exprt>(expr))
1465
1498
{
0 commit comments