Merge pull request #505 from chriseth/fixdelete

Fix for bug about deleting dynamic array of structs

2 files changed, 23 insertions, 1 deletions

diff --git a/libsolidity/codegen/ArrayUtils.cpp b/libsolidity/codegen/ArrayUtils.cpp
index 8e568be5..e7e8a98e 100644
--- a/libsolidity/codegen/ArrayUtils.cpp
+++ b/libsolidity/codegen/ArrayUtils.cpp
@@ -759,7 +759,7 @@ void ArrayUtils::clearStorageLoop(Type const& _type) const
 	StorageItem(m_context, _type).setToZero(SourceLocation(), false);
 	m_context << Instruction::POP;
 	// increment
-	m_context << u256(1) << Instruction::ADD;
+	m_context << _type.storageSize() << Instruction::ADD;
 	m_context.appendJumpTo(loopStart);
 	// cleanup
 	m_context << zeroLoopEnd;
diff --git a/test/libsolidity/SolidityEndToEndTest.cpp b/test/libsolidity/SolidityEndToEndTest.cpp
index c872f011..a26570d3 100644
--- a/test/libsolidity/SolidityEndToEndTest.cpp
+++ b/test/libsolidity/SolidityEndToEndTest.cpp
@@ -6591,6 +6591,28 @@ BOOST_AUTO_TEST_CASE(index_access_with_type_conversion)
 	BOOST_CHECK(callContractFunction("f(uint256)", u256(0x101)).size() == 256 * 32);
 }
 
+BOOST_AUTO_TEST_CASE(delete_on_array_of_structs)
+{
+	// Test for a bug where we did not increment the counter properly while deleting a dynamic array.
+	char const* sourceCode = R"(
+		contract C {
+			struct S { uint x; uint[] y; }
+			S[] data;
+			function f() returns (bool) {
+				data.length = 2;
+				data[0].x = 2**200;
+				data[1].x = 2**200;
+				delete data;
+				return true;
+			}
+		}
+	)";
+	compileAndRun(sourceCode, 0, "C");
+	// This code interprets x as an array length and thus will go out of gas.
+	// neither of the two should throw due to out-of-bounds access
+	BOOST_CHECK(callContractFunction("f()") == encodeArgs(true));
+}
+
 BOOST_AUTO_TEST_SUITE_END()
 
 }