Fixing a soundness bug due to the default implmentation of Theory::ppAssert() not respecting subtyping.

1 files changed, 6 insertions, 2 deletions

diff --git a/src/theory/theory.cpp b/src/theory/theory.cpp
index f65e48ec2..2dd474a19 100644
--- a/src/theory/theory.cpp
+++ b/src/theory/theory.cpp
@@ -210,11 +210,15 @@ void Theory::computeRelevantTerms(set<Node>& termSet) const
 Theory::PPAssertStatus Theory::ppAssert(TNode in, SubstitutionMap& outSubstitutions)
 {
   if (in.getKind() == kind::EQUAL) {
-    if (in[0].isVar() && !in[1].hasSubterm(in[0])) {
+    // (and (= x t) phi) can be replaced by phi[x/t] if
+    // 1) x is a variable
+    // 2) x is not in the term t
+    // 3) x : T and t : S, then S <: T
+    if (in[0].isVar() && !in[1].hasSubterm(in[0]) && (in[1].getType()).isSubtypeOf(in[0].getType()) ){
       outSubstitutions.addSubstitution(in[0], in[1]);
       return PP_ASSERT_STATUS_SOLVED;
     }
-    if (in[1].isVar() && !in[0].hasSubterm(in[1])) {
+    if (in[1].isVar() && !in[0].hasSubterm(in[1]) && (in[0].getType()).isSubtypeOf(in[1].getType())){
       outSubstitutions.addSubstitution(in[1], in[0]);
       return PP_ASSERT_STATUS_SOLVED;
     }