@@ -530,13 +530,31 @@ static smt_termt convert_relational_to_smt(
530530 const auto &lhs = converted.at (binary_relation.lhs ());
531531 const auto &rhs = converted.at (binary_relation.rhs ());
532532 const typet operand_type = binary_relation.lhs ().type ();
533- if (lhs.get_sort ().cast <smt_bit_vector_sortt>())
533+ if (can_cast_type<pointer_typet>(operand_type))
534+ {
535+ // The code here is operating under the assumption that the comparison
536+ // operands have types for which the comparison makes sense.
537+
538+ // We already know this is the case given that we have followed
539+ // the if statement branch, but including the same check here
540+ // for consistency (it's cheap).
541+ const auto lhs_type_is_pointer =
542+ can_cast_type<pointer_typet>(binary_relation.lhs ().type ());
543+ const auto rhs_type_is_pointer =
544+ can_cast_type<pointer_typet>(binary_relation.rhs ().type ());
545+ INVARIANT (
546+ lhs_type_is_pointer && rhs_type_is_pointer,
547+ " pointer comparison requires that both operand types are pointers." );
548+ return unsigned_factory (lhs, rhs);
549+ }
550+ else if (lhs.get_sort ().cast <smt_bit_vector_sortt>())
534551 {
535552 if (can_cast_type<unsignedbv_typet>(operand_type))
536553 return unsigned_factory (lhs, rhs);
537554 if (can_cast_type<signedbv_typet>(operand_type))
538555 return signed_factory (lhs, rhs);
539556 }
557+
540558 UNIMPLEMENTED_FEATURE (
541559 " Generation of SMT formula for relational expression: " +
542560 binary_relation.pretty ());
0 commit comments