From 29744e3da7abba18ca58f6a21ff2f5c300fbe241 Mon Sep 17 00:00:00 2001
From: Tim King <taking@cs.nyu.edu>
Date: Mon, 26 May 2014 10:12:19 -0400
Subject: [PATCH] Fixing a soundness bug due to the default implmentation of
 Theory::ppAssert() not respecting subtyping.

---
 src/theory/theory.cpp | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/theory/theory.cpp b/src/theory/theory.cpp
index f65e48ec2..2dd474a19 100644
--- a/src/theory/theory.cpp
+++ b/src/theory/theory.cpp
@@ -210,11 +210,15 @@ void Theory::computeRelevantTerms(set<Node>& termSet) const
 Theory::PPAssertStatus Theory::ppAssert(TNode in, SubstitutionMap& outSubstitutions)
 {
   if (in.getKind() == kind::EQUAL) {
-    if (in[0].isVar() && !in[1].hasSubterm(in[0])) {
+    // (and (= x t) phi) can be replaced by phi[x/t] if
+    // 1) x is a variable
+    // 2) x is not in the term t
+    // 3) x : T and t : S, then S <: T
+    if (in[0].isVar() && !in[1].hasSubterm(in[0]) && (in[1].getType()).isSubtypeOf(in[0].getType()) ){
       outSubstitutions.addSubstitution(in[0], in[1]);
       return PP_ASSERT_STATUS_SOLVED;
     }
-    if (in[1].isVar() && !in[0].hasSubterm(in[1])) {
+    if (in[1].isVar() && !in[0].hasSubterm(in[1]) && (in[0].getType()).isSubtypeOf(in[1].getType())){
       outSubstitutions.addSubstitution(in[1], in[0]);
       return PP_ASSERT_STATUS_SOLVED;
     }
-- 
2.30.2