Merge pull request #1341 from chriseth/sol_packedStorage

Packed storage for arrays.

6 files changed, 274 insertions, 93 deletions

diff --git a/ArrayUtils.cpp b/ArrayUtils.cpp
index 2596e4af..bbf7f985 100644
--- a/ArrayUtils.cpp
+++ b/ArrayUtils.cpp
@@ -52,15 +52,21 @@ void ArrayUtils::copyArrayToStorage(ArrayType const& _targetType, ArrayType cons
 	// TODO unroll loop for small sizes
 
 	bool sourceIsStorage = _sourceType.getLocation() == ArrayType::Location::Storage;
+	bool directCopy = sourceIsStorage && sourceBaseType->isValueType() && *sourceBaseType == *targetBaseType;
+	bool haveByteOffsetSource = !directCopy && sourceIsStorage && sourceBaseType->getStorageBytes() <= 16;
+	bool haveByteOffsetTarget = !directCopy && targetBaseType->getStorageBytes() <= 16;
+	unsigned byteOffsetSize = (haveByteOffsetSource ? 1 : 0) + (haveByteOffsetTarget ? 1 : 0);
 
 	// stack: source_ref [source_byte_off] [source_length] target_ref target_byte_off
 	// store target_ref
-	m_context << eth::Instruction::POP; //@todo
+	// arrays always start at zero byte offset, pop offset
+	m_context << eth::Instruction::POP;
 	for (unsigned i = _sourceType.getSizeOnStack(); i > 0; --i)
 		m_context << eth::swapInstruction(i);
 	// stack: target_ref source_ref [source_byte_off] [source_length]
 	if (sourceIsStorage)
-		m_context << eth::Instruction::POP; //@todo
+		// arrays always start at zero byte offset, pop offset
+		m_context << eth::Instruction::POP;
 	// stack: target_ref source_ref [source_length]
 	// retrieve source length
 	if (_sourceType.getLocation() != ArrayType::Location::CallData || !_sourceType.isDynamicallySized())
@@ -81,7 +87,7 @@ void ArrayUtils::copyArrayToStorage(ArrayType const& _targetType, ArrayType cons
 		m_context
 			<< eth::Instruction::POP << eth::Instruction::POP
 			<< eth::Instruction::POP << eth::Instruction::POP;
-		m_context << u256(0); //@todo
+		m_context << u256(0);
 		return;
 	}
 	// compute hashes (data positions)
@@ -97,8 +103,8 @@ void ArrayUtils::copyArrayToStorage(ArrayType const& _targetType, ArrayType cons
 	// stack: target_ref target_data_end source_length target_data_pos source_ref
 	// skip copying if source length is zero
 	m_context << eth::Instruction::DUP3 << eth::Instruction::ISZERO;
-	eth::AssemblyItem copyLoopEnd = m_context.newTag();
-	m_context.appendConditionalJumpTo(copyLoopEnd);
+	eth::AssemblyItem copyLoopEndWithoutByteOffset = m_context.newTag();
+	m_context.appendConditionalJumpTo(copyLoopEndWithoutByteOffset);
 
 	if (_sourceType.getLocation() == ArrayType::Location::Storage && _sourceType.isDynamicallySized())
 		CompilerUtils(m_context).computeHashStatic();
@@ -107,18 +113,24 @@ void ArrayUtils::copyArrayToStorage(ArrayType const& _targetType, ArrayType cons
 	convertLengthToSize(_sourceType);
 	m_context << eth::Instruction::DUP3 << eth::Instruction::ADD;
 	// stack: target_ref target_data_end source_data_pos target_data_pos source_data_end
+	if (haveByteOffsetTarget)
+		m_context << u256(0);
+	if (haveByteOffsetSource)
+		m_context << u256(0);
+	// stack: target_ref target_data_end source_data_pos target_data_pos source_data_end [target_byte_offset] [source_byte_offset]
 	eth::AssemblyItem copyLoopStart = m_context.newTag();
 	m_context << copyLoopStart;
 	// check for loop condition
 	m_context
-		<< eth::Instruction::DUP3 << eth::Instruction::DUP2
+		<< eth::dupInstruction(3 + byteOffsetSize) << eth::dupInstruction(2 + byteOffsetSize)
 		<< eth::Instruction::GT << eth::Instruction::ISZERO;
+	eth::AssemblyItem copyLoopEnd = m_context.newTag();
 	m_context.appendConditionalJumpTo(copyLoopEnd);
-	// stack: target_ref target_data_end source_data_pos target_data_pos source_data_end
+	// stack: target_ref target_data_end source_data_pos target_data_pos source_data_end [target_byte_offset] [source_byte_offset]
 	// copy
 	if (sourceBaseType->getCategory() == Type::Category::Array)
 	{
-		//@todo
+		solAssert(byteOffsetSize == 0, "Byte offset for array as base type.");
 		m_context << eth::Instruction::DUP3;
 		if (sourceIsStorage)
 			m_context << u256(0);
@@ -129,36 +141,80 @@ void ArrayUtils::copyArrayToStorage(ArrayType const& _targetType, ArrayType cons
 		);
 		m_context << eth::Instruction::POP << eth::Instruction::POP;
 	}
+	else if (directCopy)
+	{
+		solAssert(byteOffsetSize == 0, "Byte offset for direct copy.");
+		m_context
+			<< eth::Instruction::DUP3 << eth::Instruction::SLOAD
+			<< eth::Instruction::DUP3 << eth::Instruction::SSTORE;
+	}
 	else
 	{
-		m_context << eth::Instruction::DUP3;
+		// Note that we have to copy each element on its own in case conversion is involved.
+		// We might copy too much if there is padding at the last element, but this way end
+		// checking is easier.
+		// stack: target_ref target_data_end source_data_pos target_data_pos source_data_end [target_byte_offset] [source_byte_offset]
+		m_context << eth::dupInstruction(3 + byteOffsetSize);
 		if (_sourceType.getLocation() == ArrayType::Location::Storage)
 		{
-			m_context << u256(0);
+			if (haveByteOffsetSource)
+				m_context << eth::Instruction::DUP2;
+			else
+				m_context << u256(0);
 			StorageItem(m_context, *sourceBaseType).retrieveValue(SourceLocation(), true);
 		}
 		else if (sourceBaseType->isValueType())
 			CompilerUtils(m_context).loadFromMemoryDynamic(*sourceBaseType, true, true, false);
 		else
 			solAssert(false, "Copying of unknown type requested: " + sourceBaseType->toString());
-		solAssert(2 + sourceBaseType->getSizeOnStack() <= 16, "Stack too deep.");
-		m_context << eth::dupInstruction(2 + sourceBaseType->getSizeOnStack()) << u256(0);
+		// stack: target_ref target_data_end source_data_pos target_data_pos source_data_end [target_byte_offset] [source_byte_offset] <source_value>...
+		solAssert(2 + byteOffsetSize + sourceBaseType->getSizeOnStack() <= 16, "Stack too deep.");
+		// fetch target storage reference
+		m_context << eth::dupInstruction(2 + byteOffsetSize + sourceBaseType->getSizeOnStack());
+		if (haveByteOffsetTarget)
+			m_context << eth::dupInstruction(1 + byteOffsetSize + sourceBaseType->getSizeOnStack());
+		else
+			m_context << u256(0);
 		StorageItem(m_context, *targetBaseType).storeValue(*sourceBaseType, SourceLocation(), true);
 	}
+	// stack: target_ref target_data_end source_data_pos target_data_pos source_data_end [target_byte_offset] [source_byte_offset]
 	// increment source
-	m_context
-		<< eth::Instruction::SWAP2
-		<< (sourceIsStorage ? sourceBaseType->getStorageSize() : sourceBaseType->getCalldataEncodedSize())
-		<< eth::Instruction::ADD
-		<< eth::Instruction::SWAP2;
+	if (haveByteOffsetSource)
+		incrementByteOffset(sourceBaseType->getStorageBytes(), 1, haveByteOffsetTarget ? 5 : 4);
+	else
+		m_context
+			<< eth::swapInstruction(2 + byteOffsetSize)
+			<< (sourceIsStorage ? sourceBaseType->getStorageSize() : sourceBaseType->getCalldataEncodedSize())
+			<< eth::Instruction::ADD
+			<< eth::swapInstruction(2 + byteOffsetSize);
 	// increment target
-	m_context
-		<< eth::Instruction::SWAP1
-		<< targetBaseType->getStorageSize()
-		<< eth::Instruction::ADD
-		<< eth::Instruction::SWAP1;
+	if (haveByteOffsetTarget)
+		incrementByteOffset(targetBaseType->getStorageBytes(), byteOffsetSize, byteOffsetSize + 2);
+	else
+		m_context
+			<< eth::swapInstruction(1 + byteOffsetSize)
+			<< targetBaseType->getStorageSize()
+			<< eth::Instruction::ADD
+			<< eth::swapInstruction(1 + byteOffsetSize);
 	m_context.appendJumpTo(copyLoopStart);
 	m_context << copyLoopEnd;
+	if (haveByteOffsetTarget)
+	{
+		// clear elements that might be left over in the current slot in target
+		// stack: target_ref target_data_end source_data_pos target_data_pos source_data_end target_byte_offset [source_byte_offset]
+		m_context << eth::dupInstruction(byteOffsetSize) << eth::Instruction::ISZERO;
+		eth::AssemblyItem copyCleanupLoopEnd = m_context.appendConditionalJump();
+		m_context << eth::dupInstruction(2 + byteOffsetSize) << eth::dupInstruction(1 + byteOffsetSize);
+		StorageItem(m_context, *targetBaseType).setToZero(SourceLocation(), true);
+		incrementByteOffset(targetBaseType->getStorageBytes(), byteOffsetSize, byteOffsetSize + 2);
+		m_context.appendJumpTo(copyLoopEnd);
+
+		m_context << copyCleanupLoopEnd;
+		m_context << eth::Instruction::POP; // might pop the source, but then target is popped next
+	}
+	if (haveByteOffsetSource)
+		m_context << eth::Instruction::POP;
+	m_context << copyLoopEndWithoutByteOffset;
 
 	// zero-out leftovers in target
 	// stack: target_ref target_data_end source_data_pos target_data_pos_updated source_data_end
@@ -166,41 +222,61 @@ void ArrayUtils::copyArrayToStorage(ArrayType const& _targetType, ArrayType cons
 	// stack: target_ref target_data_end target_data_pos_updated
 	clearStorageLoop(*targetBaseType);
 	m_context << eth::Instruction::POP;
-	m_context << u256(0); //@todo
+	m_context << u256(0);
 }
 
 void ArrayUtils::clearArray(ArrayType const& _type) const
 {
 	unsigned stackHeightStart = m_context.getStackHeight();
 	solAssert(_type.getLocation() == ArrayType::Location::Storage, "");
-	if (_type.isDynamicallySized())
+	if (_type.getBaseType()->getStorageBytes() < 32)
 	{
-		m_context << eth::Instruction::POP; // remove byte offset
-		clearDynamicArray(_type);
+		solAssert(_type.getBaseType()->isValueType(), "Invalid storage size for non-value type.");
+		solAssert(_type.getBaseType()->getStorageSize() <= 1, "Invalid storage size for type.");
 	}
+	if (_type.getBaseType()->isValueType())
+		solAssert(_type.getBaseType()->getStorageSize() <= 1, "Invalid size for value type.");
+
+	m_context << eth::Instruction::POP; // remove byte offset
+	if (_type.isDynamicallySized())
+		clearDynamicArray(_type);
 	else if (_type.getLength() == 0 || _type.getBaseType()->getCategory() == Type::Category::Mapping)
-		m_context << eth::Instruction::POP << eth::Instruction::POP;
-	else if (_type.getLength() < 5) // unroll loop for small arrays @todo choose a good value
+		m_context << eth::Instruction::POP;
+	else if (_type.getBaseType()->isValueType() && _type.getStorageSize() <= 5)
+	{
+		// unroll loop for small arrays @todo choose a good value
+		// Note that we loop over storage slots here, not elements.
+		for (unsigned i = 1; i < _type.getStorageSize(); ++i)
+			m_context
+				<< u256(0) << eth::Instruction::DUP2 << eth::Instruction::SSTORE
+				<< u256(1) << eth::Instruction::ADD;
+		m_context << u256(0) << eth::Instruction::SWAP1 << eth::Instruction::SSTORE;
+	}
+	else if (!_type.getBaseType()->isValueType() && _type.getLength() <= 4)
 	{
-		solAssert(!_type.isByteArray(), "");
+		// unroll loop for small arrays @todo choose a good value
+		solAssert(_type.getBaseType()->getStorageBytes() >= 32, "Invalid storage size.");
 		for (unsigned i = 1; i < _type.getLength(); ++i)
 		{
+			m_context << u256(0);
 			StorageItem(m_context, *_type.getBaseType()).setToZero(SourceLocation(), false);
-			m_context << eth::Instruction::SWAP1;
-			m_context << u256(_type.getBaseType()->getStorageSize()) << eth::Instruction::ADD;
-			m_context << eth::Instruction::SWAP1;
+			m_context
+				<< eth::Instruction::POP
+				<< u256(_type.getBaseType()->getStorageSize()) << eth::Instruction::ADD;
 		}
+		m_context << u256(0);
 		StorageItem(m_context, *_type.getBaseType()).setToZero(SourceLocation(), true);
 	}
 	else
 	{
-		solAssert(!_type.isByteArray(), "");
-		m_context << eth::Instruction::SWAP1;
 		m_context << eth::Instruction::DUP1 << _type.getLength();
 		convertLengthToSize(_type);
 		m_context << eth::Instruction::ADD << eth::Instruction::SWAP1;
-		clearStorageLoop(*_type.getBaseType());
-		m_context << eth::Instruction::POP << eth::Instruction::POP;
+		if (_type.getBaseType()->getStorageBytes() < 32)
+			clearStorageLoop(IntegerType(256));
+		else
+			clearStorageLoop(*_type.getBaseType());
+		m_context << eth::Instruction::POP;
 	}
 	solAssert(m_context.getStackHeight() == stackHeightStart - 2, "");
 }
@@ -224,7 +300,7 @@ void ArrayUtils::clearDynamicArray(ArrayType const& _type) const
 	m_context << eth::Instruction::SWAP1 << eth::Instruction::DUP2 << eth::Instruction::ADD
 		<< eth::Instruction::SWAP1;
 	// stack: data_pos_end data_pos
-	if (_type.isByteArray())
+	if (_type.isByteArray() || _type.getBaseType()->getStorageBytes() < 32)
 		clearStorageLoop(IntegerType(256));
 	else
 		clearStorageLoop(*_type.getBaseType());
@@ -237,6 +313,8 @@ void ArrayUtils::resizeDynamicArray(const ArrayType& _type) const
 {
 	solAssert(_type.getLocation() == ArrayType::Location::Storage, "");
 	solAssert(_type.isDynamicallySized(), "");
+	if (!_type.isByteArray() && _type.getBaseType()->getStorageBytes() < 32)
+		solAssert(_type.getBaseType()->isValueType(), "Invalid storage size for non-value type.");
 
 	unsigned stackHeightStart = m_context.getStackHeight();
 	eth::AssemblyItem resizeEnd = m_context.newTag();
@@ -266,7 +344,7 @@ void ArrayUtils::resizeDynamicArray(const ArrayType& _type) const
 	// stack: ref new_length data_pos new_size delete_end
 	m_context << eth::Instruction::SWAP2 << eth::Instruction::ADD;
 	// stack: ref new_length delete_end delete_start
-	if (_type.isByteArray())
+	if (_type.isByteArray() || _type.getBaseType()->getStorageBytes() < 32)
 		clearStorageLoop(IntegerType(256));
 	else
 		clearStorageLoop(*_type.getBaseType());
@@ -294,7 +372,7 @@ void ArrayUtils::clearStorageLoop(Type const& _type) const
 	eth::AssemblyItem zeroLoopEnd = m_context.newTag();
 	m_context.appendConditionalJumpTo(zeroLoopEnd);
 	// delete
-	m_context << u256(0); //@todo
+	m_context << u256(0);
 	StorageItem(m_context, _type).setToZero(SourceLocation(), false);
 	m_context << eth::Instruction::POP;
 	// increment
@@ -313,7 +391,20 @@ void ArrayUtils::convertLengthToSize(ArrayType const& _arrayType, bool _pad) con
 		if (_arrayType.isByteArray())
 			m_context << u256(31) << eth::Instruction::ADD
 				<< u256(32) << eth::Instruction::SWAP1 << eth::Instruction::DIV;
-		else if (_arrayType.getBaseType()->getStorageSize() > 1)
+		else if (_arrayType.getBaseType()->getStorageSize() <= 1)
+		{
+			unsigned baseBytes = _arrayType.getBaseType()->getStorageBytes();
+			if (baseBytes == 0)
+				m_context << eth::Instruction::POP << u256(1);
+			else if (baseBytes <= 16)
+			{
+				unsigned itemsPerSlot = 32 / baseBytes;
+				m_context
+					<< u256(itemsPerSlot - 1) << eth::Instruction::ADD
+					<< u256(itemsPerSlot) << eth::Instruction::SWAP1 << eth::Instruction::DIV;
+			}
+		}
+		else
 			m_context << _arrayType.getBaseType()->getStorageSize() << eth::Instruction::MUL;
 	}
 	else
@@ -349,3 +440,39 @@ void ArrayUtils::retrieveLength(ArrayType const& _arrayType) const
 	}
 }
 
+void ArrayUtils::incrementByteOffset(unsigned _byteSize, unsigned _byteOffsetPosition, unsigned _storageOffsetPosition) const
+{
+	solAssert(_byteSize < 32, "");
+	solAssert(_byteSize != 0, "");
+	// We do the following, but avoiding jumps:
+	// byteOffset += byteSize
+	// if (byteOffset + byteSize > 32)
+	// {
+	//     storageOffset++;
+	//     byteOffset = 0;
+	// }
+	if (_byteOffsetPosition > 1)
+		m_context << eth::swapInstruction(_byteOffsetPosition - 1);
+	m_context << u256(_byteSize) << eth::Instruction::ADD;
+	if (_byteOffsetPosition > 1)
+		m_context << eth::swapInstruction(_byteOffsetPosition - 1);
+	// compute, X := (byteOffset + byteSize - 1) / 32, should be 1 iff byteOffset + bytesize > 32
+	m_context
+		<< u256(32) << eth::dupInstruction(1 + _byteOffsetPosition) << u256(_byteSize - 1)
+		<< eth::Instruction::ADD << eth::Instruction::DIV;
+	// increment storage offset if X == 1 (just add X to it)
+	// stack: X
+	m_context
+		<< eth::swapInstruction(_storageOffsetPosition) << eth::dupInstruction(_storageOffsetPosition + 1)
+		<< eth::Instruction::ADD << eth::swapInstruction(_storageOffsetPosition);
+	// stack: X
+	// set source_byte_offset to zero if X == 1 (using source_byte_offset *= 1 - X)
+	m_context << u256(1) << eth::Instruction::SUB;
+	// stack: 1 - X
+	if (_byteOffsetPosition == 1)
+		m_context << eth::Instruction::MUL;
+	else
+		m_context
+			<< eth::dupInstruction(_byteOffsetPosition + 1) << eth::Instruction::MUL
+			<< eth::swapInstruction(_byteOffsetPosition) << eth::Instruction::POP;
+}
diff --git a/ArrayUtils.h b/ArrayUtils.h
index c7b05b6d..22c0646a 100644
--- a/ArrayUtils.h
+++ b/ArrayUtils.h
@@ -72,6 +72,12 @@ public:
 	void retrieveLength(ArrayType const& _arrayType) const;
 
 private:
+	/// Adds the given number of bytes to a storage byte offset counter and also increments
+	/// the storage offset if adding this number again would increase the counter over 32.
+	/// @param byteOffsetPosition the stack offset of the storage byte offset
+	/// @param storageOffsetPosition the stack offset of the storage slot offset
+	void incrementByteOffset(unsigned _byteSize, unsigned _byteOffsetPosition, unsigned _storageOffsetPosition) const;
+
 	CompilerContext& m_context;
 };
 
diff --git a/Compiler.cpp b/Compiler.cpp
index db61cc4a..8e263449 100644
--- a/Compiler.cpp
+++ b/Compiler.cpp
@@ -20,12 +20,12 @@
  * Solidity compiler.
  */
 
+#include <libsolidity/Compiler.h>
 #include <algorithm>
 #include <boost/range/adaptor/reversed.hpp>
 #include <libevmcore/Instruction.h>
 #include <libevmcore/Assembly.h>
 #include <libsolidity/AST.h>
-#include <libsolidity/Compiler.h>
 #include <libsolidity/ExpressionCompiler.h>
 #include <libsolidity/CompilerUtils.h>
 
@@ -274,19 +274,8 @@ void Compiler::appendReturnValuePacker(TypePointers const& _typeParameters)
 
 void Compiler::registerStateVariables(ContractDefinition const& _contract)
 {
-	vector<VariableDeclaration const*> variables;
-	for (ContractDefinition const* contract: boost::adaptors::reverse(_contract.getLinearizedBaseContracts()))
-		for (ASTPointer<VariableDeclaration> const& variable: contract->getStateVariables())
-			if (!variable->isConstant())
-				variables.push_back(variable.get());
-	TypePointers types;
-	for (auto variable: variables)
-		types.push_back(variable->getType());
-	StorageOffsets offsets;
-	offsets.computeOffsets(types);
-	for (size_t index = 0; index < variables.size(); ++index)
-		if (auto const* offset = offsets.getOffset(index))
-			m_context.addStateVariable(*variables[index], offset->first, offset->second);
+	for (auto const& var: ContractType(_contract).getStateVariables())
+		m_context.addStateVariable(*get<0>(var), get<1>(var), get<2>(var));
 }
 
 void Compiler::initializeStateVariables(ContractDefinition const& _contract)
diff --git a/ExpressionCompiler.cpp b/ExpressionCompiler.cpp
index 61b17f66..da762147 100644
--- a/ExpressionCompiler.cpp
+++ b/ExpressionCompiler.cpp
@@ -753,7 +753,6 @@ bool ExpressionCompiler::visit(IndexAccess const& _indexAccess)
 	}
 	else if (baseType.getCategory() == Type::Category::Array)
 	{
-		// stack layout: <base_ref> [storage_byte_offset] [<length>] <index>
 		ArrayType const& arrayType = dynamic_cast<ArrayType const&>(baseType);
 		solAssert(_indexAccess.getIndexExpression(), "Index expression expected.");
 		ArrayType::Location location = arrayType.getLocation();
@@ -762,6 +761,11 @@ bool ExpressionCompiler::visit(IndexAccess const& _indexAccess)
 			location == ArrayType::Location::Memory ? eth::Instruction::MLOAD :
 			eth::Instruction::CALLDATALOAD;
 
+		// remove storage byte offset
+		if (location == ArrayType::Location::Storage)
+			m_context << eth::Instruction::POP;
+
+		// stack layout: <base_ref> [<length>] <index>
 		_indexAccess.getIndexExpression()->accept(*this);
 		// retrieve length
 		if (!arrayType.isDynamicallySized())
@@ -769,11 +773,9 @@ bool ExpressionCompiler::visit(IndexAccess const& _indexAccess)
 		else if (location == ArrayType::Location::CallData)
 			// length is stored on the stack
 			m_context << eth::Instruction::SWAP1;
-		else if (location == ArrayType::Location::Storage)
-			m_context << eth::Instruction::DUP3 << load;
 		else
 			m_context << eth::Instruction::DUP2 << load;
-		// stack: <base_ref> [storage_byte_offset] <index> <length>
+		// stack: <base_ref> <index> <length>
 		// check out-of-bounds access
 		m_context << eth::Instruction::DUP2 << eth::Instruction::LT;
 		eth::AssemblyItem legalAccess = m_context.appendConditionalJump();
@@ -781,23 +783,22 @@ bool ExpressionCompiler::visit(IndexAccess const& _indexAccess)
 		m_context << eth::Instruction::STOP;
 
 		m_context << legalAccess;
-		// stack: <base_ref> [storage_byte_offset] <index>
+		// stack: <base_ref> <index>
 		if (arrayType.isByteArray())
-			// byte array is packed differently, especially in storage
 			switch (location)
 			{
 			case ArrayType::Location::Storage:
 				// byte array index storage lvalue on stack (goal):
 				// <ref> <byte_number> = <base_ref + index / 32> <index % 32>
-				m_context << u256(32) << eth::Instruction::SWAP3;
+				m_context << u256(32) << eth::Instruction::SWAP2;
 				CompilerUtils(m_context).computeHashStatic();
-				// stack: 32 storage_byte_offset index data_ref
+				// stack: 32 index data_ref
 				m_context
-					<< eth::Instruction::DUP4 << eth::Instruction::DUP3
+					<< eth::Instruction::DUP3 << eth::Instruction::DUP3
 					<< eth::Instruction::DIV << eth::Instruction::ADD
-				// stack: 32 storage_byte_offset index (data_ref + index / 32)
-					<< eth::Instruction::SWAP3 << eth::Instruction::SWAP2
-					<< eth::Instruction::POP << eth::Instruction::MOD;
+				// stack: 32 index (data_ref + index / 32)
+					<< eth::Instruction::SWAP2 << eth::Instruction::SWAP1
+					<< eth::Instruction::MOD;
 				setLValue<StorageByteArrayElement>(_indexAccess);
 				break;
 			case ArrayType::Location::CallData:
@@ -811,36 +812,51 @@ bool ExpressionCompiler::visit(IndexAccess const& _indexAccess)
 			}
 		else
 		{
-			// stack: <base_ref> [storage_byte_offset] <index>
-			if (location == ArrayType::Location::Storage)
-				//@todo use byte offset, remove it for now
-				m_context << eth::Instruction::SWAP1 << eth::Instruction::POP;
-			u256 elementSize =
-				location == ArrayType::Location::Storage ?
-					arrayType.getBaseType()->getStorageSize() :
-					arrayType.getBaseType()->getCalldataEncodedSize();
-			solAssert(elementSize != 0, "Invalid element size.");
-			if (elementSize > 1)
-				m_context << elementSize << eth::Instruction::MUL;
+			// stack: <base_ref> <index>
+			m_context << eth::Instruction::SWAP1;
 			if (arrayType.isDynamicallySized())
 			{
 				if (location == ArrayType::Location::Storage)
-				{
-					m_context << eth::Instruction::SWAP1;
 					CompilerUtils(m_context).computeHashStatic();
-				}
 				else if (location == ArrayType::Location::Memory)
 					m_context << u256(32) << eth::Instruction::ADD;
 			}
-			m_context << eth::Instruction::ADD;
+			// stack: <index> <data_ref>
 			switch (location)
 			{
 			case ArrayType::Location::CallData:
+				m_context
+					<< eth::Instruction::SWAP1 << arrayType.getBaseType()->getCalldataEncodedSize()
+					<< eth::Instruction::MUL << eth::Instruction::ADD;
 				if (arrayType.getBaseType()->isValueType())
 					CompilerUtils(m_context).loadFromMemoryDynamic(*arrayType.getBaseType(), true, true, false);
 				break;
 			case ArrayType::Location::Storage:
-				m_context << u256(0); // @todo
+				m_context << eth::Instruction::SWAP1;
+				if (arrayType.getBaseType()->getStorageBytes() <= 16)
+				{
+					// stack: <data_ref> <index>
+					// goal:
+					// <ref> <byte_number> = <base_ref + index / itemsPerSlot> <(index % itemsPerSlot) * byteSize>
+					unsigned byteSize = arrayType.getBaseType()->getStorageBytes();
+					solAssert(byteSize != 0, "");
+					unsigned itemsPerSlot = 32 / byteSize;
+					m_context << u256(itemsPerSlot) << eth::Instruction::SWAP2;
+					// stack: itemsPerSlot index data_ref
+					m_context
+						<< eth::Instruction::DUP3 << eth::Instruction::DUP3
+						<< eth::Instruction::DIV << eth::Instruction::ADD
+					// stack: itemsPerSlot index (data_ref + index / itemsPerSlot)
+						<< eth::Instruction::SWAP2 << eth::Instruction::SWAP1
+						<< eth::Instruction::MOD
+						<< u256(byteSize) << eth::Instruction::MUL;
+				}
+				else
+				{
+					if (arrayType.getBaseType()->getStorageSize() != 1)
+						m_context << arrayType.getBaseType()->getStorageSize() << eth::Instruction::MUL;
+					m_context << eth::Instruction::ADD << u256(0);
+				}
 				setLValueToStorageItem(_indexAccess);
 				break;
 			case ArrayType::Location::Memory:
diff --git a/Types.cpp b/Types.cpp
index 4b5dddac..016f0b23 100644
--- a/Types.cpp
+++ b/Types.cpp
@@ -20,14 +20,14 @@
  * Solidity data types
  */
 
+#include <libsolidity/Types.h>
+#include <limits>
+#include <boost/range/adaptor/reversed.hpp>
 #include <libdevcore/CommonIO.h>
 #include <libdevcore/CommonData.h>
 #include <libsolidity/Utils.h>
-#include <libsolidity/Types.h>
 #include <libsolidity/AST.h>
 
-#include <limits>
-
 using namespace std;
 
 namespace dev
@@ -184,6 +184,8 @@ TypePointer Type::fromArrayTypeName(TypeName& _baseTypeName, Expression* _length
 	TypePointer baseType = _baseTypeName.toType();
 	if (!baseType)
 		BOOST_THROW_EXCEPTION(_baseTypeName.createTypeError("Invalid type name."));
+	if (baseType->getStorageBytes() == 0)
+		BOOST_THROW_EXCEPTION(_baseTypeName.createTypeError("Illegal base type of storage size zero for array."));
 	if (_length)
 	{
 		if (!_length->getType())
@@ -700,13 +702,21 @@ u256 ArrayType::getStorageSize() const
 {
 	if (isDynamicallySized())
 		return 1;
-	else
+
+	bigint size;
+	unsigned baseBytes = getBaseType()->getStorageBytes();
+	if (baseBytes == 0)
+		size = 1;
+	else if (baseBytes < 32)
 	{
-		bigint size = bigint(getLength()) * getBaseType()->getStorageSize();
-		if (size >= bigint(1) << 256)
-			BOOST_THROW_EXCEPTION(TypeError() << errinfo_comment("Array too large for storage."));
-		return max<u256>(1, u256(size));
+		unsigned itemsPerSlot = 32 / baseBytes;
+		size = (bigint(getLength()) + (itemsPerSlot - 1)) / itemsPerSlot;
 	}
+	else
+		size = bigint(getLength()) * getBaseType()->getStorageSize();
+	if (size >= bigint(1) << 256)
+		BOOST_THROW_EXCEPTION(TypeError() << errinfo_comment("Array too large for storage."));
+	return max<u256>(1, u256(size));
 }
 
 unsigned ArrayType::getSizeOnStack() const
@@ -806,6 +816,26 @@ u256 ContractType::getFunctionIdentifier(string const& _functionName) const
 	return Invalid256;
 }
 
+vector<tuple<VariableDeclaration const*, u256, unsigned>> ContractType::getStateVariables() const
+{
+	vector<VariableDeclaration const*> variables;
+	for (ContractDefinition const* contract: boost::adaptors::reverse(m_contract.getLinearizedBaseContracts()))
+		for (ASTPointer<VariableDeclaration> const& variable: contract->getStateVariables())
+			if (!variable->isConstant())
+				variables.push_back(variable.get());
+	TypePointers types;
+	for (auto variable: variables)
+		types.push_back(variable->getType());
+	StorageOffsets offsets;
+	offsets.computeOffsets(types);
+
+	vector<tuple<VariableDeclaration const*, u256, unsigned>> variablesAndOffsets;
+	for (size_t index = 0; index < variables.size(); ++index)
+		if (auto const* offset = offsets.getOffset(index))
+			variablesAndOffsets.push_back(make_tuple(variables[index], offset->first, offset->second));
+	return variablesAndOffsets;
+}
+
 TypePointer StructType::unaryOperatorResult(Token::Value _operator) const
 {
 	return _operator == Token::Delete ? make_shared<VoidType>() : TypePointer();
diff --git a/Types.h b/Types.h
index e7601fde..c90aabda 100644
--- a/Types.h
+++ b/Types.h
@@ -335,13 +335,22 @@ public:
 
 	/// Constructor for a byte array ("bytes")
 	explicit ArrayType(Location _location):
-		m_location(_location), m_isByteArray(true), m_baseType(std::make_shared<IntegerType>(8)) {}
+		m_location(_location),
+		m_isByteArray(true),
+		m_baseType(std::make_shared<FixedBytesType>(8))
+	{}
 	/// Constructor for a dynamically sized array type ("type[]")
 	ArrayType(Location _location, const TypePointer &_baseType):
-		m_location(_location), m_baseType(_baseType) {}
+		m_location(_location),
+		m_baseType(_baseType)
+	{}
 	/// Constructor for a fixed-size array type ("type[20]")
 	ArrayType(Location _location, const TypePointer &_baseType, u256 const& _length):
-		m_location(_location), m_baseType(_baseType), m_hasDynamicLength(false), m_length(_length) {}
+		m_location(_location),
+		m_baseType(_baseType),
+		m_hasDynamicLength(false),
+		m_length(_length)
+	{}
 
 	virtual bool isImplicitlyConvertibleTo(Type const& _convertTo) const override;
 	virtual TypePointer unaryOperatorResult(Token::Value _operator) const override;
@@ -403,6 +412,10 @@ public:
 	/// not exist.
 	u256 getFunctionIdentifier(std::string const& _functionName) const;
 
+	/// @returns a list of all state variables (including inherited) of the contract and their
+	/// offsets in storage.
+	std::vector<std::tuple<VariableDeclaration const*, u256, unsigned>> getStateVariables() const;
+
 private:
 	ContractDefinition const& m_contract;
 	/// If true, it is the "super" type of the current contract, i.e. it contains only inherited