Merge pull request #4148 from ethereum/develop

Merge develop into release for 0.4.24

35 files changed, 1683 insertions, 321 deletions

diff --git a/libsolidity/CMakeLists.txt b/libsolidity/CMakeLists.txt
index 97b01c83..0bdec4b4 100644
--- a/libsolidity/CMakeLists.txt
+++ b/libsolidity/CMakeLists.txt
@@ -28,7 +28,7 @@ else()
 endif()
 
 add_library(solidity ${sources} ${headers})
-target_link_libraries(solidity PUBLIC evmasm devcore)
+target_link_libraries(solidity PUBLIC evmasm devcore ${Boost_FILESYSTEM_LIBRARY} ${Boost_SYSTEM_LIBRARY})
 
 if (${Z3_FOUND})
   target_link_libraries(solidity PUBLIC ${Z3_LIBRARY})
diff --git a/libsolidity/analysis/ControlFlowAnalyzer.cpp b/libsolidity/analysis/ControlFlowAnalyzer.cpp
new file mode 100644
index 00000000..6edf7986
--- /dev/null
+++ b/libsolidity/analysis/ControlFlowAnalyzer.cpp
@@ -0,0 +1,156 @@
+/*
+	This file is part of solidity.
+
+	solidity is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	solidity is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with solidity.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include <libsolidity/analysis/ControlFlowAnalyzer.h>
+
+using namespace std;
+using namespace dev::solidity;
+
+bool ControlFlowAnalyzer::analyze(ASTNode const& _astRoot)
+{
+	_astRoot.accept(*this);
+	return Error::containsOnlyWarnings(m_errorReporter.errors());
+}
+
+bool ControlFlowAnalyzer::visit(FunctionDefinition const& _function)
+{
+	auto const& functionFlow = m_cfg.functionFlow(_function);
+	checkUnassignedStorageReturnValues(_function, functionFlow.entry, functionFlow.exit);
+	return false;
+}
+
+set<VariableDeclaration const*> ControlFlowAnalyzer::variablesAssignedInNode(CFGNode const *node)
+{
+	set<VariableDeclaration const*> result;
+	for (auto expression: node->block.expressions)
+	{
+		if (auto const* assignment = dynamic_cast<Assignment const*>(expression))
+		{
+			stack<Expression const*> expressions;
+			expressions.push(&assignment->leftHandSide());
+			while (!expressions.empty())
+			{
+				Expression const* expression = expressions.top();
+				expressions.pop();
+
+				if (auto const *tuple = dynamic_cast<TupleExpression const*>(expression))
+					for (auto const& component: tuple->components())
+						expressions.push(component.get());
+				else if (auto const* identifier = dynamic_cast<Identifier const*>(expression))
+					if (auto const* variableDeclaration = dynamic_cast<VariableDeclaration const*>(
+						identifier->annotation().referencedDeclaration
+					))
+						result.insert(variableDeclaration);
+			}
+		}
+	}
+	return result;
+}
+
+void ControlFlowAnalyzer::checkUnassignedStorageReturnValues(
+	FunctionDefinition const& _function,
+	CFGNode const* _functionEntry,
+	CFGNode const* _functionExit
+) const
+{
+	if (_function.returnParameterList()->parameters().empty())
+		return;
+
+	map<CFGNode const*, set<VariableDeclaration const*>> unassigned;
+
+	{
+		auto& unassignedAtFunctionEntry = unassigned[_functionEntry];
+		for (auto const& returnParameter: _function.returnParameterList()->parameters())
+			if (returnParameter->type()->dataStoredIn(DataLocation::Storage))
+				unassignedAtFunctionEntry.insert(returnParameter.get());
+	}
+
+	stack<CFGNode const*> nodesToTraverse;
+	nodesToTraverse.push(_functionEntry);
+
+	// walk all paths from entry with maximal set of unassigned return values
+	while (!nodesToTraverse.empty())
+	{
+		auto node = nodesToTraverse.top();
+		nodesToTraverse.pop();
+
+		auto& unassignedAtNode = unassigned[node];
+
+		if (node->block.returnStatement != nullptr)
+			if (node->block.returnStatement->expression())
+				unassignedAtNode.clear();
+		if (!unassignedAtNode.empty())
+		{
+			// kill all return values to which a value is assigned
+			for (auto const* variableDeclaration: variablesAssignedInNode(node))
+				unassignedAtNode.erase(variableDeclaration);
+
+			// kill all return values referenced in inline assembly
+			// a reference is enough, checking whether there actually was an assignment might be overkill
+			for (auto assembly: node->block.inlineAssemblyStatements)
+				for (auto const& ref: assembly->annotation().externalReferences)
+					if (auto variableDeclaration = dynamic_cast<VariableDeclaration const*>(ref.second.declaration))
+						unassignedAtNode.erase(variableDeclaration);
+		}
+
+		for (auto const& exit: node->exits)
+		{
+			auto& unassignedAtExit = unassigned[exit];
+			auto oldSize = unassignedAtExit.size();
+			unassignedAtExit.insert(unassignedAtNode.begin(), unassignedAtNode.end());
+			// (re)traverse an exit, if we are on a path with new unassigned return values to consider
+			// this will terminate, since there is only a finite number of unassigned return values
+			if (unassignedAtExit.size() > oldSize)
+				nodesToTraverse.push(exit);
+		}
+	}
+
+	if (!unassigned[_functionExit].empty())
+	{
+		vector<VariableDeclaration const*> unassignedOrdered(
+			unassigned[_functionExit].begin(),
+			unassigned[_functionExit].end()
+		);
+		sort(
+			unassignedOrdered.begin(),
+			unassignedOrdered.end(),
+			[](VariableDeclaration const* lhs, VariableDeclaration const* rhs) -> bool {
+				return lhs->id() < rhs->id();
+			}
+		);
+		for (auto const* returnVal: unassignedOrdered)
+		{
+			SecondarySourceLocation ssl;
+			for (CFGNode* lastNodeBeforeExit: _functionExit->entries)
+				if (unassigned[lastNodeBeforeExit].count(returnVal))
+				{
+					if (!!lastNodeBeforeExit->block.returnStatement)
+						ssl.append("Problematic return:", lastNodeBeforeExit->block.returnStatement->location());
+					else
+						ssl.append("Problematic end of function:", _function.location());
+				}
+
+			m_errorReporter.warning(
+				returnVal->location(),
+				"This variable is of storage pointer type and might be returned without assignment. "
+				"This can cause storage corruption. Assign the variable (potentially from itself) "
+				"to remove this warning.",
+				ssl
+			);
+		}
+	}
+}
diff --git a/libsolidity/analysis/ControlFlowAnalyzer.h b/libsolidity/analysis/ControlFlowAnalyzer.h
new file mode 100644
index 00000000..43e13fb6
--- /dev/null
+++ b/libsolidity/analysis/ControlFlowAnalyzer.h
@@ -0,0 +1,52 @@
+/*
+	This file is part of solidity.
+
+	solidity is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	solidity is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with solidity.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#pragma once
+
+#include <libsolidity/analysis/ControlFlowGraph.h>
+
+#include <set>
+
+namespace dev
+{
+namespace solidity
+{
+
+class ControlFlowAnalyzer: private ASTConstVisitor
+{
+public:
+	explicit ControlFlowAnalyzer(CFG const& _cfg, ErrorReporter& _errorReporter):
+		m_cfg(_cfg), m_errorReporter(_errorReporter) {}
+
+	bool analyze(ASTNode const& _astRoot);
+
+	virtual bool visit(FunctionDefinition const& _function) override;
+
+private:
+	static std::set<VariableDeclaration const*> variablesAssignedInNode(CFGNode const *node);
+	void checkUnassignedStorageReturnValues(
+		FunctionDefinition const& _function,
+		CFGNode const* _functionEntry,
+		CFGNode const* _functionExit
+	) const;
+
+	CFG const& m_cfg;
+	ErrorReporter& m_errorReporter;
+};
+
+}
+}
diff --git a/libsolidity/analysis/ControlFlowBuilder.cpp b/libsolidity/analysis/ControlFlowBuilder.cpp
new file mode 100644
index 00000000..35d7687c
--- /dev/null
+++ b/libsolidity/analysis/ControlFlowBuilder.cpp
@@ -0,0 +1,370 @@
+/*
+	This file is part of solidity.
+
+	solidity is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	solidity is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with solidity.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include <libsolidity/analysis/ControlFlowBuilder.h>
+
+using namespace dev;
+using namespace solidity;
+using namespace std;
+
+ControlFlowBuilder::ControlFlowBuilder(CFG::NodeContainer& _nodeContainer, FunctionFlow const& _functionFlow):
+	m_nodeContainer(_nodeContainer), m_currentFunctionFlow(_functionFlow), m_currentNode(_functionFlow.entry)
+{
+}
+
+unique_ptr<FunctionFlow> ControlFlowBuilder::createFunctionFlow(
+	CFG::NodeContainer& _nodeContainer,
+	FunctionDefinition const& _function
+)
+{
+	auto functionFlow = unique_ptr<FunctionFlow>(new FunctionFlow());
+	functionFlow->entry = _nodeContainer.newNode();
+	functionFlow->exit = _nodeContainer.newNode();
+	functionFlow->revert = _nodeContainer.newNode();
+	ControlFlowBuilder builder(_nodeContainer, *functionFlow);
+	builder.appendControlFlow(_function);
+	connect(builder.m_currentNode, functionFlow->exit);
+	return functionFlow;
+}
+
+
+unique_ptr<ModifierFlow> ControlFlowBuilder::createModifierFlow(
+	CFG::NodeContainer& _nodeContainer,
+	ModifierDefinition const& _modifier
+)
+{
+	auto modifierFlow = unique_ptr<ModifierFlow>(new ModifierFlow());
+	modifierFlow->entry = _nodeContainer.newNode();
+	modifierFlow->exit = _nodeContainer.newNode();
+	modifierFlow->revert = _nodeContainer.newNode();
+	modifierFlow->placeholderEntry = _nodeContainer.newNode();
+	modifierFlow->placeholderExit = _nodeContainer.newNode();
+	ControlFlowBuilder builder(_nodeContainer, *modifierFlow);
+	builder.appendControlFlow(_modifier);
+	connect(builder.m_currentNode, modifierFlow->exit);
+	return modifierFlow;
+}
+
+bool ControlFlowBuilder::visit(BinaryOperation const& _operation)
+{
+	solAssert(!!m_currentNode, "");
+
+	switch(_operation.getOperator())
+	{
+		case Token::Or:
+		case Token::And:
+		{
+			appendControlFlow(_operation.leftExpression());
+
+			auto nodes = splitFlow<2>();
+			nodes[0] = createFlow(nodes[0], _operation.rightExpression());
+			mergeFlow(nodes, nodes[1]);
+
+			return false;
+		}
+		default:
+			break;
+	}
+	return ASTConstVisitor::visit(_operation);
+}
+
+bool ControlFlowBuilder::visit(Conditional const& _conditional)
+{
+	solAssert(!!m_currentNode, "");
+
+	_conditional.condition().accept(*this);
+
+	auto nodes = splitFlow<2>();
+
+	nodes[0] = createFlow(nodes[0], _conditional.trueExpression());
+	nodes[1] = createFlow(nodes[1], _conditional.falseExpression());
+
+	mergeFlow(nodes);
+
+	return false;
+}
+
+bool ControlFlowBuilder::visit(IfStatement const& _ifStatement)
+{
+	solAssert(!!m_currentNode, "");
+
+	_ifStatement.condition().accept(*this);
+
+	auto nodes = splitFlow<2>();
+	nodes[0] = createFlow(nodes[0], _ifStatement.trueStatement());
+
+	if (_ifStatement.falseStatement())
+	{
+		nodes[1] = createFlow(nodes[1], *_ifStatement.falseStatement());
+		mergeFlow(nodes);
+	}
+	else
+		mergeFlow(nodes, nodes[1]);
+
+	return false;
+}
+
+bool ControlFlowBuilder::visit(ForStatement const& _forStatement)
+{
+	solAssert(!!m_currentNode, "");
+
+	if (_forStatement.initializationExpression())
+		_forStatement.initializationExpression()->accept(*this);
+
+	auto condition = createLabelHere();
+
+	if (_forStatement.condition())
+		appendControlFlow(*_forStatement.condition());
+
+	auto loopExpression = newLabel();
+	auto nodes = splitFlow<2>();
+	auto afterFor = nodes[1];
+	m_currentNode = nodes[0];
+
+	{
+		BreakContinueScope scope(*this, afterFor, loopExpression);
+		appendControlFlow(_forStatement.body());
+	}
+
+	placeAndConnectLabel(loopExpression);
+
+	if (auto expression = _forStatement.loopExpression())
+		appendControlFlow(*expression);
+
+	connect(m_currentNode, condition);
+	m_currentNode = afterFor;
+
+	return false;
+}
+
+bool ControlFlowBuilder::visit(WhileStatement const& _whileStatement)
+{
+	solAssert(!!m_currentNode, "");
+
+	if (_whileStatement.isDoWhile())
+	{
+		auto afterWhile = newLabel();
+		auto whileBody = createLabelHere();
+
+		{
+			// Note that "continue" in this case currently indeed jumps to whileBody
+			// and not to the condition. This is inconsistent with JavaScript and C and
+			// therefore a bug. This will be fixed in the future (planned for 0.5.0)
+			// and the Control Flow Graph will have to be adjusted accordingly.
+			BreakContinueScope scope(*this, afterWhile, whileBody);
+			appendControlFlow(_whileStatement.body());
+		}
+		appendControlFlow(_whileStatement.condition());
+
+		connect(m_currentNode, whileBody);
+		placeAndConnectLabel(afterWhile);
+	}
+	else
+	{
+		auto whileCondition = createLabelHere();
+
+		appendControlFlow(_whileStatement.condition());
+
+		auto nodes = splitFlow<2>();
+
+		auto whileBody = nodes[0];
+		auto afterWhile = nodes[1];
+
+		m_currentNode = whileBody;
+		{
+			BreakContinueScope scope(*this, afterWhile, whileCondition);
+			appendControlFlow(_whileStatement.body());
+		}
+
+		connect(m_currentNode, whileCondition);
+
+		m_currentNode = afterWhile;
+	}
+
+
+	return false;
+}
+
+bool ControlFlowBuilder::visit(Break const&)
+{
+	solAssert(!!m_currentNode, "");
+	solAssert(!!m_breakJump, "");
+	connect(m_currentNode, m_breakJump);
+	m_currentNode = newLabel();
+	return false;
+}
+
+bool ControlFlowBuilder::visit(Continue const&)
+{
+	solAssert(!!m_currentNode, "");
+	solAssert(!!m_continueJump, "");
+	connect(m_currentNode, m_continueJump);
+	m_currentNode = newLabel();
+	return false;
+}
+
+bool ControlFlowBuilder::visit(Throw const&)
+{
+	solAssert(!!m_currentNode, "");
+	solAssert(!!m_currentFunctionFlow.revert, "");
+	connect(m_currentNode, m_currentFunctionFlow.revert);
+	m_currentNode = newLabel();
+	return false;
+}
+
+bool ControlFlowBuilder::visit(Block const&)
+{
+	solAssert(!!m_currentNode, "");
+	createLabelHere();
+	return true;
+}
+
+void ControlFlowBuilder::endVisit(Block const&)
+{
+	solAssert(!!m_currentNode, "");
+	createLabelHere();
+}
+
+bool ControlFlowBuilder::visit(Return const& _return)
+{
+	solAssert(!!m_currentNode, "");
+	solAssert(!!m_currentFunctionFlow.exit, "");
+	solAssert(!m_currentNode->block.returnStatement, "");
+	m_currentNode->block.returnStatement = &_return;
+	connect(m_currentNode, m_currentFunctionFlow.exit);
+	m_currentNode = newLabel();
+	return true;
+}
+
+
+bool ControlFlowBuilder::visit(PlaceholderStatement const&)
+{
+	solAssert(!!m_currentNode, "");
+	auto modifierFlow = dynamic_cast<ModifierFlow const*>(&m_currentFunctionFlow);
+	solAssert(!!modifierFlow, "");
+
+	connect(m_currentNode, modifierFlow->placeholderEntry);
+
+	m_currentNode = newLabel();
+
+	connect(modifierFlow->placeholderExit, m_currentNode);
+	return false;
+}
+
+bool ControlFlowBuilder::visitNode(ASTNode const& node)
+{
+	solAssert(!!m_currentNode, "");
+	if (auto const* expression = dynamic_cast<Expression const*>(&node))
+		m_currentNode->block.expressions.emplace_back(expression);
+	else if (auto const* variableDeclaration = dynamic_cast<VariableDeclaration const*>(&node))
+		m_currentNode->block.variableDeclarations.emplace_back(variableDeclaration);
+	else if (auto const* assembly = dynamic_cast<InlineAssembly const*>(&node))
+		m_currentNode->block.inlineAssemblyStatements.emplace_back(assembly);
+
+	return true;
+}
+
+bool ControlFlowBuilder::visit(FunctionCall const& _functionCall)
+{
+	solAssert(!!m_currentNode, "");
+	solAssert(!!_functionCall.expression().annotation().type, "");
+
+	if (auto functionType = dynamic_pointer_cast<FunctionType const>(_functionCall.expression().annotation().type))
+		switch (functionType->kind())
+		{
+			case FunctionType::Kind::Revert:
+				solAssert(!!m_currentFunctionFlow.revert, "");
+				_functionCall.expression().accept(*this);
+				ASTNode::listAccept(_functionCall.arguments(), *this);
+				connect(m_currentNode, m_currentFunctionFlow.revert);
+				m_currentNode = newLabel();
+				return false;
+			case FunctionType::Kind::Require:
+			case FunctionType::Kind::Assert:
+			{
+				solAssert(!!m_currentFunctionFlow.revert, "");
+				_functionCall.expression().accept(*this);
+				ASTNode::listAccept(_functionCall.arguments(), *this);
+				connect(m_currentNode, m_currentFunctionFlow.revert);
+				auto nextNode = newLabel();
+				connect(m_currentNode, nextNode);
+				m_currentNode = nextNode;
+				return false;
+			}
+			default:
+				break;
+		}
+	return ASTConstVisitor::visit(_functionCall);
+}
+
+void ControlFlowBuilder::appendControlFlow(ASTNode const& _node)
+{
+	_node.accept(*this);
+}
+
+CFGNode* ControlFlowBuilder::createFlow(CFGNode* _entry, ASTNode const& _node)
+{
+	auto oldCurrentNode = m_currentNode;
+	m_currentNode = _entry;
+	appendControlFlow(_node);
+	auto endNode = m_currentNode;
+	m_currentNode = oldCurrentNode;
+	return endNode;
+}
+
+void ControlFlowBuilder::connect(CFGNode* _from, CFGNode* _to)
+{
+	solAssert(_from, "");
+	solAssert(_to, "");
+	_from->exits.push_back(_to);
+	_to->entries.push_back(_from);
+}
+
+CFGNode* ControlFlowBuilder::newLabel()
+{
+	return m_nodeContainer.newNode();
+}
+
+CFGNode* ControlFlowBuilder::createLabelHere()
+{
+	auto label = m_nodeContainer.newNode();
+	connect(m_currentNode, label);
+	m_currentNode = label;
+	return label;
+}
+
+void ControlFlowBuilder::placeAndConnectLabel(CFGNode* _node)
+{
+	connect(m_currentNode, _node);
+	m_currentNode = _node;
+}
+
+ControlFlowBuilder::BreakContinueScope::BreakContinueScope(
+	ControlFlowBuilder& _parser,
+	CFGNode* _breakJump,
+	CFGNode* _continueJump
+): m_parser(_parser), m_origBreakJump(_parser.m_breakJump), m_origContinueJump(_parser.m_continueJump)
+{
+	m_parser.m_breakJump = _breakJump;
+	m_parser.m_continueJump = _continueJump;
+}
+
+ControlFlowBuilder::BreakContinueScope::~BreakContinueScope()
+{
+	m_parser.m_breakJump = m_origBreakJump;
+	m_parser.m_continueJump = m_origContinueJump;
+}
diff --git a/libsolidity/analysis/ControlFlowBuilder.h b/libsolidity/analysis/ControlFlowBuilder.h
new file mode 100644
index 00000000..e9d96e5f
--- /dev/null
+++ b/libsolidity/analysis/ControlFlowBuilder.h
@@ -0,0 +1,143 @@
+/*
+	This file is part of solidity.
+
+	solidity is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	solidity is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with solidity.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#pragma once
+
+#include <libsolidity/analysis/ControlFlowGraph.h>
+#include <libsolidity/ast/AST.h>
+#include <libsolidity/ast/ASTVisitor.h>
+
+#include <array>
+#include <memory>
+
+namespace dev {
+namespace solidity {
+
+/** Helper class that builds the control flow of a function or modifier.
+ * Modifiers are not yet applied to the functions. This is done in a second
+ * step in the CFG class.
+ */
+class ControlFlowBuilder: private ASTConstVisitor
+{
+public:
+	static std::unique_ptr<FunctionFlow> createFunctionFlow(
+		CFG::NodeContainer& _nodeContainer,
+		FunctionDefinition const& _function
+	);
+	static std::unique_ptr<ModifierFlow> createModifierFlow(
+		CFG::NodeContainer& _nodeContainer,
+		ModifierDefinition const& _modifier
+	);
+
+private:
+	explicit ControlFlowBuilder(CFG::NodeContainer& _nodeContainer, FunctionFlow const& _functionFlow);
+
+	virtual bool visit(BinaryOperation const& _operation) override;
+	virtual bool visit(Conditional const& _conditional) override;
+	virtual bool visit(IfStatement const& _ifStatement) override;
+	virtual bool visit(ForStatement const& _forStatement) override;
+	virtual bool visit(WhileStatement const& _whileStatement) override;
+	virtual bool visit(Break const&) override;
+	virtual bool visit(Continue const&) override;
+	virtual bool visit(Throw const&) override;
+	virtual bool visit(Block const&) override;
+	virtual void endVisit(Block const&) override;
+	virtual bool visit(Return const& _return) override;
+	virtual bool visit(PlaceholderStatement const&) override;
+	virtual bool visit(FunctionCall const& _functionCall) override;
+
+
+	/// Appends the control flow of @a _node to the current control flow.
+	void appendControlFlow(ASTNode const& _node);
+
+	/// Starts at @a _entry and parses the control flow of @a _node.
+	/// @returns The node at which the parsed control flow ends.
+	/// m_currentNode is not affected (it is saved and restored).
+	CFGNode* createFlow(CFGNode* _entry, ASTNode const& _node);
+
+	/// Creates an arc from @a _from to @a _to.
+	static void connect(CFGNode* _from, CFGNode* _to);
+
+
+protected:
+	virtual bool visitNode(ASTNode const& node) override;
+
+private:
+
+	/// Splits the control flow starting at the current node into n paths.
+	/// m_currentNode is set to nullptr and has to be set manually or
+	/// using mergeFlow later.
+	template<size_t n>
+	std::array<CFGNode*, n> splitFlow()
+	{
+		std::array<CFGNode*, n> result;
+		for (auto& node: result)
+		{
+			node = m_nodeContainer.newNode();
+			connect(m_currentNode, node);
+		}
+		m_currentNode = nullptr;
+		return result;
+	}
+
+	/// Merges the control flow of @a _nodes to @a _endNode.
+	/// If @a _endNode is nullptr, a new node is creates and used as end node.
+	/// Sets the merge destination as current node.
+	/// Note: @a _endNode may be one of the nodes in @a _nodes.
+	template<size_t n>
+	void mergeFlow(std::array<CFGNode*, n> const& _nodes, CFGNode* _endNode = nullptr)
+	{
+		CFGNode* mergeDestination = (_endNode == nullptr) ? m_nodeContainer.newNode() : _endNode;
+		for (auto& node: _nodes)
+			if (node != mergeDestination)
+				connect(node, mergeDestination);
+		m_currentNode = mergeDestination;
+	}
+
+	CFGNode* newLabel();
+	CFGNode* createLabelHere();
+	void placeAndConnectLabel(CFGNode *_node);
+
+	CFG::NodeContainer& m_nodeContainer;
+
+	/// The control flow of the function that is currently parsed.
+	/// Note: this can also be a ModifierFlow
+	FunctionFlow const& m_currentFunctionFlow;
+
+	CFGNode* m_currentNode = nullptr;
+
+	/// The current jump destination of break Statements.
+	CFGNode* m_breakJump = nullptr;
+	/// The current jump destination of continue Statements.
+	CFGNode* m_continueJump = nullptr;
+
+	/// Helper class that replaces the break and continue jump destinations for the
+	/// current scope and restores the originals at the end of the scope.
+	class BreakContinueScope
+	{
+	public:
+		BreakContinueScope(ControlFlowBuilder& _parser, CFGNode* _breakJump, CFGNode* _continueJump);
+		~BreakContinueScope();
+	private:
+		ControlFlowBuilder& m_parser;
+		CFGNode* m_origBreakJump;
+		CFGNode* m_origContinueJump;
+	};
+};
+
+}
+}
diff --git a/libsolidity/analysis/ControlFlowGraph.cpp b/libsolidity/analysis/ControlFlowGraph.cpp
new file mode 100644
index 00000000..9b3da0eb
--- /dev/null
+++ b/libsolidity/analysis/ControlFlowGraph.cpp
@@ -0,0 +1,136 @@
+/*
+	This file is part of solidity.
+
+	solidity is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	solidity is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with solidity.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include <libsolidity/analysis/ControlFlowGraph.h>
+#include <libsolidity/analysis/ControlFlowBuilder.h>
+
+#include <boost/range/adaptor/reversed.hpp>
+
+#include <algorithm>
+
+using namespace std;
+using namespace dev::solidity;
+
+bool CFG::constructFlow(ASTNode const& _astRoot)
+{
+	_astRoot.accept(*this);
+	applyModifiers();
+	return Error::containsOnlyWarnings(m_errorReporter.errors());
+}
+
+
+bool CFG::visit(ModifierDefinition const& _modifier)
+{
+	m_modifierControlFlow[&_modifier] = ControlFlowBuilder::createModifierFlow(m_nodeContainer, _modifier);
+	return false;
+}
+
+bool CFG::visit(FunctionDefinition const& _function)
+{
+	m_functionControlFlow[&_function] = ControlFlowBuilder::createFunctionFlow(m_nodeContainer, _function);
+	return false;
+}
+
+FunctionFlow const& CFG::functionFlow(FunctionDefinition const& _function) const
+{
+	solAssert(m_functionControlFlow.count(&_function), "");
+	return *m_functionControlFlow.find(&_function)->second;
+}
+
+CFGNode* CFG::NodeContainer::newNode()
+{
+	m_nodes.emplace_back(new CFGNode());
+	return m_nodes.back().get();
+}
+
+void CFG::applyModifiers()
+{
+	for (auto const& function: m_functionControlFlow)
+	{
+		for (auto const& modifierInvocation: boost::adaptors::reverse(function.first->modifiers()))
+		{
+			if (auto modifierDefinition = dynamic_cast<ModifierDefinition const*>(
+				modifierInvocation->name()->annotation().referencedDeclaration
+			))
+			{
+				solAssert(m_modifierControlFlow.count(modifierDefinition), "");
+				applyModifierFlowToFunctionFlow(*m_modifierControlFlow[modifierDefinition], function.second.get());
+			}
+		}
+	}
+}
+
+void CFG::applyModifierFlowToFunctionFlow(
+	ModifierFlow const& _modifierFlow,
+	FunctionFlow* _functionFlow
+)
+{
+	solAssert(!!_functionFlow, "");
+
+	map<CFGNode*, CFGNode*> copySrcToCopyDst;
+
+	// inherit the revert node of the function
+	copySrcToCopyDst[_modifierFlow.revert] = _functionFlow->revert;
+
+	// replace the placeholder nodes by the function entry and exit
+	copySrcToCopyDst[_modifierFlow.placeholderEntry] = _functionFlow->entry;
+	copySrcToCopyDst[_modifierFlow.placeholderExit] = _functionFlow->exit;
+
+	stack<CFGNode*> nodesToCopy;
+	nodesToCopy.push(_modifierFlow.entry);
+
+	// map the modifier entry to a new node that will become the new function entry
+	copySrcToCopyDst[_modifierFlow.entry] = m_nodeContainer.newNode();
+
+	while (!nodesToCopy.empty())
+	{
+		CFGNode* copySrcNode = nodesToCopy.top();
+		nodesToCopy.pop();
+
+		solAssert(copySrcToCopyDst.count(copySrcNode), "");
+
+		CFGNode* copyDstNode = copySrcToCopyDst[copySrcNode];
+
+		copyDstNode->block = copySrcNode->block;
+		for (auto const& entry: copySrcNode->entries)
+		{
+			if (!copySrcToCopyDst.count(entry))
+			{
+				copySrcToCopyDst[entry] = m_nodeContainer.newNode();
+				nodesToCopy.push(entry);
+			}
+			copyDstNode->entries.emplace_back(copySrcToCopyDst[entry]);
+		}
+		for (auto const& exit: copySrcNode->exits)
+		{
+			if (!copySrcToCopyDst.count(exit))
+			{
+				copySrcToCopyDst[exit] = m_nodeContainer.newNode();
+				nodesToCopy.push(exit);
+			}
+			copyDstNode->exits.emplace_back(copySrcToCopyDst[exit]);
+		}
+	}
+
+	// if the modifier control flow never reached its exit node,
+	// we need to create a new (disconnected) exit node now
+	if (!copySrcToCopyDst.count(_modifierFlow.exit))
+		copySrcToCopyDst[_modifierFlow.exit] = m_nodeContainer.newNode();
+
+	_functionFlow->entry = copySrcToCopyDst[_modifierFlow.entry];
+	_functionFlow->exit = copySrcToCopyDst[_modifierFlow.exit];
+}
\ No newline at end of file
diff --git a/libsolidity/analysis/ControlFlowGraph.h b/libsolidity/analysis/ControlFlowGraph.h
new file mode 100644
index 00000000..c646e4f1
--- /dev/null
+++ b/libsolidity/analysis/ControlFlowGraph.h
@@ -0,0 +1,148 @@
+/*
+	This file is part of solidity.
+
+	solidity is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	solidity is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with solidity.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#pragma once
+
+#include <libsolidity/ast/AST.h>
+#include <libsolidity/ast/ASTVisitor.h>
+#include <libsolidity/interface/ErrorReporter.h>
+
+#include <map>
+#include <memory>
+#include <stack>
+#include <vector>
+
+namespace dev
+{
+namespace solidity
+{
+
+/** Basic Control Flow Block.
+ * Basic block of control flow. Consists of a set of (unordered) AST nodes
+ * for which control flow is always linear. A basic control flow block
+ * encompasses at most one scope. Reverts are considered to break the control
+ * flow.
+ * @todo Handle function calls correctly. So far function calls are not considered
+ * to change the control flow.
+ */
+struct ControlFlowBlock
+{
+	/// All variable declarations inside this control flow block.
+	std::vector<VariableDeclaration const*> variableDeclarations;
+	/// All expressions inside this control flow block (this includes all subexpressions!).
+	std::vector<Expression const*> expressions;
+	/// All inline assembly statements inside in this control flow block.
+	std::vector<InlineAssembly const*> inlineAssemblyStatements;
+	/// If control flow returns in this node, the return statement is stored in returnStatement,
+	/// otherwise returnStatement is nullptr.
+	Return const* returnStatement = nullptr;
+};
+
+/** Node of the Control Flow Graph.
+  * The control flow is a directed graph connecting control flow blocks.
+  * An arc between two nodes indicates that the control flow can possibly
+  * move from its start node to its end node during execution.
+  */
+struct CFGNode
+{
+	/// Entry nodes. All CFG nodes from which control flow may move into this node.
+	std::vector<CFGNode*> entries;
+	/// Exit nodes. All CFG nodes to which control flow may continue after this node.
+	std::vector<CFGNode*> exits;
+
+	/// Control flow in the node.
+	ControlFlowBlock block;
+};
+
+/** Describes the control flow of a function. */
+struct FunctionFlow
+{
+	virtual ~FunctionFlow() {}
+	/// Entry node. Control flow of the function starts here.
+	/// This node is empty and does not have any entries.
+	CFGNode* entry = nullptr;
+	/// Exit node. All non-reverting control flow of the function ends here.
+	/// This node is empty and does not have any exits, but may have multiple entries
+	/// (e.g. all return statements of the function).
+	CFGNode* exit = nullptr;
+	/// Revert node. Control flow of the function in case of revert.
+	/// This node is empty does not have any exits, but may have multiple entries
+	/// (e.g. all assert, require, revert and throw statements).
+	CFGNode* revert = nullptr;
+};
+
+/** Describes the control flow of a modifier.
+ * Every placeholder breaks the control flow. The node preceding the
+ * placeholder is assigned placeholderEntry as exit and the node
+ * following the placeholder is assigned placeholderExit as entry.
+ */
+struct ModifierFlow: FunctionFlow
+{
+	/// Control flow leading towards a placeholder exit in placeholderEntry.
+	CFGNode* placeholderEntry = nullptr;
+	/// Control flow coming from a placeholder enter from placeholderExit.
+	CFGNode* placeholderExit = nullptr;
+};
+
+class CFG: private ASTConstVisitor
+{
+public:
+	explicit CFG(ErrorReporter& _errorReporter): m_errorReporter(_errorReporter) {}
+
+	bool constructFlow(ASTNode const& _astRoot);
+
+	virtual bool visit(ModifierDefinition const& _modifier) override;
+	virtual bool visit(FunctionDefinition const& _function) override;
+
+	FunctionFlow const& functionFlow(FunctionDefinition const& _function) const;
+
+	class NodeContainer
+	{
+	public:
+		CFGNode* newNode();
+	private:
+		std::vector<std::unique_ptr<CFGNode>> m_nodes;
+	};
+private:
+	/// Initially the control flow for all functions *ignoring* modifiers and for
+	/// all modifiers is constructed. Afterwards the control flow of functions
+	/// is adjusted by applying all modifiers.
+	void applyModifiers();
+
+	/// Creates a copy of the modifier flow @a _modifierFlow, while replacing the
+	/// placeholder entry and exit with the function entry and exit, as well as
+	/// replacing the modifier revert node with the function's revert node.
+	/// The resulting control flow is the new function flow with the modifier applied.
+	/// @a _functionFlow is updated in-place.
+	void applyModifierFlowToFunctionFlow(
+		ModifierFlow const& _modifierFlow,
+		FunctionFlow* _functionFlow
+	);
+
+	ErrorReporter& m_errorReporter;
+
+	/// Node container.
+	/// All nodes allocated during the construction of the control flow graph
+	/// are owned by the CFG class and stored in this container.
+	NodeContainer m_nodeContainer;
+
+	std::map<FunctionDefinition const*, std::unique_ptr<FunctionFlow>> m_functionControlFlow;
+	std::map<ModifierDefinition const*, std::unique_ptr<ModifierFlow>> m_modifierControlFlow;
+};
+
+}
+}
diff --git a/libsolidity/analysis/TypeChecker.cpp b/libsolidity/analysis/TypeChecker.cpp
index 72d29762..30302908 100644
--- a/libsolidity/analysis/TypeChecker.cpp
+++ b/libsolidity/analysis/TypeChecker.cpp
@@ -1067,6 +1067,7 @@ void TypeChecker::endVisit(EmitStatement const& _emit)
 {
 	if (
 		_emit.eventCall().annotation().kind != FunctionCallKind::FunctionCall ||
+		type(_emit.eventCall().expression())->category() != Type::Category::Function ||
 		dynamic_cast<FunctionType const&>(*type(_emit.eventCall().expression())).kind() != FunctionType::Kind::Event
 	)
 		m_errorReporter.typeError(_emit.eventCall().expression().location(), "Expression has to be an event invocation.");
@@ -1075,6 +1076,7 @@ void TypeChecker::endVisit(EmitStatement const& _emit)
 
 bool TypeChecker::visit(VariableDeclarationStatement const& _statement)
 {
+	bool const v050 = m_scope->sourceUnit().annotation().experimentalFeatures.count(ExperimentalFeature::V050);
 	if (!_statement.initialValue())
 	{
 		// No initial value is only permitted for single variables with specified type.
@@ -1091,7 +1093,7 @@ bool TypeChecker::visit(VariableDeclarationStatement const& _statement)
 				if (varDecl.referenceLocation() == VariableDeclaration::Location::Default)
 					errorText += " Did you mean '<type> memory " + varDecl.name() + "'?";
 				solAssert(m_scope, "");
-				if (m_scope->sourceUnit().annotation().experimentalFeatures.count(ExperimentalFeature::V050))
+				if (v050)
 					m_errorReporter.declarationError(varDecl.location(), errorText);
 				else
 					m_errorReporter.warning(varDecl.location(), errorText);
@@ -1131,12 +1133,33 @@ bool TypeChecker::visit(VariableDeclarationStatement const& _statement)
 				") in value for variable assignment (0) needed"
 			);
 	}
-	else if (valueTypes.size() != variables.size() && !variables.front() && !variables.back())
-		m_errorReporter.fatalTypeError(
-			_statement.location(),
-			"Wildcard both at beginning and end of variable declaration list is only allowed "
-			"if the number of components is equal."
-		);
+	else if (valueTypes.size() != variables.size())
+	{
+		if (v050)
+			m_errorReporter.fatalTypeError(
+				_statement.location(),
+				"Different number of components on the left hand side (" +
+				toString(variables.size()) +
+				") than on the right hand side (" +
+				toString(valueTypes.size()) +
+				")."
+			);
+		else if (!variables.front() && !variables.back())
+			m_errorReporter.fatalTypeError(
+				_statement.location(),
+				"Wildcard both at beginning and end of variable declaration list is only allowed "
+				"if the number of components is equal."
+			);
+		else
+			m_errorReporter.warning(
+				_statement.location(),
+				"Different number of components on the left hand side (" +
+				toString(variables.size()) +
+				") than on the right hand side (" +
+				toString(valueTypes.size()) +
+				")."
+			);
+	}
 	size_t minNumValues = variables.size();
 	if (!variables.empty() && (!variables.back() || !variables.front()))
 		--minNumValues;
@@ -1200,8 +1223,9 @@ bool TypeChecker::visit(VariableDeclarationStatement const& _statement)
 				string extension;
 				if (auto type = dynamic_cast<IntegerType const*>(var.annotation().type.get()))
 				{
-					int numBits = type->numBits();
+					unsigned numBits = type->numBits();
 					bool isSigned = type->isSigned();
+					solAssert(numBits > 0, "");
 					string minValue;
 					string maxValue;
 					if (isSigned)
@@ -1333,6 +1357,7 @@ bool TypeChecker::visit(Conditional const& _conditional)
 
 bool TypeChecker::visit(Assignment const& _assignment)
 {
+	bool const v050 = m_scope->sourceUnit().annotation().experimentalFeatures.count(ExperimentalFeature::V050);
 	requireLValue(_assignment.leftHandSide());
 	TypePointer t = type(_assignment.leftHandSide());
 	_assignment.annotation().type = t;
@@ -1345,11 +1370,29 @@ bool TypeChecker::visit(Assignment const& _assignment)
 			);
 		// Sequenced assignments of tuples is not valid, make the result a "void" type.
 		_assignment.annotation().type = make_shared<TupleType>();
+
 		expectType(_assignment.rightHandSide(), *tupleType);
 
 		// expectType does not cause fatal errors, so we have to check again here.
-		if (dynamic_cast<TupleType const*>(type(_assignment.rightHandSide()).get()))
+		if (TupleType const* rhsType = dynamic_cast<TupleType const*>(type(_assignment.rightHandSide()).get()))
+		{
 			checkDoubleStorageAssignment(_assignment);
+			// @todo For 0.5.0, this code shoud move to TupleType::isImplicitlyConvertibleTo,
+			// but we cannot do it right now.
+			if (rhsType->components().size() != tupleType->components().size())
+			{
+				string message =
+					"Different number of components on the left hand side (" +
+					toString(tupleType->components().size()) +
+					") than on the right hand side (" +
+					toString(rhsType->components().size()) +
+					").";
+				if (v050)
+					m_errorReporter.typeError(_assignment.location(), message);
+				else
+					m_errorReporter.warning(_assignment.location(), message);
+			}
+		}
 	}
 	else if (t->category() == Type::Category::Mapping)
 	{
@@ -1406,8 +1449,10 @@ bool TypeChecker::visit(TupleExpression const& _tuple)
 	}
 	else
 	{
+		bool const v050 = m_scope->sourceUnit().annotation().experimentalFeatures.count(ExperimentalFeature::V050);
 		bool isPure = true;
 		TypePointer inlineArrayType;
+
 		for (size_t i = 0; i < components.size(); ++i)
 		{
 			// Outside of an lvalue-context, the only situation where a component can be empty is (x,).
@@ -1418,6 +1463,17 @@ bool TypeChecker::visit(TupleExpression const& _tuple)
 				components[i]->accept(*this);
 				types.push_back(type(*components[i]));
 
+				if (types[i]->category() == Type::Category::Tuple)
+					if (dynamic_cast<TupleType const&>(*types[i]).components().empty())
+					{
+						if (_tuple.isInlineArray())
+							m_errorReporter.fatalTypeError(components[i]->location(), "Array component cannot be empty.");
+						if (v050)
+							m_errorReporter.fatalTypeError(components[i]->location(), "Tuple component cannot be empty.");
+						else
+							m_errorReporter.warning(components[i]->location(), "Tuple component cannot be empty.");
+					}
+
 				// Note: code generation will visit each of the expression even if they are not assigned from.
 				if (types[i]->category() == Type::Category::RationalNumber && components.size() > 1)
 					if (!dynamic_cast<RationalNumberType const&>(*types[i]).mobileType())
@@ -1648,12 +1704,22 @@ bool TypeChecker::visit(FunctionCall const& _functionCall)
 	else
 		_functionCall.annotation().type = make_shared<TupleType>(returnTypes);
 
+	bool const v050 = m_scope->sourceUnit().annotation().experimentalFeatures.count(ExperimentalFeature::V050);
+
 	if (auto functionName = dynamic_cast<Identifier const*>(&_functionCall.expression()))
 	{
+		string msg;
 		if (functionName->name() == "sha3" && functionType->kind() == FunctionType::Kind::SHA3)
-			m_errorReporter.warning(_functionCall.location(), "\"sha3\" has been deprecated in favour of \"keccak256\"");
+			msg = "\"sha3\" has been deprecated in favour of \"keccak256\"";
 		else if (functionName->name() == "suicide" && functionType->kind() == FunctionType::Kind::Selfdestruct)
-			m_errorReporter.warning(_functionCall.location(), "\"suicide\" has been deprecated in favour of \"selfdestruct\"");
+			msg = "\"suicide\" has been deprecated in favour of \"selfdestruct\"";
+		if (!msg.empty())
+		{
+			if (v050)
+				m_errorReporter.typeError(_functionCall.location(), msg);
+			else
+				m_errorReporter.warning(_functionCall.location(), msg);
+		}
 	}
 	if (!m_insideEmitStatement && functionType->kind() == FunctionType::Kind::Event)
 	{
@@ -1674,18 +1740,55 @@ bool TypeChecker::visit(FunctionCall const& _functionCall)
 			{
 				/* If no mobile type is available an error will be raised elsewhere. */
 				if (literal->mobileType())
-					m_errorReporter.warning(
-						arguments[i]->location(),
-						"The type of \"" +
-						argType->toString() +
-						"\" was inferred as " +
-						literal->mobileType()->toString() +
-						". This is probably not desired. Use an explicit type to silence this warning."
-					);
+				{
+					if (v050)
+						m_errorReporter.typeError(
+							arguments[i]->location(),
+							"Cannot perform packed encoding for a literal. Please convert it to an explicit type first."
+						);
+					else
+						m_errorReporter.warning(
+							arguments[i]->location(),
+							"The type of \"" +
+							argType->toString() +
+							"\" was inferred as " +
+							literal->mobileType()->toString() +
+							". This is probably not desired. Use an explicit type to silence this warning."
+						);
+				}
 			}
 		}
 	}
 
+	if (functionType->takesSinglePackedBytesParameter())
+	{
+		if (
+			(arguments.size() > 1) ||
+			(arguments.size() == 1 && !type(*arguments.front())->isImplicitlyConvertibleTo(ArrayType(DataLocation::Memory)))
+		)
+		{
+			string msg =
+				"This function only accepts a single \"bytes\" argument. Please use "
+				"\"abi.encodePacked(...)\" or a similar function to encode the data.";
+			if (v050)
+				m_errorReporter.typeError(_functionCall.location(), msg);
+			else
+				m_errorReporter.warning(_functionCall.location(), msg);
+		}
+
+		if (arguments.size() == 1 && !type(*arguments.front())->isImplicitlyConvertibleTo(ArrayType(DataLocation::Memory)))
+		{
+			string msg =
+				"The provided argument of type " +
+				type(*arguments.front())->toString() +
+				" is not implicitly convertible to expected type bytes memory.";
+			if (v050)
+				m_errorReporter.typeError(_functionCall.location(), msg);
+			else
+				m_errorReporter.warning(_functionCall.location(), msg);
+		}
+	}
+
 	if (functionType->takesArbitraryParameters() && arguments.size() < parameterTypes.size())
 	{
 		solAssert(_functionCall.annotation().kind == FunctionCallKind::FunctionCall, "");
@@ -2019,6 +2122,9 @@ bool TypeChecker::visit(MemberAccess const& _memberAccess)
 	if (auto tt = dynamic_cast<TypeType const*>(exprType.get()))
 		if (tt->actualType()->category() == Type::Category::Enum)
 			annotation.isPure = true;
+	if (auto magicType = dynamic_cast<MagicType const*>(exprType.get()))
+		if (magicType->kind() == MagicType::Kind::ABI)
+			annotation.isPure = true;
 
 	return false;
 }
@@ -2202,6 +2308,7 @@ void TypeChecker::endVisit(Literal const& _literal)
 				"For more information please see https://solidity.readthedocs.io/en/develop/types.html#address-literals"
 			);
 	}
+
 	if (_literal.isHexNumber() && _literal.subDenomination() != Literal::SubDenomination::None)
 	{
 		if (v050)
@@ -2217,6 +2324,21 @@ void TypeChecker::endVisit(Literal const& _literal)
 				"You can use an expression of the form \"0x1234 * 1 day\" instead."
 			);
 	}
+
+	if (_literal.subDenomination() == Literal::SubDenomination::Year)
+	{
+		if (v050)
+			m_errorReporter.typeError(
+				_literal.location(),
+				"Using \"years\" as a unit denomination is deprecated."
+			);
+		else
+			m_errorReporter.warning(
+				_literal.location(),
+				"Using \"years\" as a unit denomination is deprecated."
+			);
+	}
+
 	if (!_literal.annotation().type)
 		_literal.annotation().type = Type::forLiteral(_literal);
 
diff --git a/libsolidity/ast/AST.h b/libsolidity/ast/AST.h
index a53987bf..fa0d6921 100644
--- a/libsolidity/ast/AST.h
+++ b/libsolidity/ast/AST.h
@@ -146,6 +146,7 @@ private:
 class Scopable
 {
 public:
+	virtual ~Scopable() = default;
 	/// @returns the scope this declaration resides in. Can be nullptr if it is the global scope.
 	/// Available only after name and type resolution step.
 	ASTNode const* scope() const { return m_scope; }
@@ -307,6 +308,7 @@ private:
 class VariableScope
 {
 public:
+	virtual ~VariableScope() = default;
 	void addLocalVariable(VariableDeclaration const& _localVariable) { m_localVariables.push_back(&_localVariable); }
 	std::vector<VariableDeclaration const*> const& localVariables() const { return m_localVariables; }
 
@@ -320,6 +322,7 @@ private:
 class Documented
 {
 public:
+	virtual ~Documented() = default;
 	explicit Documented(ASTPointer<ASTString> const& _documentation): m_documentation(_documentation) {}
 
 	/// @return A shared pointer of an ASTString.
@@ -336,6 +339,7 @@ protected:
 class ImplementationOptional
 {
 public:
+	virtual ~ImplementationOptional() = default;
 	explicit ImplementationOptional(bool _implemented): m_implemented(_implemented) {}
 
 	/// @return whether this node is fully implemented or not
diff --git a/libsolidity/ast/ASTVisitor.h b/libsolidity/ast/ASTVisitor.h
index b1389f0f..6c0ce6f8 100644
--- a/libsolidity/ast/ASTVisitor.h
+++ b/libsolidity/ast/ASTVisitor.h
@@ -43,6 +43,7 @@ namespace solidity
 class ASTVisitor
 {
 public:
+	virtual ~ASTVisitor() = default;
 	virtual bool visit(SourceUnit& _node) { return visitNode(_node); }
 	virtual bool visit(PragmaDirective& _node) { return visitNode(_node); }
 	virtual bool visit(ImportDirective& _node) { return visitNode(_node); }
@@ -147,6 +148,7 @@ protected:
 class ASTConstVisitor
 {
 public:
+	virtual ~ASTConstVisitor() = default;
 	virtual bool visit(SourceUnit const& _node) { return visitNode(_node); }
 	virtual bool visit(PragmaDirective const& _node) { return visitNode(_node); }
 	virtual bool visit(ImportDirective const& _node) { return visitNode(_node); }
diff --git a/libsolidity/ast/Types.cpp b/libsolidity/ast/Types.cpp
index 425e5045..60e3183c 100644
--- a/libsolidity/ast/Types.cpp
+++ b/libsolidity/ast/Types.cpp
@@ -425,14 +425,14 @@ bool isValidShiftAndAmountType(Token::Value _operator, Type const& _shiftAmountT
 
 }
 
-IntegerType::IntegerType(int _bits, IntegerType::Modifier _modifier):
+IntegerType::IntegerType(unsigned _bits, IntegerType::Modifier _modifier):
 	m_bits(_bits), m_modifier(_modifier)
 {
 	if (isAddress())
 		solAssert(m_bits == 160, "");
 	solAssert(
 		m_bits > 0 && m_bits <= 256 && m_bits % 8 == 0,
-		"Invalid bit number for integer type: " + dev::toString(_bits)
+		"Invalid bit number for integer type: " + dev::toString(m_bits)
 	);
 }
 
@@ -584,7 +584,7 @@ MemberList::MemberMap IntegerType::nativeMembers(ContractDefinition const*) cons
 {
 	if (isAddress())
 		return {
-			{"balance", make_shared<IntegerType >(256)},
+			{"balance", make_shared<IntegerType>(256)},
 			{"call", make_shared<FunctionType>(strings(), strings{"bool"}, FunctionType::Kind::BareCall, true, StateMutability::Payable)},
 			{"callcode", make_shared<FunctionType>(strings(), strings{"bool"}, FunctionType::Kind::BareCallCode, true, StateMutability::Payable)},
 			{"delegatecall", make_shared<FunctionType>(strings(), strings{"bool"}, FunctionType::Kind::BareDelegateCall, true)},
@@ -595,13 +595,12 @@ MemberList::MemberMap IntegerType::nativeMembers(ContractDefinition const*) cons
 		return MemberList::MemberMap();
 }
 
-FixedPointType::FixedPointType(int _totalBits, int _fractionalDigits, FixedPointType::Modifier _modifier):
+FixedPointType::FixedPointType(unsigned _totalBits, unsigned _fractionalDigits, FixedPointType::Modifier _modifier):
 	m_totalBits(_totalBits), m_fractionalDigits(_fractionalDigits), m_modifier(_modifier)
 {
 	solAssert(
-		8 <= m_totalBits && m_totalBits <= 256 && m_totalBits % 8 == 0 &&
-		0 <= m_fractionalDigits && m_fractionalDigits <= 80, 
-		"Invalid bit number(s) for fixed type: " + 
+		8 <= m_totalBits && m_totalBits <= 256 && m_totalBits % 8 == 0 && m_fractionalDigits <= 80,
+		"Invalid bit number(s) for fixed type: " +
 		dev::toString(_totalBits) + "x" + dev::toString(_fractionalDigits)
 	);
 }
@@ -627,8 +626,7 @@ bool FixedPointType::isImplicitlyConvertibleTo(Type const& _convertTo) const
 bool FixedPointType::isExplicitlyConvertibleTo(Type const& _convertTo) const
 {
 	return _convertTo.category() == category() ||
-		_convertTo.category() == Category::Integer ||
-		_convertTo.category() == Category::FixedBytes;
+		(_convertTo.category() == Category::Integer && !dynamic_cast<IntegerType const&>(_convertTo).isAddress());
 }
 
 TypePointer FixedPointType::unaryOperatorResult(Token::Value _operator) const
@@ -682,13 +680,7 @@ bigint FixedPointType::minIntegerValue() const
 
 TypePointer FixedPointType::binaryOperatorResult(Token::Value _operator, TypePointer const& _other) const
 {
-	if (
-		_other->category() != Category::RationalNumber &&
-		_other->category() != category() &&
-		_other->category() != Category::Integer
-	)
-		return TypePointer();
-	auto commonType = Type::commonType(shared_from_this(), _other); //might be fixed point or integer
+	auto commonType = Type::commonType(shared_from_this(), _other);
 
 	if (!commonType)
 		return TypePointer();
@@ -696,19 +688,16 @@ TypePointer FixedPointType::binaryOperatorResult(Token::Value _operator, TypePoi
 	// All fixed types can be compared
 	if (Token::isCompareOp(_operator))
 		return commonType;
-	if (Token::isBitOp(_operator) || Token::isBooleanOp(_operator))
+	if (Token::isBitOp(_operator) || Token::isBooleanOp(_operator) || _operator == Token::Exp)
 		return TypePointer();
-	if (auto fixType = dynamic_pointer_cast<FixedPointType const>(commonType))
-	{
-		if (Token::Exp == _operator)
-			return TypePointer();
-	}
-	else if (auto intType = dynamic_pointer_cast<IntegerType const>(commonType))
-		if (intType->isAddress())
-			return TypePointer();
 	return commonType;
 }
 
+std::shared_ptr<IntegerType> FixedPointType::asIntegerType() const
+{
+	return make_shared<IntegerType>(numBits(), isSigned() ? IntegerType::Modifier::Signed : IntegerType::Modifier::Unsigned);
+}
+
 tuple<bool, rational> RationalNumberType::parseRational(string const& _value)
 {
 	rational value;
@@ -860,7 +849,7 @@ bool RationalNumberType::isImplicitlyConvertibleTo(Type const& _convertTo) const
 		if (isFractional())
 			return false;
 		IntegerType const& targetType = dynamic_cast<IntegerType const&>(_convertTo);
-		int forSignBit = (targetType.isSigned() ? 1 : 0);
+		unsigned forSignBit = (targetType.isSigned() ? 1 : 0);
 		if (m_value > rational(0))
 		{
 			if (m_value.numerator() <= (u256(-1) >> (256 - targetType.numBits() + forSignBit)))
@@ -1148,7 +1137,7 @@ u256 RationalNumberType::literalValue(Literal const*) const
 		auto fixed = fixedPointType();
 		solAssert(fixed, "");
 		int fractionalDigits = fixed->fractionalDigits();
-		shiftedValue = (m_value.numerator() / m_value.denominator()) * pow(bigint(10), fractionalDigits);
+		shiftedValue = m_value.numerator() * pow(bigint(10), fractionalDigits) / m_value.denominator();
 	}
 
 	// we ignore the literal and hope that the type was correctly determined
@@ -1274,17 +1263,12 @@ bool StringLiteralType::isValidUTF8() const
 	return dev::validateUTF8(m_value);
 }
 
-shared_ptr<FixedBytesType> FixedBytesType::smallestTypeForLiteral(string const& _literal)
+FixedBytesType::FixedBytesType(unsigned _bytes): m_bytes(_bytes)
 {
-	if (_literal.length() <= 32)
-		return make_shared<FixedBytesType>(_literal.length());
-	return shared_ptr<FixedBytesType>();
-}
-
-FixedBytesType::FixedBytesType(int _bytes): m_bytes(_bytes)
-{
-	solAssert(m_bytes >= 0 && m_bytes <= 32,
-			  "Invalid byte number for fixed bytes type: " + dev::toString(m_bytes));
+	solAssert(
+		m_bytes > 0 && m_bytes <= 32,
+		"Invalid byte number for fixed bytes type: " + dev::toString(m_bytes)
+	);
 }
 
 bool FixedBytesType::isImplicitlyConvertibleTo(Type const& _convertTo) const
@@ -2881,7 +2865,11 @@ bool FunctionType::isPure() const
 		m_kind == Kind::RIPEMD160 ||
 		m_kind == Kind::AddMod ||
 		m_kind == Kind::MulMod ||
-		m_kind == Kind::ObjectCreation;
+		m_kind == Kind::ObjectCreation ||
+		m_kind == Kind::ABIEncode ||
+		m_kind == Kind::ABIEncodePacked ||
+		m_kind == Kind::ABIEncodeWithSelector ||
+		m_kind == Kind::ABIEncodeWithSignature;
 }
 
 TypePointers FunctionType::parseElementaryTypeVector(strings const& _types)
diff --git a/libsolidity/ast/Types.h b/libsolidity/ast/Types.h
index 345f84a1..95821634 100644
--- a/libsolidity/ast/Types.h
+++ b/libsolidity/ast/Types.h
@@ -138,6 +138,7 @@ private:
 class Type: private boost::noncopyable, public std::enable_shared_from_this<Type>
 {
 public:
+	virtual ~Type() = default;
 	enum class Category
 	{
 		Integer, RationalNumber, StringLiteral, Bool, FixedPoint, Array,
@@ -318,7 +319,7 @@ public:
 	};
 	virtual Category category() const override { return Category::Integer; }
 
-	explicit IntegerType(int _bits, Modifier _modifier = Modifier::Unsigned);
+	explicit IntegerType(unsigned _bits, Modifier _modifier = Modifier::Unsigned);
 
 	virtual std::string richIdentifier() const override;
 	virtual bool isImplicitlyConvertibleTo(Type const& _convertTo) const override;
@@ -341,7 +342,7 @@ public:
 	virtual TypePointer encodingType() const override { return shared_from_this(); }
 	virtual TypePointer interfaceType(bool) const override { return shared_from_this(); }
 
-	int numBits() const { return m_bits; }
+	unsigned numBits() const { return m_bits; }
 	bool isAddress() const { return m_modifier == Modifier::Address; }
 	bool isSigned() const { return m_modifier == Modifier::Signed; }
 
@@ -349,7 +350,7 @@ public:
 	bigint maxValue() const;
 
 private:
-	int m_bits;
+	unsigned m_bits;
 	Modifier m_modifier;
 };
 
@@ -365,7 +366,7 @@ public:
 	};
 	virtual Category category() const override { return Category::FixedPoint; }
 
-	explicit FixedPointType(int _totalBits, int _fractionalDigits, Modifier _modifier = Modifier::Unsigned);
+	explicit FixedPointType(unsigned _totalBits, unsigned _fractionalDigits, Modifier _modifier = Modifier::Unsigned);
 
 	virtual std::string richIdentifier() const override;
 	virtual bool isImplicitlyConvertibleTo(Type const& _convertTo) const override;
@@ -385,9 +386,9 @@ public:
 	virtual TypePointer interfaceType(bool) const override { return shared_from_this(); }
 
 	/// Number of bits used for this type in total.
-	int numBits() const { return m_totalBits; }
+	unsigned numBits() const { return m_totalBits; }
 	/// Number of decimal digits after the radix point.
-	int fractionalDigits() const { return m_fractionalDigits; }
+	unsigned fractionalDigits() const { return m_fractionalDigits; }
 	bool isSigned() const { return m_modifier == Modifier::Signed; }
 	/// @returns the largest integer value this type con hold. Note that this is not the
 	/// largest value in general.
@@ -396,9 +397,12 @@ public:
 	/// smallest value in general.
 	bigint minIntegerValue() const;
 
+	/// @returns the smallest integer type that can hold this type with fractional parts shifted to integers.
+	std::shared_ptr<IntegerType> asIntegerType() const;
+
 private:
-	int m_totalBits;
-	int m_fractionalDigits;
+	unsigned m_totalBits;
+	unsigned m_fractionalDigits;
 	Modifier m_modifier;
 };
 
@@ -502,11 +506,7 @@ class FixedBytesType: public Type
 public:
 	virtual Category category() const override { return Category::FixedBytes; }
 
-	/// @returns the smallest bytes type for the given literal or an empty pointer
-	/// if no type fits.
-	static std::shared_ptr<FixedBytesType> smallestTypeForLiteral(std::string const& _literal);
-
-	explicit FixedBytesType(int _bytes);
+	explicit FixedBytesType(unsigned _bytes);
 
 	virtual bool isImplicitlyConvertibleTo(Type const& _convertTo) const override;
 	virtual bool isExplicitlyConvertibleTo(Type const& _convertTo) const override;
@@ -524,10 +524,10 @@ public:
 	virtual TypePointer encodingType() const override { return shared_from_this(); }
 	virtual TypePointer interfaceType(bool) const override { return shared_from_this(); }
 
-	int numBytes() const { return m_bytes; }
+	unsigned numBytes() const { return m_bytes; }
 
 private:
-	int m_bytes;
+	unsigned m_bytes;
 };
 
 /**
@@ -1046,8 +1046,8 @@ public:
 		return *m_declaration;
 	}
 	bool hasDeclaration() const { return !!m_declaration; }
-	/// @returns true if the result of this function only depends on its arguments
-	/// and it does not modify the state.
+	/// @returns true if the result of this function only depends on its arguments,
+	/// does not modify the state and is a compile-time constant.
 	/// Currently, this will only return true for internal functions like keccak and ecrecover.
 	bool isPure() const;
 	bool isPayable() const { return m_stateMutability == StateMutability::Payable; }
@@ -1058,6 +1058,22 @@ public:
 	/// true iff arguments are to be padded to multiples of 32 bytes for external calls
 	bool padArguments() const { return !(m_kind == Kind::SHA3 || m_kind == Kind::SHA256 || m_kind == Kind::RIPEMD160 || m_kind == Kind::ABIEncodePacked); }
 	bool takesArbitraryParameters() const { return m_arbitraryParameters; }
+	/// true iff the function takes a single bytes parameter and it is passed on without padding.
+	/// @todo until 0.5.0, this is just a "recommendation".
+	bool takesSinglePackedBytesParameter() const
+	{
+		// @todo add the call kinds here with 0.5.0 and perhaps also log0.
+		switch (m_kind)
+		{
+		case FunctionType::Kind::SHA3:
+		case FunctionType::Kind::SHA256:
+		case FunctionType::Kind::RIPEMD160:
+			return true;
+		default:
+			return false;
+		}
+	}
+
 	bool gasSet() const { return m_gasSet; }
 	bool valueSet() const { return m_valueSet; }
 	bool bound() const { return m_bound; }
diff --git a/libsolidity/codegen/ABIFunctions.cpp b/libsolidity/codegen/ABIFunctions.cpp
index 8e890854..3e3aa0ae 100644
--- a/libsolidity/codegen/ABIFunctions.cpp
+++ b/libsolidity/codegen/ABIFunctions.cpp
@@ -371,7 +371,7 @@ string ABIFunctions::conversionFunction(Type const& _from, Type const& _to)
 			if (toCategory == Type::Category::Integer)
 				body =
 					Whiskers("converted := <convert>(<shift>(value))")
-					("shift", shiftRightFunction(256 - from.numBytes() * 8, false))
+					("shift", shiftRightFunction(256 - from.numBytes() * 8))
 					("convert", conversionFunction(IntegerType(from.numBytes() * 8), _to))
 					.render();
 			else
@@ -458,8 +458,8 @@ string ABIFunctions::splitExternalFunctionIdFunction()
 			}
 		)")
 		("functionName", functionName)
-		("shr32", shiftRightFunction(32, false))
-		("shr64", shiftRightFunction(64, false))
+		("shr32", shiftRightFunction(32))
+		("shr64", shiftRightFunction(64))
 		.render();
 	});
 }
@@ -831,7 +831,7 @@ string ABIFunctions::abiEncodingFunctionCompactStorageArray(
 			templ("encodeToMemoryFun", encodeToMemoryFun);
 			std::vector<std::map<std::string, std::string>> items(itemsPerSlot);
 			for (size_t i = 0; i < itemsPerSlot; ++i)
-				items[i]["shiftRightFun"] = shiftRightFunction(i * storageBytes * 8, false);
+				items[i]["shiftRightFun"] = shiftRightFunction(i * storageBytes * 8);
 			templ("items", items);
 			return templ.render();
 		}
@@ -927,7 +927,7 @@ string ABIFunctions::abiEncodingFunctionStruct(
 					}
 					else
 						memberTempl("preprocess", "");
-					memberTempl("retrieveValue", shiftRightFunction(intraSlotOffset * 8, false) + "(slotValue)");
+					memberTempl("retrieveValue", shiftRightFunction(intraSlotOffset * 8) + "(slotValue)");
 				}
 				else
 				{
@@ -1401,37 +1401,75 @@ string ABIFunctions::copyToMemoryFunction(bool _fromCalldata)
 
 string ABIFunctions::shiftLeftFunction(size_t _numBits)
 {
+	solAssert(_numBits < 256, "");
+
 	string functionName = "shift_left_" + to_string(_numBits);
-	return createFunction(functionName, [&]() {
-		solAssert(_numBits < 256, "");
-		return
-			Whiskers(R"(
-			function <functionName>(value) -> newValue {
-				newValue := mul(value, <multiplier>)
-			}
-			)")
-			("functionName", functionName)
-			("multiplier", toCompactHexWithPrefix(u256(1) << _numBits))
-			.render();
-	});
+	if (m_evmVersion.hasBitwiseShifting())
+	{
+		return createFunction(functionName, [&]() {
+			return
+				Whiskers(R"(
+				function <functionName>(value) -> newValue {
+					newValue := shl(<numBits>, value)
+				}
+				)")
+				("functionName", functionName)
+				("numBits", to_string(_numBits))
+				.render();
+		});
+	}
+	else
+	{
+		return createFunction(functionName, [&]() {
+			return
+				Whiskers(R"(
+				function <functionName>(value) -> newValue {
+					newValue := mul(value, <multiplier>)
+				}
+				)")
+				("functionName", functionName)
+				("multiplier", toCompactHexWithPrefix(u256(1) << _numBits))
+				.render();
+		});
+	}
 }
 
-string ABIFunctions::shiftRightFunction(size_t _numBits, bool _signed)
+string ABIFunctions::shiftRightFunction(size_t _numBits)
 {
-	string functionName = "shift_right_" + to_string(_numBits) + (_signed ? "_signed" : "_unsigned");
-	return createFunction(functionName, [&]() {
-		solAssert(_numBits < 256, "");
-		return
-			Whiskers(R"(
-			function <functionName>(value) -> newValue {
-				newValue := <div>(value, <multiplier>)
-			}
-			)")
-			("functionName", functionName)
-			("div", _signed ? "sdiv" : "div")
-			("multiplier", toCompactHexWithPrefix(u256(1) << _numBits))
-			.render();
-	});
+	solAssert(_numBits < 256, "");
+
+	// Note that if this is extended with signed shifts,
+	// the opcodes SAR and SDIV behave differently with regards to rounding!
+
+	string functionName = "shift_right_" + to_string(_numBits) + "_unsigned";
+	if (m_evmVersion.hasBitwiseShifting())
+	{
+		return createFunction(functionName, [&]() {
+			return
+				Whiskers(R"(
+				function <functionName>(value) -> newValue {
+					newValue := shr(<numBits>, value)
+				}
+				)")
+				("functionName", functionName)
+				("numBits", to_string(_numBits))
+				.render();
+		});
+	}
+	else
+	{
+		return createFunction(functionName, [&]() {
+			return
+				Whiskers(R"(
+				function <functionName>(value) -> newValue {
+					newValue := div(value, <multiplier>)
+				}
+				)")
+				("functionName", functionName)
+				("multiplier", toCompactHexWithPrefix(u256(1) << _numBits))
+				.render();
+		});
+	}
 }
 
 string ABIFunctions::roundUpFunction()
diff --git a/libsolidity/codegen/ABIFunctions.h b/libsolidity/codegen/ABIFunctions.h
index 2b582e84..db4d40f5 100644
--- a/libsolidity/codegen/ABIFunctions.h
+++ b/libsolidity/codegen/ABIFunctions.h
@@ -22,6 +22,8 @@
 
 #pragma once
 
+#include <libsolidity/interface/EVMVersion.h>
+
 #include <libsolidity/ast/ASTForward.h>
 
 #include <vector>
@@ -48,6 +50,8 @@ using TypePointers = std::vector<TypePointer>;
 class ABIFunctions
 {
 public:
+	explicit ABIFunctions(EVMVersion _evmVersion = EVMVersion{}) : m_evmVersion(_evmVersion) {}
+
 	/// @returns name of an assembly function to ABI-encode values of @a _givenTypes
 	/// into memory, converting the types to @a _targetTypes on the fly.
 	/// Parameters are: <headStart> <value_n> ... <value_1>, i.e.
@@ -191,7 +195,7 @@ private:
 	std::string copyToMemoryFunction(bool _fromCalldata);
 
 	std::string shiftLeftFunction(size_t _numBits);
-	std::string shiftRightFunction(size_t _numBits, bool _signed);
+	std::string shiftRightFunction(size_t _numBits);
 	/// @returns the name of a function that rounds its input to the next multiple
 	/// of 32 or the input if it is a multiple of 32.
 	std::string roundUpFunction();
@@ -225,6 +229,8 @@ private:
 
 	/// Map from function name to code for a multi-use function.
 	std::map<std::string, std::string> m_requestedFunctions;
+
+	EVMVersion m_evmVersion;
 };
 
 }
diff --git a/libsolidity/codegen/CompilerContext.h b/libsolidity/codegen/CompilerContext.h
index 098472f7..5776b5d1 100644
--- a/libsolidity/codegen/CompilerContext.h
+++ b/libsolidity/codegen/CompilerContext.h
@@ -55,7 +55,8 @@ public:
 	explicit CompilerContext(EVMVersion _evmVersion = EVMVersion{}, CompilerContext* _runtimeContext = nullptr):
 		m_asm(std::make_shared<eth::Assembly>()),
 		m_evmVersion(_evmVersion),
-		m_runtimeContext(_runtimeContext)
+		m_runtimeContext(_runtimeContext),
+		m_abiFunctions(m_evmVersion)
 	{
 		if (m_runtimeContext)
 			m_runtimeSub = size_t(m_asm->newSub(m_runtimeContext->m_asm).data());
diff --git a/libsolidity/codegen/CompilerUtils.cpp b/libsolidity/codegen/CompilerUtils.cpp
index 4af7d905..d9f17263 100644
--- a/libsolidity/codegen/CompilerUtils.cpp
+++ b/libsolidity/codegen/CompilerUtils.cpp
@@ -89,7 +89,6 @@ void CompilerUtils::revertWithStringData(Type const& _argumentType)
 	abiEncode({_argumentType.shared_from_this()}, {make_shared<ArrayType>(DataLocation::Memory, true)});
 	toSizeAfterFreeMemoryPointer();
 	m_context << Instruction::REVERT;
-	m_context.adjustStackOffset(_argumentType.sizeOnStack());
 }
 
 unsigned CompilerUtils::loadFromMemory(
@@ -110,7 +109,7 @@ void CompilerUtils::loadFromMemoryDynamic(
 	bool _padToWordBoundaries,
 	bool _keepUpdatedMemoryOffset
 )
-{		
+{
 	if (_keepUpdatedMemoryOffset)
 		m_context << Instruction::DUP1;
 
@@ -396,7 +395,7 @@ void CompilerUtils::encodeToMemory(
 			// leave end_of_mem as dyn head pointer
 			m_context << Instruction::DUP1 << u256(32) << Instruction::ADD;
 			dynPointers++;
-			solAssert((argSize + dynPointers) < 16, "Stack too deep, try using less variables.");
+			solAssert((argSize + dynPointers) < 16, "Stack too deep, try using fewer variables.");
 		}
 		else
 		{
@@ -599,15 +598,15 @@ void CompilerUtils::splitExternalFunctionType(bool _leftAligned)
 	if (_leftAligned)
 	{
 		m_context << Instruction::DUP1;
-		rightShiftNumberOnStack(64 + 32, false);
+		rightShiftNumberOnStack(64 + 32);
 		// <input> <address>
 		m_context << Instruction::SWAP1;
-		rightShiftNumberOnStack(64, false);
+		rightShiftNumberOnStack(64);
 	}
 	else
 	{
 		m_context << Instruction::DUP1;
-		rightShiftNumberOnStack(32, false);
+		rightShiftNumberOnStack(32);
 		m_context << ((u256(1) << 160) - 1) << Instruction::AND << Instruction::SWAP1;
 	}
 	m_context << u256(0xffffffffUL) << Instruction::AND;
@@ -675,7 +674,7 @@ void CompilerUtils::convertType(
 			// conversion from bytes to integer. no need to clean the high bit
 			// only to shift right because of opposite alignment
 			IntegerType const& targetIntegerType = dynamic_cast<IntegerType const&>(_targetType);
-			rightShiftNumberOnStack(256 - typeOnStack.numBytes() * 8, false);
+			rightShiftNumberOnStack(256 - typeOnStack.numBytes() * 8);
 			if (targetIntegerType.numBits() < typeOnStack.numBytes() * 8)
 				convertType(IntegerType(typeOnStack.numBytes() * 8), _targetType, _cleanupNeeded);
 		}
@@ -688,7 +687,7 @@ void CompilerUtils::convertType(
 				m_context << Instruction::POP << u256(0);
 			else if (targetType.numBytes() > typeOnStack.numBytes() || _cleanupNeeded)
 			{
-				int bytes = min(typeOnStack.numBytes(), targetType.numBytes());
+				unsigned bytes = min(typeOnStack.numBytes(), targetType.numBytes());
 				m_context << ((u256(1) << (256 - bytes * 8)) - 1);
 				m_context << Instruction::NOT << Instruction::AND;
 			}
@@ -741,7 +740,7 @@ void CompilerUtils::convertType(
 		else if (targetTypeCategory == Type::Category::FixedPoint)
 		{
 			solAssert(
-				stackTypeCategory == Type::Category::Integer || 
+				stackTypeCategory == Type::Category::Integer ||
 				stackTypeCategory == Type::Category::RationalNumber ||
 				stackTypeCategory == Type::Category::FixedPoint,
 				"Invalid conversion to FixedMxNType requested."
@@ -796,7 +795,7 @@ void CompilerUtils::convertType(
 		bytesConstRef data(value);
 		if (targetTypeCategory == Type::Category::FixedBytes)
 		{
-			int const numBytes = dynamic_cast<FixedBytesType const&>(_targetType).numBytes();
+			unsigned const numBytes = dynamic_cast<FixedBytesType const&>(_targetType).numBytes();
 			solAssert(data.size() <= 32, "");
 			m_context << (h256::Arith(h256(data, h256::AlignLeft)) & (~(u256(-1) >> (8 * numBytes))));
 		}
@@ -1242,7 +1241,7 @@ unsigned CompilerUtils::loadFromMemoryHelper(Type const& _type, bool _fromCallda
 		bool leftAligned = _type.category() == Type::Category::FixedBytes;
 		// add leading or trailing zeros by dividing/multiplying depending on alignment
 		int shiftFactor = (32 - numBytes) * 8;
-		rightShiftNumberOnStack(shiftFactor, false);
+		rightShiftNumberOnStack(shiftFactor);
 		if (leftAligned)
 			leftShiftNumberOnStack(shiftFactor);
 	}
@@ -1265,13 +1264,20 @@ void CompilerUtils::cleanHigherOrderBits(IntegerType const& _typeOnStack)
 void CompilerUtils::leftShiftNumberOnStack(unsigned _bits)
 {
 	solAssert(_bits < 256, "");
-	m_context << (u256(1) << _bits) << Instruction::MUL;
+	if (m_context.evmVersion().hasBitwiseShifting())
+		m_context << _bits << Instruction::SHL;
+	else
+		m_context << (u256(1) << _bits) << Instruction::MUL;
 }
 
-void CompilerUtils::rightShiftNumberOnStack(unsigned _bits, bool _isSigned)
+void CompilerUtils::rightShiftNumberOnStack(unsigned _bits)
 {
 	solAssert(_bits < 256, "");
-	m_context << (u256(1) << _bits) << Instruction::SWAP1 << (_isSigned ? Instruction::SDIV : Instruction::DIV);
+	// NOTE: If we add signed right shift, SAR rounds differently than SDIV
+	if (m_context.evmVersion().hasBitwiseShifting())
+		m_context << _bits << Instruction::SHR;
+	else
+		m_context << (u256(1) << _bits) << Instruction::SWAP1 << Instruction::DIV;
 }
 
 unsigned CompilerUtils::prepareMemoryStore(Type const& _type, bool _padToWords)
diff --git a/libsolidity/codegen/CompilerUtils.h b/libsolidity/codegen/CompilerUtils.h
index 476a7559..8e3a8a5d 100644
--- a/libsolidity/codegen/CompilerUtils.h
+++ b/libsolidity/codegen/CompilerUtils.h
@@ -254,7 +254,7 @@ public:
 	/// Helper function to shift top value on the stack to the right.
 	/// Stack pre: <value> <shift_by_bits>
 	/// Stack post: <shifted_value>
-	void rightShiftNumberOnStack(unsigned _bits, bool _isSigned = false);
+	void rightShiftNumberOnStack(unsigned _bits);
 
 	/// Appends code that computes tha Keccak-256 hash of the topmost stack element of 32 byte type.
 	void computeHashStatic();
diff --git a/libsolidity/codegen/ExpressionCompiler.cpp b/libsolidity/codegen/ExpressionCompiler.cpp
index 3cf46a9d..4bcc1fa9 100644
--- a/libsolidity/codegen/ExpressionCompiler.cpp
+++ b/libsolidity/codegen/ExpressionCompiler.cpp
@@ -548,7 +548,7 @@ bool ExpressionCompiler::visit(FunctionCall const& _functionCall)
 
 			if (m_context.runtimeContext())
 				// We have a runtime context, so we need the creation part.
-				utils().rightShiftNumberOnStack(32, false);
+				utils().rightShiftNumberOnStack(32);
 			else
 				// Extract the runtime part.
 				m_context << ((u256(1) << 32) - 1) << Instruction::AND;
@@ -933,7 +933,11 @@ bool ExpressionCompiler::visit(FunctionCall const& _functionCall)
 				// condition was not met, flag an error
 				m_context.appendInvalid();
 			else if (arguments.size() > 1)
+			{
 				utils().revertWithStringData(*arguments.at(1)->annotation().type);
+				// Here, the argument is consumed, but in the other branch, it is still there.
+				m_context.adjustStackOffset(arguments.at(1)->annotation().type->sizeOnStack());
+			}
 			else
 				m_context.appendRevert();
 			// the success branch
@@ -1706,13 +1710,23 @@ void ExpressionCompiler::appendShiftOperatorCode(Token::Value _operator, Type co
 		m_context.appendConditionalInvalid();
 	}
 
+	m_context << Instruction::SWAP1;
+	// stack: value_to_shift shift_amount
+
 	switch (_operator)
 	{
 	case Token::SHL:
-		m_context << Instruction::SWAP1 << u256(2) << Instruction::EXP << Instruction::MUL;
+		if (m_context.evmVersion().hasBitwiseShifting())
+			m_context << Instruction::SHL;
+		else
+			m_context << u256(2) << Instruction::EXP << Instruction::MUL;
 		break;
 	case Token::SAR:
-		m_context << Instruction::SWAP1 << u256(2) << Instruction::EXP << Instruction::SWAP1 << (c_valueSigned ? Instruction::SDIV : Instruction::DIV);
+		// NOTE: SAR rounds differently than SDIV
+		if (m_context.evmVersion().hasBitwiseShifting() && !c_valueSigned)
+			m_context << Instruction::SHR;
+		else
+			m_context << u256(2) << Instruction::EXP << Instruction::SWAP1 << (c_valueSigned ? Instruction::SDIV : Instruction::DIV);
 		break;
 	case Token::SHR:
 	default:
diff --git a/libsolidity/codegen/LValue.cpp b/libsolidity/codegen/LValue.cpp
index e19cf41e..77684683 100644
--- a/libsolidity/codegen/LValue.cpp
+++ b/libsolidity/codegen/LValue.cpp
@@ -267,7 +267,7 @@ void StorageItem::storeValue(Type const& _sourceType, SourceLocation const& _loc
 			else if (m_dataType->category() == Type::Category::FixedBytes)
 			{
 				solAssert(_sourceType.category() == Type::Category::FixedBytes, "source not fixed bytes");
-				CompilerUtils(m_context).rightShiftNumberOnStack(256 - 8 * dynamic_cast<FixedBytesType const&>(*m_dataType).numBytes(), false);
+				CompilerUtils(m_context).rightShiftNumberOnStack(256 - 8 * dynamic_cast<FixedBytesType const&>(*m_dataType).numBytes());
 			}
 			else
 			{
diff --git a/libsolidity/codegen/LValue.h b/libsolidity/codegen/LValue.h
index f8b68362..c576f9de 100644
--- a/libsolidity/codegen/LValue.h
+++ b/libsolidity/codegen/LValue.h
@@ -49,6 +49,7 @@ protected:
 		m_context(_compilerContext), m_dataType(_dataType) {}
 
 public:
+	virtual ~LValue() {}
 	/// @returns the number of stack slots occupied by the lvalue reference
 	virtual unsigned sizeOnStack() const { return 1; }
 	/// Copies the value of the current lvalue to the top of the stack and, if @a _remove is true,
diff --git a/libsolidity/formal/SMTChecker.cpp b/libsolidity/formal/SMTChecker.cpp
index 777e57c3..425c5c1e 100644
--- a/libsolidity/formal/SMTChecker.cpp
+++ b/libsolidity/formal/SMTChecker.cpp
@@ -58,6 +58,19 @@ void SMTChecker::analyze(SourceUnit const& _source)
 		_source.accept(*this);
 }
 
+bool SMTChecker::visit(ContractDefinition const& _contract)
+{
+	for (auto _var : _contract.stateVariables())
+		if (_var->type()->isValueType())
+			createVariable(*_var);
+	return true;
+}
+
+void SMTChecker::endVisit(ContractDefinition const&)
+{
+	m_stateVariables.clear();
+}
+
 void SMTChecker::endVisit(VariableDeclaration const& _varDecl)
 {
 	if (_varDecl.isLocalVariable() && _varDecl.type()->isValueType() &&_varDecl.value())
@@ -72,13 +85,13 @@ bool SMTChecker::visit(FunctionDefinition const& _function)
 			"Assertion checker does not yet support constructors and functions with modifiers."
 		);
 	m_currentFunction = &_function;
-	// We only handle local variables, so we clear at the beginning of the function.
-	// If we add storage variables, those should be cleared differently.
 	m_interface->reset();
 	m_variables.clear();
+	m_variables.insert(m_stateVariables.begin(), m_stateVariables.end());
 	m_pathConditions.clear();
-	m_conditionalExecutionHappened = false;
+	m_loopExecutionHappened = false;
 	initializeLocalVariables(_function);
+	resetStateVariables();
 	return true;
 }
 
@@ -132,6 +145,7 @@ bool SMTChecker::visit(WhileStatement const& _node)
 
 		visitBranch(_node.body(), expr(_node.condition()));
 	}
+	m_loopExecutionHappened = true;
 	resetVariables(touchedVariables);
 
 	return false;
@@ -171,7 +185,7 @@ bool SMTChecker::visit(ForStatement const& _node)
 
 	m_interface->pop();
 
-	m_conditionalExecutionHappened = true;
+	m_loopExecutionHappened = true;
 	std::swap(sequenceCountersStart, m_variables);
 
 	resetVariables(touchedVariables);
@@ -548,7 +562,6 @@ SMTChecker::VariableSequenceCounters SMTChecker::visitBranch(Statement const& _s
 	if (_condition)
 		popPathCondition();
 
-	m_conditionalExecutionHappened = true;
 	std::swap(m_variables, beforeVars);
 
 	return beforeVars;
@@ -586,15 +599,21 @@ void SMTChecker::checkCondition(
 				expressionsToEvaluate.emplace_back(currentValue(*var));
 				expressionNames.push_back(var->name());
 			}
+		for (auto const& var: m_stateVariables)
+			if (knownVariable(*var.first))
+			{
+				expressionsToEvaluate.emplace_back(currentValue(*var.first));
+				expressionNames.push_back(var.first->name());
+			}
 	}
 	smt::CheckResult result;
 	vector<string> values;
 	tie(result, values) = checkSatisfiableAndGenerateModel(expressionsToEvaluate);
 
-	string conditionalComment;
-	if (m_conditionalExecutionHappened)
-		conditionalComment =
-			"\nNote that some information is erased after conditional execution of parts of the code.\n"
+	string loopComment;
+	if (m_loopExecutionHappened)
+		loopComment =
+			"\nNote that some information is erased after the execution of loops.\n"
 			"You can re-introduce information using require().";
 	switch (result)
 	{
@@ -607,17 +626,18 @@ void SMTChecker::checkCondition(
 			message << " for:\n";
 			solAssert(values.size() == expressionNames.size(), "");
 			for (size_t i = 0; i < values.size(); ++i)
-				message << "  " << expressionNames.at(i) << " = " << values.at(i) << "\n";
+				if (expressionsToEvaluate.at(i).name != values.at(i))
+					message << "  " << expressionNames.at(i) << " = " << values.at(i) << "\n";
 		}
 		else
 			message << ".";
-		m_errorReporter.warning(_location, message.str() + conditionalComment);
+		m_errorReporter.warning(_location, message.str() + loopComment);
 		break;
 	}
 	case smt::CheckResult::UNSATISFIABLE:
 		break;
 	case smt::CheckResult::UNKNOWN:
-		m_errorReporter.warning(_location, _description + " might happen here." + conditionalComment);
+		m_errorReporter.warning(_location, _description + " might happen here." + loopComment);
 		break;
 	case smt::CheckResult::ERROR:
 		m_errorReporter.warning(_location, "Error trying to invoke SMT solver.");
@@ -722,6 +742,15 @@ void SMTChecker::initializeLocalVariables(FunctionDefinition const& _function)
 				setZeroValue(*retParam);
 }
 
+void SMTChecker::resetStateVariables()
+{
+	for (auto const& variable: m_stateVariables)
+	{
+		newValue(*variable.first);
+		setUnknownValue(*variable.first);
+	}
+}
+
 void SMTChecker::resetVariables(vector<Declaration const*> _variables)
 {
 	for (auto const* decl: _variables)
@@ -752,7 +781,14 @@ bool SMTChecker::createVariable(VariableDeclaration const& _varDecl)
 	if (SSAVariable::isSupportedType(_varDecl.type()->category()))
 	{
 		solAssert(m_variables.count(&_varDecl) == 0, "");
-		m_variables.emplace(&_varDecl, SSAVariable(_varDecl, *m_interface));
+		solAssert(m_stateVariables.count(&_varDecl) == 0, "");
+		if (_varDecl.isLocalVariable())
+			m_variables.emplace(&_varDecl, SSAVariable(_varDecl, *m_interface));
+		else
+		{
+			solAssert(_varDecl.isStateVariable(), "");
+			m_stateVariables.emplace(&_varDecl, SSAVariable(_varDecl, *m_interface));
+		}
 		return true;
 	}
 	else
diff --git a/libsolidity/formal/SMTChecker.h b/libsolidity/formal/SMTChecker.h
index 7e7996cf..50d40ab9 100644
--- a/libsolidity/formal/SMTChecker.h
+++ b/libsolidity/formal/SMTChecker.h
@@ -50,6 +50,8 @@ private:
 	// because the order of expression evaluation is undefined
 	// TODO: or just force a certain order, but people might have a different idea about that.
 
+	virtual bool visit(ContractDefinition const& _node) override;
+	virtual void endVisit(ContractDefinition const& _node) override;
 	virtual void endVisit(VariableDeclaration const& _node) override;
 	virtual bool visit(FunctionDefinition const& _node) override;
 	virtual void endVisit(FunctionDefinition const& _node) override;
@@ -111,6 +113,7 @@ private:
 	smt::CheckResult checkSatisfiable();
 
 	void initializeLocalVariables(FunctionDefinition const& _function);
+	void resetStateVariables();
 	void resetVariables(std::vector<Declaration const*> _variables);
 	/// Given two different branches and the touched variables,
 	/// merge the touched variables into after-branch ite variables
@@ -160,9 +163,10 @@ private:
 
 	std::shared_ptr<smt::SolverInterface> m_interface;
 	std::shared_ptr<VariableUsage> m_variableUsage;
-	bool m_conditionalExecutionHappened = false;
+	bool m_loopExecutionHappened = false;
 	std::map<Expression const*, smt::Expression> m_expressions;
 	std::map<Declaration const*, SSAVariable> m_variables;
+	std::map<Declaration const*, SSAVariable> m_stateVariables;
 	std::vector<smt::Expression> m_pathConditions;
 	ErrorReporter& m_errorReporter;
 
diff --git a/libsolidity/formal/SolverInterface.h b/libsolidity/formal/SolverInterface.h
index e127bb55..16796684 100644
--- a/libsolidity/formal/SolverInterface.h
+++ b/libsolidity/formal/SolverInterface.h
@@ -193,6 +193,7 @@ DEV_SIMPLE_EXCEPTION(SolverError);
 class SolverInterface
 {
 public:
+	virtual ~SolverInterface() = default;
 	virtual void reset() = 0;
 
 	virtual void push() = 0;
diff --git a/libsolidity/formal/SymbolicVariable.h b/libsolidity/formal/SymbolicVariable.h
index e4e4ea8d..e29ded26 100644
--- a/libsolidity/formal/SymbolicVariable.h
+++ b/libsolidity/formal/SymbolicVariable.h
@@ -40,6 +40,7 @@ public:
 		Declaration const& _decl,
 		smt::SolverInterface& _interface
 	);
+	virtual ~SymbolicVariable() = default;
 
 	smt::Expression operator()(int _seq) const
 	{
diff --git a/libsolidity/formal/VariableUsage.cpp b/libsolidity/formal/VariableUsage.cpp
index 4e96059d..c2dea844 100644
--- a/libsolidity/formal/VariableUsage.cpp
+++ b/libsolidity/formal/VariableUsage.cpp
@@ -33,7 +33,6 @@ VariableUsage::VariableUsage(ASTNode const& _node)
 			solAssert(declaration, "");
 			if (VariableDeclaration const* varDecl = dynamic_cast<VariableDeclaration const*>(declaration))
 				if (
-					varDecl->isLocalVariable() &&
 					identifier->annotation().lValueRequested &&
 					varDecl->annotation().type->isValueType()
 				)
diff --git a/libsolidity/inlineasm/AsmAnalysis.cpp b/libsolidity/inlineasm/AsmAnalysis.cpp
index abf7ddf2..9f505889 100644
--- a/libsolidity/inlineasm/AsmAnalysis.cpp
+++ b/libsolidity/inlineasm/AsmAnalysis.cpp
@@ -54,6 +54,7 @@ bool AsmAnalyzer::analyze(Block const& _block)
 
 bool AsmAnalyzer::operator()(Label const& _label)
 {
+	solAssert(!_label.name.empty(), "");
 	checkLooseFeature(
 		_label.location,
 		"The use of labels is deprecated. Please use \"if\", \"switch\", \"for\" or function calls instead."
@@ -107,6 +108,7 @@ bool AsmAnalyzer::operator()(assembly::Literal const& _literal)
 
 bool AsmAnalyzer::operator()(assembly::Identifier const& _identifier)
 {
+	solAssert(!_identifier.name.empty(), "");
 	size_t numErrorsBefore = m_errorReporter.errors().size();
 	bool success = true;
 	if (m_currentScope->lookup(_identifier.name, Scope::Visitor(
@@ -208,6 +210,7 @@ bool AsmAnalyzer::operator()(assembly::StackAssignment const& _assignment)
 
 bool AsmAnalyzer::operator()(assembly::Assignment const& _assignment)
 {
+	solAssert(_assignment.value, "");
 	int const expectedItems = _assignment.variableNames.size();
 	solAssert(expectedItems >= 1, "");
 	int const stackHeight = m_stackHeight;
@@ -259,6 +262,7 @@ bool AsmAnalyzer::operator()(assembly::VariableDeclaration const& _varDecl)
 
 bool AsmAnalyzer::operator()(assembly::FunctionDefinition const& _funDef)
 {
+	solAssert(!_funDef.name.empty(), "");
 	Block const* virtualBlock = m_info.virtualBlocks.at(&_funDef).get();
 	solAssert(virtualBlock, "");
 	Scope& varScope = scope(virtualBlock);
@@ -280,6 +284,7 @@ bool AsmAnalyzer::operator()(assembly::FunctionDefinition const& _funDef)
 
 bool AsmAnalyzer::operator()(assembly::FunctionCall const& _funCall)
 {
+	solAssert(!_funCall.functionName.name.empty(), "");
 	bool success = true;
 	size_t arguments = 0;
 	size_t returns = 0;
@@ -349,6 +354,8 @@ bool AsmAnalyzer::operator()(If const& _if)
 
 bool AsmAnalyzer::operator()(Switch const& _switch)
 {
+	solAssert(_switch.expression, "");
+
 	bool success = true;
 
 	if (!expectExpression(*_switch.expression))
@@ -391,6 +398,8 @@ bool AsmAnalyzer::operator()(Switch const& _switch)
 
 bool AsmAnalyzer::operator()(assembly::ForLoop const& _for)
 {
+	solAssert(_for.condition, "");
+
 	Scope* originalScope = m_currentScope;
 
 	bool success = true;
@@ -478,6 +487,7 @@ bool AsmAnalyzer::expectDeposit(int _deposit, int _oldHeight, SourceLocation con
 
 bool AsmAnalyzer::checkAssignment(assembly::Identifier const& _variable, size_t _valueSize)
 {
+	solAssert(!_variable.name.empty(), "");
 	bool success = true;
 	size_t numErrorsBefore = m_errorReporter.errors().size();
 	size_t variableSize(-1);
diff --git a/libsolidity/inlineasm/AsmParser.cpp b/libsolidity/inlineasm/AsmParser.cpp
index 7f618e07..d3b0808b 100644
--- a/libsolidity/inlineasm/AsmParser.cpp
+++ b/libsolidity/inlineasm/AsmParser.cpp
@@ -276,7 +276,7 @@ assembly::Expression Parser::parseExpression()
 		int args = instructionInfo(instr.instruction).args;
 		if (args > 0 && currentToken() != Token::LParen)
 			fatalParserError(string(
-				"Expected token \"(\" (\"" +
+				"Expected '(' (instruction \"" +
 				instructionNames().at(instr.instruction) +
 				"\" expects " +
 				boost::lexical_cast<string>(args) +
@@ -504,7 +504,7 @@ assembly::Expression Parser::parseCall(Parser::ElementaryOperation&& _initialOp)
 			/// check for premature closing parentheses
 			if (currentToken() == Token::RParen)
 				fatalParserError(string(
-					"Expected expression (\"" +
+					"Expected expression (instruction \"" +
 					instructionNames().at(instr) +
 					"\" expects " +
 					boost::lexical_cast<string>(args) +
@@ -516,7 +516,7 @@ assembly::Expression Parser::parseCall(Parser::ElementaryOperation&& _initialOp)
 			{
 				if (currentToken() != Token::Comma)
 					fatalParserError(string(
-						"Expected comma (\"" +
+						"Expected ',' (instruction \"" +
 						instructionNames().at(instr) +
 						"\" expects " +
 						boost::lexical_cast<string>(args) +
@@ -529,7 +529,7 @@ assembly::Expression Parser::parseCall(Parser::ElementaryOperation&& _initialOp)
 		ret.location.end = endPosition();
 		if (currentToken() == Token::Comma)
 			fatalParserError(string(
-				"Expected ')' (\"" +
+				"Expected ')' (instruction \"" +
 				instructionNames().at(instr) +
 				"\" expects " +
 				boost::lexical_cast<string>(args) +
diff --git a/libsolidity/interface/CompilerStack.cpp b/libsolidity/interface/CompilerStack.cpp
index 4ff14aa2..47dc30cf 100644
--- a/libsolidity/interface/CompilerStack.cpp
+++ b/libsolidity/interface/CompilerStack.cpp
@@ -29,6 +29,8 @@
 #include <libsolidity/ast/AST.h>
 #include <libsolidity/parsing/Scanner.h>
 #include <libsolidity/parsing/Parser.h>
+#include <libsolidity/analysis/ControlFlowAnalyzer.h>
+#include <libsolidity/analysis/ControlFlowGraph.h>
 #include <libsolidity/analysis/GlobalContext.h>
 #include <libsolidity/analysis/NameAndTypeResolver.h>
 #include <libsolidity/analysis/TypeChecker.h>
@@ -224,6 +226,22 @@ bool CompilerStack::analyze()
 
 		if (noErrors)
 		{
+			CFG cfg(m_errorReporter);
+			for (Source const* source: m_sourceOrder)
+				if (!cfg.constructFlow(*source->ast))
+					noErrors = false;
+
+			if (noErrors)
+			{
+				ControlFlowAnalyzer controlFlowAnalyzer(cfg, m_errorReporter);
+				for (Source const* source: m_sourceOrder)
+					if (!controlFlowAnalyzer.analyze(*source->ast))
+						noErrors = false;
+			}
+		}
+
+		if (noErrors)
+		{
 			StaticAnalyzer staticAnalyzer(m_errorReporter);
 			for (Source const* source: m_sourceOrder)
 				if (!staticAnalyzer.analyze(*source->ast))
diff --git a/libsolidity/interface/GasEstimator.cpp b/libsolidity/interface/GasEstimator.cpp
index a496cc21..a532f86e 100644
--- a/libsolidity/interface/GasEstimator.cpp
+++ b/libsolidity/interface/GasEstimator.cpp
@@ -136,13 +136,22 @@ GasEstimator::GasConsumption GasEstimator::functionalEstimation(
 		ExpressionClasses& classes = state->expressionClasses();
 		using Id = ExpressionClasses::Id;
 		using Ids = vector<Id>;
-		// div(calldataload(0), 1 << 224) equals to hashValue
 		Id hashValue = classes.find(u256(FixedHash<4>::Arith(FixedHash<4>(dev::keccak256(_signature)))));
 		Id calldata = classes.find(Instruction::CALLDATALOAD, Ids{classes.find(u256(0))});
-		classes.forceEqual(hashValue, Instruction::DIV, Ids{
-			calldata,
-			classes.find(u256(1) << 224)
-		});
+		if (!m_evmVersion.hasBitwiseShifting())
+			// div(calldataload(0), 1 << 224) equals to hashValue
+			classes.forceEqual(
+				hashValue,
+				Instruction::DIV,
+				Ids{calldata, classes.find(u256(1) << 224)}
+			);
+		else
+			// shr(0xe0, calldataload(0)) equals to hashValue
+			classes.forceEqual(
+				hashValue,
+				Instruction::SHR,
+				Ids{classes.find(u256(0xe0)), calldata}
+			);
 		// lt(calldatasize(), 4) equals to 0 (ignore the shortcut for fallback functions)
 		classes.forceEqual(
 			classes.find(u256(0)),
diff --git a/libsolidity/parsing/DocStringParser.cpp b/libsolidity/parsing/DocStringParser.cpp
index d058d556..d9588e5c 100644
--- a/libsolidity/parsing/DocStringParser.cpp
+++ b/libsolidity/parsing/DocStringParser.cpp
@@ -72,7 +72,7 @@ bool DocStringParser::parse(string const& _docString, ErrorReporter& _errorRepor
 			auto tagNameEndPos = firstWhitespaceOrNewline(tagPos, end);
 			if (tagNameEndPos == end)
 			{
-				appendError("End of tag " + string(tagPos, tagNameEndPos) + "not found");
+				appendError("End of tag " + string(tagPos, tagNameEndPos) + " not found");
 				break;
 			}
 
diff --git a/libsolidity/parsing/Parser.cpp b/libsolidity/parsing/Parser.cpp
index 618a0896..e2e1eebc 100644
--- a/libsolidity/parsing/Parser.cpp
+++ b/libsolidity/parsing/Parser.cpp
@@ -54,6 +54,7 @@ public:
 	template <class NodeType, typename... Args>
 	ASTPointer<NodeType> createNode(Args&& ... _args)
 	{
+		solAssert(m_location.sourceName, "");
 		if (m_location.end < 0)
 			markEndPosition();
 		return make_shared<NodeType>(m_location, forward<Args>(_args)...);
@@ -528,7 +529,7 @@ ASTPointer<EnumDefinition> Parser::parseEnumDefinition()
 			break;
 		expectToken(Token::Comma);
 		if (m_scanner->currentToken() != Token::Identifier)
-			fatalParserError(string("Expected Identifier after ','"));
+			fatalParserError(string("Expected identifier after ','"));
 	}
 	if (members.size() == 0)
 		parserError({"enum with no members is not allowed."});
@@ -1057,16 +1058,16 @@ ASTPointer<EmitStatement> Parser::parseEmitStatement(ASTPointer<ASTString> const
 	if (m_scanner->currentToken() != Token::Identifier)
 		fatalParserError("Expected event name or path.");
 
-	vector<ASTPointer<PrimaryExpression>> path;
+	IndexAccessedPath iap;
 	while (true)
 	{
-		path.push_back(parseIdentifier());
+		iap.path.push_back(parseIdentifier());
 		if (m_scanner->currentToken() != Token::Period)
 			break;
 		m_scanner->next();
 	};
 
-	auto eventName = expressionFromIndexAccessStructure(path, {});
+	auto eventName = expressionFromIndexAccessStructure(iap);
 	expectToken(Token::LParen);
 
 	vector<ASTPointer<Expression>> arguments;
@@ -1083,61 +1084,124 @@ ASTPointer<EmitStatement> Parser::parseEmitStatement(ASTPointer<ASTString> const
 ASTPointer<Statement> Parser::parseSimpleStatement(ASTPointer<ASTString> const& _docString)
 {
 	RecursionGuard recursionGuard(*this);
+	LookAheadInfo statementType;
+	IndexAccessedPath iap;
+
+	if (m_scanner->currentToken() == Token::LParen)
+	{
+		ASTNodeFactory nodeFactory(*this);
+		size_t emptyComponents = 0;
+		// First consume all empty components.
+		expectToken(Token::LParen);
+		while (m_scanner->currentToken() == Token::Comma)
+		{
+			m_scanner->next();
+			emptyComponents++;
+		}
+
+		// Now see whether we have a variable declaration or an expression.
+		tie(statementType, iap) = tryParseIndexAccessedPath();
+		switch (statementType)
+		{
+		case LookAheadInfo::VariableDeclaration:
+		{
+			vector<ASTPointer<VariableDeclaration>> variables;
+			ASTPointer<Expression> value;
+			// We have already parsed something like `(,,,,a.b.c[2][3]`
+			VarDeclParserOptions options;
+			options.allowLocationSpecifier = true;
+			variables = vector<ASTPointer<VariableDeclaration>>(emptyComponents, nullptr);
+			variables.push_back(parseVariableDeclaration(options, typeNameFromIndexAccessStructure(iap)));
+
+			while (m_scanner->currentToken() != Token::RParen)
+			{
+				expectToken(Token::Comma);
+				if (m_scanner->currentToken() == Token::Comma || m_scanner->currentToken() == Token::RParen)
+					variables.push_back(nullptr);
+				else
+					variables.push_back(parseVariableDeclaration(options));
+			}
+			expectToken(Token::RParen);
+			expectToken(Token::Assign);
+			value = parseExpression();
+			nodeFactory.setEndPositionFromNode(value);
+			return nodeFactory.createNode<VariableDeclarationStatement>(_docString, variables, value);
+		}
+		case LookAheadInfo::Expression:
+		{
+			// Complete parsing the expression in the current component.
+			vector<ASTPointer<Expression>> components(emptyComponents, nullptr);
+			components.push_back(parseExpression(expressionFromIndexAccessStructure(iap)));
+			while (m_scanner->currentToken() != Token::RParen)
+			{
+				expectToken(Token::Comma);
+				if (m_scanner->currentToken() == Token::Comma || m_scanner->currentToken() == Token::RParen)
+					components.push_back(ASTPointer<Expression>());
+				else
+					components.push_back(parseExpression());
+			}
+			nodeFactory.markEndPosition();
+			expectToken(Token::RParen);
+			return parseExpressionStatement(_docString, nodeFactory.createNode<TupleExpression>(components, false));
+		}
+		default:
+			solAssert(false, "");
+		}
+	}
+	else
+	{
+		tie(statementType, iap) = tryParseIndexAccessedPath();
+		switch (statementType)
+		{
+		case LookAheadInfo::VariableDeclaration:
+			return parseVariableDeclarationStatement(_docString, typeNameFromIndexAccessStructure(iap));
+		case LookAheadInfo::Expression:
+			return parseExpressionStatement(_docString, expressionFromIndexAccessStructure(iap));
+		default:
+			solAssert(false, "");
+		}
+	}
+}
+
+bool Parser::IndexAccessedPath::empty() const
+{
+	if (!indices.empty())
+	{
+		solAssert(!path.empty(), "");
+	}
+	return path.empty() && indices.empty();
+}
+
+
+pair<Parser::LookAheadInfo, Parser::IndexAccessedPath> Parser::tryParseIndexAccessedPath()
+{
 	// These two cases are very hard to distinguish:
-	// x[7 * 20 + 3] a;  -  x[7 * 20 + 3] = 9;
+	// x[7 * 20 + 3] a;     and     x[7 * 20 + 3] = 9;
 	// In the first case, x is a type name, in the second it is the name of a variable.
 	// As an extension, we can even have:
 	// `x.y.z[1][2] a;` and `x.y.z[1][2] = 10;`
 	// Where in the first, x.y.z leads to a type name where in the second, it accesses structs.
-	switch (peekStatementType())
+
+	auto statementType = peekStatementType();
+	switch (statementType)
 	{
-	case LookAheadInfo::VariableDeclarationStatement:
-		return parseVariableDeclarationStatement(_docString);
-	case LookAheadInfo::ExpressionStatement:
-		return parseExpressionStatement(_docString);
+	case LookAheadInfo::VariableDeclaration:
+	case LookAheadInfo::Expression:
+		return make_pair(statementType, IndexAccessedPath());
 	default:
 		break;
 	}
+
 	// At this point, we have 'Identifier "["' or 'Identifier "." Identifier' or 'ElementoryTypeName "["'.
-	// We parse '(Identifier ("." Identifier)* |ElementaryTypeName) ( "[" Expression "]" )+'
+	// We parse '(Identifier ("." Identifier)* |ElementaryTypeName) ( "[" Expression "]" )*'
 	// until we can decide whether to hand this over to ExpressionStatement or create a
 	// VariableDeclarationStatement out of it.
-	vector<ASTPointer<PrimaryExpression>> path;
-	bool startedWithElementary = false;
-	if (m_scanner->currentToken() == Token::Identifier)
-		path.push_back(parseIdentifier());
-	else
-	{
-		startedWithElementary = true;
-		unsigned firstNum;
-		unsigned secondNum;
-		tie(firstNum, secondNum) = m_scanner->currentTokenInfo();
-		ElementaryTypeNameToken elemToken(m_scanner->currentToken(), firstNum, secondNum);
-		path.push_back(ASTNodeFactory(*this).createNode<ElementaryTypeNameExpression>(elemToken));
-		m_scanner->next();
-	}
-	while (!startedWithElementary && m_scanner->currentToken() == Token::Period)
-	{
-		m_scanner->next();
-		path.push_back(parseIdentifier());
-	}
-	vector<pair<ASTPointer<Expression>, SourceLocation>> indices;
-	while (m_scanner->currentToken() == Token::LBrack)
-	{
-		expectToken(Token::LBrack);
-		ASTPointer<Expression> index;
-		if (m_scanner->currentToken() != Token::RBrack)
-			index = parseExpression();
-		SourceLocation indexLocation = path.front()->location();
-		indexLocation.end = endPosition();
-		indices.push_back(make_pair(index, indexLocation));
-		expectToken(Token::RBrack);
-	}
+	IndexAccessedPath iap = parseIndexAccessedPath();
 
 	if (m_scanner->currentToken() == Token::Identifier || Token::isLocationSpecifier(m_scanner->currentToken()))
-		return parseVariableDeclarationStatement(_docString, typeNameIndexAccessStructure(path, indices));
+		return make_pair(LookAheadInfo::VariableDeclaration, move(iap));
 	else
-		return parseExpressionStatement(_docString, expressionFromIndexAccessStructure(path, indices));
+		return make_pair(LookAheadInfo::Expression, move(iap));
 }
 
 ASTPointer<VariableDeclarationStatement> Parser::parseVariableDeclarationStatement(
@@ -1145,6 +1209,9 @@ ASTPointer<VariableDeclarationStatement> Parser::parseVariableDeclarationStateme
 	ASTPointer<TypeName> const& _lookAheadArrayType
 )
 {
+	// This does not parse multi variable declaration statements starting directly with
+	// `(`, they are parsed in parseSimpleStatement, because they are hard to distinguish
+	// from tuple expressions.
 	RecursionGuard recursionGuard(*this);
 	ASTNodeFactory nodeFactory(*this);
 	if (_lookAheadArrayType)
@@ -1207,23 +1274,24 @@ ASTPointer<VariableDeclarationStatement> Parser::parseVariableDeclarationStateme
 
 ASTPointer<ExpressionStatement> Parser::parseExpressionStatement(
 	ASTPointer<ASTString> const& _docString,
-	ASTPointer<Expression> const& _lookAheadIndexAccessStructure
+	ASTPointer<Expression> const& _partialParserResult
 )
 {
 	RecursionGuard recursionGuard(*this);
-	ASTPointer<Expression> expression = parseExpression(_lookAheadIndexAccessStructure);
+	ASTPointer<Expression> expression = parseExpression(_partialParserResult);
 	return ASTNodeFactory(*this, expression).createNode<ExpressionStatement>(_docString, expression);
 }
 
 ASTPointer<Expression> Parser::parseExpression(
-	ASTPointer<Expression> const& _lookAheadIndexAccessStructure
+	ASTPointer<Expression> const& _partiallyParsedExpression
 )
 {
 	RecursionGuard recursionGuard(*this);
-	ASTPointer<Expression> expression = parseBinaryExpression(4, _lookAheadIndexAccessStructure);
+	ASTPointer<Expression> expression = parseBinaryExpression(4, _partiallyParsedExpression);
 	if (Token::isAssignmentOp(m_scanner->currentToken()))
 	{
-		Token::Value assignmentOperator = expectAssignmentOperator();
+		Token::Value assignmentOperator = m_scanner->currentToken();
+		m_scanner->next();
 		ASTPointer<Expression> rightHandSide = parseExpression();
 		ASTNodeFactory nodeFactory(*this, expression);
 		nodeFactory.setEndPositionFromNode(rightHandSide);
@@ -1245,11 +1313,11 @@ ASTPointer<Expression> Parser::parseExpression(
 
 ASTPointer<Expression> Parser::parseBinaryExpression(
 	int _minPrecedence,
-	ASTPointer<Expression> const& _lookAheadIndexAccessStructure
+	ASTPointer<Expression> const& _partiallyParsedExpression
 )
 {
 	RecursionGuard recursionGuard(*this);
-	ASTPointer<Expression> expression = parseUnaryExpression(_lookAheadIndexAccessStructure);
+	ASTPointer<Expression> expression = parseUnaryExpression(_partiallyParsedExpression);
 	ASTNodeFactory nodeFactory(*this, expression);
 	int precedence = Token::precedence(m_scanner->currentToken());
 	for (; precedence >= _minPrecedence; --precedence)
@@ -1265,14 +1333,14 @@ ASTPointer<Expression> Parser::parseBinaryExpression(
 }
 
 ASTPointer<Expression> Parser::parseUnaryExpression(
-	ASTPointer<Expression> const& _lookAheadIndexAccessStructure
+	ASTPointer<Expression> const& _partiallyParsedExpression
 )
 {
 	RecursionGuard recursionGuard(*this);
-	ASTNodeFactory nodeFactory = _lookAheadIndexAccessStructure ?
-		ASTNodeFactory(*this, _lookAheadIndexAccessStructure) : ASTNodeFactory(*this);
+	ASTNodeFactory nodeFactory = _partiallyParsedExpression ?
+		ASTNodeFactory(*this, _partiallyParsedExpression) : ASTNodeFactory(*this);
 	Token::Value token = m_scanner->currentToken();
-	if (!_lookAheadIndexAccessStructure && (Token::isUnaryOp(token) || Token::isCountOp(token)))
+	if (!_partiallyParsedExpression && (Token::isUnaryOp(token) || Token::isCountOp(token)))
 	{
 		// prefix expression
 		m_scanner->next();
@@ -1283,7 +1351,7 @@ ASTPointer<Expression> Parser::parseUnaryExpression(
 	else
 	{
 		// potential postfix expression
-		ASTPointer<Expression> subExpression = parseLeftHandSideExpression(_lookAheadIndexAccessStructure);
+		ASTPointer<Expression> subExpression = parseLeftHandSideExpression(_partiallyParsedExpression);
 		token = m_scanner->currentToken();
 		if (!Token::isCountOp(token))
 			return subExpression;
@@ -1294,16 +1362,16 @@ ASTPointer<Expression> Parser::parseUnaryExpression(
 }
 
 ASTPointer<Expression> Parser::parseLeftHandSideExpression(
-	ASTPointer<Expression> const& _lookAheadIndexAccessStructure
+	ASTPointer<Expression> const& _partiallyParsedExpression
 )
 {
 	RecursionGuard recursionGuard(*this);
-	ASTNodeFactory nodeFactory = _lookAheadIndexAccessStructure ?
-		ASTNodeFactory(*this, _lookAheadIndexAccessStructure) : ASTNodeFactory(*this);
+	ASTNodeFactory nodeFactory = _partiallyParsedExpression ?
+		ASTNodeFactory(*this, _partiallyParsedExpression) : ASTNodeFactory(*this);
 
 	ASTPointer<Expression> expression;
-	if (_lookAheadIndexAccessStructure)
-		expression = _lookAheadIndexAccessStructure;
+	if (_partiallyParsedExpression)
+		expression = _partiallyParsedExpression;
 	else if (m_scanner->currentToken() == Token::New)
 	{
 		expectToken(Token::New);
@@ -1517,44 +1585,79 @@ Parser::LookAheadInfo Parser::peekStatementType() const
 	bool mightBeTypeName = (Token::isElementaryTypeName(token) || token == Token::Identifier);
 
 	if (token == Token::Mapping || token == Token::Function || token == Token::Var)
-		return LookAheadInfo::VariableDeclarationStatement;
+		return LookAheadInfo::VariableDeclaration;
 	if (mightBeTypeName)
 	{
 		Token::Value next = m_scanner->peekNextToken();
 		if (next == Token::Identifier || Token::isLocationSpecifier(next))
-			return LookAheadInfo::VariableDeclarationStatement;
+			return LookAheadInfo::VariableDeclaration;
 		if (next == Token::LBrack || next == Token::Period)
 			return LookAheadInfo::IndexAccessStructure;
 	}
-	return LookAheadInfo::ExpressionStatement;
+	return LookAheadInfo::Expression;
 }
 
-ASTPointer<TypeName> Parser::typeNameIndexAccessStructure(
-	vector<ASTPointer<PrimaryExpression>> const& _path,
-	vector<pair<ASTPointer<Expression>, SourceLocation>> const& _indices
-)
+Parser::IndexAccessedPath Parser::parseIndexAccessedPath()
 {
-	solAssert(!_path.empty(), "");
+	IndexAccessedPath iap;
+	if (m_scanner->currentToken() == Token::Identifier)
+	{
+		iap.path.push_back(parseIdentifier());
+		while (m_scanner->currentToken() == Token::Period)
+		{
+			m_scanner->next();
+			iap.path.push_back(parseIdentifier());
+		}
+	}
+	else
+	{
+		unsigned firstNum;
+		unsigned secondNum;
+		tie(firstNum, secondNum) = m_scanner->currentTokenInfo();
+		ElementaryTypeNameToken elemToken(m_scanner->currentToken(), firstNum, secondNum);
+		iap.path.push_back(ASTNodeFactory(*this).createNode<ElementaryTypeNameExpression>(elemToken));
+		m_scanner->next();
+	}
+	while (m_scanner->currentToken() == Token::LBrack)
+	{
+		expectToken(Token::LBrack);
+		ASTPointer<Expression> index;
+		if (m_scanner->currentToken() != Token::RBrack)
+			index = parseExpression();
+		SourceLocation indexLocation = iap.path.front()->location();
+		indexLocation.end = endPosition();
+		iap.indices.push_back(make_pair(index, indexLocation));
+		expectToken(Token::RBrack);
+	}
+
+	return iap;
+}
+
+ASTPointer<TypeName> Parser::typeNameFromIndexAccessStructure(Parser::IndexAccessedPath const& _iap)
+{
+	if (_iap.empty())
+		return {};
+
 	RecursionGuard recursionGuard(*this);
 	ASTNodeFactory nodeFactory(*this);
-	SourceLocation location = _path.front()->location();
-	location.end = _path.back()->location().end;
+	SourceLocation location = _iap.path.front()->location();
+	location.end = _iap.path.back()->location().end;
 	nodeFactory.setLocation(location);
 
 	ASTPointer<TypeName> type;
-	if (auto typeName = dynamic_cast<ElementaryTypeNameExpression const*>(_path.front().get()))
+	if (auto typeName = dynamic_cast<ElementaryTypeNameExpression const*>(_iap.path.front().get()))
 	{
-		solAssert(_path.size() == 1, "");
+		solAssert(_iap.path.size() == 1, "");
 		type = nodeFactory.createNode<ElementaryTypeName>(typeName->typeName());
 	}
 	else
 	{
 		vector<ASTString> path;
-		for (auto const& el: _path)
+		for (auto const& el: _iap.path)
 			path.push_back(dynamic_cast<Identifier const&>(*el).name());
 		type = nodeFactory.createNode<UserDefinedTypeName>(path);
 	}
-	for (auto const& lengthExpression: _indices)
+	for (auto const& lengthExpression: _iap.indices)
 	{
 		nodeFactory.setLocation(lengthExpression.second);
 		type = nodeFactory.createNode<ArrayTypeName>(type, lengthExpression.first);
@@ -1563,26 +1666,27 @@ ASTPointer<TypeName> Parser::typeNameIndexAccessStructure(
 }
 
 ASTPointer<Expression> Parser::expressionFromIndexAccessStructure(
-	vector<ASTPointer<PrimaryExpression>> const& _path,
-	vector<pair<ASTPointer<Expression>, SourceLocation>> const& _indices
+	Parser::IndexAccessedPath const& _iap
 )
 {
-	solAssert(!_path.empty(), "");
+	if (_iap.empty())
+		return {};
+
 	RecursionGuard recursionGuard(*this);
-	ASTNodeFactory nodeFactory(*this, _path.front());
-	ASTPointer<Expression> expression(_path.front());
-	for (size_t i = 1; i < _path.size(); ++i)
+	ASTNodeFactory nodeFactory(*this, _iap.path.front());
+	ASTPointer<Expression> expression(_iap.path.front());
+	for (size_t i = 1; i < _iap.path.size(); ++i)
 	{
-		SourceLocation location(_path.front()->location());
-		location.end = _path[i]->location().end;
+		SourceLocation location(_iap.path.front()->location());
+		location.end = _iap.path[i]->location().end;
 		nodeFactory.setLocation(location);
-		Identifier const& identifier = dynamic_cast<Identifier const&>(*_path[i]);
+		Identifier const& identifier = dynamic_cast<Identifier const&>(*_iap.path[i]);
 		expression = nodeFactory.createNode<MemberAccess>(
 			expression,
 			make_shared<ASTString>(identifier.name())
 		);
 	}
-	for (auto const& index: _indices)
+	for (auto const& index: _iap.indices)
 	{
 		nodeFactory.setLocation(index.second);
 		expression = nodeFactory.createNode<IndexAccess>(expression, index.first);
@@ -1598,40 +1702,10 @@ ASTPointer<ParameterList> Parser::createEmptyParameterList()
 	return nodeFactory.createNode<ParameterList>(vector<ASTPointer<VariableDeclaration>>());
 }
 
-string Parser::currentTokenName()
-{
-	Token::Value token = m_scanner->currentToken();
-	if (Token::isElementaryTypeName(token)) //for the sake of accuracy in reporting
-	{
-		ElementaryTypeNameToken elemTypeName = m_scanner->currentElementaryTypeNameToken();
-		return elemTypeName.toString();
-	}
-	else
-		return Token::name(token);
-}
-
-Token::Value Parser::expectAssignmentOperator()
-{
-	Token::Value op = m_scanner->currentToken();
-	if (!Token::isAssignmentOp(op))
-		fatalParserError(
-			string("Expected assignment operator,  got '") +
-			currentTokenName() +
-			string("'")
-		);
-	m_scanner->next();
-	return op;
-}
-
 ASTPointer<ASTString> Parser::expectIdentifierToken()
 {
-	Token::Value id = m_scanner->currentToken();
-	if (id != Token::Identifier)
-		fatalParserError(
-			string("Expected identifier, got '") +
-			currentTokenName() +
-			string("'")
-		);
+	// do not advance on success
+	expectToken(Token::Identifier, false);
 	return getLiteralAndAdvance();
 }
 
diff --git a/libsolidity/parsing/Parser.h b/libsolidity/parsing/Parser.h
index eb120a61..08653364 100644
--- a/libsolidity/parsing/Parser.h
+++ b/libsolidity/parsing/Parser.h
@@ -118,19 +118,19 @@ private:
 	);
 	ASTPointer<ExpressionStatement> parseExpressionStatement(
 		ASTPointer<ASTString> const& _docString,
-		ASTPointer<Expression> const& _lookAheadIndexAccessStructure = ASTPointer<Expression>()
+		ASTPointer<Expression> const& _partiallyParsedExpression = ASTPointer<Expression>()
 	);
 	ASTPointer<Expression> parseExpression(
-		ASTPointer<Expression> const& _lookAheadIndexAccessStructure = ASTPointer<Expression>()
+		ASTPointer<Expression> const& _partiallyParsedExpression = ASTPointer<Expression>()
 	);
 	ASTPointer<Expression> parseBinaryExpression(int _minPrecedence = 4,
-		ASTPointer<Expression> const& _lookAheadIndexAccessStructure = ASTPointer<Expression>()
+		ASTPointer<Expression> const& _partiallyParsedExpression = ASTPointer<Expression>()
 	);
 	ASTPointer<Expression> parseUnaryExpression(
-		ASTPointer<Expression> const& _lookAheadIndexAccessStructure = ASTPointer<Expression>()
+		ASTPointer<Expression> const& _partiallyParsedExpression = ASTPointer<Expression>()
 	);
 	ASTPointer<Expression> parseLeftHandSideExpression(
-		ASTPointer<Expression> const& _lookAheadIndexAccessStructure = ASTPointer<Expression>()
+		ASTPointer<Expression> const& _partiallyParsedExpression = ASTPointer<Expression>()
 	);
 	ASTPointer<Expression> parsePrimaryExpression();
 	std::vector<ASTPointer<Expression>> parseFunctionCallListArguments();
@@ -143,26 +143,32 @@ private:
 	/// Used as return value of @see peekStatementType.
 	enum class LookAheadInfo
 	{
-		IndexAccessStructure, VariableDeclarationStatement, ExpressionStatement
+		IndexAccessStructure, VariableDeclaration, Expression
+	};
+	/// Structure that represents a.b.c[x][y][z]. Can be converted either to an expression
+	/// or to a type name. For this to be valid, path cannot be empty, but indices can be empty.
+	struct IndexAccessedPath
+	{
+		std::vector<ASTPointer<PrimaryExpression>> path;
+		std::vector<std::pair<ASTPointer<Expression>, SourceLocation>> indices;
+		bool empty() const;
 	};
 
+	std::pair<LookAheadInfo, IndexAccessedPath> tryParseIndexAccessedPath();
 	/// Performs limited look-ahead to distinguish between variable declaration and expression statement.
 	/// For source code of the form "a[][8]" ("IndexAccessStructure"), this is not possible to
 	/// decide with constant look-ahead.
 	LookAheadInfo peekStatementType() const;
-	/// @returns a typename parsed in look-ahead fashion from something like "a.b[8][2**70]".
-	ASTPointer<TypeName> typeNameIndexAccessStructure(
-		std::vector<ASTPointer<PrimaryExpression>> const& _path,
-		std::vector<std::pair<ASTPointer<Expression>, SourceLocation>> const& _indices
-	);
-	/// @returns an expression parsed in look-ahead fashion from something like "a.b[8][2**70]".
-	ASTPointer<Expression> expressionFromIndexAccessStructure(
-		std::vector<ASTPointer<PrimaryExpression>> const& _path,
-		std::vector<std::pair<ASTPointer<Expression>, SourceLocation>> const& _indices
-	);
+	/// @returns an IndexAccessedPath as a prestage to parsing a variable declaration (type name)
+	/// or an expression;
+	IndexAccessedPath parseIndexAccessedPath();
+	/// @returns a typename parsed in look-ahead fashion from something like "a.b[8][2**70]",
+	/// or an empty pointer if an empty @a _pathAndIncides has been supplied.
+	ASTPointer<TypeName> typeNameFromIndexAccessStructure(IndexAccessedPath const& _pathAndIndices);
+	/// @returns an expression parsed in look-ahead fashion from something like "a.b[8][2**70]",
+	/// or an empty pointer if an empty @a _pathAndIncides has been supplied.
+	ASTPointer<Expression> expressionFromIndexAccessStructure(IndexAccessedPath const& _pathAndIndices);
 
-	std::string currentTokenName();
-	Token::Value expectAssignmentOperator();
 	ASTPointer<ASTString> expectIdentifierToken();
 	ASTPointer<ASTString> getLiteralAndAdvance();
 	///@}
diff --git a/libsolidity/parsing/ParserBase.cpp b/libsolidity/parsing/ParserBase.cpp
index 5b83c5bd..71133746 100644
--- a/libsolidity/parsing/ParserBase.cpp
+++ b/libsolidity/parsing/ParserBase.cpp
@@ -63,42 +63,32 @@ Token::Value ParserBase::advance()
 	return m_scanner->next();
 }
 
-void ParserBase::expectToken(Token::Value _value)
+void ParserBase::expectToken(Token::Value _value, bool _advance)
 {
 	Token::Value tok = m_scanner->currentToken();
 	if (tok != _value)
 	{
-		if (Token::isReservedKeyword(tok))
+		auto tokenName = [this](Token::Value _token)
 		{
-			fatalParserError(
-				string("Expected token ") +
-				string(Token::name(_value)) +
-				string(" got reserved keyword '") +
-				string(Token::name(tok)) +
-				string("'")
-			);
-		}
-		else if (Token::isElementaryTypeName(tok)) //for the sake of accuracy in reporting
-		{
-			ElementaryTypeNameToken elemTypeName = m_scanner->currentElementaryTypeNameToken();
-			fatalParserError(
-				string("Expected token ") +
-				string(Token::name(_value)) +
-				string(" got '") +
-				elemTypeName.toString() +
-				string("'")
-			);
-		}
-		else
-			fatalParserError(
-				string("Expected token ") +
-				string(Token::name(_value)) +
-				string(" got '") +
-				string(Token::name(m_scanner->currentToken())) +
-				string("'")
-			);
+			if (_token == Token::Identifier)
+				return string("identifier");
+			else if (_token == Token::EOS)
+				return string("end of source");
+			else if (Token::isReservedKeyword(_token))
+				return string("reserved keyword '") + Token::friendlyName(_token) + "'";
+			else if (Token::isElementaryTypeName(_token)) //for the sake of accuracy in reporting
+			{
+				ElementaryTypeNameToken elemTypeName = m_scanner->currentElementaryTypeNameToken();
+				return string("'") + elemTypeName.toString() + "'";
+			}
+			else
+				return string("'") + Token::friendlyName(_token) + "'";
+		};
+
+		fatalParserError(string("Expected ") + tokenName(_value) + string(" but got ") + tokenName(tok));
 	}
-	m_scanner->next();
+	if (_advance)
+		m_scanner->next();
 }
 
 void ParserBase::increaseRecursionDepth()
@@ -116,10 +106,10 @@ void ParserBase::decreaseRecursionDepth()
 
 void ParserBase::parserError(string const& _description)
 {
-	m_errorReporter.parserError(SourceLocation(position(), position(), sourceName()), _description);
+	m_errorReporter.parserError(SourceLocation(position(), endPosition(), sourceName()), _description);
 }
 
 void ParserBase::fatalParserError(string const& _description)
 {
-	m_errorReporter.fatalParserError(SourceLocation(position(), position(), sourceName()), _description);
+	m_errorReporter.fatalParserError(SourceLocation(position(), endPosition(), sourceName()), _description);
 }
diff --git a/libsolidity/parsing/ParserBase.h b/libsolidity/parsing/ParserBase.h
index fd0de0d1..b28e1b1b 100644
--- a/libsolidity/parsing/ParserBase.h
+++ b/libsolidity/parsing/ParserBase.h
@@ -63,7 +63,7 @@ protected:
 	///@{
 	///@name Helper functions
 	/// If current token value is not _value, throw exception otherwise advance token.
-	void expectToken(Token::Value _value);
+	void expectToken(Token::Value _value, bool _advance = true);
 	Token::Value currentToken() const;
 	Token::Value peekNextToken() const;
 	std::string currentLiteral() const;
diff --git a/libsolidity/parsing/Token.h b/libsolidity/parsing/Token.h
index 805fbf5d..4d7a7bc6 100644
--- a/libsolidity/parsing/Token.h
+++ b/libsolidity/parsing/Token.h
@@ -304,6 +304,17 @@ public:
 		return m_string[tok];
 	}
 
+	static std::string friendlyName(Value tok)
+	{
+		char const* ret = toString(tok);
+		if (ret == nullptr)
+		{
+			ret = name(tok);
+			solAssert(ret != nullptr, "");
+		}
+		return std::string(ret);
+	}
+
 	// @returns the precedence > 0 for binary and compare
 	// operators; returns 0 otherwise.
 	static int precedence(Value tok)