From c11a0f5565649a9783151800d92fece284919529 Mon Sep 17 00:00:00 2001
From: Sean Huh <sokwhan@google.com>
Date: Tue, 21 Jul 2026 14:18:47 -0700
Subject: [PATCH] Preserve the original CelExpr from symbol table for
 comprehensions in verifier

PiperOrigin-RevId: 951695444
---
 .../main/java/dev/cel/verifier/CelAstToZ3Translator.java    | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/verifier/src/main/java/dev/cel/verifier/CelAstToZ3Translator.java b/verifier/src/main/java/dev/cel/verifier/CelAstToZ3Translator.java
index 255658136..4a0086b16 100644
--- a/verifier/src/main/java/dev/cel/verifier/CelAstToZ3Translator.java
+++ b/verifier/src/main/java/dev/cel/verifier/CelAstToZ3Translator.java
@@ -644,6 +644,12 @@ private <T> T withScope(String varName, TranslatedValue value, Supplier<T> actio
   private TranslatedValue translateComprehension(CelExpr celExpr, CelAbstractSyntaxTree ast) {
     CelComprehension comp = celExpr.comprehension();
     CelExpr iterRangeExpr = comp.iterRange();
+    if (iterRangeExpr.exprKind().getKind() == ExprKind.Kind.IDENT) {
+      TranslatedValue boundTv = symbolTable.get(iterRangeExpr.ident().name());
+      if (boundTv != null) {
+        iterRangeExpr = boundTv.celExpr().orElse(iterRangeExpr);
+      }
+    }
     List<IterationElement> iterationElements = new ArrayList<>();
     List<BoolExpr> taints = new ArrayList<>();
     List<Expr<?>> allRangeElems = new ArrayList<>();