Overflow operations are not detected when enabling via-ir compilation
- Dominant language
- C++
- Stars
- 25.7k
- Forks
- 6.2k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 21
Description
## Description
Hi! The following code does not result in an arithmetic overflow (the multiplication in the code) when `via-ir` compilation is enabled, and the return value of `g()` is wrong. I believe this overflow should occur. Specifically, if I remove the `f()` function, the correct code causing overflow is generated. Could this be due to the `return` in the inline assembly? The `return` opcode appears to have been misplaced.
```solidity
contract Test {
function f() private returns(uint256) {
assembly {
return(0x40, 0x20)
}
}
function g() public payable returns(uint256) {
if (f() + uint256(keccak256(hex"00")) * 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff >= 0) {
return 1;
}
return 0;
}
}
```
It appears that the `g()` function has been discarded as a dead block.
```asm
sub_0: assembly {
/* "out.sol":0:320 contract Test {... */
mstore(0x40, 0x80)
jumpi(tag_26, iszero(lt(calldatasize, 0x04)))
tag_27:
tag_9
jump // in
tag_26:
tag_28
calldataload(0x00)
tag_1
jump // in
tag_28:
0xe2179b8e
sub
tag_27
jumpi
tag_8
jump // in
tag_1:
0xe0
shr
swap1
jump // out
tag_3:
0x00
dup1
revert
tag_4:
0x00
swap2
sub
slt
tag_31
jumpi
jump // out
tag_31:
tag_3
jump // in
tag_8:
tag_35
calldatasize
0x04
tag_4
jump // in
tag_35:
tag_24
jump // in
tag_9:
0x00
dup1
revert
tag_10:
0x00
swap1
jump // out
/* "out.sol":113:318 function g() public payable returns(uint256) {... */
tag_24:
/* "out.sol":149:156 uint256 */
tag_59
tag_10
jump // in
tag_59:
/* "out.sol":168:171 f() */
pop
/* "out.sol":48:55 uint256 */
tag_60
tag_10
jump // in
tag_60:
/* "out.sol":63:105 assembly {... */
return(0x40, 0x20)
auxdata: 0xa264697066735822122014b5cfb858122f0be48cf19a684cce82ebd7bec7b8a7ce6343ef1443e62532c764736f6c637827302e382e32372d646576656c6f702e323032342e372e382b636f6d6d69742e64343266393262640058
}
```
## Environment
- Compiler version: commit d42f92bd68d76db01b0dc17477cd4c7716059d93
Contributor guide
Research direction
Reproduce the Solidity contract with via-ir enabled using the compiler commit d42f92bd68d76db01b0dc17477cd4c7716059d93. Compare the generated assembly for the full example with the version without f(), focusing on the return from f() and the discarded g() block. Done means the multiplication overflow is detected and g() returns the expected value.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- solidity
- Domain
- blockchain, compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100