IR-based codegen: Modifying the length of a dynamic array to a large number in assembly, followed by a push() operation, will cause a revert.
- Dominant language
- C++
- Stars
- 25.7k
- Forks
- 6.2k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 21
Description
- Compiler version: 0.8.27
- Target EVM version (as per compiler settings): None
- Framework/IDE (e.g. Truffle or Remix): Remix
- EVM execution environment / backend / blockchain client: None
- Operating system: None
## Steps to Reproduce
```solidity
contract A {
int[] public a;
function f() public {
assembly {
let converted := 14
let _1 := 50
sstore(0, keccak256(_1, converted))
// sstore(0, 1)
}
a.push(2);
}
}
```
### Remix
#### Legacy codegen

#### IR-based codegen

1. If we comment out a.push(2), transaction will not revert
2. If replaced with sstore(0, 1), it still will not revert
Contributor guide
Research direction
Start with the supplied Solidity reproducer and compare execution under IR-based and legacy codegen, focusing on the dynamic-array push after the assembly storage write. Trace the compiler path involved and add a regression test; done means the IR-generated contract no longer reverts while the reproducer remains covered.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, solidity
- Domain
- blockchain, compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100