ICE in `MagicVariableDeclaration::functionType` when `abi` is subscripted in a state variable array size
- Dominant language
- C++
- Stars
- 25.7k
- Forks
- 6.2k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 21
Description
The compiler panics with `Solidity assertion failed` in [`libsolidity/ast/AST.h:1398`](https://github.com/ethereum/solidity/blob/9be66192f9db40e5a43f71fc78e06b2f35e9ccdd/libsolidity/ast/AST.h#L1398) inside `MagicVariableDeclaration::functionType()` when `abi` is used as a subscriptable expression in the size of a state variable array declaration.
MRE:
```solidity
contract C { uint[uint(abi("")[0])] x; }
```
Reproduce: save as `mre.sol`, run `solc --bin mre.sol`.
Output:
```
Internal compiler error:
/solidity/libsolidity/ast/AST.h(1398): Throw in function virtual const solidity::frontend::FunctionType* solidity::frontend::MagicVariableDeclaration::functionType(bool) const
Dynamic exception type: boost::wrapexcept
std::exception::what: Solidity assertion failed
[solidity::util::tag_comment*] = Solidity assertion failed
```
Expected behavior: a type error explaining that `abi` cannot be subscripted or used as a function.
Also reproduces with `abi("").length` as the array size.
Git commit: 9be66192f
solc 0.8.35-develop.2026.4.18+commit.9be66192.Linux.g++
Contributor guide
Research direction
Start by reproducing the issue with the provided mre.sol input using solc --bin mre.sol, then inspect libsolidity/ast/AST.h:1398 and the MagicVariableDeclaration::functionType() path. Check both the subscripted abi expression and abi("").length case. Done means the compiler reports a type error explaining that abi cannot be subscripted or used as a function instead of panicking.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, solidity
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100