argotorg / argotorg/solidity

ICE in `ArrayType::calldataEncodedSize` when `abi.encode` is called on a memory struct containing an oversized static array

Open
#16,621 0 comments 0 reactions 0 assignees View on GitHub
bug :bug: low effort low impact must have eventually
Dominant language
C++
Stars
25.7k
Forks
6.2k
Avg merge
2d 19h
Merged PRs (30d)
29

Description

The compiler panics with `Array size does not fit unsigned.` in [`libsolidity/ast/Types.cpp:1789`](https://github.com/ethereum/solidity/blob/9be66192f9db40e5a43f71fc78e06b2f35e9ccdd/libsolidity/ast/Types.cpp#L1789) inside `ArrayType::calldataEncodedSize()` when `abi.encode` is called on a struct in memory that contains a static array large enough for its ABI-encoded size to overflow `unsigned`. The type checker correctly rejects such types in calldata position (`Type too large for calldata`) but does not check memory types — so the overflow is only detected when the ABI codegen function unconditionally casts the size to `unsigned`.

MRE:
```solidity
contract C {
struct S { uint256[134217729] y; }
function f() public pure returns (bytes memory) {
S[1] memory s;
return abi.encode(s);
}
}
```

`134217729 * 32 = 4294967328 > UINT_MAX`. Reproduce: save as `mre.sol`, run `solc --bin mre.sol`.

Output:
```
Internal compiler error:
/solidity/libsolidity/ast/Types.cpp(1789): Throw in function virtual unsigned int solidity::frontend::ArrayType::calldataEncodedSize(bool) const
Dynamic exception type: boost::wrapexcept
std::exception::what: Array size does not fit unsigned.
[solidity::util::tag_comment*] = Array size does not fit unsigned.
```

Expected behavior: a type error (consistent with the calldata check) rejecting the struct member type as too large for ABI encoding.

Also reproduces with `S[] memory s = new S[](1)` and with a 2D array member `int256[4][33554433]` (4 * 33554433 * 32 > UINT_MAX).

Git commit: 9be66192f
solc 0.8.35-develop.2026.4.18+commit.9be66192.Linux.g++

Contributor guide

Open the contributing guide

Research direction

Start in libsolidity/ast/Types.cpp:1789, in ArrayType::calldataEncodedSize(), and reproduce the ICE with the provided mre.sol using solc --bin. Trace the existing calldata size validation for memory structs and add or test the corresponding rejection for oversized ABI-encoded types; done when the examples produce a type error instead of an internal compiler error.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, solidity
Domain
compilers
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.