ICE in `StorageOffsets::computeOffsets` when a struct's cumulative field storage exceeds 2^256
- Dominant language
- C++
- Stars
- 25.7k
- Forks
- 6.2k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 21
Description
The compiler panics with `Object extends past the end of storage.` in [`libsolidity/ast/Types.cpp`](https://github.com/ethereum/solidity/blob/9be66192f9db40e5a43f71fc78e06b2f35e9ccdd/libsolidity/ast/Types.cpp#L172) inside `StorageOffsets::computeOffsets()` when a struct's fields individually pass the per-field storage size check (`storageSize() < 2^256`) but their cumulative storage slot offset reaches or exceeds 2^256. The overflow is caught by a `solAssert` rather than a user-facing diagnostic.
MRE:
```solidity
contract C {
struct S {
uint256[340282366920938463463374607431768211456][170141183460469231731687303715884105728] a;
uint256[340282366920938463463374607431768211456][170141183460469231731687303715884105728] b;
}
S[] p;
}
```
Each field has storage size 2^255 (below the per-field limit), but combined they reach 2^256. Reproduce: save as `mre.sol`, run `solc --standard-json` (the ICE appears in the JSON `errors` array).
Output (standard JSON):
```
InternalCompilerError: Uncaught exception:
/solidity/libsolidity/ast/Types.cpp(172): Throw in function void solidity::frontend::StorageOffsets::computeOffsets(...)
Dynamic exception type: boost::wrapexcept
std::exception::what: Object extends past the end of storage.
```
Expected behavior: a type error at the struct declaration or at the array variable explaining that the total storage required exceeds the maximum.
Also reproduces with four fields of 2^254 slots each, and with `mapping(uint => S)` instead of `S[]`.
Git commit: 9be66192f
solc 0.8.35-develop.2026.4.18+commit.9be66192.Linux.g++
Contributor guide
Assessment
This issue has not been assessed yet.