ICE in `AssemblyItem::toAssemblyText` when modifier inlining generates more than 65535 tags
- Dominant language
- C++
- Stars
- 25.7k
- Forks
- 6.2k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 21
Description
The compiler panics with `Declaration of sub-assembly tag.` in [`libevmasm/AssemblyItem.cpp:364`](https://github.com/ethereum/solidity/blob/9be66192f9db40e5a43f71fc78e06b2f35e9ccdd/libevmasm/AssemblyItem.cpp#L364) inside `AssemblyItem::toAssemblyText()` when a modifier containing multiple body placeholders (`_`) is applied enough times that the total number of inlined code blocks exceeds 65535 (the 16-bit tag limit).
MRE:
```solidity
contract C {
modifier m() { _;_;_;_; }
function f(uint256[] calldata v) public m() m() m() m() m() m() m() m() { }
}
```
Reproduce: save as `mre.sol`, run `solc --standard-json` (the ICE appears in the JSON `errors` array; `--bin` exits 0 with warnings only).
Output (standard JSON):
```
InternalCompilerError: Uncaught exception:
/solidity/libevmasm/AssemblyItem.cpp(364): Throw in function std::string solidity::evmasm::AssemblyItem::toAssemblyText(const solidity::evmasm::Assembly&) const
Dynamic exception type: boost::wrapexcept
std::exception::what: Declaration of sub-assembly tag.
```
Expected behavior: a compile error limiting modifier inlining depth, or a 32-bit tag counter.
Git commit: 9be66192f
solc 0.8.35-develop.2026.4.18+commit.9be66192.Linux.g++
Contributor guide
Assessment
This issue has not been assessed yet.