argotorg / argotorg/solidity

ICE in `AssemblyItem::toAssemblyText` when modifier inlining generates more than 65535 tags

Open
#16,628 1 comment 0 reactions 1 assignee Claimed by @nikola-matic View on GitHub
bug :bug:
Dominant language
C++
Stars
25.7k
Forks
6.2k
Avg merge
1d 11h
Merged PRs (30d)
21

Description

The compiler panics with `Declaration of sub-assembly tag.` in [`libevmasm/AssemblyItem.cpp:364`](https://github.com/ethereum/solidity/blob/9be66192f9db40e5a43f71fc78e06b2f35e9ccdd/libevmasm/AssemblyItem.cpp#L364) inside `AssemblyItem::toAssemblyText()` when a modifier containing multiple body placeholders (`_`) is applied enough times that the total number of inlined code blocks exceeds 65535 (the 16-bit tag limit).

MRE:
```solidity
contract C {
modifier m() { _;_;_;_; }
function f(uint256[] calldata v) public m() m() m() m() m() m() m() m() { }
}
```

Reproduce: save as `mre.sol`, run `solc --standard-json` (the ICE appears in the JSON `errors` array; `--bin` exits 0 with warnings only).

Output (standard JSON):
```
InternalCompilerError: Uncaught exception:
/solidity/libevmasm/AssemblyItem.cpp(364): Throw in function std::string solidity::evmasm::AssemblyItem::toAssemblyText(const solidity::evmasm::Assembly&) const
Dynamic exception type: boost::wrapexcept
std::exception::what: Declaration of sub-assembly tag.
```

Expected behavior: a compile error limiting modifier inlining depth, or a 32-bit tag counter.

Git commit: 9be66192f
solc 0.8.35-develop.2026.4.18+commit.9be66192.Linux.g++

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.