ICE in `ArrayType::memoryDataSize` when `new` allocates a dynamic array with an oversized static base type
- Dominant language
- C++
- Stars
- 25.7k
- Forks
- 6.2k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 21
Description
The compiler panics with `Array size does not fit u256.` in [`libsolidity/ast/Types.cpp:2032`](https://github.com/ethereum/solidity/blob/9be66192f9db40e5a43f71fc78e06b2f35e9ccdd/libsolidity/ast/Types.cpp#L2032) inside `ArrayType::memoryDataSize()` when a `new T[](n)` expression allocates a dynamic array whose static base type `T` has a memory footprint that overflows `u256`.
MRE:
```solidity
contract C {
function f() public {
new uint256[57896044618658097711785492504343953926634992332820282019728792003956564819967][](1);
}
}
```
`2^255 * 32 > u256::max`. Reproduce: save as `mre.sol`, run `solc --bin mre.sol`.
Output:
```
Internal compiler error:
/solidity/libsolidity/ast/Types.cpp(2032): Throw in function virtual solidity::u256 solidity::frontend::ArrayType::memoryDataSize() const
Dynamic exception type: boost::wrapexcept
std::exception::what: Array size does not fit u256.
[solidity::util::tag_comment*] = Array size does not fit u256.
```
Expected behavior: a type error rejecting the inner array dimension as too large to allocate in memory.
Git commit: 9be66192f
solc 0.8.35-develop.2026.4.18+commit.9be66192.Linux.g++
Contributor guide
Research direction
Save the supplied contract as mre.sol and reproduce the ICE with solc --bin mre.sol. Start at libsolidity/ast/Types.cpp:2032 in ArrayType::memoryDataSize(); done means the oversized inner array dimension is rejected with a type error instead of triggering the u256 overflow ICE.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, solidity
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100