Multiple Evaluations of the Target of Byte and Dynamic Array Assignments

[ritzdorf]

Version Information

• vyper Version (output of vyper --version OR linkable commit hash vyperlang/vyper@): vyperlang/vyper@b43fface148b45cbd2c90b5d24f77398a63745b5

  Issue Description

Multiple evaluations of the target of byte and dynamic array assignments have been described in issue 3514. However, this issue was incomplete since it would only show the case where the complex expression being evaluated twice is caught by the compiler's "non-unique symbol" sanity check. However, it is possible to have a complex expression evaluated twice without the compiler crashing by using builtins like raw_call or the create_ class or .pop() on a non-storage array.

Note that this issue has been partially mitigated by 3835 given that builtins like raw_call and the create_ class are now emitting unique symbols, however, this is not yet the case for .pop() when the array is not in storage.

POC

The following code will compile successfully, and x.pop() will be performed twice:

d:DynArray[DynArray[uint256,1],1]
addr:address
@external
def foo() -> DynArray[uint256, 2]:
    self.d = [[0]]
    x:DynArray[uint256, 2] = [0,0]
    self.d[x.pop()] = [1]
    return x # return [] instead of [0]

[ritzdorf]

We also found an example using a HashMap now:

#@version 0.4.0.rc3
m: HashMap[uint256, String[33]]

@external
def foo(a: address):
    self.m[len(raw_call(a, msg.data, max_outsize=32))] = "Hello world"

fails to compile with

AssertionError: non-unique symbols {'raw_call_builtin102'}

[charles-cooper]

addressed in https://github.com/vyperlang/vyper/pull/4030