fix(typeck): reject non-path receivers for Vector/Mapping storage ops

`Vector::{len,get,set,push,pop,swap_remove,clear}` and
`Mapping::{get,get_or_use,contains,set,remove}` assumed an
`Expression::Path` receiver downstream: storage_lowering for vectors,
codegen for mappings. Type-checking only verified the receiver's type.

- Read ops (`len`/`get`/`get_or_use`/`contains`) had no path check at
  all, so a ternary of two storage vectors ICEd in storage_lowering
  (#29428) and a ternary of two mappings produced invalid bytecode that
  failed late at disassembly.
- Write ops already had an `is_local_path` check, but emitted the
  "external vectors/mappings" diagnostic for a local ternary receiver,
  which is misleading.

Add an `Expression::Path` pre-check to all eleven arms and emit a new
`ETYC0372191` for non-path receivers. The existing
"external vectors/mappings" diagnostic now only fires when the receiver
is an actual external path, which is what its wording describes.

Fixes #29428.

Author: Mohammad Fawaz

crates/passes/src/errors/type_checker.rs

@@ -942,6 +942,21 @@ pub(crate) fn multi_identifier_definition_requires_tuple(type_: impl Display, sp
     .with_help("Use a tuple expression, e.g. `let (a, b) = (x, y);`.")
 }
 
+pub(crate) fn storage_op_requires_path_receiver(
+    module: impl Display,
+    operation: impl Display,
+    kind: impl Display,
+    span: Span,
+) -> Formatted {
+    Formatted::error(
+        CODE_PREFIX,
+        CODE_MASK + 191,
+        format!("The receiver of `{module}::{operation}` must be a {kind}."),
+        span,
+    )
+    .with_help(format!("Call `{operation}` directly on a declared {kind}, not on a temporary expression."))
+}
+
 // TypeCheckerWarning builder functions
 
 pub(crate) fn caller_as_record_owner(record_name: impl Display, span: Span) -> Formatted {

crates/passes/src/type_checking/visitor.rs

@@ -966,6 +966,19 @@ impl TypeCheckingVisitor<'_> {
                 // Check that the operation is invoked in a `finalize` or `async` block.
                 self.check_access_allowed("Mapping::get", true, function_span);
 
+                // The receiver must be a path. Codegen lowers `Mapping::get` to an Aleo
+                // `get` instruction whose first operand is a mapping name, so non-path
+                // receivers (e.g. a ternary over mappings) cannot be lowered.
+                if !matches!(map_expr, Expression::Path(_)) {
+                    self.state.handler.emit_err(crate::errors::type_checker::storage_op_requires_path_receiver(
+                        "Mapping",
+                        "get",
+                        "mapping",
+                        map_expr.span(),
+                    ));
+                    return Type::Err;
+                }
+
                 *value.clone()
             }
             Intrinsic::MappingSet => {
@@ -979,6 +992,18 @@ impl TypeCheckingVisitor<'_> {
                 // Check that the operation is invoked in a `finalize` or `async` block.
                 self.check_access_allowed("Mapping::set", true, function_span);
 
+                // Receiver must be a path. Codegen emits an Aleo `set` whose first
+                // operand is a mapping name.
+                if !matches!(map_expr, Expression::Path(_)) {
+                    self.state.handler.emit_err(crate::errors::type_checker::storage_op_requires_path_receiver(
+                        "Mapping",
+                        "set",
+                        "mapping",
+                        map_expr.span(),
+                    ));
+                    return Type::Err;
+                }
+
                 // Argument 0 must be a local path (cannot modify external mappings).
                 if !is_local_path(map_expr) {
                     self.state.handler.emit_err(crate::errors::type_checker::cannot_modify_external_container(
@@ -1005,6 +1030,18 @@ impl TypeCheckingVisitor<'_> {
                     return Type::Err;
                 };
 
+                // The receiver must be a path. Codegen lowers `Mapping::get_or_use` to an
+                // Aleo `get.or_use` instruction whose first operand is a mapping name.
+                if !matches!(map_expr, Expression::Path(_)) {
+                    self.state.handler.emit_err(crate::errors::type_checker::storage_op_requires_path_receiver(
+                        "Mapping",
+                        "get_or_use",
+                        "mapping",
+                        map_expr.span(),
+                    ));
+                    return Type::Err;
+                }
+
                 value.deref().clone()
             }
             Intrinsic::MappingRemove => {
@@ -1021,6 +1058,18 @@ impl TypeCheckingVisitor<'_> {
                     return Type::Err;
                 };
 
+                // Receiver must be a path. Codegen emits an Aleo `remove` whose first
+                // operand is a mapping name.
+                if !matches!(map_expr, Expression::Path(_)) {
+                    self.state.handler.emit_err(crate::errors::type_checker::storage_op_requires_path_receiver(
+                        "Mapping",
+                        "remove",
+                        "mapping",
+                        map_expr.span(),
+                    ));
+                    return Type::Err;
+                }
+
                 // Argument 0 must be a local path (cannot modify external mappings).
                 if !is_local_path(map_expr) {
                     self.state.handler.emit_err(crate::errors::type_checker::cannot_modify_external_container(
@@ -1047,6 +1096,18 @@ impl TypeCheckingVisitor<'_> {
                     return Type::Err;
                 };
 
+                // The receiver must be a path. Codegen lowers `Mapping::contains` to an
+                // Aleo `contains` instruction whose first operand is a mapping name.
+                if !matches!(map_expr, Expression::Path(_)) {
+                    self.state.handler.emit_err(crate::errors::type_checker::storage_op_requires_path_receiver(
+                        "Mapping",
+                        "contains",
+                        "mapping",
+                        map_expr.span(),
+                    ));
+                    return Type::Err;
+                }
+
                 Type::Boolean
             }
             Intrinsic::OptionalUnwrap => {
@@ -1082,6 +1143,19 @@ impl TypeCheckingVisitor<'_> {
                 // Check that the operation is invoked in a `finalize` or `async` block.
                 self.check_access_allowed("Vector::get", true, function_span);
 
+                // The receiver must be a path. storage_lowering looks up the backing
+                // mappings by name, so non-path receivers (e.g. a ternary over storage
+                // vectors) cannot be lowered.
+                if !matches!(vec_expr, Expression::Path(_)) {
+                    self.state.handler.emit_err(crate::errors::type_checker::storage_op_requires_path_receiver(
+                        "Vector",
+                        "get",
+                        "storage vector",
+                        vec_expr.span(),
+                    ));
+                    return Type::Err;
+                }
+
                 Type::Optional(OptionalType { inner: Box::new(*element_type.clone()) })
             }
             Intrinsic::VectorSet => {
@@ -1095,6 +1169,18 @@ impl TypeCheckingVisitor<'_> {
                 // Check that the operation is invoked in a `finalize` or `async` block.
                 self.check_access_allowed("Vector::set", true, function_span);
 
+                // Receiver must be a path (storage_lowering needs to identify the backing
+                // mappings by name).
+                if !matches!(vec_expr, Expression::Path(_)) {
+                    self.state.handler.emit_err(crate::errors::type_checker::storage_op_requires_path_receiver(
+                        "Vector",
+                        "set",
+                        "storage vector",
+                        vec_expr.span(),
+                    ));
+                    return Type::Err;
+                }
+
                 // Argument 0 must be a local path (cannot modify external vectors).
                 if !is_local_path(vec_expr) {
                     self.state.handler.emit_err(crate::errors::type_checker::cannot_modify_external_container(
@@ -1123,6 +1209,18 @@ impl TypeCheckingVisitor<'_> {
                 // Check that the operation is invoked in a `finalize` or `async` block.
                 self.check_access_allowed("Vector::push", true, function_span);
 
+                // Receiver must be a path (storage_lowering needs to identify the backing
+                // mappings by name).
+                if !matches!(vec_expr, Expression::Path(_)) {
+                    self.state.handler.emit_err(crate::errors::type_checker::storage_op_requires_path_receiver(
+                        "Vector",
+                        "push",
+                        "storage vector",
+                        vec_expr.span(),
+                    ));
+                    return Type::Err;
+                }
+
                 // Argument 0 must be a local path (cannot modify external vectors).
                 if !is_local_path(vec_expr) {
                     self.state.handler.emit_err(crate::errors::type_checker::cannot_modify_external_container(
@@ -1141,12 +1239,25 @@ impl TypeCheckingVisitor<'_> {
                 // Check that the operation is invoked in a `finalize` or `async` block.
                 self.check_access_allowed("Vector::len", true, function_span);
 
-                if vec_ty.is_vector() {
-                    Type::Integer(IntegerType::U32)
-                } else {
+                if !vec_ty.is_vector() {
                     self.assert_vector_type(vec_ty, vec_expr.span());
-                    Type::Err
+                    return Type::Err;
+                }
+
+                // The receiver must be a path. storage_lowering looks up the backing
+                // mappings by name, so non-path receivers (e.g. a ternary over storage
+                // vectors) cannot be lowered.
+                if !matches!(vec_expr, Expression::Path(_)) {
+                    self.state.handler.emit_err(crate::errors::type_checker::storage_op_requires_path_receiver(
+                        "Vector",
+                        "len",
+                        "storage vector",
+                        vec_expr.span(),
+                    ));
+                    return Type::Err;
                 }
+
+                Type::Integer(IntegerType::U32)
             }
             Intrinsic::VectorPop => {
                 let (vec_ty, vec_expr) = &arguments[0];
@@ -1159,6 +1270,18 @@ impl TypeCheckingVisitor<'_> {
                     return Type::Err;
                 };
 
+                // Receiver must be a path (storage_lowering needs to identify the backing
+                // mappings by name).
+                if !matches!(vec_expr, Expression::Path(_)) {
+                    self.state.handler.emit_err(crate::errors::type_checker::storage_op_requires_path_receiver(
+                        "Vector",
+                        "pop",
+                        "storage vector",
+                        vec_expr.span(),
+                    ));
+                    return Type::Err;
+                }
+
                 // Argument 0 must be a local path (cannot modify external vectors).
                 if !is_local_path(vec_expr) {
                     self.state.handler.emit_err(crate::errors::type_checker::cannot_modify_external_container(
@@ -1182,6 +1305,18 @@ impl TypeCheckingVisitor<'_> {
                     return Type::Err;
                 };
 
+                // Receiver must be a path (storage_lowering needs to identify the backing
+                // mappings by name).
+                if !matches!(vec_expr, Expression::Path(_)) {
+                    self.state.handler.emit_err(crate::errors::type_checker::storage_op_requires_path_receiver(
+                        "Vector",
+                        "swap_remove",
+                        "storage vector",
+                        vec_expr.span(),
+                    ));
+                    return Type::Err;
+                }
+
                 // Argument 0 must be a local path (cannot modify external vectors).
                 if !is_local_path(vec_expr) {
                     self.state.handler.emit_err(crate::errors::type_checker::cannot_modify_external_container(
@@ -1202,6 +1337,18 @@ impl TypeCheckingVisitor<'_> {
                     return Type::Err;
                 }
 
+                // Receiver must be a path (storage_lowering needs to identify the backing
+                // mappings by name).
+                if !matches!(vec_expr, Expression::Path(_)) {
+                    self.state.handler.emit_err(crate::errors::type_checker::storage_op_requires_path_receiver(
+                        "Vector",
+                        "clear",
+                        "storage vector",
+                        vec_expr.span(),
+                    ));
+                    return Type::Err;
+                }
+
                 // Argument 0 must be a local path (cannot modify external vectors).
                 if !is_local_path(vec_expr) {
                     self.state.handler.emit_err(crate::errors::type_checker::cannot_modify_external_container(

tests/expectations/compiler/storage/ternary_mapping_receiver_fail.out

@@ -0,0 +1,21 @@
+[ETYC0372191] Error: The receiver of `Mapping::get` must be a mapping.
+    ╭─[ compiler-test:12:27 ]
+    │
+ 12 │             let v: u32 = (c ? m1 : m2).get(0u32); // ❌ non-path receiver
+    │ 
+    │ Help: Call `get` directly on a declared mapping, not on a temporary expression.
+────╯
+[ETYC0372191] Error: The receiver of `Mapping::contains` must be a mapping.
+    ╭─[ compiler-test:19:28 ]
+    │
+ 19 │             let b: bool = (c ? m1 : m2).contains(0u32); // ❌ non-path receiver
+    │ 
+    │ Help: Call `contains` directly on a declared mapping, not on a temporary expression.
+────╯
+[ETYC0372191] Error: The receiver of `Mapping::get_or_use` must be a mapping.
+    ╭─[ compiler-test:26:27 ]
+    │
+ 26 │             let v: u32 = (c ? m1 : m2).get_or_use(0u32, 0u32); // ❌ non-path receiver
+    │ 
+    │ Help: Call `get_or_use` directly on a declared mapping, not on a temporary expression.
+────╯

tests/expectations/compiler/storage/ternary_vector_receiver_fail.out

@@ -0,0 +1,21 @@
+[ETYC0372191] Error: The receiver of `Vector::len` must be a storage vector.
+    ╭─[ compiler-test:15:27 ]
+    │
+ 15 │             let n: u32 = (c ? h1 : h2).len(); // ❌ non-path receiver
+    │ 
+    │ Help: Call `len` directly on a declared storage vector, not on a temporary expression.
+────╯
+[ETYC0372191] Error: The receiver of `Vector::get` must be a storage vector.
+    ╭─[ compiler-test:22:28 ]
+    │
+ 22 │             let v: u64? = (c ? h1 : h2).get(0u32); // ❌ non-path receiver
+    │ 
+    │ Help: Call `get` directly on a declared storage vector, not on a temporary expression.
+────╯
+[ETYC0372191] Error: The receiver of `Vector::len` must be a storage vector.
+    ╭─[ compiler-test:29:39 ]
+    │
+ 29 │             let n: u32 = Vector::len((c ? h1 : h2)); // ❌ non-path receiver
+    │ 
+    │ Help: Call `len` directly on a declared storage vector, not on a temporary expression.
+────╯

tests/expectations/compiler/storage/ternary_write_receiver_fail.out

@@ -0,0 +1,49 @@
+[ETYC0372191] Error: The receiver of `Vector::set` must be a storage vector.
+    ╭─[ compiler-test:15:25 ]
+    │
+ 15 │         return final { (c ? h1 : h2).set(0u32, 1u64); }; // ❌ non-path receiver
+    │ 
+    │ Help: Call `set` directly on a declared storage vector, not on a temporary expression.
+────╯
+[ETYC0372191] Error: The receiver of `Vector::push` must be a storage vector.
+    ╭─[ compiler-test:19:25 ]
+    │
+ 19 │         return final { (c ? h1 : h2).push(1u64); }; // ❌ non-path receiver
+    │ 
+    │ Help: Call `push` directly on a declared storage vector, not on a temporary expression.
+────╯
+[ETYC0372191] Error: The receiver of `Vector::pop` must be a storage vector.
+    ╭─[ compiler-test:24:28 ]
+    │
+ 24 │             let x: u64? = (c ? h1 : h2).pop(); // ❌ non-path receiver
+    │ 
+    │ Help: Call `pop` directly on a declared storage vector, not on a temporary expression.
+────╯
+[ETYC0372191] Error: The receiver of `Vector::swap_remove` must be a storage vector.
+    ╭─[ compiler-test:31:27 ]
+    │
+ 31 │             let x: u64 = (c ? h1 : h2).swap_remove(0u32); // ❌ non-path receiver
+    │ 
+    │ Help: Call `swap_remove` directly on a declared storage vector, not on a temporary expression.
+────╯
+[ETYC0372191] Error: The receiver of `Vector::clear` must be a storage vector.
+    ╭─[ compiler-test:37:25 ]
+    │
+ 37 │         return final { (c ? h1 : h2).clear(); }; // ❌ non-path receiver
+    │ 
+    │ Help: Call `clear` directly on a declared storage vector, not on a temporary expression.
+────╯
+[ETYC0372191] Error: The receiver of `Mapping::set` must be a mapping.
+    ╭─[ compiler-test:41:25 ]
+    │
+ 41 │         return final { (c ? m1 : m2).set(0u32, 1u32); }; // ❌ non-path receiver
+    │ 
+    │ Help: Call `set` directly on a declared mapping, not on a temporary expression.
+────╯
+[ETYC0372191] Error: The receiver of `Mapping::remove` must be a mapping.
+    ╭─[ compiler-test:45:25 ]
+    │
+ 45 │         return final { (c ? m1 : m2).remove(0u32); }; // ❌ non-path receiver
+    │ 
+    │ Help: Call `remove` directly on a declared mapping, not on a temporary expression.
+────╯

tests/tests/compiler/storage/ternary_mapping_receiver_fail.leo

@@ -0,0 +1,30 @@
+// Companion to #29428: ensure non-path receivers for `Mapping::get` /
+// `Mapping::contains` / `Mapping::get_or_use` are also caught cleanly.
+program bugpoc_map.aleo {
+    @noupgrade
+    constructor() {}
+
+    mapping m1: u32 => u32;
+    mapping m2: u32 => u32;
+
+    fn method_get(c: bool) -> Final {
+        return final {
+            let v: u32 = (c ? m1 : m2).get(0u32); // ❌ non-path receiver
+            assert(v >= 0u32);
+        };
+    }
+
+    fn method_contains(c: bool) -> Final {
+        return final {
+            let b: bool = (c ? m1 : m2).contains(0u32); // ❌ non-path receiver
+            assert(b == b);
+        };
+    }
+
+    fn method_get_or_use(c: bool) -> Final {
+        return final {
+            let v: u32 = (c ? m1 : m2).get_or_use(0u32, 0u32); // ❌ non-path receiver
+            assert(v >= 0u32);
+        };
+    }
+}