Skip to content

Commit b432744

Browse files
rodiazetrodiazet
committed
Add changelog and bug list entry.
1 parent c8e7f43 commit b432744

3 files changed

Lines changed: 42 additions & 1 deletion

File tree

‎Changelog.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@
33
Language Features:
44
* General: Add a builtin that computes the base slot of a storage namespace using the `erc7201` formula from ERC-7201.
55

6+
Important Bugfixes:
7+
* Yul Optimizer: Fix `UnusedStoreEliminator` incorrectly removing `returndatacopy` operations when the length comes from a stale `returndatasize()` call that was invalidated by subsequent call opcodes.
8+
69
Compiler Features:
710
* Commandline Interface: Disallow selecting the deprecated assembly input mode that was only accessible via `--assemble` instead of treating it as equivalent to `--strict-assembly`.
811
* Commandline Interface: Introduce `--experimental` flag required for enabling the experimental mode.
@@ -15,6 +18,7 @@ Compiler Features:
1518
* Standard JSON Interface: Introduce `settings.experimental` setting required for enabling the experimental mode.
1619
* Standard JSON Interface: Replace the top-level ``ethdebug`` output with ``ethdebug.resources`` and ``ethdebug.compilation``. Decouple ethdebug outputs from binary compilation so that global ethdebug outputs can be produced without generating bytecode.
1720
* Yul Optimizer: Improve performance of control flow side effects collector and function references resolver.
21+
* Yul Optimizer: Remove optimization that eliminated `returndatacopy` operations.
1822

1923
Bugfixes:
2024
* Yul: Fix incorrect serialization of Yul object names containing double quotes and escape sequences, producing output that could not be parsed as valid Yul.

‎docs/bugs.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,18 @@
11
[
2+
{
3+
"uid": "SOL-2026-2",
4+
"name": "UnusedStoreEliminatorStaleReturnDataSize",
5+
"summary": "The Yul optimizer's ``UnusedStoreEliminator`` may incorrectly remove ``returndatacopy(...)`` operations when using a stale value from ``returndatasize()`` that was invalidated by subsequent call operations.",
6+
"description": "The ``UnusedStoreEliminator`` is a Yul optimizer step that removes redundant memory and storage writes. One of the operations eligible for removal is ``returndatacopy(...)``. This particular operation has a quirk - unlike any other instruction for bulk memory copying it reverts on out-of-bounds access. A revert is one of the side-effects that the optimizer guarantees to preserve so the operation can only be removed when it is certain that it cannot revert. This is the case when the entire return data buffer is copied to memory, i.e. when the start offset is zero and the length equals ``returndatasize()``. The optimizer was special-cased to detect and optimize only this specific pattern, since it matches the code produced by the code generator for external calls. However, the check did not account for the possibility of ``returndatasize()`` values becoming stale. The size of the return data buffer is updated by ``call()``, ``staticcall()``, ``delegatecall()``, and ``callcode()``. If a ``returndatasize()`` value is stored in a variable before such an operation and then used in a subsequent ``returndatacopy(...)``, the stored size may no longer reflect the actual return data buffer size. Despite this, the optimizer would consider it safe to remove, bypassing the revert and allowing the code to continue, possibly leading to unexpected behavior. Since the code generator never produces code that interleaves multiple calls and access to their return data, the bug only affected inline assembly or handwritten Yul code. The necessary condition is the use of an optimizer sequence including the ``UnusedStoreEliminator`` step (which is the default).",
7+
"link": "https://blog.soliditylang.org/2026/04/21/unusedstore-eliminator-stale-returndatasize-bug/",
8+
"introduced": "0.8.13",
9+
"fixed": "0.8.35",
10+
"severity": "very low",
11+
"conditions": {
12+
"yulOptimizer": true,
13+
"evmVersion": ">=byzantium"
14+
}
15+
},
216
{
317
"uid": "SOL-2026-1",
418
"name": "TransientStorageClearingHelperCollision",

‎docs/bugs_by_version.json‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1869,6 +1869,7 @@
18691869
},
18701870
"0.8.13": {
18711871
"bugs": [
1872+
"UnusedStoreEliminatorStaleReturnDataSize",
18721873
"LostStorageArrayWriteOnSlotOverflow",
18731874
"VerbatimInvalidDeduplication",
18741875
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
@@ -1884,6 +1885,7 @@
18841885
},
18851886
"0.8.14": {
18861887
"bugs": [
1888+
"UnusedStoreEliminatorStaleReturnDataSize",
18871889
"LostStorageArrayWriteOnSlotOverflow",
18881890
"VerbatimInvalidDeduplication",
18891891
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
@@ -1897,6 +1899,7 @@
18971899
},
18981900
"0.8.15": {
18991901
"bugs": [
1902+
"UnusedStoreEliminatorStaleReturnDataSize",
19001903
"LostStorageArrayWriteOnSlotOverflow",
19011904
"VerbatimInvalidDeduplication",
19021905
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
@@ -1908,6 +1911,7 @@
19081911
},
19091912
"0.8.16": {
19101913
"bugs": [
1914+
"UnusedStoreEliminatorStaleReturnDataSize",
19111915
"LostStorageArrayWriteOnSlotOverflow",
19121916
"VerbatimInvalidDeduplication",
19131917
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
@@ -1918,6 +1922,7 @@
19181922
},
19191923
"0.8.17": {
19201924
"bugs": [
1925+
"UnusedStoreEliminatorStaleReturnDataSize",
19211926
"LostStorageArrayWriteOnSlotOverflow",
19221927
"VerbatimInvalidDeduplication",
19231928
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
@@ -1927,6 +1932,7 @@
19271932
},
19281933
"0.8.18": {
19291934
"bugs": [
1935+
"UnusedStoreEliminatorStaleReturnDataSize",
19301936
"LostStorageArrayWriteOnSlotOverflow",
19311937
"VerbatimInvalidDeduplication",
19321938
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
@@ -1936,6 +1942,7 @@
19361942
},
19371943
"0.8.19": {
19381944
"bugs": [
1945+
"UnusedStoreEliminatorStaleReturnDataSize",
19391946
"LostStorageArrayWriteOnSlotOverflow",
19401947
"VerbatimInvalidDeduplication",
19411948
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
@@ -1960,6 +1967,7 @@
19601967
},
19611968
"0.8.20": {
19621969
"bugs": [
1970+
"UnusedStoreEliminatorStaleReturnDataSize",
19631971
"LostStorageArrayWriteOnSlotOverflow",
19641972
"VerbatimInvalidDeduplication",
19651973
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
@@ -1969,57 +1977,66 @@
19691977
},
19701978
"0.8.21": {
19711979
"bugs": [
1980+
"UnusedStoreEliminatorStaleReturnDataSize",
19721981
"LostStorageArrayWriteOnSlotOverflow",
19731982
"VerbatimInvalidDeduplication"
19741983
],
19751984
"released": "2023-07-19"
19761985
},
19771986
"0.8.22": {
19781987
"bugs": [
1988+
"UnusedStoreEliminatorStaleReturnDataSize",
19791989
"LostStorageArrayWriteOnSlotOverflow",
19801990
"VerbatimInvalidDeduplication"
19811991
],
19821992
"released": "2023-10-25"
19831993
},
19841994
"0.8.23": {
19851995
"bugs": [
1996+
"UnusedStoreEliminatorStaleReturnDataSize",
19861997
"LostStorageArrayWriteOnSlotOverflow"
19871998
],
19881999
"released": "2023-11-08"
19892000
},
19902001
"0.8.24": {
19912002
"bugs": [
2003+
"UnusedStoreEliminatorStaleReturnDataSize",
19922004
"LostStorageArrayWriteOnSlotOverflow"
19932005
],
19942006
"released": "2024-01-25"
19952007
},
19962008
"0.8.25": {
19972009
"bugs": [
2010+
"UnusedStoreEliminatorStaleReturnDataSize",
19982011
"LostStorageArrayWriteOnSlotOverflow"
19992012
],
20002013
"released": "2024-03-14"
20012014
},
20022015
"0.8.26": {
20032016
"bugs": [
2017+
"UnusedStoreEliminatorStaleReturnDataSize",
20042018
"LostStorageArrayWriteOnSlotOverflow"
20052019
],
20062020
"released": "2024-05-21"
20072021
},
20082022
"0.8.27": {
20092023
"bugs": [
2024+
"UnusedStoreEliminatorStaleReturnDataSize",
20102025
"LostStorageArrayWriteOnSlotOverflow"
20112026
],
20122027
"released": "2024-09-04"
20132028
},
20142029
"0.8.28": {
20152030
"bugs": [
2031+
"UnusedStoreEliminatorStaleReturnDataSize",
20162032
"TransientStorageClearingHelperCollision",
20172033
"LostStorageArrayWriteOnSlotOverflow"
20182034
],
20192035
"released": "2024-10-09"
20202036
},
20212037
"0.8.29": {
20222038
"bugs": [
2039+
"UnusedStoreEliminatorStaleReturnDataSize",
20232040
"TransientStorageClearingHelperCollision",
20242041
"LostStorageArrayWriteOnSlotOverflow"
20252042
],
@@ -2041,32 +2058,38 @@
20412058
},
20422059
"0.8.30": {
20432060
"bugs": [
2061+
"UnusedStoreEliminatorStaleReturnDataSize",
20442062
"TransientStorageClearingHelperCollision",
20452063
"LostStorageArrayWriteOnSlotOverflow"
20462064
],
20472065
"released": "2025-05-07"
20482066
},
20492067
"0.8.31": {
20502068
"bugs": [
2069+
"UnusedStoreEliminatorStaleReturnDataSize",
20512070
"TransientStorageClearingHelperCollision",
20522071
"LostStorageArrayWriteOnSlotOverflow"
20532072
],
20542073
"released": "2025-12-03"
20552074
},
20562075
"0.8.32": {
20572076
"bugs": [
2077+
"UnusedStoreEliminatorStaleReturnDataSize",
20582078
"TransientStorageClearingHelperCollision"
20592079
],
20602080
"released": "2025-12-18"
20612081
},
20622082
"0.8.33": {
20632083
"bugs": [
2084+
"UnusedStoreEliminatorStaleReturnDataSize",
20642085
"TransientStorageClearingHelperCollision"
20652086
],
20662087
"released": "2025-12-18"
20672088
},
20682089
"0.8.34": {
2069-
"bugs": [],
2090+
"bugs": [
2091+
"UnusedStoreEliminatorStaleReturnDataSize"
2092+
],
20702093
"released": "2026-02-18"
20712094
},
20722095
"0.8.4": {

0 commit comments

Comments
 (0)