Skip to content

TypeChecker: reject zero-length static array element types#16718

Open
genisis0x wants to merge 1 commit into
argotorg:developfrom
genisis0x:fix/16627-ice-zero-length-array-element
Open

TypeChecker: reject zero-length static array element types#16718
genisis0x wants to merge 1 commit into
argotorg:developfrom
genisis0x:fix/16627-ice-zero-length-array-element

Conversation

@genisis0x
Copy link
Copy Markdown

Summary

`DeclarationTypeChecker::endVisit(ArrayTypeName)` rejects `uint256[0]` (and similar) with TypeError 1406 "Array with zero length specified.", but that visitor only runs for ArrayTypeName declarations. Static array types written as expressions — e.g. inside `abi.decode((uint256[0][]))` — are constructed in `TypeChecker::visit(IndexAccess)` through the TypeType branch, which never validated the literal length. The zero-length type then propagated to codegen and triggered an ICE in `ABIFunctions::abiDecodingFunctionArrayAvailableLength` (and other callers that assume `calldataStride() > 0`).

Apply the same rejection here as a fatal type error so the existing 1406 diagnostic is the only message users see and codegen is never reached with a zero-length element type.

Fixes #16627

Test plan

  • Added `test/libsolidity/syntaxTests/array/length/abi_decode_zero_length_element.sol` covering the MRE from the issue. Expects TypeError 1406 in the same form as the existing declaration-side tests.
  • Full `make test` not run locally (no build environment); relying on CI.

DeclarationTypeChecker::endVisit(ArrayTypeName) rejects `uint256[0]` (and
similar) with TypeError 1406 "Array with zero length specified.", but that
visitor only runs for ArrayTypeName declarations. Static array types
written as expressions — e.g. inside `abi.decode((uint256[0][]))` — are
constructed in TypeChecker::visit(IndexAccess) through the TypeType
branch, which never validated the literal length. The zero-length type
then propagated to codegen and triggered an ICE in
ABIFunctions::abiDecodingFunctionArrayAvailableLength (and other callers
that assume `calldataStride() > 0`).

Apply the same rejection here as a fatal type error so the existing 1406
diagnostic is the only message users see and codegen is never reached
with a zero-length element type.

Fixes argotorg#16627
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ICE in ABIFunctions::abiDecodingFunctionArrayAvailableLength when decoding a dynamic array with a zero-sized element type

1 participant