Merge pull request #8726 from ethereum/fix-8724

Yul proto spec: Add multiple variable declaration statement

test/tools/ossfuzz/protoToYul.cpp

@@ -344,62 +344,102 @@ void ProtoConverter::visit(BinaryOp const& _x)
 	m_output << ")";
 }
 
-void ProtoConverter::visit(VarDecl const& _x)
+void ProtoConverter::scopeVariables(vector<string> const& _varNames)
 {
-	string varName = newVarName();
-	m_output << "let " << varName << " := ";
-	visit(_x.expr());
-	m_output << "\n";
 	// If we are inside a for-init block, there are two places
 	// where the visited vardecl may have been defined:
 	// - directly inside the for-init block
 	// - inside a block within the for-init block
-	// In the latter case, we don't scope extend.
+	// In the latter case, we don't scope extend. The flag
+	// m_forInitScopeExtEnabled (= true) indicates whether we are directly
+	// inside a for-init block e.g., for { let x } or (= false) inside a
+	// nested for-init block e.g., for { { let x } }
+	bool forInitScopeExtendVariable = m_inForInitScope && m_forInitScopeExtEnabled;
+
+	// There are four cases that are tackled here
+	// Case 1. We are inside a function definition and the variable declaration's
+	// scope needs to be extended.
+	// Case 2. We are inside a function definition but scope extension is disabled
+	// Case 3. We are inside global scope and scope extension is required
+	// Case 4. We are inside global scope but scope extension is disabled
 	if (m_inFunctionDef)
 	{
 		// Variables declared directly in for-init block
 		// are tracked separately because their scope
 		// extends beyond the block they are defined in
 		// to the rest of the for-loop statement.
-		if (m_inForInitScope && m_forInitScopeExtEnabled)
+		// Case 1
+		if (forInitScopeExtendVariable)
 		{
 			yulAssert(
 				!m_funcForLoopInitVars.empty() && !m_funcForLoopInitVars.back().empty(),
 				"Proto fuzzer: Invalid operation"
 			);
-			m_funcForLoopInitVars.back().back().push_back(varName);
+			for (auto const& varName: _varNames)
+				m_funcForLoopInitVars.back().back().push_back(varName);
 		}
+		// Case 2
 		else
 		{
 			yulAssert(
 				!m_funcVars.empty() && !m_funcVars.back().empty(),
 				"Proto fuzzer: Invalid operation"
 			);
-			m_funcVars.back().back().push_back(varName);
+			for (auto const& varName: _varNames)
+				m_funcVars.back().back().push_back(varName);
 		}
-
 	}
+	// If m_inFunctionDef is false, we are in global scope
 	else
 	{
-		if (m_inForInitScope && m_forInitScopeExtEnabled)
+		// Case 3
+		if (forInitScopeExtendVariable)
 		{
-			yulAssert(
+			yulAssert(!m_globalForLoopInitVars.empty(), "Proto fuzzer: Invalid operation");
-				!m_globalForLoopInitVars.empty(),
+
-				"Proto fuzzer: Invalid operation"
+			for (auto const& varName: _varNames)
-			);
+				m_globalForLoopInitVars.back().push_back(varName);
-			m_globalForLoopInitVars.back().push_back(varName);
 		}
+		// Case 4
 		else
 		{
-			yulAssert(
+			yulAssert(!m_globalVars.empty(), "Proto fuzzer: Invalid operation");
-				!m_globalVars.empty(),
+
-				"Proto fuzzer: Invalid operation"
+			for (auto const& varName: _varNames)
-			);
+				m_globalVars.back().push_back(varName);
-			m_globalVars.back().push_back(varName);
 		}
 	}
 }
 
+void ProtoConverter::visit(VarDecl const& _x)
+{
+	string varName = newVarName();
+	m_output << "let " << varName << " := ";
+	visit(_x.expr());
+	m_output << "\n";
+	scopeVariables({varName});
+}
+
+void ProtoConverter::visit(MultiVarDecl const& _x)
+{
+	m_output << "let ";
+	vector<string> varNames;
+	// We support up to 4 variables in a single
+	// declaration statement.
+	unsigned numVars = _x.num_vars() % 3 + 2;
+	string delimiter = "";
+	for (unsigned i = 0; i < numVars; i++)
+	{
+		string varName = newVarName();
+		varNames.push_back(varName);
+		m_output << delimiter << varName;
+		if (i == 0)
+			delimiter = ", ";
+	}
+	m_output << "\n";
+	scopeVariables(varNames);
+}
+
 void ProtoConverter::visit(TypedVarDecl const& _x)
 {
 	string varName = newVarName();
@@ -659,7 +699,7 @@ void ProtoConverter::visit(CopyFunc const& _x)
 	CopyFunc_CopyType type = _x.ct();
 
 	// datacopy() is valid only if we are inside
-	// a yul object.
+	// a Yul object.
 	if (type == CopyFunc::DATA && !m_isObject)
 		return;
 
@@ -1093,7 +1133,8 @@ void ProtoConverter::visit(ForStmt const& _x)
 	{
 		yulAssert(
 			!m_funcForLoopInitVars.empty() && !m_funcForLoopInitVars.back().empty(),
-			"Proto fuzzer: Invalid data structure");
+			"Proto fuzzer: Invalid data structure"
+		);
 		// Remove variables in for-init
 		m_funcForLoopInitVars.back().pop_back();
 	}
@@ -1361,6 +1402,9 @@ void ProtoConverter::visit(Statement const& _x)
 		if (m_inFunctionDef)
 			visit(_x.leave());
 		break;
+	case Statement::kMultidecl:
+		visit(_x.multidecl());
+		break;
 	case Statement::STMT_ONEOF_NOT_SET:
 		break;
 	}
@@ -1606,7 +1650,7 @@ void ProtoConverter::fillFunctionCallInput(unsigned _numInParams)
 	{
 		// Throw a 4-sided dice to choose whether to populate function input
 		// argument from a pseudo-randomly chosen slot in one of the following
-		// locations: calldata, memory, storage, or yul optimizer dictionary.
+		// locations: calldata, memory, storage, or Yul optimizer dictionary.
 		unsigned diceValue = counter() % 4;
 		// Pseudo-randomly choose one of the first ten 32-byte
 		// aligned slots.
@@ -1747,7 +1791,7 @@ void ProtoConverter::createFunctionDefAndCall(
 
 	yulAssert(
 		!m_inForInitScope,
-		"Proto fuzzer: Trying to create function call inside for-init block"
+		"Proto fuzzer: Trying to create function call inside a for-init block"
 	);
 	if (_x.force_call())
 		createFunctionCall(funcName, _numInParams, _numOutParams);
@@ -1837,7 +1881,7 @@ void ProtoConverter::visit(Program const& _x)
 	// Record EVM Version
 	m_evmVersion = evmVersionMapping(_x.ver());
 
-	// Program is either a yul object or a block of
+	// Program is either a Yul object or a block of
 	// statements.
 	switch (_x.program_oneof_case())
 	{
@@ -1854,7 +1898,7 @@ void ProtoConverter::visit(Program const& _x)
 		visit(_x.obj());
 		break;
 	case Program::PROGRAM_ONEOF_NOT_SET:
-		// {} is a trivial yul program
+		// {} is a trivial Yul program
 		m_output << "{}";
 		break;
 	}

test/tools/ossfuzz/protoToYul.h

@@ -68,7 +68,7 @@ private:
 	void visit(BinaryOp const&);
 
 	/// Visits a basic block optionally adding @a _funcParams to scope.
-	/// @param _block Reference to a basic block of yul statements.
+	/// @param _block Reference to a basic block of Yul statements.
 	/// @param _funcParams List of function parameter names, defaults to
 	/// an empty vector.
 	void visit(Block const& _block);
@@ -77,6 +77,7 @@ private:
 	void visit(VarRef const&);
 	void visit(Expression const&);
 	void visit(VarDecl const&);
+	void visit(MultiVarDecl const&);
 	void visit(TypedVarDecl const&);
 	void visit(UnaryOp const&);
 	void visit(AssignmentStatement const&);
@@ -196,7 +197,7 @@ private:
 	/// false otherwise
 	bool functionValid(FunctionCall_Returns _type, unsigned _numOutParams);
 
-	/// Converts protobuf function call to a yul function call and appends
+	/// Converts protobuf function call to a Yul function call and appends
 	/// it to output stream.
 	/// @param _x Protobuf function call
 	/// @param _name Function name
@@ -210,7 +211,7 @@ private:
 		bool _newLine = true
 	);
 
-	/// Prints a yul formatted variable declaration statement to the output
+	/// Prints a Yul formatted variable declaration statement to the output
 	/// stream.
 	/// Example 1: createVarDecls(0, 1, true) returns {"x_0"} and prints
 	///		let x_0 :=
@@ -235,21 +236,26 @@ private:
 	/// @return A vector of strings containing the printed variable names.
 	std::vector<std::string> createVars(unsigned _startIdx, unsigned _endIdx);
 
-	/// Print the yul syntax to make a call to a function named @a _funcName to
+	/// Manages scope of Yul variables
+	/// @param _varNames is a list of Yul variable names whose scope needs
+	/// to be tracked according to Yul scoping rules.
+	void scopeVariables(std::vector<std::string> const& _varNames);
+
+	/// Print the Yul syntax to make a call to a function named @a _funcName to
 	/// the output stream.
 	/// @param _funcName Name of the function to be called
 	/// @param _numInParams Number of input parameters in function signature
 	/// @param _numOutParams Number of output parameters in function signature
 	void createFunctionCall(std::string _funcName, unsigned _numInParams, unsigned _numOutParams);
 
-	/// Print the yul syntax to pass input arguments to a function that has
+	/// Print the Yul syntax to pass input arguments to a function that has
 	/// @a _numInParams number of input parameters to the output stream.
 	/// The input arguments are pseudo-randomly chosen from calldata, memory,
-	/// storage, or the yul optimizer hex dictionary.
+	/// storage, or the Yul optimizer hex dictionary.
 	/// @param _numInParams Number of input arguments to fill
 	void fillFunctionCallInput(unsigned _numInParams);
 
-	/// Print the yul syntax to save values returned by a function call
+	/// Print the Yul syntax to save values returned by a function call
 	/// to the output stream. The values are either stored to memory or
 	/// storage based on a simulated coin flip. The saved location is
 	/// decided pseudo-randomly.
@@ -266,7 +272,7 @@ private:
 
 	/// Build a tree of objects that contains the object/data
 	/// identifiers that are in scope in a given object.
-	/// @param _x root object of the yul protobuf specification.
+	/// @param _x root object of the Yul protobuf specification.
 	void buildObjectScopeTree(Object const& _x);
 
 	/// Returns a pseudo-random dictionary token.

test/tools/ossfuzz/yulProto.proto

@@ -21,6 +21,10 @@ message VarDecl {
   required Expression expr = 1;
 }
 
+message MultiVarDecl {
+  required uint32 num_vars = 1;
+}
+
 message LowLevelCall {
   enum Type {
     CALL = 0;
@@ -373,6 +377,7 @@ message Statement {
     FunctionDef         funcdef         = 16;
     PopStmt             pop             = 17;
     LeaveStmt           leave           = 18;
+    MultiVarDecl        multidecl       = 19;
   }
 }