mirror of
https://github.com/ethereum/solidity
synced 2023-10-03 13:03:40 +00:00
FullInliner: Fix order of arguments of inlined functions
This commit is contained in:
Kamil Śliwak
@@ -1,4 +1,17 @@
|
||||
[
|
||||
{
|
||||
"uid": "SOL-2023-2",
|
||||
"name": "FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"summary": "Optimizer sequences containing FullInliner do not preserve the evaluation order of arguments of inlined function calls in code that is not in expression-split form.",
|
||||
"description": "Function call arguments in Yul are evaluated right to left. This order matters when the argument expressions have side-effects, and changing it may change contract behavior. FullInliner is an optimizer step that can replace a function call with the body of that function. The transformation involves assigning argument expressions to temporary variables, which imposes an explicit evaluation order. FullInliner was written with the assumption that this order does not necessarily have to match usual argument evaluation order because the argument expressions have no side-effects. In most circumstances this assumption is true because the default optimization step sequence contains the ExpressionSplitter step. ExpressionSplitter ensures that the code is in *expression-split form*, which means that function calls cannot appear nested inside expressions, and all function call arguments have to be variables. The assumption is, however, not guaranteed to be true in general. Version 0.6.7 introduced a setting allowing users to specify an arbitrary optimization step sequence, making it possible for the FullInliner to actually encounter argument expressions with side-effects, which can result in behavior differences between optimized and unoptimized bytecode. Contracts compiled without optimization or with the default optimization sequence are not affected. To trigger the bug the user has to explicitly choose compiler settings that contain a sequence with FullInliner step not preceded by ExpressionSplitter.",
|
||||
"link": "https://blog.soliditylang.org/2023/07/19/full-inliner-non-expression-split-argument-evaluation-order-bug/",
|
||||
"introduced": "0.6.7",
|
||||
"fixed": "0.8.21",
|
||||
"severity": "low",
|
||||
"conditions": {
|
||||
"yulOptimizer": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"uid": "SOL-2022-7",
|
||||
"name": "StorageWriteRemovalBeforeConditionalTermination",
|
||||
|
||||
@@ -1422,6 +1422,7 @@
|
||||
},
|
||||
"0.6.10": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1436,6 +1437,7 @@
|
||||
},
|
||||
"0.6.11": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1450,6 +1452,7 @@
|
||||
},
|
||||
"0.6.12": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1548,6 +1551,7 @@
|
||||
},
|
||||
"0.6.7": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"NestedCalldataArrayAbiReencodingSizeValidation",
|
||||
@@ -1564,6 +1568,7 @@
|
||||
},
|
||||
"0.6.8": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"NestedCalldataArrayAbiReencodingSizeValidation",
|
||||
@@ -1577,6 +1582,7 @@
|
||||
},
|
||||
"0.6.9": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1592,6 +1598,7 @@
|
||||
},
|
||||
"0.7.0": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1606,6 +1613,7 @@
|
||||
},
|
||||
"0.7.1": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1621,6 +1629,7 @@
|
||||
},
|
||||
"0.7.2": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1635,6 +1644,7 @@
|
||||
},
|
||||
"0.7.3": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1648,6 +1658,7 @@
|
||||
},
|
||||
"0.7.4": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1660,6 +1671,7 @@
|
||||
},
|
||||
"0.7.5": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1672,6 +1684,7 @@
|
||||
},
|
||||
"0.7.6": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1684,6 +1697,7 @@
|
||||
},
|
||||
"0.8.0": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1696,6 +1710,7 @@
|
||||
},
|
||||
"0.8.1": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1708,6 +1723,7 @@
|
||||
},
|
||||
"0.8.10": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1717,6 +1733,7 @@
|
||||
},
|
||||
"0.8.11": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1727,6 +1744,7 @@
|
||||
},
|
||||
"0.8.12": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1737,6 +1755,7 @@
|
||||
},
|
||||
"0.8.13": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"StorageWriteRemovalBeforeConditionalTermination",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
@@ -1748,6 +1767,7 @@
|
||||
},
|
||||
"0.8.14": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"StorageWriteRemovalBeforeConditionalTermination",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
@@ -1757,6 +1777,7 @@
|
||||
},
|
||||
"0.8.15": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"StorageWriteRemovalBeforeConditionalTermination",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup"
|
||||
],
|
||||
@@ -1764,24 +1785,32 @@
|
||||
},
|
||||
"0.8.16": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"StorageWriteRemovalBeforeConditionalTermination"
|
||||
],
|
||||
"released": "2022-08-08"
|
||||
},
|
||||
"0.8.17": {
|
||||
"bugs": [],
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder"
|
||||
],
|
||||
"released": "2022-09-08"
|
||||
},
|
||||
"0.8.18": {
|
||||
"bugs": [],
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder"
|
||||
],
|
||||
"released": "2023-02-01"
|
||||
},
|
||||
"0.8.19": {
|
||||
"bugs": [],
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder"
|
||||
],
|
||||
"released": "2023-02-22"
|
||||
},
|
||||
"0.8.2": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1793,11 +1822,14 @@
|
||||
"released": "2021-03-02"
|
||||
},
|
||||
"0.8.20": {
|
||||
"bugs": [],
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder"
|
||||
],
|
||||
"released": "2023-05-10"
|
||||
},
|
||||
"0.8.3": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1809,6 +1841,7 @@
|
||||
},
|
||||
"0.8.4": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1819,6 +1852,7 @@
|
||||
},
|
||||
"0.8.5": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1829,6 +1863,7 @@
|
||||
},
|
||||
"0.8.6": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1839,6 +1874,7 @@
|
||||
},
|
||||
"0.8.7": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1849,6 +1885,7 @@
|
||||
},
|
||||
"0.8.8": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
@@ -1860,6 +1897,7 @@
|
||||
},
|
||||
"0.8.9": {
|
||||
"bugs": [
|
||||
"FullInlinerNonExpressionSplitArgumentEvaluationOrder",
|
||||
"AbiReencodingHeadOverflowWithStaticArrayCleanup",
|
||||
"DirtyBytesArrayToStorage",
|
||||
"DataLocationChangeInInternalOverride",
|
||||
|
||||
@@ -570,7 +570,7 @@ It is not applied to loop iteration-condition, because the loop control flow doe
|
||||
this "outlining" of the inner expressions in all cases. We can sidestep this limitation by applying
|
||||
:ref:`for-loop-condition-into-body` to move the iteration condition into loop body.
|
||||
|
||||
The final program should be in a form such that (with the exception of loop conditions)
|
||||
The final program should be in an *expression-split form*, where (with the exception of loop conditions)
|
||||
function calls cannot appear nested inside expressions
|
||||
and all function call arguments have to be variables.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user