Merge pull request #11899 from ethereum/move-check-keccak-gas

Resolving Keccak-256: check if arguments are identifiers early.

Changelog.md

@@ -12,6 +12,7 @@ Compiler Features:
  * SMTChecker: Add constraints to better correlate ``address(this).balance`` and ``msg.value``.
  * SMTChecker: Support the ``value`` option for external function calls.
  * Commandline Interface: Disallowed the ``--experimental-via-ir`` option to be used with Standard Json, Assembler and Linker modes.
+ * Yul Optimizer: Fix a crash in LoadResolver, when ``keccak256`` has particular non-identifier arguments.
 
 
 Bugfixes:

libyul/optimiser/LoadResolver.cpp

@@ -97,6 +97,13 @@ void LoadResolver::tryEvaluateKeccak(
 	std::vector<Expression> const& _arguments
 )
 {
+	yulAssert(_arguments.size() == 2, "");
+	Identifier const* memoryKey = std::get_if<Identifier>(&_arguments.at(0));
+	Identifier const* length = std::get_if<Identifier>(&_arguments.at(1));
+
+	if (!memoryKey || !length)
+		return;
+
 	// The costs are only correct for hashes of 32 bytes or 1 word (when rounded up).
 	GasMeter gasMeter{
 		dynamic_cast<EVMDialect const&>(m_dialect),
@@ -122,13 +129,6 @@ void LoadResolver::tryEvaluateKeccak(
 	if (costOfLiteral > costOfKeccak)
 		return;
 
-	yulAssert(_arguments.size() == 2, "");
-	Identifier const* memoryKey = std::get_if<Identifier>(&_arguments.at(0));
-	Identifier const* length = std::get_if<Identifier>(&_arguments.at(1));
-
-	if (!memoryKey || !length)
-		return;
-
 	auto memoryValue = util::valueOrNullptr(m_memory, memoryKey->name);
 	if (memoryValue && inScope(*memoryValue))
 	{

test/libyul/yulOptimizerTests/loadResolver/keccak_crash.yul

@@ -0,0 +1,13 @@
+// This test used to crash: https://github.com/ethereum/solidity/issues/11801
+{
+  for {} addmod(keccak256(0x0,create(0x0, 0x0, 0x0)), 0x0, 0x0) {} {}
+}
+// ----
+// step: loadResolver
+//
+// {
+//     for { }
+//     addmod(keccak256(0x0, create(0x0, 0x0, 0x0)), 0x0, 0x0)
+//     { }
+//     { }
+// }