The optimizer incorrectly removes sstore instructions in initialization code when followed by a call to an undefined internal function

[m4k2]

Description

The optimizer incorrectly removes sstore instructions in initialization code when followed by a call to an undefined internal function (foo()).

Environment

• Compiler version: 0.8.28
• Target EVM version (as per compiler settings): Cancun
• Framework/IDE (e.g. Truffle or Remix): None
• EVM execution environment / backend / blockchain client: None
• Operating system: Linux

Steps to Reproduce

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.0;

contract A {
    function() internal foo;

    constructor(uint256 x, bytes memory) {
        assembly {
            sstore(1, x)
        }

        foo();
    }
}

$ solc-select install 0.8.12 && solc-select use 0.8.12
Installing solc '0.8.12'...
Version '0.8.12' installed.
Switched global version to 0.8.12

$ solc --optimize --ir-optimized src/A.sol | grep sstore
            sstore(1, var_x)

$ solc-select install 0.8.13 && solc-select use 0.8.13
Installing solc '0.8.13'...
Version '0.8.13' installed.
Switched global version to 0.8.13

$ solc --optimize --ir-optimized src/A.sol | grep sstore
# (no match)

$ solc-select install 0.8.28 && solc-select use 0.8.28
Installing solc '0.8.28'...
Version '0.8.28' installed.
Switched global version to 0.8.28

$ solc --optimize --ir-optimized src/A.sol | grep sstore
# (no match)

Expected behavior: find sstore in the ir-optimized output.
Actual behavior: the sstore is missing from the ir-optimized output with solc 0.8.28.

It worked as expected in 0.8.12 but from 0.8.13 to 0.8.28, the sstore is missing from the ir-optimized output

[cameel]

This is correct behavior. The foo() call will always revert, erasing any possible effects of such an sstore.

[nikola-matic]

This is correct behavior. The foo() call will always revert, erasing any possible effects of such an sstore.

Closing as not a bug.

[0xkarmacoma]

There was an error in the PoC, the intent was not for the uninitialized call to always revert, but for the constructor argument x to dynamically initialize foo. I know it's weird, but I got this to work on 0.8.12:

// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.12;

contract A {
    // events
    event Success();

    // storage
    function() internal foo;

    constructor(uint256 x) {
        assembly {
            sstore(foo.slot, x)
        }

        foo();
    }

    // public so that it's not eliminated by the optimizer
    function bar() public {
        emit Success();
    }
}

Manually inspecting the deployment bytecode shows that bar() is at 0x14b, so if we call it like this in a test:

import {A} from "src/A.sol";

contract ATest {
    function test_dyn_fun_ptr() public {
        new A(0x14b << 0x20);
    }
}

then it actually does set and call bar() as expected on 0.8.12:

Ran 1 test for test/A.t.sol:ATest
[PASS] test_dyn_fun_ptr() (gas: 97719)
Traces:
  [97719] ATest::test_dyn_fun_ptr()
    ├─ [65075] → new A@0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f
    │   ├─ emit Success()
    │   └─ ← [Return] 208 bytes of code
    └─ ← [Stop] 

but the sstore is eliminated from 0.8.13 and up as reported previously

[0xkarmacoma]

(following up in #15716)