Fix segmentation fault when assigning to a parenthesized non-tuple ex…

…pression of a tuple type

Co-authored-by: Kamil Śliwak <kamil.sliwak@codepoets.it>

Changelog.md

@@ -16,6 +16,7 @@ Bugfixes:
  * SMTChecker: Fix internal error when using bitwise operators with an array element as argument.
  * Standard JSON Interface: Fix ICE when the optimizer is disabled and an empty/blank string is used for ``optimizerSteps`` sequence.
  * StaticAnalyzer: Only raise a compile time error for division and modulo by zero when it's between literals.
+ * TypeChecker: Fix compiler crash when the left-hand side of an assignment was a parenthesized non-tuple expression of a tuple type.
  * Yul Optimizer: Fix the order of assignments generated by ``SSATransform`` being dependent on AST IDs, sometimes resulting in different (but equivalent) bytecode when unrelated files were added to the compilation pipeline.
 
 

libsolidity/analysis/TypeChecker.cpp

@@ -116,7 +116,8 @@ void TypeChecker::checkDoubleStorageAssignment(Assignment const& _assignment)
 		TupleType const& lhsType = dynamic_cast<TupleType const&>(*type(_lhs));
 		TupleExpression const* lhsResolved = dynamic_cast<TupleExpression const*>(resolveOuterUnaryTuples(&_lhs));
 
-		if (lhsType.components().size() != _rhs.components().size() || lhsResolved->components().size() != _rhs.components().size())
+		solAssert(!lhsResolved || lhsResolved->components().size() == lhsType.components().size());
+		if (lhsType.components().size() != _rhs.components().size())
 		{
 			solAssert(m_errorReporter.hasErrors(), "");
 			return;

test/libsolidity/syntaxTests/tupleAssignments/assignments_to_tuple_and_non_tuple_expressions_of_tuple_types.sol

@@ -0,0 +1,40 @@
+contract C {
+	uint[] public array;
+
+	function f() public {
+		// (f()) is not a tuple expression, but its value is a tuple.
+		(f()) = ();
+	}
+
+	function g() public {
+		// (revert()) is not a tuple expression, but its value is a tuple.
+		(revert()) = ();
+	}
+
+	function h() internal returns (uint, uint) {}
+
+	function i() public {
+		// (h()) is not a tuple expression, but its value is a tuple (uint, uint).
+		(h()) = (1, 1);
+	}
+
+	function j() public returns (uint, uint) {
+		// (j()) is not a tuple expression, but its value is a tuple (uint, uint).
+		(j()) = (1, 1);
+	}
+
+	function m() public {
+		// (uint x, uint y) is a tuple expression, and its value is a tuple (uint, uint).
+		(uint x, uint y) = (1, 1);
+	}
+
+	function n() public {
+		// ((array.push(), array.push())) is a tuple expression of a tuple expression, and its value is a tuple (pointer uint, pointer uint).
+		((array.push(), array.push())) = (1, 1);
+	}
+}
+// ----
+// TypeError 4247: (126-129): Expression has to be an lvalue.
+// TypeError 4247: (236-244): Expression has to be an lvalue.
+// TypeError 4247: (407-410): Expression has to be an lvalue.
+// TypeError 4247: (550-553): Expression has to be an lvalue.