IR-based codegen: Modifying the length of a dynamic array to a large number in assembly, followed by a push() operation, will cause a revert.

[Subway2023]

• Compiler version: 0.8.27
• Target EVM version (as per compiler settings): None
• Framework/IDE (e.g. Truffle or Remix): Remix
• EVM execution environment / backend / blockchain client: None
• Operating system: None

Steps to Reproduce

contract A {
    int[] public a;
    function f() public  {
        assembly {
            let converted := 14
            let _1 := 50
            sstore(0, keccak256(_1, converted))
            // sstore(0, 1)
        }
        a.push(2);
    }
}

Remix

Legacy codegen

IR-based codegen

1. If we comment out a.push(2), transaction will not revert
2. If replaced with sstore(0, 1), it still will not revert