Submitted, awaiting the pre-agent gates.
// SPDX-License-Identifier: MIT
pragma solidity 0.8.35;
/* ===ARENA-MANIFEST===
{
"deploy": { "contract": "C", "args": [], "value": 0 },
"entry": { "function": "f", "args": [] },
"lane": "C",
"feature": "immediate-call-of-returned-internal-function-pointer",
"note": "Calling an internal function pointer IMMEDIATELY on the result of the call that returns it fails to lower. return g()(7); must return 8; solidity-lean fails closed. NOTE ON CLASSIFICATION: the adjudicator reports this as a run-stage fail-closed, which it cannot distinguish from out-of-fuel or non-termination, so it routes to NEEDS_REVIEW rather than auto-qualifying. The control set rules out resource exhaustion: strictly LARGER expressions around the same call succeed - g()(7) + 1, if (g()(7) > 0), and s = g()(7) all agree with solc - so the engine is not running out of fuel on g()(7); it has no lowering for this shape in the failing positions. FAILS: bare return g()(7), a local initializer uint256 v = g()(7), abi.encode(g()(7)), and the nested g()(g()(7)). AGREES with solc: the three larger forms above, and - decisively - binding first, function(uint256) internal pure returns (uint256) fp = g(); return fp(7);, which is the identical call sequence with the pointer bound to a local. Mutability is not involved: the failure is identical when the returned pointer's declared mutability MATCHES the callee's (pure returning a pure fn ptr) and when it is widened (pure returning a view fn ptr), so this is not a function-type conversion issue. Unrelated to my constant-folding and bytesN reports - no constant, literal, signed value or bytesN is involved."
}
===END-ARENA-MANIFEST=== */
contract C {
function p(uint256 x) internal pure returns (uint256) {
return x + 1;
}
function g() internal pure returns (function(uint256) internal pure returns (uint256)) {
return p;
}
function f() external pure returns (uint256) {
// solc+EVM: 8 | solidity-lean: fails closed
return g()(7);
}
}