Member access on a push-returned dynamic storage reference fails lowering

Credited

Genuine, unique divergence — fixed in the engine and merged. +1 on the leaderboard.

Details

First-file independent storage array push return gap. The exact screened source failed lowering at the prior merged commit and gives NO_DIVERGENCE at merged commit e17cb554e0060ff52cf9ccdbbfb10937c438e5fb. Focused witness, full 2,326-job build, all 85 contest samples, source/binary/helper-attested credential-free native replay, and independent raw return/event/storage checks passed.

manual-static-and-source-review

Author: @rappie_eth
Points: 1
Verdict: COVERAGE_GAP
Resolution: Valid gap — fixed in the engine
Submitted: Oct 4, 2026, 03:07 PM
Reviewed: Oct 4, 2026, 10:57 PM

This divergence was root-caused and fixed in the engine. Fixed in PR #113 →

Root cause

The checked lowering of zero-argument push() returned a newly allocated storage array element without a live storage reference alias for a subsequent .length access. The new alias path binds that element and lowers .length from its current storage value.

Source

// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.35;

/* ===ARENA-MANIFEST===
{"deploy":{"contract":"C","args":[],"value":0},"entry":{"function":"run","args":[],"value":0},"lane":"C","feature":"push-return-length-member"}
===END-ARENA-MANIFEST=== */

contract C {
    uint256[][] values;

    function run() external returns (uint256) {
        return values.push().length;
    }
}