bugc: revert on out-of-bounds indexing (#344)

* bugc: add an assert instruction that reverts with Panic

An `assert` instruction takes a condition and a panic code. Code
generation jumps over a revert when the condition holds; otherwise the
code reverts with Solidity's `Panic(uint256)` error data, and the
REVERT carries a `revert` context with the panic code and a pointer
to that data. Dead code elimination keeps asserts, and constant
folding removes an assert whose condition is a true constant.

* bugc: give an array literal a memory reference type

An array literal's value had a scalar type, so code generation took its
length as the scalar's size: [1, 2, 3].length was 32.

* bugc: require an unsigned integer index

As in Solidity, an array or bytes index and a slice bound must be an
unsigned integer. Before, a signed index compiled, and since #339 its
comparisons are signed, so -1 would pass a bounds check.

* bugc: revert on out-of-bounds indexing

Indexing an array or bytes in memory, or a fixed-size array in
storage, now reverts with Panic(0x32) when the index is not less than
the length, as Solidity does. This holds for reads and writes, at
every level of a nested array. A slice x[a:b] reverts unless
a <= b <= x.length.

The check compares as unsigned words whatever the index's type, so a
negative value cast to an index is a huge index and reverts.

Before, an index past the end read or wrote whatever memory followed:
writing m[0][1] on [[1], [2]] overwrote m[1]'s length word.

The locals soundness test that sliced msg.data[0:4] runs with no
calldata, so it slices msg.data[0:0] now.

* bugc: document bounds checks

Author: gnidan

packages/bugc/CHANGELOG.md

@@ -50,6 +50,18 @@ support. Changes to the specification itself are tracked in the root
 - A cast from dynamic `bytes` to an integer or `address` is now a type
   error, as in Solidity: cast to `bytesN` first, as in
   `msg.data[4:36] as bytes32 as uint256` ([#334]).
+- An index out of bounds now reverts with Solidity's `Panic(0x32)`, as
+  in Solidity: `a[i]` on an array or `bytes` in memory, or on a
+  fixed-size array in storage, reverts unless `i` is less than the
+  length, for reads and writes, at each level of a nested array. A slice
+  `b[s:e]` reverts unless `s <= e <= b.length`, so `msg.data[0:4]`
+  reverts on shorter calldata. The `REVERT` has a `revert` context with
+  the panic code. Before, an index past the end read or wrote the memory
+  that follows, such as the next inner array's length word. A dynamic
+  array in storage is not checked ([#344]).
+- An array or bytes index and a slice bound must now be an unsigned
+  integer, as in Solidity; cast a signed one, as in `a[i as uint256]`.
+  Before, a signed index compiled ([#344]).
 
 ### Fixed
 
@@ -187,6 +199,9 @@ support. Changes to the specification itself are tracked in the root
   skipped no length word and read a whole word, so it gave the length's
   bytes; a write failed with error EVM999, as an array element write did
   ([#343]).
+- `.length` of an array literal, as in `[1, 2, 3].length`, is now the
+  number of elements. Before, at every optimization level, it was 32
+  ([#344]).
 
 ## 0.1.0-preview.1 — 2026-10-03
 
@@ -240,3 +255,4 @@ First publication.
 [#340]: https://github.com/ethdebug/format/pull/340
 [#341]: https://github.com/ethdebug/format/pull/341
 [#343]: https://github.com/ethdebug/format/pull/343
+[#344]: https://github.com/ethdebug/format/pull/344

packages/bugc/src/evmgen/analysis/liveness.ts

@@ -284,6 +284,9 @@ function getUsedValues(inst: Ir.Instruction): Set<string> {
     case "length":
       addValue(inst.object);
       break;
+    case "assert":
+      addValue(inst.condition);
+      break;
     case "allocate":
       addValue(inst.size);
       break;
@@ -338,6 +341,7 @@ function getDefinedValue(inst: Ir.Instruction): string | undefined {
       return inst.dest;
     // These instructions don't define values
     case "write": // NEW: unified write
+    case "assert":
       return undefined;
   }
 }

packages/bugc/src/evmgen/analysis/memory.ts

@@ -265,6 +265,7 @@ function simulateInstruction(stack: string[], inst: Ir.Instruction): string[] {
     case "unary":
     case "cast":
     case "length":
+    case "assert":
       newStack.pop(); // One operand
       break;
     // NEW: unified read - pops slot/offset/length as needed
@@ -356,6 +357,9 @@ function getUsedValues(inst: Ir.Instruction): Set<string> {
     case "hash":
       addValue(inst.value);
       break;
+    case "assert":
+      addValue(inst.condition);
+      break;
     // Call instruction removed - calls are now block terminators
   }
 
@@ -412,6 +416,7 @@ function definedType(inst: Ir.Instruction): Ir.Type | undefined {
     case "compute_offset":
       return Ir.Type.Scalar.word;
     case "write":
+    case "assert":
       return undefined;
   }
 }