PR #4795 Ships Venom Regression

[pcaversaccio]

Version Information

• vyper Version (output of vyper --version): 0.4.4+commit.418dbda6
• OS: linux
• Python Version (output of python --version): 3.14.2

What's your issue about?

The commit 418dbda (PR #4795) introduces a regression in Vyper. My nightly snekmate tests were failing: https://github.com/pcaversaccio/snekmate/actions/runs/20632614478/job/59253113565#step:12:54191

Failing tests:
Encountered 1 failing test in test/governance/TimelockController.t.sol:TimelockControllerTest
[FAIL: Failed(0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f)] testHandleERC721() (gas: 1040430236)

Encountered 1 failing test in test/tokens/ERC20.t.sol:ERC20Invariants
[FAIL: Failed(0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f)] setUp() (gas: 0)

Encountered 1 failing test in test/tokens/ERC20.t.sol:ERC20Test
[FAIL: Failed(0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f)] setUp() (gas: 0)

Encountered 1 failing test in test/tokens/ERC721.t.sol:ERC721Invariants
[FAIL: Failed(0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f)] setUp() (gas: 0)

Encountered 1 failing test in test/tokens/ERC721.t.sol:ERC721Test
[FAIL: Failed(0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f)] setUp() (gas: 0)

Encountered a total of 5 failing tests, 631 tests succeeded

    │   ├─ [50607] → new <unknown>@0x104fBc016F4bb334D775a19E8A6510109AC63E00
    │   │   ├─ emit OwnershipTransferred(previousOwner: 0x0000000000000000000000000000000000000000, newOwner: VyperDeployer: [0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f])
    │   │   ├─ emit RoleMinterChanged(minter: VyperDeployer: [0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f], status: true)
    │   │   └─ ← [InvalidOperandOOG]
    │   └─ ← [Revert] Failed(0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f)
    └─ ← [Revert] Failed(0x5615dEB798BB3E4dFa0139dFa1b3D433Cc23b72f)

those are the Vyper contracts that generate invalid bytecode using venom with latest master commit:

• https://github.com/pcaversaccio/snekmate/blob/main/src/snekmate/governance/mocks/timelock_controller_mock.vy
• https://github.com/pcaversaccio/snekmate/blob/main/src/snekmate/tokens/mocks/erc20_mock.vy
• https://github.com/pcaversaccio/snekmate/blob/main/src/snekmate/tokens/mocks/erc721_mock.vy

How can it be fixed?

Make it a valid bytecode.

[charles-cooper]

Triage: Root Cause Analysis

Tested on: 7d53bab7f (master)

The bug is in vyper/venom/memory_allocator.py, allocate() method, lines 54-56:

if resv_ptr < ptr:
    ptr = resv_ptr + resv_size  # BUG: can move ptr BACKWARD
    continue

When processing sorted reserved regions, if a reservation starts before the current ptr, the algorithm updates ptr to the end of that reservation. However, this can move ptr backward when there are overlapping reservations, because it doesn't check if resv_ptr + resv_size > ptr.

Venom-level reproduction

Given these reserved regions (from overlapping livesets):

reserved = [(0, 64), (0, 320), (64, 64)]  # sorted by start position

When allocating a 256-byte region:

ptr=0, size=256

Processing (0, 64):   0 >= 0, not < ptr  → ptr = 0 + 64 = 64
Processing (0, 320):  0 < 64             → ptr = 0 + 320 = 320  ✓
Processing (64, 64):  64 < 320           → ptr = 64 + 64 = 128  ✗ GOES BACKWARD!

Result: allocated at offset 128, range [128, 384)
But (0, 320) was reserved, range [0, 320)
Overlap at [128, 320) → memory corruption

Why overlapping reservations occur

The allocator processes allocations in order of liveset size (smallest first). When allocation A is placed, its livesets may not overlap with allocations B and C. But allocation D (largest liveset) may overlap with all three, creating a reserved set with overlapping regions like {(0, 64), (64, 64), (0, 320)}.

Fix

PR #4801 addresses this correctly by skipping regions that end before the current pointer:

resv_end = resv_ptr + resv_size
if resv_end <= ptr:
    continue

---

Generated with Claude Code