Validate array length in type checker

3 files changed, 12 insertions, 1 deletions

diff --git a/Changelog.md b/Changelog.md
index a83c6ddb..cbcf83ca 100644
--- a/Changelog.md
+++ b/Changelog.md
@@ -5,6 +5,7 @@ Features:
 
 Bugfixes:
  * Parser: Fix source location of VariableDeclarationStatement.
+ * Type Checker: Properly check array length and don't rely on an assertion in code generation.
  * Type Checker: Properly support overwriting members inherited from ``address`` in a contract
    (such as ``balance``, ``transfer``, etc.)
 
diff --git a/libsolidity/analysis/ReferencesResolver.cpp b/libsolidity/analysis/ReferencesResolver.cpp
index 8f07d43a..a7fa908d 100644
--- a/libsolidity/analysis/ReferencesResolver.cpp
+++ b/libsolidity/analysis/ReferencesResolver.cpp
@@ -149,7 +149,7 @@ void ReferencesResolver::endVisit(ArrayTypeName const& _typeName)
 		if (!length->annotation().type)
 			ConstantEvaluator e(*length);
 		auto const* lengthType = dynamic_cast<RationalNumberType const*>(length->annotation().type.get());
-		if (!lengthType || lengthType->isFractional())
+		if (!lengthType || lengthType->isFractional() || !lengthType->mobileType())
 			fatalTypeError(length->location(), "Invalid array length, expected integer literal.");
 		else if (lengthType->isNegative())
 			fatalTypeError(length->location(), "Array with negative length specified.");
diff --git a/test/libsolidity/SolidityNameAndTypeResolution.cpp b/test/libsolidity/SolidityNameAndTypeResolution.cpp
index 959bc4ff..91c2adb1 100644
--- a/test/libsolidity/SolidityNameAndTypeResolution.cpp
+++ b/test/libsolidity/SolidityNameAndTypeResolution.cpp
@@ -6976,6 +6976,16 @@ BOOST_AUTO_TEST_CASE(address_overload_resolution)
 	CHECK_SUCCESS(text);
 }
 
+BOOST_AUTO_TEST_CASE(array_length_validation)
+{
+	char const* text = R"(
+		contract C {
+			uint[8**90] ids;
+		}
+	)";
+	CHECK_ERROR(text, TypeError, "Invalid array length, expected integer literal.");
+}
+
 BOOST_AUTO_TEST_SUITE_END()
 
 }