View-pure checker misses reads from storage pointer variable

[chriseth]

contract Storage {
    struct S { uint x; }
    S t;

    function store(S storage x) internal {
        S memory y = x;
    }
    
    function f() public {
        store(t);   
    }
}

Function store is considered pure. Same if x is used in function call conversion to memory. Reading members from x is properly detected.

[chriseth]

This seems to be far trickier than initially thought. During type checking, we need to store if a variable is converted from storage to memory (we wanted to do that anyway for 'copyof'), but this could be difficult for things like abi.encode() where we do not have a particular target type.

[hrkrshnn]

Related #8425?

[chriseth]

Places to check for copying:

• function call (including struct creation and special functions like bytes.concat and abi.encode)
• assignment (multi-assignment?)
• inheritance specifier
• modifier invocation
• emit statement
• revert statement
• mapping index access
• state variable declaration
• regular variable declaration (but maybe only preparatory)
• new
• return statement

[cameel]

Repro from #13174:

contract Demo {
    string internal _thing = "I am a string";

    function thing() external pure returns (string memory) {
        string storage ref;
        assembly ("memory-safe") {
            ref.slot := _thing.slot
        }
        return ref;
    }
}