Solc Compiler oversight? Innappropriate mapping declaration overwrites storage

Question

I have written a contract that has the mapping storage variable A & B. These variables get initialized with some values in constructor. A method getBalance returns the balance from mapping A & B.

In the method I declared another mapping - thinking that it would give a compilation error (since mapping allowed for storage only). Instead it lead to a strange behavior - appears that the new local mapping overwrites mappingA.

Result without local mapping (100, 200) as expected Result with local mapping (500, 200) <<< Why?

/** Tested in Truffle/TestRPC **/

contract Mapping {

  mapping(address => uint)  balancesA;
  mapping(address => uint)  balancesB;

  function Mapping() {
    // constructor
    balancesA[msg.sender] = 100;
    balancesB[msg.sender] = 200;
  }

  function getBalance(address addr) returns(uint, uint) {

    // If these 2 lines are commented then behavior is as expected
    mapping(address => uint)  balancers;
    balancers[msg.sender] = 500;

    return (balancesA[addr], balancesB[addr]);

  }
}

Answer 1

Opened an issue here, github, ethereum, solidity, issue 1731: https://github.com/ethereum/solidity/issues/1731

If I understand their process correctly, original issue 1731 is closed by issue 1737 which is now merged. Possibly the compiler is going to emit an error for this sort of thing in the future.

Both thumbs up for the devs!

https://github.com/ethereum/solidity/pull/1737

Answer 2

I'm afraid this is not a bug. I very much agree that it's a problem and presents a huge trap, though.

Please see the documentation here: https://solidity.readthedocs.io/en/v0.4.9/types.html#data-location

As mentioned in max taldykin's answer: By declaring the local variable balancers inside the function you're merely creating a new reference with a different name that points to a mapping in storage. I guess it just links to the first one it finds declared on the global level.

Declaring the local variable as memory would prevent the overwrite.

mapping(address => uint) memory balancers;

To be clear: this problem only applies to non-primitives (structs, mappings, and arrays) when declared locally inside functions as their default location is storage as explained in the doc linked above!

Answer 3

Aside from that it is a bug in solidity (as it should notice that uninitialized variable is used), it worth mentioning that the code is not correct also.

The problem is that mapping(address => uint) balancers in function body does not allocate new mapping. It just introduces variable balancers which can reference some mapping (allocated elsewhere).

In the example balancers is not initialized and coincidentially references balancesA. Hence the unexpected behavior.

From Solidity docs:

Mappings are only allowed for state variables (or as storage reference types in internal functions).