fix[codegen]: cache result of iter eval

tests/functional/codegen/features/iteration/test_for_in_list.py

@@ -945,3 +945,67 @@ def foo() -> DynArray[uint256, 12]:
     """
     c = get_contract(code)
     assert c.foo() == [1, 2, 3]
+
+
+def test_iterator_eval_order(get_contract):
+    # GHSA-h33q-mhmp-8p67
+    code = """
+x: uint256
+trace: DynArray[uint256, 3]
+
+@deploy
+def __init__():
+    self.x = 0
+
+@external
+def test():
+    for i: uint256 in [self.usesideeffect(), self.usesideeffect(), self.usesideeffect()]:
+        self.x += 1
+        self.trace.append(i)
+
+@view
+def usesideeffect() -> uint256:
+    return self.x
+
+@view
+@external
+def get_trace() -> DynArray[uint256, 3]:
+    return self.trace
+    """
+    c = get_contract(code)
+    c.test()
+    assert c.get_trace() == [0, 0, 0]
+
+
+def test_iterator_eval_order2(get_contract):
+    # GHSA-h33q-mhmp-8p67
+    code = """
+x: uint256
+trace: DynArray[uint256, 3]
+
+@deploy
+def __init__():
+    self.x = 0
+
+@external
+def test():
+    for i: uint256 in ([self.usesideeffect(), self.usesideeffect(), self.usesideeffect()] if True else self.otherclause()):
+        self.x += 1
+        self.trace.append(i)
+
+@view
+def usesideeffect() -> uint256:
+    return self.x
+
+@view
+def otherclause() -> uint256[3]:
+    return [0, 0, 0]
+
+@view
+@external
+def get_trace() -> DynArray[uint256, 3]:
+    return self.trace
+    """  # noqa: E501
+    c = get_contract(code)
+    c.test()
+    assert c.get_trace() == [0, 0, 0]

vyper/codegen/stmt.py

@@ -263,20 +263,21 @@ def _parse_For_list(self):
             ret.append(make_setter(tmp_list, iter_list))
             iter_list = tmp_list
 
-        # set up the loop variable
-        e = get_element_ptr(iter_list, i, array_bounds_check=False)
-        body = ["seq", make_setter(loop_var, e), parse_body(self.stmt.body, self.context)]
-
-        repeat_bound = iter_list.typ.count
-        if isinstance(iter_list.typ, DArrayT):
-            array_len = get_dyn_array_count(iter_list)
-        else:
-            array_len = repeat_bound
+        with iter_list.cache_when_complex("list_iter") as (b1, iter_list):
+            # set up the loop variable
+            e = get_element_ptr(iter_list, i, array_bounds_check=False)
+            body = ["seq", make_setter(loop_var, e), parse_body(self.stmt.body, self.context)]
+
+            repeat_bound = iter_list.typ.count
+            if isinstance(iter_list.typ, DArrayT):
+                array_len = get_dyn_array_count(iter_list)
+            else:
+                array_len = repeat_bound
 
-        ret.append(["repeat", i, 0, array_len, repeat_bound, body])
+            ret.append(["repeat", i, 0, array_len, repeat_bound, body])
 
-        del self.context.forvars[varname]
-        return IRnode.from_list(ret)
+            del self.context.forvars[varname]
+            return b1.resolve(IRnode.from_list(ret))
 
     def parse_AugAssign(self):
         target = self._get_target(self.stmt.target)

vyper/semantics/analysis/local.py

@@ -522,6 +522,7 @@ def visit_Expr(self, node):
     def _analyse_range_iter(self, iter_node, target_type):
         # iteration via range()
         if iter_node.get("func.id") != "range":
+            # CMC 2025-02-12 I think we can allow this actually
             raise IteratorException("Cannot iterate over the result of a function call", iter_node)
         _validate_range_call(iter_node)