From 5b2dc5268145cb50fc354beb767e1947c964ee4f Mon Sep 17 00:00:00 2001
From: Wilson Snyder <wsnyder@wsnyder.org>
Date: Sat, 7 Jun 2025 17:20:48 -0400
Subject: [PATCH] Fix array bounds checking with class member selects (#5996)
 (#5997).

---
 Changes                           |  1 +
 src/V3Unknown.cpp                 |  2 +-
 test_regress/t/t_select_bound3.py | 18 ++++++++++++++++++
 test_regress/t/t_select_bound3.v  | 28 ++++++++++++++++++++++++++++
 4 files changed, 48 insertions(+), 1 deletion(-)
 create mode 100755 test_regress/t/t_select_bound3.py
 create mode 100644 test_regress/t/t_select_bound3.v

diff --git a/Changes b/Changes
index 13540bc1d..4cf930058 100644
--- a/Changes
+++ b/Changes
@@ -40,6 +40,7 @@ Verilator 5.037 devel
 * Fix AstAssignW conversion (#5991) (#5992). [Ryszard Rozak, Antmicro Ltd.]
 * Fix const-bit-op-tree with single-bit masks (#5993) (#5998). [Yutetsu TAKATSUKASA]
 * Fix arithmetic right-shift by constants over 32 bits (#5994). [Zhen Yan]
+* Fix array bounds checking with class member selects (#5996) (#5997). [Krzysztof Starecki]
 * Fix checking for too-wide divide and modulus (#6003) (#6006). [Zhen Yan]
 * Fix folding of LteS in DfgPeephole (#6000) (#6004). [Geza Lore]
 * Fix slicing of AstExprStmt nodes (#6005). [Ryszard Rozak, Antmicro Ltd.]
diff --git a/src/V3Unknown.cpp b/src/V3Unknown.cpp
index d5c3b3061..2536862ac 100644
--- a/src/V3Unknown.cpp
+++ b/src/V3Unknown.cpp
@@ -102,7 +102,7 @@ class UnknownVisitor final : public VNVisitor {
 
         // Scan back to put the condlvalue above all selects (IE top of the lvalue)
         while (VN_IS(prep->backp(), NodeSel) || VN_IS(prep->backp(), Sel)
-               || VN_IS(prep->backp(), StructSel)) {
+               || VN_IS(prep->backp(), MemberSel) || VN_IS(prep->backp(), StructSel)) {
             prep = VN_AS(prep->backp(), NodeExpr);
         }
         FileLine* const fl = nodep->fileline();
diff --git a/test_regress/t/t_select_bound3.py b/test_regress/t/t_select_bound3.py
new file mode 100755
index 000000000..f989a35fb
--- /dev/null
+++ b/test_regress/t/t_select_bound3.py
@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+# DESCRIPTION: Verilator: Verilog Test driver/expect definition
+#
+# Copyright 2025 by Wilson Snyder. This program is free software; you
+# can redistribute it and/or modify it under the terms of either the GNU
+# Lesser General Public License Version 3 or the Perl Artistic License
+# Version 2.0.
+# SPDX-License-Identifier: LGPL-3.0-only OR Artistic-2.0
+
+import vltest_bootstrap
+
+test.scenarios('simulator')
+
+test.compile()
+
+test.execute()
+
+test.passes()
diff --git a/test_regress/t/t_select_bound3.v b/test_regress/t/t_select_bound3.v
new file mode 100644
index 000000000..19f6ac8f7
--- /dev/null
+++ b/test_regress/t/t_select_bound3.v
@@ -0,0 +1,28 @@
+// DESCRIPTION: Verilator: Verilog Test module
+//
+// Copyright 2025 by Wilson Snyder. This program is free software; you can
+// redistribute it and/or modify it under the terms of either the GNU
+// Lesser General Public License Version 3 or the Perl Artistic License
+// Version 2.0.
+// SPDX-License-Identifier: LGPL-3.0-only OR Artistic-2.0
+
+class cls;
+   int m_field;
+endclass
+
+module t();
+   cls inst[2];
+
+   initial begin
+      // Loop (even just 1 iteration) is needed to reproduce the error
+      for (int i = 0; i < 2; ++i) begin
+         inst[i] = new();
+         inst[i].m_field = i;
+      end
+      for (int i = 0; i < 2; ++i) begin
+         if (inst[i].m_field != i) $stop;
+      end
+      $write("*-* All Finished *-*\n");
+      $finish;
+    end
+endmodule