From 853ee5df1796354ff24de19cb7b6cba49a0530f7 Mon Sep 17 00:00:00 2001 From: Jakub Michalski <143384197+jmichalski-ant@users.noreply.github.com> Date: Thu, 2 Jul 2026 12:33:38 +0200 Subject: [PATCH] Fix DFG misoptimizing bound checks (#7755) Signed-off-by: Jakub Michalski --- src/V3Dfg.cpp | 6 ++++++ src/V3Dfg.h | 2 ++ src/V3DfgPeephole.cpp | 24 +++++++++++---------- test_regress/t/t_dfg_oob_array_access.py | 18 ++++++++++++++++ test_regress/t/t_dfg_oob_array_access.v | 27 ++++++++++++++++++++++++ 5 files changed, 66 insertions(+), 11 deletions(-) create mode 100755 test_regress/t/t_dfg_oob_array_access.py create mode 100644 test_regress/t/t_dfg_oob_array_access.v diff --git a/src/V3Dfg.cpp b/src/V3Dfg.cpp index fc6be54ce..2fd5afb95 100644 --- a/src/V3Dfg.cpp +++ b/src/V3Dfg.cpp @@ -620,6 +620,12 @@ DfgVertex::DfgVertex(DfgGraph& dfg, VDfgType type, FileLine* flp, const DfgDataT dfg.addVertex(*this); } +bool DfgVertex::unsafe() const { + if (is()) return true; + if (is()) return !as()->bitp()->is(); + return false; +} + void DfgVertex::typeCheck(const DfgGraph& dfg) const { #define CHECK(cond, msg) \ diff --git a/src/V3Dfg.h b/src/V3Dfg.h index b93c1c716..d80be4d84 100644 --- a/src/V3Dfg.h +++ b/src/V3Dfg.h @@ -195,6 +195,8 @@ public: UASSERT_OBJ(m_dtype.isPacked(), this, "Non packed vertex has no 'width'"); return m_dtype.size(); } + // Has terminating side-effect + bool unsafe() const; // Type check vertex (for debugging) void typeCheck(const DfgGraph& dfg) const; diff --git a/src/V3DfgPeephole.cpp b/src/V3DfgPeephole.cpp index de92790a8..fa29339fe 100644 --- a/src/V3DfgPeephole.cpp +++ b/src/V3DfgPeephole.cpp @@ -2269,7 +2269,7 @@ class V3DfgPeephole final : public DfgVisitor { } void visit(DfgLogAnd* const vtxp) override { - if (binary(vtxp)) return; + if (binary(vtxp) || vtxp->rhsp()->unsafe()) return; DfgVertex* const lhsp = vtxp->lhsp(); DfgVertex* const rhsp = vtxp->rhsp(); @@ -2287,11 +2287,11 @@ class V3DfgPeephole final : public DfgVisitor { } void visit(DfgLogIf* const vtxp) override { - if (binary(vtxp)) return; + if (binary(vtxp) || vtxp->rhsp()->unsafe()) return; } void visit(DfgLogOr* const vtxp) override { - if (binary(vtxp)) return; + if (binary(vtxp) || vtxp->rhsp()->unsafe()) return; DfgVertex* const lhsp = vtxp->lhsp(); DfgVertex* const rhsp = vtxp->rhsp(); @@ -2890,13 +2890,13 @@ class V3DfgPeephole final : public DfgVisitor { } if (vtxp->dtype() == m_bitDType) { - if (isSame(condp, thenp)) { // a ? a : b becomes a | b + if (isSame(condp, thenp) && !elsep->unsafe()) { // a ? a : b becomes a | b APPLYING(REPLACE_COND_WITH_THEN_BRANCH_COND) { replace(make(vtxp, condp, elsep)); return; } } - if (isSame(condp, elsep)) { // a ? b : a becomes a & b + if (isSame(condp, elsep) && !thenp->unsafe()) { // a ? b : a becomes a & b APPLYING(REPLACE_COND_WITH_ELSE_BRANCH_COND) { replace(make(vtxp, condp, thenp)); return; @@ -2905,28 +2905,28 @@ class V3DfgPeephole final : public DfgVisitor { } if (vtxp->width() <= VL_QUADSIZE) { - if (isZero(thenp)) { // a ? 0 : b becomes ~a & b + if (isZero(thenp) && !elsep->unsafe()) { // a ? 0 : b becomes ~a & b APPLYING(REPLACE_COND_WITH_THEN_BRANCH_ZERO) { DfgVertex* const maskp = replicate(vtxp, make(condp, condp)); replace(make(vtxp, maskp, elsep)); return; } } - if (isOnes(thenp)) { // a ? 1 : b becomes a | b + if (isOnes(thenp) && !elsep->unsafe()) { // a ? 1 : b becomes a | b APPLYING(REPLACE_COND_WITH_THEN_BRANCH_ONES) { DfgVertex* const maskp = replicate(vtxp, condp); replace(make(vtxp, maskp, elsep)); return; } } - if (isZero(elsep)) { // a ? b : 0 becomes a & b + if (isZero(elsep) && !thenp->unsafe()) { // a ? b : 0 becomes a & b APPLYING(REPLACE_COND_WITH_ELSE_BRANCH_ZERO) { DfgVertex* const maskp = replicate(vtxp, condp); replace(make(vtxp, maskp, thenp)); return; } } - if (isOnes(elsep)) { // a ? b : 1 becomes ~a | b + if (isOnes(elsep) && !thenp->unsafe()) { // a ? b : 1 becomes ~a | b APPLYING(REPLACE_COND_WITH_ELSE_BRANCH_ONES) { DfgVertex* const maskp = replicate(vtxp, make(condp, condp)); replace(make(vtxp, maskp, thenp)); @@ -2935,7 +2935,8 @@ class V3DfgPeephole final : public DfgVisitor { } if (DfgOr* const tOrp = thenp->cast()) { - if (isSame(tOrp->lhsp(), elsep)) { // a ? b | c : b becomes b | (a & c) + if (isSame(tOrp->lhsp(), elsep) + && !tOrp->rhsp()->unsafe()) { // a ? b | c : b becomes b | (a & c) APPLYING(REPLACE_COND_THEN_OR_LHS) { DfgVertex* const maskp = replicate(vtxp, condp); DfgAnd* const andp = make(vtxp, maskp, tOrp->rhsp()); @@ -2943,7 +2944,8 @@ class V3DfgPeephole final : public DfgVisitor { return; } } - if (isSame(tOrp->rhsp(), elsep)) { // a ? b | c : c becomes c | (a & b) + if (isSame(tOrp->rhsp(), elsep) + && !tOrp->lhsp()->unsafe()) { // a ? b | c : c becomes c | (a & b) APPLYING(REPLACE_COND_THEN_OR_RHS) { DfgVertex* const maskp = replicate(vtxp, condp); DfgAnd* const andp = make(vtxp, maskp, tOrp->lhsp()); diff --git a/test_regress/t/t_dfg_oob_array_access.py b/test_regress/t/t_dfg_oob_array_access.py new file mode 100755 index 000000000..b7bc5e342 --- /dev/null +++ b/test_regress/t/t_dfg_oob_array_access.py @@ -0,0 +1,18 @@ +#!/usr/bin/env python3 +# DESCRIPTION: Verilator: Verilog Test driver/expect definition +# +# This program is free software; you can redistribute it and/or modify it +# under the terms of either the GNU Lesser General Public License Version 3 +# or the Perl Artistic License Version 2.0. +# SPDX-FileCopyrightText: 2026 Wilson Snyder +# SPDX-License-Identifier: LGPL-3.0-only OR Artistic-2.0 + +import vltest_bootstrap + +test.scenarios('simulator') + +test.compile(verilator_flags2=["-runtime-debug"]) + +test.execute() + +test.passes() diff --git a/test_regress/t/t_dfg_oob_array_access.v b/test_regress/t/t_dfg_oob_array_access.v new file mode 100644 index 000000000..39b3f4d17 --- /dev/null +++ b/test_regress/t/t_dfg_oob_array_access.v @@ -0,0 +1,27 @@ +// DESCRIPTION: Verilator: Verilog Test module +// +// This file ONLY is placed under the Creative Commons Public Domain. +// SPDX-FileCopyrightText: 2026 Antmicro +// SPDX-License-Identifier: CC0-1.0 + + +module t ( + input clk +); + wire mem_wire; + bit [15:0] idx = 65535; + bit mem_reg[0:34000]; + assign mem_wire = mem_reg[idx]; + + always @(posedge clk) begin + if (idx < 65533) begin + $display("oob_val %d", mem_wire); + $write("*-* All Finished *-*\n"); + $finish; + end + else begin + idx <= idx - 1; + mem_reg[idx] <= 0; + end + end +endmodule