From 9187b4d552cc3b5ae43cbe660a5cbc2073829d90 Mon Sep 17 00:00:00 2001
From: Wilson Snyder <wsnyder@wsnyder.org>
Date: Tue, 16 Sep 2025 08:18:51 -0400
Subject: [PATCH] Fix internal error on out-of-bounds real array access.

---
 Changes                                |  1 +
 src/V3Number.h                         |  5 ++++
 src/V3Unknown.cpp                      |  5 +++-
 test_regress/t/t_real_out_of_bounds.py | 18 +++++++++++++
 test_regress/t/t_real_out_of_bounds.v  | 35 ++++++++++++++++++++++++++
 5 files changed, 63 insertions(+), 1 deletion(-)
 create mode 100755 test_regress/t/t_real_out_of_bounds.py
 create mode 100644 test_regress/t/t_real_out_of_bounds.v

diff --git a/Changes b/Changes
index 8747aa757..3ebeadc57 100644
--- a/Changes
+++ b/Changes
@@ -47,6 +47,7 @@ Verilator 5.041 devel
 * Fix parsing for sequence expressions (#6427). [Bartłomiej Chmiel, Antmicro Ltd.]
 * Fix resolving parameters (#6388) (#6418) (#6421) (#6438) (#6429). [Artur Bieniek, Antmicro Ltd.]
 * Fix external function declarations with class typedef references (#6433).
+* Fix internal error on out-of-bounds real array access.
 
 
 Verilator 5.040 2025-08-30
diff --git a/src/V3Number.h b/src/V3Number.h
index 5d882e8ae..a351991bb 100644
--- a/src/V3Number.h
+++ b/src/V3Number.h
@@ -492,6 +492,11 @@ public:
     V3Number(FileLine* flp, const char* sourcep) { create(flp, sourcep); }
     class VerilogStringLiteral {};  // For creator type-overload selection
     V3Number(VerilogStringLiteral, AstNode* nodep, const string& str);
+    class Double {};
+    V3Number(Double, AstNode* nodep, double value) {
+        init(nodep, 64);
+        setDouble(value);
+    }
     class String {};
     V3Number(String, AstNode* nodep, const string& value) {
         init(nodep);
diff --git a/src/V3Unknown.cpp b/src/V3Unknown.cpp
index 611f763d5..44c1289bf 100644
--- a/src/V3Unknown.cpp
+++ b/src/V3Unknown.cpp
@@ -484,8 +484,11 @@ class UnknownVisitor final : public VNVisitor {
                 // ARRAYSEL(...) -> COND(LT(bit<maxbit), ARRAYSEL(...), {width{1'bx}})
                 VNRelinker replaceHandle;
                 nodep->unlinkFrBack(&replaceHandle);
+                // TODO make a tieoff function that takes AstNode and returns typed value
                 V3Number xnum{nodep, nodep->width()};
-                if (nodeDtp->isString()) {
+                if (nodeDtp->isDouble()) {
+                    xnum = V3Number{V3Number::Double{}, nodep, 0.0};
+                } else if (nodeDtp->isString()) {
                     xnum = V3Number{V3Number::String{}, nodep, ""};
                 } else {
                     xnum.setAllBitsX();
diff --git a/test_regress/t/t_real_out_of_bounds.py b/test_regress/t/t_real_out_of_bounds.py
new file mode 100755
index 000000000..563b6fc6f
--- /dev/null
+++ b/test_regress/t/t_real_out_of_bounds.py
@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+# DESCRIPTION: Verilator: Verilog Test driver/expect definition
+#
+# Copyright 2025 by Wilson Snyder. This program is free software; you
+# can redistribute it and/or modify it under the terms of either the GNU
+# Lesser General Public License Version 3 or the Perl Artistic License
+# Version 2.0.
+# SPDX-License-Identifier: LGPL-3.0-only OR Artistic-2.0
+
+import vltest_bootstrap
+
+test.scenarios('simulator_st')
+
+test.compile()
+
+test.execute()
+
+test.passes()
diff --git a/test_regress/t/t_real_out_of_bounds.v b/test_regress/t/t_real_out_of_bounds.v
new file mode 100644
index 000000000..62a9d406a
--- /dev/null
+++ b/test_regress/t/t_real_out_of_bounds.v
@@ -0,0 +1,35 @@
+// DESCRIPTION: Verilator: Verilog Test module
+//
+// This file ONLY is placed under the Creative Commons Public Domain, for
+// any use, without warranty, 2025 by Wilson Snyder.
+// SPDX-License-Identifier: CC0-1.0
+
+// verilog_format: off
+`define stop $stop
+`define checks(gotv,expv) do if ((gotv) != (expv)) begin $write("%%Error: %s:%0d:  got='%s' exp='%s'\n", `__FILE__,`__LINE__, (gotv), (expv)); `stop; end while(0);
+// verilog_format: on
+
+module t;
+  class Cls;
+
+    function void m_uvm_execute_field_op();
+      real sa_real[3];
+      string s;
+      // 5 doesn't match array size of 3
+      for (int i = 0; i < 5; ++i) begin
+        s = $sformatf("%g", sa_real[i]);
+        `checks(s, "0");
+        s = $sformatf("%p", sa_real[i]);
+        `checks(s, "0");
+      end
+    endfunction
+  endclass
+
+  initial begin
+    Cls c;
+    c = new;
+    c.m_uvm_execute_field_op();
+    $finish;
+  end
+
+endmodule