From 4506dffa9f3f99fbbc5280026439046a910ad78a Mon Sep 17 00:00:00 2001 From: nella Date: Mon, 13 Apr 2026 12:45:55 +0200 Subject: [PATCH] Fix use after free. --- passes/techmap/arith_tree.cc | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/passes/techmap/arith_tree.cc b/passes/techmap/arith_tree.cc index 92e9239f6..9494fa958 100644 --- a/passes/techmap/arith_tree.cc +++ b/passes/techmap/arith_tree.cc @@ -337,27 +337,28 @@ struct Rewriter { auto parent_of = find_parents(candidates); auto [children_of, has_parent] = invert_parent_map(parent_of); - pool processed; + pool to_remove; for (auto root : candidates) { - if (has_parent.count(root) || processed.count(root)) + if (has_parent.count(root) || to_remove.count(root)) continue; // Not a tree root pool chain = collect_chain(root, children_of); if (chain.size() < 2) continue; - for (auto c : chain) - processed.insert(c); - int neg_compensation; auto operands = extract_chain_operands(chain, root, parent_of, neg_compensation); if (operands.size() < 3) continue; + for (auto c : chain) + to_remove.insert(c); + replace_with_carry_save_tree(operands, root->getPort(ID::Y), neg_compensation, "Replaced add/sub chain"); - for (auto cell : chain) - module->remove(cell); } + + for (auto cell : to_remove) + module->remove(cell); } void process_maccs()