From cebb80250c90cea2740b41a1bae9512bc92a2b41 Mon Sep 17 00:00:00 2001
From: "Emil J. Tywoniak" <emil@tywoniak.eu>
Date: Mon, 1 Dec 2025 19:40:17 +0100
Subject: [PATCH 1/3] aiger2: formatting

---
 backends/aiger2/aiger.cc | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/backends/aiger2/aiger.cc b/backends/aiger2/aiger.cc
index 41e1b91c1..499dfd22d 100644
--- a/backends/aiger2/aiger.cc
+++ b/backends/aiger2/aiger.cc
@@ -24,6 +24,7 @@
 
 #include "kernel/register.h"
 #include "kernel/celltypes.h"
+#include "kernel/rtlil.h"
 
 USING_YOSYS_NAMESPACE
 PRIVATE_NAMESPACE_BEGIN
@@ -845,11 +846,14 @@ struct XAigerAnalysis : Index<XAigerAnalysis, int, 0, 0> {
 			return false;
 
 		int max = 1;
-		for (auto wire : mod->wires())
-		if (wire->port_input && !wire->port_output)
-		for (int i = 0; i < wire->width; i++) {
-			int ilevel = visit(cursor, driver->getPort(wire->name)[i]);
-			max = std::max(max, ilevel + 1);
+		for (auto wire : mod->wires()) {
+			if (wire->port_input && !wire->port_output) {
+				SigSpec port = driver->getPort(wire->name);
+				for (int i = 0; i < wire->width; i++) {
+					int ilevel = visit(cursor, port[i]);
+					max = std::max(max, ilevel + 1);
+				}
+			}
 		}
 		lits[idx] = max;
 

From b2270ae1c888a29712c99f7c658ffc1cb3ee83e1 Mon Sep 17 00:00:00 2001
From: "Emil J. Tywoniak" <emil@tywoniak.eu>
Date: Mon, 1 Dec 2025 19:40:58 +0100
Subject: [PATCH 2/3] aiger2: fix case where submodule cell input port has
 empty SigSpec

---
 backends/aiger2/aiger.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backends/aiger2/aiger.cc b/backends/aiger2/aiger.cc
index 499dfd22d..babc29826 100644
--- a/backends/aiger2/aiger.cc
+++ b/backends/aiger2/aiger.cc
@@ -849,7 +849,7 @@ struct XAigerAnalysis : Index<XAigerAnalysis, int, 0, 0> {
 		for (auto wire : mod->wires()) {
 			if (wire->port_input && !wire->port_output) {
 				SigSpec port = driver->getPort(wire->name);
-				for (int i = 0; i < wire->width; i++) {
+				for (int i = 0; i < std::min(wire->width, port.size()); i++) {
 					int ilevel = visit(cursor, port[i]);
 					max = std::max(max, ilevel + 1);
 				}

From 36f0e0392fdcbf2fb3bd051ac73b88ec530510b5 Mon Sep 17 00:00:00 2001
From: "Emil J. Tywoniak" <emil@tywoniak.eu>
Date: Tue, 2 Dec 2025 15:26:21 +0100
Subject: [PATCH 3/3] aiger2: add crash test

---
 tests/techmap/abc_speed_gia_only.script | 28 ++++++++++++
 tests/techmap/xaiger2-5169.ys           | 60 +++++++++++++++++++++++++
 2 files changed, 88 insertions(+)
 create mode 100644 tests/techmap/abc_speed_gia_only.script
 create mode 100644 tests/techmap/xaiger2-5169.ys

diff --git a/tests/techmap/abc_speed_gia_only.script b/tests/techmap/abc_speed_gia_only.script
new file mode 100644
index 000000000..d3730fdb5
--- /dev/null
+++ b/tests/techmap/abc_speed_gia_only.script
@@ -0,0 +1,28 @@
+&st
+&dch -r
+&nf
+&st
+&syn2
+&if -g -K 6
+&synch2 -r
+&nf
+&st
+&syn2
+&if -g -K 6
+&synch2 -r
+&nf
+&st
+&syn2
+&if -g -K 6
+&synch2 -r
+&nf
+&st
+&syn2
+&if -g -K 6
+&synch2 -r
+&nf
+&st
+&syn2
+&if -g -K 6
+&synch2 -r
+&nf
diff --git a/tests/techmap/xaiger2-5169.ys b/tests/techmap/xaiger2-5169.ys
new file mode 100644
index 000000000..110f17346
--- /dev/null
+++ b/tests/techmap/xaiger2-5169.ys
@@ -0,0 +1,60 @@
+read_rtlil <<EOF
+
+# Generated by Yosys 0.53+98 (git sha1 780b12271, g++ 15.1.1 -fPIC -O3)
+autoidx 30
+attribute \top 1
+attribute \src "top.v:1.1-21.10"
+module \top
+  attribute \src "top.v:7.15-7.18"
+  wire output 1 \led
+  attribute \src "top.v:9.8-9.9"
+  wire \w
+  attribute \src "top.v:20.16-20.18"
+  cell $not $not$top.v:20$1
+    parameter \A_SIGNED 0
+    parameter \A_WIDTH 1
+    parameter \Y_WIDTH 1
+    connect \A \w
+    connect \Y \led
+  end
+  attribute \module_not_derived 1
+  attribute \src "top.v:10.10-18.4"
+  cell \CC_MX4 \mux
+    connect \D0 1'x
+    connect \D1 1'x
+    connect \D2 1'x
+    connect \D3 { }
+    connect \S0 1'x
+    connect \S1 1'x
+    connect \Y \w
+  end
+end
+
+EOF
+
+read_verilog -lib -specify <<EOF
+
+(* abc9_box, lib_whitebox *)
+module CC_MX4 (
+        input  D0, D1, D2, D3,
+        input  S0, S1,
+        output Y
+);
+        specify
+                (D0 => Y) = 453;
+                (D1 => Y) = 449;
+                (D2 => Y) = 488;
+                (D3 => Y) = 484;
+                (S0 => Y) = 422;
+                (S1 => Y) = 385;
+        endspecify
+
+        assign Y = S1 ? (S0 ? D3 : D2) :
+                        (S0 ? D1 : D0);
+
+endmodule
+
+EOF
+
+logger -expect error "Malformed design" 1
+abc_new -script abc_speed_gia_only.script -liberty ../../tests/liberty/normal.lib -liberty ../../tests/liberty/dff.lib