Merge pull request #8102 from The-OpenROAD-Project-staging/secure-merge_net-fix

odb, rsz: Fixed incorrect BTerm iteration in mergeNet(). Changed a wrong code sequence in removeBuffer().

Author: maliberty

src/odb/src/db/dbNet.cpp

@@ -2234,20 +2234,24 @@ void dbNet::mergeNet(dbNet* in_net)
   _dbNet* net = (_dbNet*) this;
   _dbBlock* block = (_dbBlock*) net->getOwner();
 
-  std::vector<dbITerm*> iterms;
-  for (dbITerm* iterm : in_net->getITerms()) {
-    iterms.push_back(iterm);
-  }
-
   for (auto callback : block->_callbacks) {
     callback->inDbNetPreMerge(this, in_net);
   }
 
+  // in_net->getITerms() returns a terminal iterator, and iterm->connect() can
+  // invalidate the iterator by disconnecting a dbITerm.
+  // Calling iterm->connect() during iteration with the iterator is not safe.
+  // Thus create another vector for safe iterms iteration.
+  auto iterms_set = in_net->getITerms();
+  std::vector<dbITerm*> iterms(iterms_set.begin(), iterms_set.end());
   for (dbITerm* iterm : iterms) {
     iterm->connect(this);
   }
 
-  for (dbBTerm* bterm : in_net->getBTerms()) {
+  // Create vector for safe iteration.
+  auto bterms_set = in_net->getBTerms();
+  std::vector<dbBTerm*> bterms(bterms_set.begin(), bterms_set.end());
+  for (dbBTerm* bterm : bterms) {
     bterm->connect(this);
   }
 }

src/rsz/src/UnbufferMove.cc

@@ -405,7 +405,7 @@ void UnbufferMove::removeBuffer(Instance* buffer)
     }
   }
 
-  // Remove buffer from the database and handle the nets
+  // Disconnect the buffer and handle the nets
   debugPrint(logger_,
              RSZ,
              "remove_buffer",
@@ -423,10 +423,6 @@ void UnbufferMove::removeBuffer(Instance* buffer)
   }
   sta_->disconnectPin(in_pin);
   sta_->disconnectPin(out_pin);
-  sta_->deleteInstance(buffer);
-  if (removed) {
-    sta_->deleteNet(removed);
-  }
 
   // Hierarchical case supported:
   // moving an output hierarchical net to the input pin driver.
@@ -447,6 +443,12 @@ void UnbufferMove::removeBuffer(Instance* buffer)
     db_network_->connectPin(driver_pin, db_network_->dbToSta(op_modnet));
   }
 
+  // Deletion
+  sta_->deleteInstance(buffer);
+  if (removed) {
+    sta_->deleteNet(removed);
+  }
+
   estimate_parasitics_->removeNetFromParasiticsInvalid(removed);
   estimate_parasitics_->parasiticsInvalid(survivor);
   estimate_parasitics_->updateParasitics();