Merge pull request #9048 from The-OpenROAD-Project-staging/secure-copy-drivers-pin-set

rsz: Fixed a memory corruption issue by copying `PinSet* drivers`

Author: maliberty

src/dbSta/include/db_sta/dbNetwork.hh

@@ -251,8 +251,26 @@ class dbNetwork : public ConcreteNetwork
   Instance* instance(const Pin* pin) const override;
   Net* net(const Pin* pin) const override;
   void net(const Pin* pin, dbNet*& db_net, dbModNet*& db_modnet) const;
+
+  ///
+  /// Get a dbNet connected to the input pin.
+  /// - If both dbNet and dbModNet are connected to the input pin,
+  ///   this function returns the dbNet.
+  /// - NOTE: If only dbModNet is connected to the input pin, this
+  ///   function returns nullptr. If you need to get the dbNet corresponding to
+  ///   the dbModNet, use findFlatDbNet() instead.
+  ///
   dbNet* flatNet(const Pin* pin) const;
+
+  ///
+  /// Get a dbModNet connected to the input pin.
+  /// - If both dbNet and dbModNet are connected to the input pin,
+  ///   this function returns the dbModNet.
+  /// - If only dbNet is connected to the input pin, this function returns
+  ///   nullptr.
+  ///
   dbModNet* hierNet(const Pin* pin) const;
+
   dbITerm* flatPin(const Pin* pin) const;
   dbModITerm* hierPin(const Pin* pin) const;
   dbBlock* getBlockOf(const Pin* pin) const;

src/rsz/src/RepairDesign.cc

@@ -402,28 +402,33 @@ void RepairDesign::repairDesign(
               }
             }
             if (slew_viol) {
-              PinSet* drivers = network_->drivers(vertex->pin());
-              for (const Pin* drvr_pin : *drivers) {
-                debugPrint(logger_,
-                           RSZ,
-                           "repair_design",
-                           2,
-                           "last pass: drvr {} has slew {} vs. limit {}",
-                           sdc_network_->pathName(drvr_pin),
-                           delayAsString(actual, this, 3),
-                           delayAsString(limit, this, 3));
-                repairDriver(graph_->pinDrvrVertex(drvr_pin),
-                             true /* check_slew */,
-                             false /* check_cap */,
-                             false /* check_fanout */,
-                             0 /* max_length */,
-                             true /* resize_driver */,
-                             corner,
-                             repaired_net_count2,
-                             slew_violations2,
-                             cap_violations,
-                             fanout_violations,
-                             length_violations);
+              PinSet* drivers_ptr = network_->drivers(vertex->pin());
+              if (drivers_ptr) {
+                // Copy PinSet because repairDriver() can invalidate the
+                // drivers_ptr by invalidating net_drvr_pin_map_ cache.
+                PinSet drivers = *drivers_ptr;
+                for (const Pin* drvr_pin : drivers) {
+                  debugPrint(logger_,
+                             RSZ,
+                             "repair_design",
+                             2,
+                             "last pass: drvr {} has slew {} vs. limit {}",
+                             sdc_network_->pathName(drvr_pin),
+                             delayAsString(actual, this, 3),
+                             delayAsString(limit, this, 3));
+                  repairDriver(graph_->pinDrvrVertex(drvr_pin),
+                               true /* check_slew */,
+                               false /* check_cap */,
+                               false /* check_fanout */,
+                               0 /* max_length */,
+                               true /* resize_driver */,
+                               corner,
+                               repaired_net_count2,
+                               slew_violations2,
+                               cap_violations,
+                               fanout_violations,
+                               length_violations);
+                }
               }
             }
           }
@@ -1014,13 +1019,7 @@ void RepairDesign::repairDriver(Vertex* drvr,
                                 int& length_violations)
 {
   Pin* drvr_pin = drvr->pin();
-  // hier fix
-  // clang-format off
-      Net* net = network_->isTopLevelPort(drvr_pin)
-                     ? db_network_->dbToSta(
-                         db_network_->flatNet(network_->term(drvr_pin)))
-                     : db_network_->dbToSta(db_network_->flatNet(drvr_pin));
-  // clang-format on
+  Net* net = db_network_->findFlatNet(drvr_pin);
   if (!net) {
     return;
   }