Project

General

Profile

[logo] 
 
Home
News
Activity
About/Contact
Major Tools
  Dinotrace
  Verilator
  Verilog-mode
  Verilog-Perl
Other Tools
  BugVise
  CovVise
  Force-Gate-Sim
  Gspice
  IPC::Locker
  Rsvn
  SVN::S4
  Voneline
  WFH
General Info
  Papers

Issue #792

Incorrect handling of index out of declared bound on multi-dim packed array

Added by Jie Xu almost 5 years ago. Updated almost 5 years ago.

Status:
Confirmed
Priority:
Normal
Assignee:
-
Category:
WrongRuntimeResult
% Done:

0%


Description

For the given code below, Verilator will overwrite the value of tt[0] with c without giving any warning or error.
logic [1:0][31:0] tt ;
logic [31:0] a;
logic [31:0] b;
logic [31:0] c;

always_comb begin
  tt[0] = a;
  tt[1] = b;
  tt[2] = c;
end

FYI, VCS will report a out of bound warning and ignore the tt[2] assignment.

History

#1 Updated by Wilson Snyder almost 5 years ago

  • Subject changed from incorrect handling of index out of declared bound to Incorrect handling of index out of declared bound on multi-dim packed array
  • Category set to WrongRuntimeResult
  • Status changed from New to Confirmed

This occurs because Verilator flattens the multidimensional packed array into a single dimension and so has lost the bounds information far before it changes the code to suppress assignments that are out-of-bounds. This won't be quick to fix.

#2 Updated by Jie Xu almost 5 years ago

Maybe the complete fix will take quite some efforts given the complexity of Width processing. But for now it would be nice just report errors on these cases.

diff --git a/src/V3WidthSel.cpp b/src/V3WidthSel.cpp
index ed649b2..6d92591 100644
--- a/src/V3WidthSel.cpp
+++ b/src/V3WidthSel.cpp
@@ -225,6 +225,12 @@ private:
            if (fromRange.lo()!=0 || fromRange.hi()<0) {
                subp = newSubNeg (subp, fromRange.lo());
            }
+        if (AstConst* index = subp->castConst()) {
+        if (index->toSInt() < fromRange.lo() || index->toSInt() > fromRange.hi())
+        adtypep->v3fatalSrc("array selection out of range: " << index->toSInt() << " out of " << fromRange.lo() << ":" << fromRange.hi());
+        }
+
+
            if (!fromRange.elements() || (adtypep->width() % fromRange.elements())!=0)
                adtypep->v3fatalSrc("Array extraction with width miscomputed " 
                                    <<adtypep->width()<<"/"<<fromRange.elements());

I am able to generate error on the above particular case using the patch. Could you make it more general or point to me how to make it more general?

Also available in: Atom