Skip to content

mbff: Use getLibertyCell (now testCell) instead of libertyCell.#10665

Open
Logikable wants to merge 2 commits into
The-OpenROAD-Project:masterfrom
Logikable:mbff
Open

mbff: Use getLibertyCell (now testCell) instead of libertyCell.#10665
Logikable wants to merge 2 commits into
The-OpenROAD-Project:masterfrom
Logikable:mbff

Conversation

@Logikable

Copy link
Copy Markdown
Contributor

dbNetwork::getLibertyCell (now testCell) returns the TestCell if available. After 89f47ff, certain parts of the MBFF code began to compare the TestCell against the base cell. This causes a crash in GetPinMapping() in certain PDKs.

dbNetwork::getLibertyCell (now testCell) returns the TestCell
if available. After 89f47ff, certain parts of the MBFF code began to
compare the TestCell against the base cell. This causes a crash in
GetPinMapping() in certain PDKs.

Signed-off-by: Sean Luchen <seanluchen@google.com>
@Logikable Logikable requested review from a team as code owners June 15, 2026 21:06
@Logikable Logikable requested review from gudeh and maliberty June 15, 2026 21:06

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request replaces the private getLibertyCell method with a public testCell method in dbNetwork and updates its usages, including replacing libertyCell calls in src/gpl/src/mbff.cpp. Feedback focuses on several instances in mbff.cpp where the returned lib_cell pointer from testCell is dereferenced or used without a null check, which could lead to potential crashes or undefined behavior if the cell does not have a corresponding liberty cell.

Comment thread src/gpl/src/mbff.cpp

const sta::Cell* cell = network_->dbToSta(inst->getMaster());
const sta::LibertyCell* lib_cell = network_->libertyCell(cell);
const sta::LibertyCell* lib_cell = network_->testCell(cell);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The network_->testCell(cell) call can return nullptr if the cell does not have a corresponding liberty cell (e.g., for physical-only cells). Dereferencing lib_cell directly on the following line without a null check will cause a crash. We should add a defensive null check and return a fallback value.

  const sta::LibertyCell* lib_cell = network_->testCell(cell);
  if (lib_cell == nullptr) {
    return d;
  }

Comment thread src/gpl/src/mbff.cpp
Comment on lines +283 to 286
const sta::LibertyCell* lib_cell = network_->testCell(cell);
const auto& seqs = lib_cell->sequentials();
if (!seqs.empty()) {
ret.func_idx = GetMatchingFunc(seqs.front().data(), inst, isTray);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The network_->testCell(cell) call can return nullptr. Dereferencing lib_cell directly on the following line to access sequentials() will cause a crash. We should wrap the access in a null check.

  const sta::LibertyCell* lib_cell = network_->testCell(cell);
  if (lib_cell != nullptr) {
    const auto& seqs = lib_cell->sequentials();
    if (!seqs.empty()) {
      ret.func_idx = GetMatchingFunc(seqs.front().data(), inst, isTray);
    }
  }

Comment thread src/gpl/src/mbff.cpp
Comment on lines +297 to 298
const sta::LibertyCell* lib_cell = network_->testCell(cell);
sta::LibertyCellPortIterator port_itr(lib_cell);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The network_->testCell(cell) call can return nullptr. Passing a null pointer to sta::LibertyCellPortIterator will cause undefined behavior or a crash. We should add a null check and return an empty map if lib_cell is null.

  const sta::LibertyCell* lib_cell = network_->testCell(cell);
  if (lib_cell == nullptr) {
    return {};
  }
  sta::LibertyCellPortIterator port_itr(lib_cell);

@maliberty

Copy link
Copy Markdown
Member

Please add a unit test that would fail without this fix.

Signed-off-by: Sean Luchen <seanluchen@google.com>
@Logikable

Copy link
Copy Markdown
Contributor Author

Done, PTAL.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants