From 7afcb72c98620adaace7cc9622c4d577668f9426 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marcelina=20Ko=C5=9Bcielnicka?= <mwk@0x04.net>
Date: Sun, 5 Jul 2020 00:55:38 +0200
Subject: [PATCH] opt_expr: Fix crash on $mul optimization with more zeros
 removed than Y has.

Fixes #2221.
---
 passes/opt/opt_expr.cc |  8 ++++++++
 tests/opt/bug2221.ys   | 16 ++++++++++++++++
 2 files changed, 24 insertions(+)
 create mode 100644 tests/opt/bug2221.ys

diff --git a/passes/opt/opt_expr.cc b/passes/opt/opt_expr.cc
index 1051a59f2..649ad83a6 100644
--- a/passes/opt/opt_expr.cc
+++ b/passes/opt/opt_expr.cc
@@ -1596,6 +1596,14 @@ skip_identity:
 				log_debug("Removing low %d A and %d B bits from cell `%s' in module `%s'.\n",
 						a_zeros, b_zeros, cell->name.c_str(), module->name.c_str());
 
+				if (y_zeros >= GetSize(sig_y)) {
+					module->connect(sig_y, RTLIL::SigSpec(0, GetSize(sig_y)));
+					module->remove(cell);
+
+					did_something = true;
+					goto next_cell;
+				}
+
 				if (a_zeros) {
 					cell->setPort(ID::A, sig_a.extract_end(a_zeros));
 					cell->parameters[ID::A_WIDTH] = GetSize(sig_a) - a_zeros;
diff --git a/tests/opt/bug2221.ys b/tests/opt/bug2221.ys
new file mode 100644
index 000000000..8ac380243
--- /dev/null
+++ b/tests/opt/bug2221.ys
@@ -0,0 +1,16 @@
+read_verilog <<EOT
+module test (
+        input [1:0] a,
+        input [1:0] b,
+        output [5:0] y
+);
+
+wire [5:0] aa = {a, 4'h0};
+wire [5:0] bb = {b, 4'h0};
+
+assign y = aa * bb;
+
+endmodule
+EOT
+
+equiv_opt -assert opt_expr