modtools: fix use-after-free of cell pointers in ModWalker

cell_inputs and cell_outputs retain cell pointers as their keys across
invocations of setup(), which may however be invalidated in the meantime
(as happens in e.g. passes/opt/share.cc:1432). A later rehash of the
dicts (caused by inserting in ModWalker::add_wire()) will cause them to
be dereferenced.

diff --git a/kernel/modtools.h b/kernel/modtools.h
index 29c510059ffc4f5e0220ffdeb6e9bea8eacffe0d..3af5367b177a38feecf792200a73c99a4a1991a8 100644 (file)
--- a/kernel/modtools.h
+++ b/kernel/modtools.h
@@ -395,6 +395,8 @@ struct ModWalker
                signal_consumers.clear();
                signal_inputs.clear();
                signal_outputs.clear();
+               cell_inputs.clear();
+               cell_outputs.clear();
 
                for (auto &it : module->wires_)
                        add_wire(it.second);