rsz: add cpp test guarding prevArc()->from() driver-input port lookup

Regression guard for the issue #10210 fix in SizeUpMove: the driver
input LibertyPort is now resolved via drvr_path->prevArc()->from()
(using prev_edge_id_ / prev_arc_idx_ stored on the Path itself)
instead of drvr_path->prevPath()->pin(), which dereferenced a raw
prev_path_ pointer vulnerable to dangling after paths_ realloc.

This test uses the existing BufRemTest buffer chain, constrains
timing with a virtual clock + output delay, then checks that
prevArc()->from() returns the same LibertyPort as network_->libertyPort(
driver_input_pin). It does not attempt to reproduce the UAF (which
requires ASAN + a full multi-corner repair_timing run) but pins the
semantic contract the fix relies on, so a future refactor that
substitutes the wrong arc/port would fail here.

Signed-off-by: Minju Kim <mkim@precisioninno.com>

Author: minjukim55

src/rsz/test/cpp/TestBufferRemoval.cc

@@ -24,9 +24,11 @@
 #include "sta/Graph.hh"
 #include "sta/Liberty.hh"
 #include "sta/NetworkClass.hh"
+#include "sta/Path.hh"
 #include "sta/Search.hh"
 #include "sta/SearchClass.hh"
 #include "sta/Sta.hh"
+#include "sta/TimingArc.hh"
 #include "stt/SteinerTreeBuilder.h"
 #include "tst/fixture.h"
 #include "tst/nangate45_fixture.h"
@@ -167,4 +169,34 @@ TEST_F(BufRemTest, SlackImproves)
   EXPECT_EQ(restoredArrival, origArrival);
 }
 
+// Regression guard for #10210: SizeUpMove used drvr_path->prevPath()->pin()
+// which could dangle after paths_ realloc; prevArc()->from() resolves the same
+// driver-input LibertyPort via data stored on the Path itself.
+TEST_F(BufRemTest, PrevArcFromMatchesDriverInputPort)
+{
+  sta::Graph* graph = sta_->ensureGraph();
+  sta::Network* network = sta_->network();
+  sta_->updateTiming(true);
+
+  odb::dbInst* b3_db = block_->findInst("b3");
+  ASSERT_NE(b3_db, nullptr);
+  sta::Instance* b3 = db_network_->dbToSta(b3_db);
+  sta::Pin* b3_z = network->findPin(b3, "Z");
+  sta::Pin* b3_a = network->findPin(b3, "A");
+  ASSERT_NE(b3_z, nullptr);
+  ASSERT_NE(b3_a, nullptr);
+
+  sta::Vertex* b3_z_vertex = graph->pinDrvrVertex(b3_z);
+  ASSERT_NE(b3_z_vertex, nullptr);
+
+  sta::Path* drvr_path
+      = sta_->vertexWorstArrivalPath(b3_z_vertex, sta::MinMax::max());
+  ASSERT_NE(drvr_path, nullptr);
+  ASSERT_FALSE(drvr_path->isNull());
+
+  const sta::TimingArc* in_arc = drvr_path->prevArc(sta_.get());
+  ASSERT_NE(in_arc, nullptr);
+  EXPECT_EQ(in_arc->from(), network->libertyPort(b3_a));
+}
+
 }  // namespace rsz