build: patch yosys 0.62 with the Tcl 9 use-after-free fix from main

YosysHQ/yosys 167c6c4 ("Replace deprecated Tcl API to fix
use-after-free", povik, 2026-03-06) replaces five Tcl_SetResult(...,
TCL_VOLATILE) callsites in kernel/tclapi.cc with Tcl_SetObjResult +
Tcl_NewStringObj, the right idiom now that Tcl_SetResult is a macro
under Tcl 9.

Without it, rtlil::get_attr -string returns memory whose backing
std::string has already been destructed, producing module names with
stray control characters when synth_wrap_operators.tcl concatenates
${base}_${suffix}. Symptom: 'Found control character or space (0x18)
in string \\K B-W_KOGGE_STONE'.

Fix is in yosys main but not yet in BCR-tagged 0.62. Carry as patch
on the BCR pin via single_version_override.

Signed-off-by: Øyvind Harboe <oyvind.harboe@zylin.com>

Author: oharboe

MODULE.bazel

@@ -74,6 +74,20 @@ git_override(
     remote = "https://github.com/povik/yosys-slang.git",
 )
 
+# YosysHQ/yosys 167c6c4 ("Replace deprecated Tcl API to fix use-after-free")
+# fixes a Tcl 9 use-after-free in rtlil::get_attr/get_param that produces
+# corrupted module names like '\K B-W_KOGGE_STONE' during ORFS-style
+# wrapcell flows. The fix is in yosys main but not yet in the BCR-tagged
+# 0.62; carry it as a patch until the next release lands.
+single_version_override(
+    module_name = "yosys",
+    patch_strip = 1,
+    patches = [
+        "//bazel/yosys-patches:0001-Replace-deprecated-Tcl-API-to-fix-use-after-free.patch",
+    ],
+    version = "0.62.bcr.2",
+)
+
 # --- Extensions ---
 
 llvm = use_extension(

bazel/yosys-patches/0001-Replace-deprecated-Tcl-API-to-fix-use-after-free.patch

@@ -0,0 +1,78 @@
+From 167c6c45858fa637a872a57cdcdb758cd9e6c77a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Martin=20Povi=C5=A1er?= <povik@cutebit.org>
+Date: Fri, 6 Mar 2026 11:52:17 +0100
+Subject: [PATCH] Replace deprecated Tcl API to fix use-after-free
+
+Under Tcl 9.0 the Tcl_SetResult utility is a macro:
+
+	#define Tcl_SetResult(interp, result, freeProc) \
+		do { \
+		    const char *__result = result; \
+		    Tcl_FreeProc *__freeProc = freeProc; \
+		    Tcl_SetObjResult(interp, Tcl_NewStringObj(__result, -1)); \
+		    if (__result != NULL && __freeProc != NULL && __freeProc != TCL_VOLATILE) { \
+			if (__freeProc == TCL_DYNAMIC) { \
+			    Tcl_Free((char *)__result); \
+			} else { \
+			    (*__freeProc)((char *)__result); \
+			} \
+		    } \
+		} while(0)
+
+Temporaries constructed as part of the 'result' expression will be
+dropped before the 'result' pointer is used. What was safe when
+Tcl_SetResult was a function isn't safe with the macro definition.
+Transition away from deprecated SetResult to calling
+SetObjResult/MewStringObj directly.
+---
+ kernel/tclapi.cc | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/tclapi.cc b/kernel/tclapi.cc
+index ec0483a4a02..9866f5c9820 100644
+--- a/kernel/tclapi.cc
++++ b/kernel/tclapi.cc
+@@ -279,7 +279,7 @@ static int tcl_get_attr(ClientData, Tcl_Interp *interp, int argc, const char *ar
+ 		ERROR("object not found")
+
+ 	if (string_flag) {
+-		Tcl_SetResult(interp, (char *) obj->get_string_attribute(attr_id).c_str(), TCL_VOLATILE);
++		Tcl_SetObjResult(interp, Tcl_NewStringObj(obj->get_string_attribute(attr_id).c_str(), -1));
+ 	} else if (int_flag || uint_flag || sint_flag) {
+ 		if (!obj->has_attribute(attr_id))
+ 			ERROR("attribute missing (required for -int)");
+@@ -295,7 +295,7 @@ static int tcl_get_attr(ClientData, Tcl_Interp *interp, int argc, const char *ar
+ 		if (!obj->has_attribute(attr_id))
+ 			ERROR("attribute missing (required unless -bool or -string)")
+
+-		Tcl_SetResult(interp, (char *) obj->attributes.at(attr_id).as_string().c_str(), TCL_VOLATILE);
++		Tcl_SetObjResult(interp, Tcl_NewStringObj(obj->attributes.at(attr_id).as_string().c_str(), -1));
+ 	}
+
+ 	return TCL_OK;
+@@ -341,7 +341,7 @@ static int tcl_has_attr(ClientData, Tcl_Interp *interp, int argc, const char *ar
+ 	if (!obj)
+ 		ERROR("object not found")
+
+-	Tcl_SetResult(interp, (char *) std::to_string(obj->has_attribute(attr_id)).c_str(), TCL_VOLATILE);
++	Tcl_SetObjResult(interp, Tcl_NewStringObj(std::to_string(obj->has_attribute(attr_id)).c_str(), -1));
+ 	return TCL_OK;
+ }
+
+@@ -465,14 +465,14 @@ static int tcl_get_param(ClientData, Tcl_Interp *interp, int argc, const char *a
+ 	const RTLIL::Const &value = cell->getParam(param_id);
+
+ 	if (string_flag) {
+-		Tcl_SetResult(interp, (char *) value.decode_string().c_str(), TCL_VOLATILE);
++		Tcl_SetObjResult(interp, Tcl_NewStringObj(value.decode_string().c_str(), -1));
+ 	} else if (int_flag || uint_flag || sint_flag) {
+ 		mp_int value_mp;
+ 		if (!const_to_mp_int(value, &value_mp, sint_flag, uint_flag))
+ 			ERROR("bignum manipulation failed");
+ 		Tcl_SetObjResult(interp, Tcl_NewBignumObj(&value_mp));
+ 	} else {
+-		Tcl_SetResult(interp, (char *) value.as_string().c_str(), TCL_VOLATILE);
++		Tcl_SetObjResult(interp, Tcl_NewStringObj(value.as_string().c_str(), -1));
+ 	}
+ 	return TCL_OK;
+ }

bazel/yosys-patches/BUILD.bazel

@@ -0,0 +1 @@
+exports_files(glob(["*.patch"]))