diff --git a/.gitignore b/.gitignore
index 770fc1034..b90e00a92 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,6 +11,7 @@
 *.whl
 *~
 __pycache__
+/.cache
 /.cproject
 /.project
 /.settings
@@ -19,6 +20,7 @@ __pycache__
 /qtcreator.config
 /qtcreator.creator
 /qtcreator.creator.user
+/compile_commands.json
 /coverage.info
 /coverage_html
 /Makefile.conf
diff --git a/backends/cxxrtl/cxxrtl_backend.cc b/backends/cxxrtl/cxxrtl_backend.cc
index 931454ada..b9958c5fb 100644
--- a/backends/cxxrtl/cxxrtl_backend.cc
+++ b/backends/cxxrtl/cxxrtl_backend.cc
@@ -616,7 +616,7 @@ std::string escape_c_string(const std::string &input)
 				output.push_back('\\');
 			output.push_back(c);
 		} else {
-			char l = c & 0x3, m = (c >> 3) & 0x3, h = (c >> 6) & 0x3;
+			char l = c & 0x7, m = (c >> 3) & 0x7, h = (c >> 6) & 0x3;
 			output.append("\\");
 			output.push_back('0' + h);
 			output.push_back('0' + m);
diff --git a/frontends/verific/verific.cc b/frontends/verific/verific.cc
index 75b460f61..11fb23dfa 100644
--- a/frontends/verific/verific.cc
+++ b/frontends/verific/verific.cc
@@ -4494,7 +4494,7 @@ struct ReadPass : public Pass {
 		log("\n");
 		log("    read {-f|-F} <command-file>\n");
 		log("\n");
-		log("Load and execute the specified command file. (Requires Verific.)\n");
+		log("Load and execute the specified command file.\n");
 		log("Check verific command for more information about supported commands in file.\n");
 		log("\n");
 		log("\n");
@@ -4608,10 +4608,14 @@ struct ReadPass : public Pass {
 		if (args[1] == "-f" || args[1] == "-F") {
 			if (use_verific) {
 				args[0] = "verific";
-				Pass::call(design, args);
 			} else {
-				cmd_error(args, 1, "This version of Yosys is built without Verific support.\n");
+#if !defined(__wasm)
+				args[0] = "read_verilog_file_list";
+#else
+				cmd_error(args, 1, "Command files are not supported on this platform.\n");
+#endif
 			}
+			Pass::call(design, args);
 			return;
 		}
 
diff --git a/frontends/verilog/verilog_frontend.cc b/frontends/verilog/verilog_frontend.cc
index d363d71fb..e4e705c39 100644
--- a/frontends/verilog/verilog_frontend.cc
+++ b/frontends/verilog/verilog_frontend.cc
@@ -26,6 +26,10 @@
  *
  */
 
+#if !defined(__wasm)
+#include <filesystem>
+#endif
+
 #include "verilog_frontend.h"
 #include "preproc.h"
 #include "kernel/yosys.h"
@@ -672,6 +676,89 @@ struct VerilogDefines : public Pass {
 	}
 } VerilogDefines;
 
+#if !defined(__wasm)
+
+static void parse_file_list(const std::string &file_list_path, RTLIL::Design *design, bool relative_to_file_list_path)
+{
+	std::ifstream flist(file_list_path);
+	if (!flist.is_open()) {
+		log_error("Verilog file list file does not exist");
+		exit(1);
+	}
+
+	std::filesystem::path file_list_parent_dir = std::filesystem::path(file_list_path).parent_path();
+
+	std::string v_file_name;
+	while (std::getline(flist, v_file_name)) {
+		if (v_file_name.empty()) {
+			continue;
+		}
+
+		std::filesystem::path verilog_file_path;
+		if (relative_to_file_list_path) {
+			verilog_file_path = file_list_parent_dir / v_file_name;
+		} else {
+			verilog_file_path = std::filesystem::current_path() / v_file_name;
+		}
+
+		bool is_sv = (verilog_file_path.extension() == ".sv");
+
+		std::vector<std::string> read_verilog_cmd = {"read_verilog", "-defer"};
+		if (is_sv) {
+			read_verilog_cmd.push_back("-sv");
+		}
+		read_verilog_cmd.push_back(verilog_file_path.string());
+		Pass::call(design, read_verilog_cmd);
+	}
+
+	flist.close();
+}
+
+struct VerilogFileList : public Pass {
+	VerilogFileList() : Pass("read_verilog_file_list", "Parse a Verilog file list") {}
+	void help() override
+	{
+		//   |---v---|---v---|---v---|---v---|---v---|---v---|---v---|---v---|---v---|---v---|
+		log("\n");
+		log("    read_verilog_file_list [options]\n");
+		log("\n");
+		log("Parse a Verilog file list, and pass the list of Verilog files to read_verilog\n");
+		log("command\n");
+		log("\n");
+		log("    -F file_list_path\n");
+		log("        File list file contains list of Verilog files to be parsed, any path is\n");
+		log("        treated relative to the file list file\n");
+		log("\n");
+		log("    -f file_list_path\n");
+		log("        File list file contains list of Verilog files to be parsed, any path is\n");
+		log("        treated relative to current working directroy\n");
+		log("\n");
+	}
+
+	void execute(std::vector<std::string> args, RTLIL::Design *design) override
+	{
+		size_t argidx;
+		for (argidx = 1; argidx < args.size(); argidx++) {
+			std::string arg = args[argidx];
+			if (arg == "-F" && argidx + 1 < args.size()) {
+				std::string file_list_path = args[++argidx];
+				parse_file_list(file_list_path, design, true);
+				continue;
+			}
+			if (arg == "-f" && argidx + 1 < args.size()) {
+				std::string file_list_path = args[++argidx];
+				parse_file_list(file_list_path, design, false);
+				continue;
+			}
+			break;
+		}
+
+		extra_args(args, argidx, design);
+	}
+} VerilogFilelist;
+
+#endif
+
 YOSYS_NAMESPACE_END
 
 // the yyerror function used by bison to report parser errors
diff --git a/kernel/fmt.cc b/kernel/fmt.cc
index 6ba1150ce..6e9f2924a 100644
--- a/kernel/fmt.cc
+++ b/kernel/fmt.cc
@@ -634,10 +634,11 @@ std::string escape_cxx_string(const std::string &input)
 				output.push_back('\\');
 			output.push_back(c);
 		} else {
-			char l = c & 0xf, h = (c >> 4) & 0xf;
-			output.append("\\x");
-			output.push_back((h < 10 ? '0' + h : 'a' + h - 10));
-			output.push_back((l < 10 ? '0' + l : 'a' + l - 10));
+			char l = c & 0x7, m = (c >> 3) & 0x7, h = (c >> 6) & 0x3;
+			output.push_back('\\');
+			output.push_back('0' + h);
+			output.push_back('0' + m);
+			output.push_back('0' + l);
 		}
 	}
 	output.push_back('"');
diff --git a/passes/cmds/splitcells.cc b/passes/cmds/splitcells.cc
index e30e87d1f..a33d968d8 100644
--- a/passes/cmds/splitcells.cc
+++ b/passes/cmds/splitcells.cc
@@ -107,8 +107,7 @@ struct SplitcellsWorker
 
 				auto slice_signal = [&](SigSpec old_sig) -> SigSpec {
 					SigSpec new_sig;
-					for (int i = 0; i < GetSize(old_sig); i += GetSize(outsig)) {
-						int offset = i+slice_lsb;
+					for (int offset = slice_lsb; offset < GetSize(old_sig); offset += GetSize(outsig)) {
 						int length = std::min(GetSize(old_sig)-offset, slice_msb-slice_lsb+1);
 						new_sig.append(old_sig.extract(offset, length));
 					}
diff --git a/tests/various/bug4909.ys b/tests/various/bug4909.ys
new file mode 100644
index 000000000..bf8cfb45b
--- /dev/null
+++ b/tests/various/bug4909.ys
@@ -0,0 +1,44 @@
+read_rtlil << EOF
+autoidx 20
+attribute \src "3510.v:2.1-26.10"
+attribute \cells_not_processed 1
+attribute \tamara_triplicate 1
+module \top
+  attribute \src "3510.v:14.3-17.8"
+  wire width 4 $0\reg5[3:0]
+  attribute $bugpoint 1
+  wire width 4 $auto$bugpoint.cc:258:simplify_something$12
+  wire $delete_wire$14
+  attribute \src "3510.v:13.19-13.59"
+  wire width 4 $xnor$3510.v:13$1_Y
+  attribute \src "3510.v:11.23-11.27"
+  wire width 4 \reg5
+  attribute \src "3510.v:8.24-8.29"
+  wire width 3 \wire4
+  attribute \src "3510.v:3.33-3.34"
+  wire width 12 output 1 \y
+  attribute \src "3510.v:13.19-13.59"
+  cell $xnor $xnor$3510.v:13$1
+    parameter \A_SIGNED 0
+    parameter \A_WIDTH 3
+    parameter \B_SIGNED 0
+    parameter \B_WIDTH 4
+    parameter \Y_WIDTH 4
+    connect \A 3'x
+    connect \B $auto$bugpoint.cc:258:simplify_something$12
+    connect \Y $xnor$3510.v:13$1_Y
+  end
+  attribute \src "3510.v:14.3-17.8"
+  process $proc$3510.v:14$2
+    assign $0\reg5[3:0] { \wire4 [2] \wire4 }
+    sync posedge $delete_wire$14
+      update \reg5 $0\reg5[3:0]
+  end
+  connect \y [4:0] { \reg5 1'0 }
+  connect \wire4 $xnor$3510.v:13$1_Y [2:0]
+end
+EOF
+
+prep
+splitcells
+