Skip to content

WIP: [mlir][func] Fix potential crash in FuncOp::verify#184607

Closed
ingomueller-net wants to merge 1 commit into
llvm:mainfrom
ingomueller-net:temp-fix-func-verifier
Closed

WIP: [mlir][func] Fix potential crash in FuncOp::verify#184607
ingomueller-net wants to merge 1 commit into
llvm:mainfrom
ingomueller-net:temp-fix-func-verifier

Conversation

@ingomueller-net
Copy link
Copy Markdown
Contributor

This PR fixes a potential crash in FuncOp::verify. This can happen if one of the operands of the return op inside the verified op is a <<NULL>> value, for example, because the original value had all uses dropped. The original implementation used the operands without checking their validity, which could lead to a crash. The fix consists in adding a test and failing verificiation if not all operands exist.

This PR fixes a potential crash in `FuncOp::verify`. This can happen if
one of the operands of the return op inside the verified op is a
`<<NULL>>` value, for example, because the original value had all uses
dropped. The original implementation used the operands without checking
their validity, which could lead to a crash. The fix consists in adding
a test and failing verificiation if not all operands exist.

Signed-off-by: Ingo Müller <ingomueller@google.com>
@llvmbot
Copy link
Copy Markdown
Member

llvmbot commented Mar 4, 2026

@llvm/pr-subscribers-mlir

@llvm/pr-subscribers-mlir-func

Author: Ingo Müller (ingomueller-net)

Changes

This PR fixes a potential crash in FuncOp::verify. This can happen if one of the operands of the return op inside the verified op is a &lt;&lt;NULL&gt;&gt; value, for example, because the original value had all uses dropped. The original implementation used the operands without checking their validity, which could lead to a crash. The fix consists in adding a test and failing verificiation if not all operands exist.


Full diff: https://github.com/llvm/llvm-project/pull/184607.diff

1 Files Affected:

  • (modified) mlir/lib/Dialect/Func/IR/FuncOps.cpp (+6-3)
diff --git a/mlir/lib/Dialect/Func/IR/FuncOps.cpp b/mlir/lib/Dialect/Func/IR/FuncOps.cpp
index 8ee2c9956d2d6..7c4c5a593d5fd 100644
--- a/mlir/lib/Dialect/Func/IR/FuncOps.cpp
+++ b/mlir/lib/Dialect/Func/IR/FuncOps.cpp
@@ -305,9 +305,12 @@ LogicalResult FuncOp::verify() {
              << " operands, but enclosing function (@" << getName()
              << ") returns " << resultTypes.size();
 
-    for (auto [i, opType] :
-         llvm::enumerate(llvm::zip(returnOp->getOperandTypes(), resultTypes))) {
-      auto [opTy, resTy] = opType;
+    for (auto [i, operand] :
+         llvm::enumerate(llvm::zip(returnOp->getOpOperands(), resultTypes))) {
+      auto [opOperand, resTy] = operand;
+      if (!opOperand.get())
+        return returnOp->emitOpError("null operand at index ") << i;
+      auto opTy = opOperand.get().getType();
       if (opTy != resTy)
         return returnOp->emitError()
                << "type of return operand " << i << " (" << opTy

@ingomueller-net
Copy link
Copy Markdown
Contributor Author

Closing in favor of #184612.

@ingomueller-net ingomueller-net deleted the temp-fix-func-verifier branch March 6, 2026 15:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants