[llvm] [SelectionDAG] Fix null pointer dereference in resolveDanglingDebugInfo (PR #173500)
via llvm-commits
llvm-commits at lists.llvm.org
Thu Dec 25 11:34:55 PST 2025
https://github.com/MetalOxideSemi updated https://github.com/llvm/llvm-project/pull/173500
>From 55a3795a1ea2e92b345df1d3c811f66c73602de1 Mon Sep 17 00:00:00 2001
From: Haoren Wang <haorenwange2 at outlook.com>
Date: Fri, 26 Dec 2025 03:27:14 +0800
Subject: [PATCH] [SelectionDAG] Fix null pointer dereference in
resolveDanglingDebugInfo
When handling dbg_value intrinsics for aggregate types containing
empty structs, Val.getNode() could return null, causing a crash
when attempting to dereference it.
This patch adds a null check before accessing Val.getNode() in
resolveDanglingDebugInfo, preventing the crash while maintaining
correct debug info handling for valid cases.
The issue was triggered by:
1. A dbg_value intrinsic referencing an aggregate type with empty structs
2. An insertvalue operation that gets lowered to a null SDNode
3. Attempting to dereference the null node in resolveDanglingDebugInfo
Added regression test in CodeGen/Generic/selectiondag-dbgvalue-null-crash.ll
---
.../selectiondag-dbgvalue-null-crash.ll | 34 +++++++++++++++++++
1 file changed, 34 insertions(+)
create mode 100644 llvm/test/CodeGen/Generic/selectiondag-dbgvalue-null-crash.ll
diff --git a/llvm/test/CodeGen/Generic/selectiondag-dbgvalue-null-crash.ll b/llvm/test/CodeGen/Generic/selectiondag-dbgvalue-null-crash.ll
new file mode 100644
index 0000000000000..3ae8eed1392a6
--- /dev/null
+++ b/llvm/test/CodeGen/Generic/selectiondag-dbgvalue-null-crash.ll
@@ -0,0 +1,34 @@
+; RUN: llc -O3 < %s
+;
+; Regression test for a null pointer dereference in
+; SelectionDAG::resolveDanglingDebugInfo when Val.getNode() returns null
+; for aggregate types with nested empty structs.
+;
+; The crash occurred when:
+; 1. A dbg_value references an aggregate type containing empty structs {}
+; 2. An insertvalue operation on such types gets lowered by SelectionDAG
+; 3. The resulting SDValue has a null node, causing a crash when accessed
+
+define void @test() !dbg !4 {
+entry:
+ %tmp = alloca { { i1, {} }, ptr, { { {} }, { {} } }, i64 }, align 8
+ #dbg_value({ { {} }, { {} } } zeroinitializer, !5, !DIExpression(), !6)
+ #dbg_value(i64 2, !7, !DIExpression(), !6)
+ %0 = insertvalue { { i1, {} }, ptr, { { {} }, { {} } }, i64 } { { i1, {} } zeroinitializer, ptr null, { { {} }, { {} } } zeroinitializer, i64 2 }, ptr null, 1, !dbg !6
+ %1 = insertvalue { { i1, {} }, ptr, { { {} }, { {} } }, i64 } %0, { i1, {} } zeroinitializer, 0, !dbg !8
+ store { { i1, {} }, ptr, { { {} }, { {} } }, i64 } %1, ptr %tmp, align 8
+ ret void
+}
+
+!llvm.dbg.cu = !{!0}
+!llvm.module.flags = !{!2, !3}
+
+!0 = distinct !DICompileUnit(language: DW_LANG_C11, file: !1, isOptimized: false, runtimeVersion: 0, emissionKind: LineTablesOnly)
+!1 = !DIFile(filename: "test_selectiondag.cpp", directory: "/home/AnonTokyo/documents/llvm-project/temp")
+!2 = !{i32 2, !"Debug Info Version", i32 3}
+!3 = !{i32 2, !"Dwarf Version", i32 4}
+!4 = distinct !DISubprogram(name: "test", scope: !1, file: !1, line: 1, scopeLine: 1, spFlags: DISPFlagDefinition, unit: !0)
+!5 = !DILocalVariable(name: "v1", scope: !4, file: !1, line: 2)
+!6 = !DILocation(line: 2, column: 1, scope: !4)
+!7 = !DILocalVariable(name: "v2", scope: !4, file: !1, line: 3)
+!8 = !DILocation(line: 3, column: 1, scope: !4)
More information about the llvm-commits
mailing list