[llvm] [Verifier] Reject incorrect types in assume operand bundles (PR #196446)

[Nikolas Klauser via llvm-commits]

https://github.com/philnik777 updated https://github.com/llvm/llvm-project/pull/196446

>From b5d34438aaacac4b4c24b94ba058ca756ddfac41 Mon Sep 17 00:00:00 2001
From: Nikolas Klauser <nikolasklauser at berlin.de>
Date: Fri, 8 May 2026 01:29:19 +0200
Subject: [PATCH 1/3] [Verifier] Reject incorrect types in assume operand
 bundles

---
 llvm/lib/IR/Verifier.cpp             | 21 +++++++++++++++++++--
 llvm/test/Verifier/assume-bundles.ll |  2 ++
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/llvm/lib/IR/Verifier.cpp b/llvm/lib/IR/Verifier.cpp
index 2ea113fe665d9..b7b4eac422bc1 100644
--- a/llvm/lib/IR/Verifier.cpp
+++ b/llvm/lib/IR/Verifier.cpp
@@ -5994,11 +5994,28 @@ void Verifier::visitIntrinsicCall(Intrinsic::ID ID, CallBase &Call) {
               Call);
         continue;
       }
-      Check(Elem.Tag->getKey() == "ignore" ||
-                Attribute::isExistingAttribute(Elem.Tag->getKey()),
+      if (Elem.Tag->getKey() == "ignore")
+        break;
+      Check(Attribute::isExistingAttribute(Elem.Tag->getKey()),
             "tags must be valid attribute names", Call);
       Attribute::AttrKind Kind =
           Attribute::getAttrKindFromName(Elem.Tag->getKey());
+
+      // Reject assume bundles with incorrect types
+      if (Elem.Begin != Elem.End) {
+        AttributeSet AS = AttributeSet().addAttribute(Context, Kind);
+        AttributeMask IncompatibleAttrs = AttributeFuncs::typeIncompatible(
+            Call.getOperand(Elem.Begin)->getType(), AS);
+        for (Attribute Attr : AS) {
+          if (!Attr.isStringAttribute() &&
+              IncompatibleAttrs.contains(Attr.getKindAsEnum())) {
+            CheckFailed("Attribute '" + Attr.getAsString() +
+                            "' applied to incompatible type!",
+                        Call.getOperand(Elem.Begin));
+          }
+        }
+      }
+
       if (Kind == Attribute::Alignment) {
         Check(ArgCount <= 3 && ArgCount >= 2,
               "alignment assumptions should have 2 or 3 arguments", Call);
diff --git a/llvm/test/Verifier/assume-bundles.ll b/llvm/test/Verifier/assume-bundles.ll
index 728b118c99fb6..00032fd3955c7 100644
--- a/llvm/test/Verifier/assume-bundles.ll
+++ b/llvm/test/Verifier/assume-bundles.ll
@@ -34,5 +34,7 @@ define void @func(ptr %P, i32 %P1, ptr %P2, ptr %P3, i1 %cond) {
   call void @llvm.assume(i1 true) ["align"(ptr %P, i32 4), "dereferenceable"(ptr %P)]
 ; CHECK: assume with operand bundles must have i1 true condition
   call void @llvm.assume(i1 %cond) ["nonnull"(ptr %P)]
+; CHECK: Attribute 'nonnull' applied to incompatible type!
+  call void @llvm.assume(i1 true) ["nonnull"(i1 true)]
   ret void
 }

>From d64c411087a4f6ab15c4299bf98a1f2ebf6867e0 Mon Sep 17 00:00:00 2001
From: Nikolas Klauser <nikolasklauser at berlin.de>
Date: Fri, 8 May 2026 21:07:00 +0200
Subject: [PATCH 2/3] Address comments

---
 llvm/lib/IR/Verifier.cpp | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/llvm/lib/IR/Verifier.cpp b/llvm/lib/IR/Verifier.cpp
index b7b4eac422bc1..6a026f8d9cf63 100644
--- a/llvm/lib/IR/Verifier.cpp
+++ b/llvm/lib/IR/Verifier.cpp
@@ -6006,13 +6006,10 @@ void Verifier::visitIntrinsicCall(Intrinsic::ID ID, CallBase &Call) {
         AttributeSet AS = AttributeSet().addAttribute(Context, Kind);
         AttributeMask IncompatibleAttrs = AttributeFuncs::typeIncompatible(
             Call.getOperand(Elem.Begin)->getType(), AS);
-        for (Attribute Attr : AS) {
-          if (!Attr.isStringAttribute() &&
-              IncompatibleAttrs.contains(Attr.getKindAsEnum())) {
-            CheckFailed("Attribute '" + Attr.getAsString() +
-                            "' applied to incompatible type!",
-                        Call.getOperand(Elem.Begin));
-          }
+        if (IncompatibleAttrs.contains(AS.begin()->getKindAsEnum())) {
+          CheckFailed("Attribute '" + AS.begin()->getAsString() +
+                          "' applied to incompatible type!",
+                      Call.getOperand(Elem.Begin));
         }
       }
 

>From b629e44ca061d0d9a7e41b9cebb5543c5d9ee2a6 Mon Sep 17 00:00:00 2001
From: Nikolas Klauser <nikolasklauser at berlin.de>
Date: Sun, 10 May 2026 11:25:02 +0200
Subject: [PATCH 3/3] Address comments

---
 llvm/lib/IR/Verifier.cpp             | 5 +++--
 llvm/test/Verifier/assume-bundles.ll | 4 ++++
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/llvm/lib/IR/Verifier.cpp b/llvm/lib/IR/Verifier.cpp
index 6a026f8d9cf63..e1909ef3df01b 100644
--- a/llvm/lib/IR/Verifier.cpp
+++ b/llvm/lib/IR/Verifier.cpp
@@ -6006,8 +6006,9 @@ void Verifier::visitIntrinsicCall(Intrinsic::ID ID, CallBase &Call) {
         AttributeSet AS = AttributeSet().addAttribute(Context, Kind);
         AttributeMask IncompatibleAttrs = AttributeFuncs::typeIncompatible(
             Call.getOperand(Elem.Begin)->getType(), AS);
-        if (IncompatibleAttrs.contains(AS.begin()->getKindAsEnum())) {
-          CheckFailed("Attribute '" + AS.begin()->getAsString() +
+        if (auto AttrKind = AS.begin()->getKindAsEnum();
+            IncompatibleAttrs.contains(AttrKind)) {
+          CheckFailed("Attribute '" + Attribute::getNameFromAttrKind(AttrKind) +
                           "' applied to incompatible type!",
                       Call.getOperand(Elem.Begin));
         }
diff --git a/llvm/test/Verifier/assume-bundles.ll b/llvm/test/Verifier/assume-bundles.ll
index 00032fd3955c7..29e205a79e7a7 100644
--- a/llvm/test/Verifier/assume-bundles.ll
+++ b/llvm/test/Verifier/assume-bundles.ll
@@ -36,5 +36,9 @@ define void @func(ptr %P, i32 %P1, ptr %P2, ptr %P3, i1 %cond) {
   call void @llvm.assume(i1 %cond) ["nonnull"(ptr %P)]
 ; CHECK: Attribute 'nonnull' applied to incompatible type!
   call void @llvm.assume(i1 true) ["nonnull"(i1 true)]
+; CHECK: Attribute 'align' applied to incompatible type!
+  call void @llvm.assume(i1 true) ["align"(i1 true)]
+; CHECK: Attribute 'dereferenceable' applied to incompatible type!
+  call void @llvm.assume(i1 true) ["dereferenceable"(i1 true)]
   ret void
 }