[llvm] [SPIR-V] Diagnose out-of-bounds argument index in function type metadata (PR #200601)

[Arseniy Obolenskiy via llvm-commits]

https://github.com/aobolensk updated https://github.com/llvm/llvm-project/pull/200601

>From 7e95409fc8de11c0111401e5c83932a66e49c266 Mon Sep 17 00:00:00 2001
From: Arseniy Obolenskiy <arseniy.obolenskiy at amd.com>
Date: Sat, 30 May 2026 21:41:17 +0200
Subject: [PATCH 1/3] [SPIR-V] Diagnose out-of-bounds argument index in
 function-type metadata

The argument index in spv.cloned_funcs/spv.mutated_callsites metadata was used to index the parameter list with only a lower bound assert

Add boundaries check it and report_fatal_error rather than silently miscompiling
---
 llvm/lib/Target/SPIRV/SPIRVUtils.cpp              |  8 +++++---
 .../CodeGen/SPIRV/cloned-funcs-metadata-oob.ll    | 15 +++++++++++++++
 2 files changed, 20 insertions(+), 3 deletions(-)
 create mode 100644 llvm/test/CodeGen/SPIRV/cloned-funcs-metadata-oob.ll

diff --git a/llvm/lib/Target/SPIRV/SPIRVUtils.cpp b/llvm/lib/Target/SPIRV/SPIRVUtils.cpp
index 0ef31f4182b4e..c4b7ef684adc5 100644
--- a/llvm/lib/Target/SPIRV/SPIRVUtils.cpp
+++ b/llvm/lib/Target/SPIRV/SPIRVUtils.cpp
@@ -66,13 +66,15 @@ static FunctionType *extractFunctionTypeFromMetadata(NamedMDNode *NMD,
     if (auto *Const = getConstInt(MD, 0)) {
       auto *CMeta = dyn_cast<ConstantAsMetadata>(MD->getOperand(1));
       assert(CMeta && "ConstantAsMetadata operand is expected");
-      assert(Const->getSExtValue() >= -1);
+      int64_t Idx = Const->getSExtValue();
       // Currently -1 indicates return value, greater values mean
       // argument numbers.
-      if (Const->getSExtValue() == -1)
+      if (Idx < -1 || static_cast<uint64_t>(Idx) >= PTys.size())
+        report_fatal_error("invalid argument index in function type metadata");
+      if (Idx == -1)
         RetTy = CMeta->getType();
       else
-        PTys[Const->getSExtValue()] = CMeta->getType();
+        PTys[Idx] = CMeta->getType();
     }
   }
 
diff --git a/llvm/test/CodeGen/SPIRV/cloned-funcs-metadata-oob.ll b/llvm/test/CodeGen/SPIRV/cloned-funcs-metadata-oob.ll
new file mode 100644
index 0000000000000..cd9ecba35a688
--- /dev/null
+++ b/llvm/test/CodeGen/SPIRV/cloned-funcs-metadata-oob.ll
@@ -0,0 +1,15 @@
+; Malformed spv.cloned_funcs metadata referencing an argument index past the
+; end of the parameter list must be diagnosed, not cause an out-of-bounds write.
+
+; RUN: not --crash llc -O0 -mtriple=spirv64-unknown-unknown %s -o - 2>&1 | FileCheck %s
+
+; CHECK: invalid argument index in function type metadata
+
+define i32 @foo(i32 %x) {
+  ret i32 %x
+}
+
+; Index 5 is out of range for the single-parameter function.
+!spv.cloned_funcs = !{!0}
+!0 = !{!"foo", !1}
+!1 = !{i32 5, <4 x i32> zeroinitializer}

>From 60753b38fa837b9552d850ccc3d944804a1aff2a Mon Sep 17 00:00:00 2001
From: Arseniy Obolenskiy <gooddoog at student.su>
Date: Sat, 30 May 2026 23:44:33 +0200
Subject: [PATCH 2/3] idx

---
 llvm/lib/Target/SPIRV/SPIRVUtils.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/llvm/lib/Target/SPIRV/SPIRVUtils.cpp b/llvm/lib/Target/SPIRV/SPIRVUtils.cpp
index c4b7ef684adc5..6e486f6104b70 100644
--- a/llvm/lib/Target/SPIRV/SPIRVUtils.cpp
+++ b/llvm/lib/Target/SPIRV/SPIRVUtils.cpp
@@ -69,7 +69,7 @@ static FunctionType *extractFunctionTypeFromMetadata(NamedMDNode *NMD,
       int64_t Idx = Const->getSExtValue();
       // Currently -1 indicates return value, greater values mean
       // argument numbers.
-      if (Idx < -1 || static_cast<uint64_t>(Idx) >= PTys.size())
+      if (Idx < -1 || (Idx >= 0 && static_cast<uint64_t>(Idx) >= PTys.size()))
         report_fatal_error("invalid argument index in function type metadata");
       if (Idx == -1)
         RetTy = CMeta->getType();

>From cc58fdc55929f7c0d095f88d7137c5164a1ab2c7 Mon Sep 17 00:00:00 2001
From: Arseniy Obolenskiy <arseniy.obolenskiy at amd.com>
Date: Wed, 3 Jun 2026 12:15:35 +0200
Subject: [PATCH 3/3] Address comment

---
 llvm/lib/Target/SPIRV/SPIRVUtils.cpp | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/llvm/lib/Target/SPIRV/SPIRVUtils.cpp b/llvm/lib/Target/SPIRV/SPIRVUtils.cpp
index 6e486f6104b70..6c5619c4585ef 100644
--- a/llvm/lib/Target/SPIRV/SPIRVUtils.cpp
+++ b/llvm/lib/Target/SPIRV/SPIRVUtils.cpp
@@ -69,12 +69,15 @@ static FunctionType *extractFunctionTypeFromMetadata(NamedMDNode *NMD,
       int64_t Idx = Const->getSExtValue();
       // Currently -1 indicates return value, greater values mean
       // argument numbers.
-      if (Idx < -1 || (Idx >= 0 && static_cast<uint64_t>(Idx) >= PTys.size()))
-        report_fatal_error("invalid argument index in function type metadata");
-      if (Idx == -1)
+      if (Idx == -1) {
         RetTy = CMeta->getType();
-      else
+        continue;
+      }
+      if (Idx >= 0 && static_cast<uint64_t>(Idx) < PTys.size()) {
         PTys[Idx] = CMeta->getType();
+        continue;
+      }
+      report_fatal_error("invalid argument index in function type metadata");
     }
   }