[llvm] [IR][NVVM] Fixed null pointer deference in AsmWriter pretty printer (PR #207223)

[Stefan Mada via llvm-commits]

https://github.com/smada3 created https://github.com/llvm/llvm-project/pull/207223

ASMWriter can deference a null pointer on intrinsics with pretty printed args when those intrinsics are called with an invalid number of arguments. This check avoids the null dereference and turns this into a graceful failure. 



>From c13ac4a3adc46837c8bfbaafcd0528d03736e1f2 Mon Sep 17 00:00:00 2001
From: Stefan Mada <smada at nvidia.com>
Date: Wed, 1 Jul 2026 21:48:21 +0000
Subject: [PATCH] Fixed null pointer deference in AsmWriter pretty printer

---
 llvm/lib/IR/AsmWriter.cpp                     |  2 +-
 ...insic-immarg-print-mismatched-signature.ll | 24 +++++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 llvm/test/CodeGen/NVPTX/intrinsic-immarg-print-mismatched-signature.ll

diff --git a/llvm/lib/IR/AsmWriter.cpp b/llvm/lib/IR/AsmWriter.cpp
index 52ed28f71f615..4878860de5788 100644
--- a/llvm/lib/IR/AsmWriter.cpp
+++ b/llvm/lib/IR/AsmWriter.cpp
@@ -4623,7 +4623,7 @@ void AssemblyWriter::printInstruction(const Instruction &I) {
     Function *CalledFunc = CI->getCalledFunction();
     auto PrintArgComment = [&](unsigned ArgNo) {
       const auto *ConstArg = dyn_cast<Constant>(CI->getArgOperand(ArgNo));
-      if (!ConstArg)
+      if (!ConstArg || !CalledFunc)
         return;
       std::string ArgComment;
       raw_string_ostream ArgCommentStream(ArgComment);
diff --git a/llvm/test/CodeGen/NVPTX/intrinsic-immarg-print-mismatched-signature.ll b/llvm/test/CodeGen/NVPTX/intrinsic-immarg-print-mismatched-signature.ll
new file mode 100644
index 0000000000000..b9d5c821cfbd0
--- /dev/null
+++ b/llvm/test/CodeGen/NVPTX/intrinsic-immarg-print-mismatched-signature.ll
@@ -0,0 +1,24 @@
+; NOTE: This test guards AsmWriter's intrinsic immediate-argument pretty-printer
+;       against a null-pointer dereference.
+; RUN: llvm-as -disable-verify < %s | llvm-dis | FileCheck %s
+
+target triple = "nvptx64-nvidia-cuda"
+
+declare void @llvm.nvvm.tensormap.replace.elemtype.p0(ptr, i32)
+
+; A well-formed call: the elemtype immediate is pretty-printed.
+define void @valid(ptr %p) {
+  ; CHECK-LABEL: define void @valid(
+  ; CHECK: call void @llvm.nvvm.tensormap.replace.elemtype.p0(ptr %p, /* elemtype=u8 */ i32 0)
+  call void @llvm.nvvm.tensormap.replace.elemtype.p0(ptr %p, i32 0)
+  ret void
+}
+
+; A call with a mismatched signature (an extra operand): getCalledFunction() is
+; null, so no comment is emitted and printing must not crash.
+define void @mismatched_signature(ptr %p) {
+  ; CHECK-LABEL: define void @mismatched_signature(
+  ; CHECK: call void @llvm.nvvm.tensormap.replace.elemtype.p0(ptr %p, i32 0, i32 0)
+  call void @llvm.nvvm.tensormap.replace.elemtype.p0(ptr %p, i32 0, i32 0)
+  ret void
+}