[llvm] 0959950 - [LowerTypeTests] Avoid null dereference on invalid branch funnel operand (#204951)

[via llvm-commits]

Author: Arda Serdar Pektezol
Date: 2026-07-15T12:54:13-07:00
New Revision: 09599503b1314a0394e57adbd6279d9a220bfdb8

URL: https://github.com/llvm/llvm-project/commit/09599503b1314a0394e57adbd6279d9a220bfdb8
DIFF: https://github.com/llvm/llvm-project/commit/09599503b1314a0394e57adbd6279d9a220bfdb8.diff

LOG: [LowerTypeTests] Avoid null dereference on invalid branch funnel operand (#204951)

On the linked issue, a null dereference happens when looping over`
ArrayRef<GlobalTypeMember *> Globals` at
`LowerTypeTestsModule::buildBitSetsFromDisjointSet()`. This stems from
the external globals in the IR which don't enter GlobalTypeMembers.
Following that, operator[] over the DenseMap returns null and it
propagates to the looped over GlobalTypeMember.

Prevent the null dereference via `.find()` and reporting fatal usage
error if it is not present. Add a negative regression test.

Additionally, the LangRef for the `@llvm.icall.branch.funnel` intrinsic
is missing (see #133635). It would also be nice to have a Verifier entry
for this intrinsic, and get rid of most report_fatal_error() in this
file since it's deprecated.

Fixes #191985

---------

Co-authored-by: Vitaly Buka <vitalybuka at google.com>

Added: 
    llvm/test/Transforms/LowerTypeTests/icall-branch-funnel-invalid-operand.ll

Modified: 
    llvm/lib/Transforms/IPO/LowerTypeTests.cpp

Removed: 
    


################################################################################
diff  --git a/llvm/lib/Transforms/IPO/LowerTypeTests.cpp b/llvm/lib/Transforms/IPO/LowerTypeTests.cpp
index 7c045c90ead5b..e25451cd1f53d 100644
--- a/llvm/lib/Transforms/IPO/LowerTypeTests.cpp
+++ b/llvm/lib/Transforms/IPO/LowerTypeTests.cpp
@@ -2456,7 +2456,11 @@ bool LowerTypeTestsModule::lower() {
           report_fatal_error(
               "Expected branch funnel operand to be global value");
 
-        GlobalTypeMember *GTM = GlobalTypeMembers[Base];
+        auto It = GlobalTypeMembers.find(Base);
+        if (It == GlobalTypeMembers.end())
+          reportFatalUsageError("Expected branch funnel operand to be a "
+                                "defined global value with type metadata");
+        GlobalTypeMember *GTM = It->second;
         Targets.push_back(GTM);
         GlobalClassesTy::member_iterator NewSet =
             GlobalClasses.findLeader(GlobalClasses.insert(GTM));

diff  --git a/llvm/test/Transforms/LowerTypeTests/icall-branch-funnel-invalid-operand.ll b/llvm/test/Transforms/LowerTypeTests/icall-branch-funnel-invalid-operand.ll
new file mode 100644
index 0000000000000..0dda1db9206bc
--- /dev/null
+++ b/llvm/test/Transforms/LowerTypeTests/icall-branch-funnel-invalid-operand.ll
@@ -0,0 +1,17 @@
+; RUN: not opt -S -passes=lowertypetests %s 2>&1 | FileCheck %s
+; CHECK: LLVM ERROR: Expected branch funnel operand to be a defined global value with type metadata
+
+target triple = "x86_64--"
+
+ at g1 = external constant i32
+ at g2 = external constant i32
+
+define void @jt2(...) {
+  musttail call void (...) @llvm.icall.branch.funnel(ptr null, ptr @g1, ptr null, ptr @g2, ptr null, ...)
+  ret void
+}
+
+; Function Attrs: nocallback nofree nosync nounwind willreturn
+declare void @llvm.icall.branch.funnel(...) #0
+
+attributes #0 = { nocallback nofree nosync nounwind willreturn }