[llvm] [TySan] Fix crash in instrumentation with scalar TBAA tag missing offset (PR #172878)

Florian Hahn via llvm-commits llvm-commits at lists.llvm.org
Thu Sep 24 10:51:15 PDT 2026


================
@@ -345,8 +345,17 @@ bool TypeSanitizer::generateBaseTypeDescriptor(
       Member = TypeDescriptors[MemberNode];
     }
 
-    uint64_t Offset =
-        mdconst::extract<ConstantInt>(MD->getOperand(i + 1))->getZExtValue();
+    uint64_t Offset;
+    if ((unsigned)i + 1 < MD->getNumOperands()) {
+      Offset =
+          mdconst::extract<ConstantInt>(MD->getOperand(i + 1))->getZExtValue();
+    } else if (i == 1 && MD->getNumOperands() == 2) {
+      // The third operand for a scalar tag is actually optional, its absence
+      // indicating an offset of zero.
+      Offset = 0;
+    } else {
+      assert(false && "Malformed TBAA MD.");
+    }
----------------
fhahn wrote:

Would be good to avoid `assert(false...)`

maybe something like

```suggestion
    } else {
     assert(i == 1 && MD->getNumOperands() == 2  && "Malformed TBAA MD.");
      // The third operand for a scalar tag is actually optional, its absence
      // indicating an offset of zero.
      Offset = 0;
    }
```

https://github.com/llvm/llvm-project/pull/172878


More information about the llvm-commits mailing list