[Mlir-commits] [mlir] [MLIR] Fix SCF verifier crash (PR #153974)

[Mehdi Amini]

https://github.com/joker-eph created https://github.com/llvm/llvm-project/pull/153974

An operand of the nested yield op can be null and hasn't been verified yet when processing the enclosing operation. Using `getResultTypes()` will dereference this null Value and crash in the verifier.

>From dc46b77c42053f9a555c89999a0a4aee22f3d41d Mon Sep 17 00:00:00 2001
From: Mehdi Amini <joker.eph at gmail.com>
Date: Sat, 16 Aug 2025 11:42:05 -0700
Subject: [PATCH] [MLIR] Fix SCF verifier crash

An operand of the nested yield op can be null and hasn't been verified
yet when processing the enclosing operation. Using `getResultTypes()`
will dereference this null Value and crash in the verifier.
---
 mlir/lib/Dialect/SCF/IR/SCF.cpp | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/mlir/lib/Dialect/SCF/IR/SCF.cpp b/mlir/lib/Dialect/SCF/IR/SCF.cpp
index 89731de1df053..fd5b2a8e852da 100644
--- a/mlir/lib/Dialect/SCF/IR/SCF.cpp
+++ b/mlir/lib/Dialect/SCF/IR/SCF.cpp
@@ -4237,13 +4237,15 @@ LogicalResult scf::IndexSwitchOp::verify() {
     }
     for (auto [idx, result, operand] :
          llvm::zip(llvm::seq<unsigned>(0, getNumResults()), getResultTypes(),
-                   yield.getOperandTypes())) {
-      if (result == operand)
+                   yield.getOperands())) {
+      if (!operand)
+        return yield.emitOpError() << "operand " << idx << " is null\n";
+      if (result == operand.getType())
         continue;
       return (emitOpError("expected result #")
               << idx << " of each region to be " << result)
                  .attachNote(yield.getLoc())
-             << name << " returns " << operand << " here";
+             << name << " returns " << operand.getType() << " here";
     }
     return success();
   };