[Mlir-commits] [mlir] [mlir][LLVMIR] Verify that `IntegerAttr` type matches result type in `llvm.mlir.constant` (PR #205304)

[llvmlistbot at llvm.org]

llvmorg-github-actions[bot] wrote:


<!--LLVM PR SUMMARY COMMENT-->

@llvm/pr-subscribers-mlir

Author: Anutosh Bhat (anutosh491)

<details>
<summary>Changes</summary>

Fixes https://github.com/llvm/llvm-project/issues/205286


The verifier checked that the result type was an integer type when the value attribute was an IntegerAttr, but did not check that the attribute's type matches the result type. This allowed malformed IR like `llvm.mlir.constant(1 : i8) : i64` to pass verification, which would later crash resulting to the error message in the issue.

Added the missing type equality check and a regression test.

---
Full diff: https://github.com/llvm/llvm-project/pull/205304.diff


2 Files Affected:

- (modified) mlir/lib/Dialect/LLVMIR/IR/LLVMDialect.cpp (+4-1) 
- (modified) mlir/test/Dialect/LLVMIR/invalid.mlir (+8) 


``````````diff
diff --git a/mlir/lib/Dialect/LLVMIR/IR/LLVMDialect.cpp b/mlir/lib/Dialect/LLVMIR/IR/LLVMDialect.cpp
index 58f569abff8ea..ff1064a6cc97b 100644
--- a/mlir/lib/Dialect/LLVMIR/IR/LLVMDialect.cpp
+++ b/mlir/lib/Dialect/LLVMIR/IR/LLVMDialect.cpp
@@ -3593,9 +3593,12 @@ LogicalResult LLVM::ConstantOp::verify() {
   };
 
   // Verification of IntegerAttr, FloatAttr, ElementsAttr, ArrayAttr.
-  if (isa<IntegerAttr>(getValue())) {
+  if (auto intAttr = dyn_cast<IntegerAttr>(getValue())) {
     if (!llvm::isa<IntegerType>(getType()))
       return emitOpError() << "expected integer type";
+    if (intAttr.getType() != getType())
+      return emitOpError() << "integer attribute type " << intAttr.getType()
+                           << " does not match op type " << getType();
   } else if (auto floatAttr = dyn_cast<FloatAttr>(getValue())) {
     return verifyFloatSemantics(floatAttr.getValue().getSemantics(), getType());
   } else if (auto elementsAttr = dyn_cast<ElementsAttr>(getValue())) {
diff --git a/mlir/test/Dialect/LLVMIR/invalid.mlir b/mlir/test/Dialect/LLVMIR/invalid.mlir
index d5ea5c8de862e..fd9d82b3e443d 100644
--- a/mlir/test/Dialect/LLVMIR/invalid.mlir
+++ b/mlir/test/Dialect/LLVMIR/invalid.mlir
@@ -450,6 +450,14 @@ llvm.func @int_attr_requires_int_type() -> f32 {
 
 // -----
 
+llvm.func @int_attr_type_mismatch() -> i64 {
+  // expected-error @below{{integer attribute type 'i8' does not match op type 'i64'}}
+  %0 = llvm.mlir.constant(1 : i8) : i64
+  llvm.return %0 : i64
+}
+
+// -----
+
 llvm.func @vector_int_attr_requires_int_type() -> vector<2xf32> {
   // expected-error @below{{expected integer element type}}
   %0 = llvm.mlir.constant(dense<[1, 2]> : vector<2xi32>) : vector<2xf32>

``````````

</details>


https://github.com/llvm/llvm-project/pull/205304