[Mlir-commits] [mlir] [mlir][shape] Fix crash when shape.lib array references undefined symbol (PR #184613)

[Mehdi Amini]

https://github.com/joker-eph created https://github.com/llvm/llvm-project/pull/184613

In verifyOperationAttribute(), the single-symbol path for shape.lib used SymbolTable::lookupSymbolIn() followed by an explicit null check. The array path at line 196-197 used dyn_cast<FunctionLibraryOp>() directly on the lookup result, which asserts when the symbol is not found (null pointer).

Fix: use dyn_cast_or_null<> instead of dyn_cast<> so that a missing symbol falls through to the existing "does not refer to FunctionLibraryOp" error diagnostic instead of asserting.

Fixes #159653

>From b4df25ac9f64a216b9c29ce9b69e4a9ec9c5821b Mon Sep 17 00:00:00 2001
From: Mehdi Amini <joker.eph at gmail.com>
Date: Wed, 4 Mar 2026 04:03:35 -0800
Subject: [PATCH] [mlir][shape] Fix crash when shape.lib array references
 undefined symbol

In verifyOperationAttribute(), the single-symbol path for shape.lib used
SymbolTable::lookupSymbolIn() followed by an explicit null check. The
array path at line 196-197 used dyn_cast<FunctionLibraryOp>() directly
on the lookup result, which asserts when the symbol is not found
(null pointer).

Fix: use dyn_cast_or_null<> instead of dyn_cast<> so that a missing
symbol falls through to the existing "does not refer to FunctionLibraryOp"
error diagnostic instead of asserting.

Fixes #159653
---
 mlir/lib/Dialect/Shape/IR/Shape.cpp  | 2 +-
 mlir/test/Dialect/Shape/invalid.mlir | 8 ++++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/mlir/lib/Dialect/Shape/IR/Shape.cpp b/mlir/lib/Dialect/Shape/IR/Shape.cpp
index 4d03b7b2b2064..38cac53be3022 100644
--- a/mlir/lib/Dialect/Shape/IR/Shape.cpp
+++ b/mlir/lib/Dialect/Shape/IR/Shape.cpp
@@ -193,7 +193,7 @@ LogicalResult ShapeDialect::verifyOperationAttribute(Operation *op,
           return op->emitError(
               "only SymbolRefAttr allowed in shape.lib attribute array");
 
-        auto shapeFnLib = dyn_cast<shape::FunctionLibraryOp>(
+        auto shapeFnLib = dyn_cast_or_null<shape::FunctionLibraryOp>(
             SymbolTable::lookupSymbolIn(op, llvm::cast<SymbolRefAttr>(it)));
         if (!shapeFnLib)
           return op->emitError()
diff --git a/mlir/test/Dialect/Shape/invalid.mlir b/mlir/test/Dialect/Shape/invalid.mlir
index ce2a438d70311..572583edd59bd 100644
--- a/mlir/test/Dialect/Shape/invalid.mlir
+++ b/mlir/test/Dialect/Shape/invalid.mlir
@@ -258,6 +258,14 @@ module attributes {shape.lib = @fn} { }
 
 // -----
 
+// Test that shape function library array entry is defined (regression test for
+// github.com/llvm/llvm-project/issues/159653: dyn_cast crash on missing symbol).
+
+// expected-error at +1 {{@missing does not refer to FunctionLibraryOp}}
+module attributes {shape.lib = [@missing]} { }
+
+// -----
+
 func.func @fn(%arg: !shape.shape) -> !shape.witness {
   // expected-error at +1 {{required at least 2 input shapes}}
   %0 = shape.cstr_broadcastable %arg : !shape.shape