[Mlir-commits] [mlir] [mlir][shape] Fix crash when shape.lib array references undefined symbol (PR #184613)

[llvmlistbot at llvm.org]

llvmbot wrote:


<!--LLVM PR SUMMARY COMMENT-->
@llvm/pr-subscribers-mlir

@llvm/pr-subscribers-mlir-shape

Author: Mehdi Amini (joker-eph)

<details>
<summary>Changes</summary>

In verifyOperationAttribute(), the single-symbol path for shape.lib used SymbolTable::lookupSymbolIn() followed by an explicit null check. The array path at line 196-197 used dyn_cast<FunctionLibraryOp>() directly on the lookup result, which asserts when the symbol is not found (null pointer).

Fix: use dyn_cast_or_null<> instead of dyn_cast<> so that a missing symbol falls through to the existing "does not refer to FunctionLibraryOp" error diagnostic instead of asserting.

Fixes #<!-- -->159653

---
Full diff: https://github.com/llvm/llvm-project/pull/184613.diff


2 Files Affected:

- (modified) mlir/lib/Dialect/Shape/IR/Shape.cpp (+1-1) 
- (modified) mlir/test/Dialect/Shape/invalid.mlir (+8) 


``````````diff
diff --git a/mlir/lib/Dialect/Shape/IR/Shape.cpp b/mlir/lib/Dialect/Shape/IR/Shape.cpp
index 4d03b7b2b2064..38cac53be3022 100644
--- a/mlir/lib/Dialect/Shape/IR/Shape.cpp
+++ b/mlir/lib/Dialect/Shape/IR/Shape.cpp
@@ -193,7 +193,7 @@ LogicalResult ShapeDialect::verifyOperationAttribute(Operation *op,
           return op->emitError(
               "only SymbolRefAttr allowed in shape.lib attribute array");
 
-        auto shapeFnLib = dyn_cast<shape::FunctionLibraryOp>(
+        auto shapeFnLib = dyn_cast_or_null<shape::FunctionLibraryOp>(
             SymbolTable::lookupSymbolIn(op, llvm::cast<SymbolRefAttr>(it)));
         if (!shapeFnLib)
           return op->emitError()
diff --git a/mlir/test/Dialect/Shape/invalid.mlir b/mlir/test/Dialect/Shape/invalid.mlir
index ce2a438d70311..572583edd59bd 100644
--- a/mlir/test/Dialect/Shape/invalid.mlir
+++ b/mlir/test/Dialect/Shape/invalid.mlir
@@ -258,6 +258,14 @@ module attributes {shape.lib = @fn} { }
 
 // -----
 
+// Test that shape function library array entry is defined (regression test for
+// github.com/llvm/llvm-project/issues/159653: dyn_cast crash on missing symbol).
+
+// expected-error at +1 {{@missing does not refer to FunctionLibraryOp}}
+module attributes {shape.lib = [@missing]} { }
+
+// -----
+
 func.func @fn(%arg: !shape.shape) -> !shape.witness {
   // expected-error at +1 {{required at least 2 input shapes}}
   %0 = shape.cstr_broadcastable %arg : !shape.shape

``````````

</details>


https://github.com/llvm/llvm-project/pull/184613