[Mlir-commits] [mlir] [MLIR] Fix crash when parsing typed attribute via parseOptionalAttribute (PR #186192)

[Mehdi Amini]

https://github.com/joker-eph created https://github.com/llvm/llvm-project/pull/186192

When calling `parseOptionalAttribute(result, type)` with a typed result (e.g. `FloatAttr`), the call resolved to the generic `parseOptionalAttribute(Attribute&, Type)` overload via implicit conversion. This overload accepted any attribute, including ones that don't match the expected concrete type. The caller would then invoke type-specific methods (e.g. `FloatAttr::getValue()`) on storage that belongs to a different attribute kind (e.g. `IntegerAttr`), causing a type-confusion crash.

The fix adds a non-virtual template overload of `parseOptionalAttribute` in `AsmParser` that intercepts calls for concrete attribute types not covered by the dedicated virtual overloads (`Attribute`, `ArrayAttr`, `StringAttr`, `SymbolRefAttr`). It parses the attribute generically and then validates the result type via `dyn_cast`, emitting an error if the parsed attribute is of the wrong kind.

Fixes #108135

Assisted-by: Claude Code

>From 77a4f8a3ef577690be9c2a5ec43313f944fc2fb2 Mon Sep 17 00:00:00 2001
From: Mehdi Amini <joker.eph at gmail.com>
Date: Mon, 9 Mar 2026 04:09:19 -0700
Subject: [PATCH] [MLIR] Fix crash when parsing typed attribute via
 parseOptionalAttribute

When calling `parseOptionalAttribute(result, type)` with a typed result
(e.g. `FloatAttr`), the call resolved to the generic
`parseOptionalAttribute(Attribute&, Type)` overload via implicit conversion.
This overload accepted any attribute, including ones that don't match the
expected concrete type. The caller would then invoke type-specific methods
(e.g. `FloatAttr::getValue()`) on storage that belongs to a different
attribute kind (e.g. `IntegerAttr`), causing a type-confusion crash.

The fix adds a non-virtual template overload of `parseOptionalAttribute`
in `AsmParser` that intercepts calls for concrete attribute types not
covered by the dedicated virtual overloads (`Attribute`, `ArrayAttr`,
`StringAttr`, `SymbolRefAttr`). It parses the attribute generically and
then validates the result type via `dyn_cast`, emitting an error if the
parsed attribute is of the wrong kind.

Fixes #108135

Assisted-by: Claude Code
---
 mlir/include/mlir/IR/OpImplementation.h       | 20 +++++++++++++++++++
 .../attr-or-type-format-invalid-parse.mlir    |  7 +++++++
 2 files changed, 27 insertions(+)
 create mode 100644 mlir/test/mlir-tblgen/attr-or-type-format-invalid-parse.mlir

diff --git a/mlir/include/mlir/IR/OpImplementation.h b/mlir/include/mlir/IR/OpImplementation.h
index 9ce92cc7e5d37..59323bc350ce7 100644
--- a/mlir/include/mlir/IR/OpImplementation.h
+++ b/mlir/include/mlir/IR/OpImplementation.h
@@ -1142,6 +1142,26 @@ class AsmParser {
   virtual OptionalParseResult parseOptionalAttribute(SymbolRefAttr &result,
                                                      Type type = {}) = 0;
 
+  /// Parse an optional attribute of a specific typed result. This overload
+  /// handles concrete attribute types (e.g. FloatAttr) that are not covered by
+  /// a dedicated virtual overload. It parses any attribute and then validates
+  /// that the result is of the expected type, emitting an error if not.
+  template <typename AttrType>
+  std::enable_if_t<!llvm::is_one_of<AttrType, Attribute, ArrayAttr, StringAttr,
+                                    SymbolRefAttr>::value,
+                   OptionalParseResult>
+  parseOptionalAttribute(AttrType &result, Type type = {}) {
+    Attribute attr;
+    OptionalParseResult parseResult = parseOptionalAttribute(attr, type);
+    if (!parseResult.has_value() || failed(*parseResult))
+      return parseResult;
+    result = dyn_cast<AttrType>(attr);
+    if (!result)
+      return emitError(getCurrentLocation())
+             << "expected attribute of a different type";
+    return success();
+  }
+
   /// Parse an optional attribute of a specific type and add it to the list with
   /// the specified name.
   template <typename AttrType>
diff --git a/mlir/test/mlir-tblgen/attr-or-type-format-invalid-parse.mlir b/mlir/test/mlir-tblgen/attr-or-type-format-invalid-parse.mlir
new file mode 100644
index 0000000000000..973bc3e17acbc
--- /dev/null
+++ b/mlir/test/mlir-tblgen/attr-or-type-format-invalid-parse.mlir
@@ -0,0 +1,7 @@
+// RUN: mlir-opt -verify-diagnostics --split-input-file %s
+
+// Test that an integer literal cannot be used where an APFloat is expected.
+// parseOptionalAttribute(FloatAttr &) should reject a non-float attribute.
+// expected-error at +2 {{expected attribute of a different type}}
+// expected-error at +1 {{failed to parse TestTypeAPFloat parameter}}
+func.func private @test() -> !test.ap_float<5U0>