[Mlir-commits] [mlir] 4ee88e8 - [mlir][gpu] Fix null-deref crash in gpu-kernel-outlining for unresolved symbols (#186273)

[llvmlistbot at llvm.org]

Author: Mehdi Amini
Date: 2026-03-13T11:15:22Z
New Revision: 4ee88e861432bdc023f3882081eb8ca2d9ffdd40

URL: https://github.com/llvm/llvm-project/commit/4ee88e861432bdc023f3882081eb8ca2d9ffdd40
DIFF: https://github.com/llvm/llvm-project/commit/4ee88e861432bdc023f3882081eb8ca2d9ffdd40.diff

LOG: [mlir][gpu] Fix null-deref crash in gpu-kernel-outlining for unresolved symbols (#186273)

In `GpuKernelOutliningPass::createKernelModule`, the symbol-copying
worklist iterates over all symbol uses inside the outlined kernel and
looks each leaf reference up in the parent symbol table. If the symbol
refers to a name inside a nested module (e.g. `@some_module::@func`),
the leaf reference `@func` is not directly present in the parent table,
so `SymbolTable::lookup` returns nullptr. Calling `->clone()` on that
null pointer causes a segfault.

Add a null check: if the symbol is not found in the parent table (it may
live in a nested gpu.module that is already handled separately), skip
it.

Fixes #185357

Assisted-by: Claude Code

Added: 
    

Modified: 
    mlir/lib/Dialect/GPU/Transforms/KernelOutlining.cpp
    mlir/test/Dialect/GPU/outlining.mlir

Removed: 
    


################################################################################
diff  --git a/mlir/lib/Dialect/GPU/Transforms/KernelOutlining.cpp b/mlir/lib/Dialect/GPU/Transforms/KernelOutlining.cpp
index adfe365ad9039..0a2268d81b46d 100644
--- a/mlir/lib/Dialect/GPU/Transforms/KernelOutlining.cpp
+++ b/mlir/lib/Dialect/GPU/Transforms/KernelOutlining.cpp
@@ -439,8 +439,10 @@ class GpuKernelOutliningPass
           if (symbolTable.lookup(symbolName))
             continue;
 
-          Operation *symbolDefClone =
-              parentSymbolTable.lookup(symbolName)->clone();
+          Operation *symbolDef = parentSymbolTable.lookup(symbolName);
+          if (!symbolDef)
+            continue;
+          Operation *symbolDefClone = symbolDef->clone();
           symbolDefWorklist.push_back(symbolDefClone);
           symbolTable.insert(symbolDefClone);
         }

diff  --git a/mlir/test/Dialect/GPU/outlining.mlir b/mlir/test/Dialect/GPU/outlining.mlir
index 2e5d12936ae65..cf5b73349f23c 100644
--- a/mlir/test/Dialect/GPU/outlining.mlir
+++ b/mlir/test/Dialect/GPU/outlining.mlir
@@ -638,6 +638,30 @@ func.func @testNoAttributes() {
 
 // -----
 
+// Regression test for https://github.com/llvm/llvm-project/issues/185357.
+// A gpu.launch whose body contains a gpu.launch_func referencing a symbol in a
+// nested gpu.module must not crash when the leaf reference cannot be found in
+// the parent symbol table.
+
+// CHECK-LABEL: func.func @launch_with_launch_func_body(
+module attributes {gpu.container_module} {
+  gpu.module @some_kernels {
+    gpu.func @some_kernel() kernel {
+      gpu.return
+    }
+  }
+  func.func @launch_with_launch_func_body(%sz : index) {
+    gpu.launch blocks(%bx, %by, %bz) in (%gx = %sz, %gy = %sz, %gz = %sz)
+               threads(%tx, %ty, %tz) in (%bsx = %sz, %bsy = %sz, %bsz = %sz) {
+      "test.use_nested"()  {uses = [@public_module::@nested_function]} : () -> ()
+      gpu.terminator
+    }
+    return
+  }
+}
+
+// -----
+
 // This test tests nested `gpu.launch`.
 
 // CHECK-LABEL: func.func @nested_launch(