Skip to content

[MLIR][Transform] transform.include with more operands than the callee has arguments asserts in getArgAttrDict (invalid argument number) instead of reporting the arity mismatch #239939

Open

Description

@YuanchengJiang

The following code:

module attributes {transform.with_named_sequence} {
  transform.named_sequence @callee(%arg0: !transform.any_op {transform.readonly}) {
    transform.yield
  }
  transform.named_sequence @__transform_main(%root: !transform.any_op {transform.readonly}) {
    %c3 = transform.param.constant 3 : i64 -> !transform.param<i64>
    transform.include @callee failures(propagate) (%root, %c3) : (!transform.any_op, !transform.param<i64>) -> ()
    transform.yield
  }
}

Resulted in this output:

Program terminated with signal SIGSEGV (11)
Stack dump:
 #3 mlir::NamedAttribute::getName
 #4 std::pair mlir::impl::findAttrSorted
 #5 mlir::DictionaryAttr::get
 #6 mlir::transform::IncludeOp::getEffects
 #7 mlir::detail::MemoryEffectOpInterfaceInterfaceTraits::Model::getEffects
 #8 mlir::transform::detail::verifyTransformOpInterface
 #9 mlir::RegisteredOperationName::Model::verifyInvariants
#10 (anonymous namespace)::OperationVerifier::verifyOnEntrance

Trunk reproducer: https://godbolt.org/z/sMoea6a5z

Activity

  1. added
    crashPrefer [crash-on-valid] or [crash-on-invalid]
    generated by fuzzerRegression test generated by fuzzing or AI analysis - not a real world code snippet
    on Nov 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    crashPrefer [crash-on-valid] or [crash-on-invalid]generated by fuzzerRegression test generated by fuzzing or AI analysis - not a real world code snippetmlir:transform_dialect

    Type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions