Skip to content

[MLIR][SMT] isa<SMTDialect>(op->getDialect()) asserts on an unregistered op inside smt.exists/smt.forall patterns and transform.smt.constrain_params (--allow-unregistered-dialect) #239942

Open

Description

@YuanchengJiang

The following code:

module attributes {transform.with_named_sequence} {
  transform.named_sequence @s(%arg0: !transform.any_op {transform.readonly}) {
    %p = transform.param.constant 42 -> !transform.param<i64>
    transform.smt.constrain_params(%p) : (!transform.param<i64>) -> () {
    ^bb0(%v: !smt.int):
      "foo.bar"() : () -> ()
    }
    transform.yield
  }
}
// -----
func.func @f() {
  %0 = smt.exists ["a"] {
  ^bb0(%a: !smt.int):
    %c = smt.int.constant 0
    %e = smt.eq %a, %c : !smt.int
    smt.yield %e : !smt.bool
  } patterns {
  ^bb0(%a: !smt.int):
    "foo.bar"() : () -> ()
    smt.yield %a : !smt.int
  }
  return
}

Resulted in this output:

Program terminated with signal SIGSEGV (11)
Stack dump:
 #3 mlir::transform::smt::ConstrainParamsOp::verify
 #4 mlir::RegisteredOperationName::Model::verifyInvariants
 #5 (anonymous namespace)::OperationVerifier::verifyOnEntrance
 #6 (anonymous namespace)::OperationVerifier::verifyOperation
 #7 (anonymous namespace)::OperationVerifier::verifyOperation
 #8 (anonymous namespace)::OperationVerifier::verifyOperation
 #9 mlir::verify
#10 mlir::parseAsmSourceFile

Trunk reproducer (--split-input-file --allow-unregistered-dialect): https://godbolt.org/z/vnKe9nfW3

Activity

  1. added
    crashPrefer [crash-on-valid] or [crash-on-invalid]
    generated by fuzzerRegression test generated by fuzzing or AI analysis - not a real world code snippet
    on Nov 7, 2026
  2. llvmorg-github-actions commented on Nov 7, 2026

    @llvmorg-github-actions

    @llvm/issue-subscribers-mlir

    Author: Jiang Yuancheng (YuanchengJiang)

    Details The following code: ```mlir module attributes {transform.with_named_sequence} { transform.named_sequence @s(%arg0: !transform.any_op {transform.readonly}) { %p = transform.param.constant 42 -> !transform.param<i64> transform.smt.constrain_params(%p) : (!transform.param<i64>) -> () { ^bb0(%v: !smt.int): "foo.bar"() : () -> () } transform.yield } } // ----- func.func @f() { %0 = smt.exists ["a"] { ^bb0(%a: !smt.int): %c = smt.int.constant 0 %e = smt.eq %a, %c : !smt.int smt.yield %e : !smt.bool } patterns { ^bb0(%a: !smt.int): "foo.bar"() : () -> () smt.yield %a : !smt.int } return } ```

    Resulted in this output:

    Program terminated with signal SIGSEGV (11)
    Stack dump:
     #<!-- -->3 mlir::transform::smt::ConstrainParamsOp::verify
     #<!-- -->4 mlir::RegisteredOperationName::Model::verifyInvariants
     #<!-- -->5 (anonymous namespace)::OperationVerifier::verifyOnEntrance
     #<!-- -->6 (anonymous namespace)::OperationVerifier::verifyOperation
     #<!-- -->7 (anonymous namespace)::OperationVerifier::verifyOperation
     #<!-- -->8 (anonymous namespace)::OperationVerifier::verifyOperation
     #<!-- -->9 mlir::verify
    #<!-- -->10 mlir::parseAsmSourceFile
    

    Trunk reproducer (--split-input-file --allow-unregistered-dialect): https://godbolt.org/z/vnKe9nfW3

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    crashPrefer [crash-on-valid] or [crash-on-invalid]generated by fuzzerRegression test generated by fuzzing or AI analysis - not a real world code snippetmlir

    Type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions