You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fix 2 more crashes: typeof-dispatch cast helpers in MLIRGenCast.cpp (#299)
castPrimitiveTypeFromAny (the __unbox<T> helper, generic type-param
unboxing from any) was dead code - its one call site already only passes
types the TypeSwitch handles - but fixed anyway (crash -> emitError) for
consistency, since location was already in scope.
castFromUnion is a real, easily-reachable crash: any union type with a
tuple/object-literal-shaped member (e.g. `number | {a: number}`) crashes
the moment it needs a runtime cast, since the typeof-dispatch TypeSwitch
never got a TupleType/ConstTupleType case. The function's own forward-decl
already carries a TODO acknowledging typeof-based dispatch can't handle
this properly (can't even distinguish two different tuple shapes from each
other) - a real redesign, out of scope here. Converted the crash to a clean
error instead.
Closes out MLIRGenCast.cpp's two TypeOf sites, the last item from the
original not-implemented-audit's §5.1 named/specific list.
829/829 ctest, no regressions.
Function×4, Class, Interface, Null, Undefined}`). Same "guarded, therefore
356
+
dead" shape as §3's `IntersectionType` and §4.6-4.8's `funcRef` family.
357
+
Fixed anyway (crash → set a flag, `emitError` + `return failure()` after
358
+
the switch) since `location` was already in scope here and leaving a live
359
+
`llvm_unreachable` behind is a landmine for the next caller.
360
+
361
+
**`castFromUnion` (was :1498-1499): a real, easily-reachable crash.** Called
362
+
from `castFromSourceSpecialCases` whenever casting *from* a union-typed
363
+
value whose members can't be merged into one storage representation
364
+
(`mth.isUnionTypeNeedsTag`) to anything other than `any`. It loops over
365
+
each union member type building the same kind of `typeof`-dispatch
366
+
function, and the `TypeSwitch` per member is missing `TupleType`/
367
+
`ConstTupleType` entirely - i.e. **any union with an object-literal-shaped
368
+
member hits this the moment it needs a runtime cast**, which is a very
369
+
ordinary shape (not an obscure corner case like §4.4's enum reverse-mapping
370
+
or §4.5's `super()` edge case):
371
+
372
+
```ts
373
+
function main() {
374
+
let x:number| { a:number };
375
+
x=5;
376
+
let y = <number>x; // crash: UNREACHABLE at MLIRGenCast.cpp:1499
377
+
}
378
+
```
379
+
380
+
The function's own forward declaration in `MLIRGenImpl.h` already carries a
381
+
`// TODO: remove using typeof for Union types as it can't handle types such
382
+
as 2 tuples in union etc` - confirming this is a known, **genuinely missing
383
+
feature** (like §4.2), not just an unreached architectural corner: even two
384
+
*different* tuple-shaped union members couldn't be told apart by `typeof`
385
+
alone (both report `"object"`), so a real fix needs a structural redesign
386
+
(a runtime shape tag, not `typeof` string dispatch), out of scope here. A
387
+
partial start at this is visible in the code - a `tupleTypes`
388
+
`SmallVector` and `TYPE_TUPLE_ALIAS` templating exist and are wired up at
389
+
the end of the function, but nothing ever pushes into `tupleTypes` because
390
+
no `.Case<mlir_ts::TupleType>` was ever added to populate it; that
391
+
half-finished thread was left as-is rather than completed, since finishing
392
+
it properly means solving the "2 tuples in union" ambiguity the TODO
393
+
already flags, not just adding one more `.Case`. Converted the crash to
394
+
`emitError(location) << "Cast from " << to_print(value.getType()) << " to "
395
+
<< to_print(type) << " is not supported"; return mlir::failure();` after the
396
+
member loop, gated by the same kind of flag used for `castPrimitiveTypeFromAny`
397
+
(a per-subtype lambda can't `return` the enclosing function directly).
398
+
399
+
Verified individually (clean diagnostic, no crash) and via the full suite
400
+
(`ctest -C Debug -j8`: 829/829, no regressions).
401
+
338
402
## 5. Inventory of remaining markers (untested this pass)
339
403
340
404
Grouped by file. "Shape" is a guess from reading the surrounding code, not a
@@ -343,12 +407,12 @@ verified verdict — see §2 for how to actually check one.
343
407
### 5.1 Named/specific (cheapest to investigate next — read the message + local branch, write a 5-line repro)
344
408
345
409
**Fixed this pass**: `MLIRGenAccessCall.cpp`'s three sites (was lines
346
-
1159/1219/1535) — see §4.3-4.5.
410
+
1159/1219/1535) — see §4.3-4.5. **Fixed a previous pass** (§4.9):
411
+
`MLIRGenCast.cpp`'s two `TypeOf` sites (was lines 1321-1322/1498-1499) — one
412
+
dead (guarded), one a real crash (union with a tuple-shaped member).
347
413
348
414
| Site | Message | Shape (unverified guess) |
349
415
| --- | --- | --- |
350
-
|`MLIRGenCast.cpp:1321-1322`| TypeOf NOT IMPLEMENTED for Type | inside a generated `__unbox<T>` helper (generic type-parameter unboxing from `any`); `.Default` for a type kind not in its explicit list (Tuple/Array/Enum/Union/Optional are plausible candidates) |
351
-
|`MLIRGenCast.cpp:1498-1499`| TypeOf NOT IMPLEMENTED for Type | second, near-identical site — check if it's reachable via a different call path than 1321 |
352
416
|`MLIRGenImpl.h:5330`| not implemented | unread |
353
417
|`MLIRGenImpl.h:6732`| not implemented | unread |
354
418
|`MLIRGenImpl.h:7314`| not implemented | unread |
@@ -424,17 +488,23 @@ bug (the built-in utility types); tracing real callers is what worked.
424
488
(faster than the originally-planned unit-test approach), found and fixed
425
489
3 more live crashes (§4.6-4.8); the other 3 functions in the family were
426
490
fixed too even though proven dead, for consistency within the family.
427
-
4. §5.2 (generic fallbacks) — triage a handful against existing passing
491
+
4.~~`MLIRGenCast.cpp`'s two `TypeOf` sites~~ — done this pass (§4.9): one
492
+
dead (guarded), one a real crash (union with a tuple-shaped member,
493
+
`<number>x` where `x: number | {a: number}`) — fixed. That was the last
494
+
item from the original §5.1 named/specific list; only the large
0 commit comments