[c-api]: segfault querying type information from value

[johannst]

Querying function type information from a function value segfaults using the c api.

Turning the LLVMValueRef -> LLVMTypeOf by calling LLVMGetElementType(LLVMTypeOf(val_ref)) segfaults.

// file: test.cpp
#include <llvm-c/Core.h>

int main() {
  LLVMContextRef ctx = LLVMContextCreate();
  LLVMModuleRef  mod = LLVMModuleCreateWithNameInContext("mod", ctx);

  LLVMTypeRef ty_void = LLVMVoidTypeInContext(ctx);
  LLVMTypeRef ty_fn   = LLVMFunctionType(ty_void, 0 /* param types */, 0 /* nargs */, 0 /* vararg */);

  LLVMValueRef func = LLVMAddFunction(mod, "func", ty_fn);

  // (1) Param type.
  unsigned cnt1 = LLVMCountParams(func);  // ok
  // llvm/lib/IR/Core.cpp:LLVMCountParams states
  //    This function is strictly redundant to
  //    LLVMCountParamTypes(LLVMGetElementType(LLVMTypeOf(FnRef)))
  unsigned cnt2 = LLVMCountParamTypes(LLVMGetElementType(LLVMTypeOf(func))); // segv

  // (2) Return type.
  LLVMTypeRef ty_ret = LLVMGetReturnType(LLVMGetElementType(LLVMTypeOf(func))); // segv

  LLVMContextDispose(ctx);
  return 0;
}

clang -o test test.c `llvm-config --cflags --ldflags --system-libs --libs core`

Tested with the following llvm versions at hand:

• 14.0.6 no segv
• 15.0.0 segv
• 15.0.7 segv
• 16.0.6 segv

[nikic]

See https://llvm.org/docs/OpaquePointers.html, pointers do not have an element type anymore.

I would recommend using an assertion-enabled build of LLVM to make incorrect uses of the C API like this fail in a clearer way.

Keeping this open to track removal of the incorrect comment in the LLVMCountParams() implementation.

[johannst]

Thanks for sharing, I didn't know about the opaque pointer introduction/migration. So far I only used llvm in some hobby project for learning :^)

I would recommend using an assertion-enabled build of LLVM to make incorrect uses of the C API like this fail in a clearer way.

Actually I did, but I have to admit that the message "Attempting to get element type of opaque pointer" didn't ring a bell since I didn't know about the opaque ptr migration.

---

A follow up question on the correct approach using the C api to build function calls.

1. Use LLVMGlobalGetValueType() as llvm::Function is a llvm::GlobalObject and that is what Function::getFunctionType() does, if I am correct?

LLVMTypeRef ty_void = LLVMVoidTypeInContext(ctx);
LLVMTypeRef ty_fn   = LLVMFunctionType(ty_void, 0 /* param types */, 0 /* nargs */, 0 /* vararg */);
  
LLVMTypeRef ty_ret_g = LLVMGetReturnType(LLVMGlobalGetValueType(func)); // ok

2. When creating new functions keep track of the function value and type similar to what is done with llvm::FunctionCallee

Any feedback or further insight would be very helpful.
Thanks a lot.

[nikic]

1. Use `LLVMGlobalGetValueType()` as [`llvm::Function`](https://github.com/llvm/llvm-project/blob/797b68c0ba699994e1038ac33d3083541482bf19/llvm/include/llvm/IR/Function.h#L59) is a `llvm::GlobalObject` and that is what [`Function::getFunctionType()`](https://github.com/llvm/llvm-project/blob/797b68c0ba699994e1038ac33d3083541482bf19/llvm/include/llvm/IR/Function.h#L189) does, if I am correct?

Yes, this is correct.

2. When creating new functions keep track of the function _value_ and _type_ similar to what is done with [`llvm::FunctionCallee`](https://github.com/llvm/llvm-project/blob/797b68c0ba699994e1038ac33d3083541482bf19/llvm/include/llvm/IR/DerivedTypes.h#L168)

If you're working on plain Functions, you can query the value type as you indicate above. On calls you can query LLVMGetCalledFunctionType.

If you want to lower calls in a frontend, then you generally need to create the FunctionType from whatever information you have available in your frontend -- if you support indirect calls, you will not necessarily be directly calling a Function. In that case, keeping track of the function type explicitly would be one approach, or you could re-lower the type from whatever your frontend ABI representation is.

[llvmbot]

@llvm/issue-subscribers-mlir-core

Author: Johannes Stölp (johannst)

Querying _function type_ information from a _function value_ segfaults using the `c` api.

Turning the LLVMValueRef -> LLVMTypeOf by calling LLVMGetElementType(LLVMTypeOf(val_ref)) segfaults.

// file: test.cpp
#include <llvm-c/Core.h>

int main() {
  LLVMContextRef ctx = LLVMContextCreate();
  LLVMModuleRef  mod = LLVMModuleCreateWithNameInContext("mod", ctx);

  LLVMTypeRef ty_void = LLVMVoidTypeInContext(ctx);
  LLVMTypeRef ty_fn   = LLVMFunctionType(ty_void, 0 /* param types */, 0 /* nargs */, 0 /* vararg */);

  LLVMValueRef func = LLVMAddFunction(mod, "func", ty_fn);

  // (1) Param type.
  unsigned cnt1 = LLVMCountParams(func);  // ok
  // llvm/lib/IR/Core.cpp:LLVMCountParams states
  //    This function is strictly redundant to
  //    LLVMCountParamTypes(LLVMGetElementType(LLVMTypeOf(FnRef)))
  unsigned cnt2 = LLVMCountParamTypes(LLVMGetElementType(LLVMTypeOf(func))); // segv

  // (2) Return type.
  LLVMTypeRef ty_ret = LLVMGetReturnType(LLVMGetElementType(LLVMTypeOf(func))); // segv

  LLVMContextDispose(ctx);
  return 0;
}

clang -o test test.c `llvm-config --cflags --ldflags --system-libs --libs core`

Tested with the following llvm versions at hand:

• 14.0.6 no segv
• 15.0.0 segv
• 15.0.7 segv
• 16.0.6 segv