Lunderberg commented on PR #13217: URL: https://github.com/apache/tvm/pull/13217#issuecomment-1324328327
Found it! The `std::unordered_map<const VarNode*, Range> var_range_map_` has a non-owning `const VarNode*`. When this is used for `arith::EvalSet`, it converts it to an owning `Map<Var, Range>` using `GetRef<Var>(var_ptr)`. However, there's no guarantee that the `Var` still exists by that point. If extent is negative, then the loop variable in `var_range_map_` is never removed. If there are no other references to the loop variable, then the map will hold a dangling pointer, and the next loop to be examined will have invalid memory access. Moving the update of `var_range_map_` to be after the check for negative extents instead of before avoids these dangling pointers, and passes local valgrind checks. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
