| Issue |
173566
|
| Summary |
mlir-opt crashes in mlir/include/mlir/IR/UseDefLists.h:198
|
| Labels |
mlir,
crash,
generated by fuzzer
|
| Assignees |
|
| Reporter |
Emilyaxe
|
When running opt on the following IR, mlir-opt crashes.
version 2c02e4c7909a
test.mlir
```
module {
pdl_interp.func @matcher(%arg0: !pdl.operation) {
pdl_interp.finalize
}
module @rewriters {
}
func.func @subposition_loop(%arg0: index) {
%0 = builtin.unrealized_conversion_cast %arg0 : index to i32
%cst8_i32 = spirv.Constant 8 : i32
%1 = spirv.Variable : !spirv.ptr<!spirv.array<64xf32>, Function>
spirv.mlir.loop {
spirv.Branch ^bb1(%0 : i32)
^bb1(%2: i32): // 2 preds: ^bb0, ^bb2
%3 = spirv.SLessThan %2, %cst8_i32 : i32
spirv.BranchConditional %3, ^bb2, ^bb3
^bb2: // pred: ^bb1
%4 = spirv.IAdd %2, %0 : i32
spirv.Branch ^bb1(%4 : i32)
^bb3: // pred: ^bb1
spirv.mlir.merge
}
spirv.Return
}
}
```
commads:
mlir-opt -lift-cf-to-scf test.mlir
stacktrace
```
mlir-opt: llvm-project/mlir/include/mlir/IR/UseDefLists.h:198: mlir::IRObjectWithUseList<mlir::BlockOperand>::~IRObjectWithUseList() [OperandType = mlir::BlockOperand]: Assertion `use_empty() && "Cannot destroy a value that still has uses!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: ./build/bin/mlir-opt -lift-cf-to-scf test.mlir
#0 0x000055f109efc358 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (./build/bin/mlir-opt+0x1e97358)
#1 0x000055f109ef9a15 llvm::sys::RunSignalHandlers() (./build/bin/mlir-opt+0x1e94a15)
#2 0x000055f109efd396 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007f5885bc5420 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14420)
#4 0x00007f588521e00b raise /build/glibc-B3wQXB/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1
#5 0x00007f58851fd859 abort /build/glibc-B3wQXB/glibc-2.31/stdlib/abort.c:81:7
#6 0x00007f58851fd729 get_sysdep_segment_value /build/glibc-B3wQXB/glibc-2.31/intl/loadmsgcat.c:509:8
#7 0x00007f58851fd729 _nl_load_domain /build/glibc-B3wQXB/glibc-2.31/intl/loadmsgcat.c:970:34
#8 0x00007f588520efd6 (/lib/x86_64-linux-gnu/libc.so.6+0x33fd6)
#9 0x000055f1127d7bc9 (./build/bin/mlir-opt+0xa772bc9)
#10 0x000055f1128aa986 llvm::iplist_impl<llvm::simple_ilist<mlir::Block>, llvm::ilist_traits<mlir::Block>>::erase(llvm::ilist_iterator<llvm::ilist_detail::node_options<mlir::Block, true, false, void, false, void>, false, false>) (./build/bin/mlir-opt+0xa845986)
#11 0x000055f1128a903b mlir::Region::~Region() (./build/bin/mlir-opt+0xa84403b)
#12 0x000055f1124feca8 mlir::transformCFGToSCF(mlir::Region&, mlir::CFGToSCFInterface&, mlir::DominanceInfo&) (./build/bin/mlir-opt+0xa499ca8)
#13 0x000055f10c206c2f mlir::WalkResult llvm::function_ref<mlir::WalkResult (mlir::Operation*)>::callback_fn<(anonymous namespace)::LiftControlFlowToSCF::runOnOperation()::'lambda'(mlir::func::FuncOp)::operator()(mlir::func::FuncOp) const::'lambda'(mlir::Operation*)>(long, mlir::Operation*) ControlFlowToSCF.cpp:0:0
#14 0x000055f109fb2dc7 mlir::WalkResult mlir::detail::walk<mlir::ForwardIterator>(mlir::Operation*, llvm::function_ref<mlir::WalkResult (mlir::Operation*)>, mlir::WalkOrder) (./build/bin/mlir-opt+0x1f4ddc7)
#15 0x000055f10c20680e mlir::WalkResult llvm::function_ref<mlir::WalkResult (mlir::Operation*)>::callback_fn<std::enable_if<!llvm::is_one_of<mlir::func::FuncOp, mlir::Operation*, mlir::Region*, mlir::Block*>::value && std::is_same<mlir::WalkResult, mlir::WalkResult>::value, mlir::WalkResult>::type mlir::detail::walk<(mlir::WalkOrder)1, mlir::ForwardIterator, (anonymous namespace)::LiftControlFlowToSCF::runOnOperation()::'lambda'(mlir::func::FuncOp), mlir::func::FuncOp, mlir::WalkResult>(mlir::Operation*, (anonymous namespace)::LiftControlFlowToSCF::runOnOperation()::'lambda'(mlir::func::FuncOp)&&)::'lambda'(mlir::Operation*)>(long, mlir::Operation*) ControlFlowToSCF.cpp:0:0
#16 0x000055f109fb2dc7 mlir::WalkResult mlir::detail::walk<mlir::ForwardIterator>(mlir::Operation*, llvm::function_ref<mlir::WalkResult (mlir::Operation*)>, mlir::WalkOrder) (./build/bin/mlir-opt+0x1f4ddc7)
#17 0x000055f10c2065a7 (anonymous namespace)::LiftControlFlowToSCF::runOnOperation() ControlFlowToSCF.cpp:0:0
#18 0x000055f1125b67be mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) (./build/bin/mlir-opt+0xa5517be)
#19 0x000055f1125b7617 mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) (./build/bin/mlir-opt+0xa552617)
#20 0x000055f1125be9ca mlir::PassManager::runPasses(mlir::Operation*, mlir::AnalysisManager) (./build/bin/mlir-opt+0xa5599ca)
#21 0x000055f1125be01f mlir::PassManager::run(mlir::Operation*) (./build/bin/mlir-opt+0xa55901f)
#22 0x000055f109fa0377 performActions(llvm::raw_ostream&, std::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) MlirOptMain.cpp:0:0
#23 0x000055f109f9f5a6 llvm::LogicalResult llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_0>(long, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&) MlirOptMain.cpp:0:0
#24 0x000055f1128d1855 mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) (./build/bin/mlir-opt+0xa86c855)
#25 0x000055f109f95166 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) (./build/bin/mlir-opt+0x1f30166)
#26 0x000055f109f954a2 mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) (./build/bin/mlir-opt+0x1f304a2)
#27 0x000055f109f95805 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) (./build/bin/mlir-opt+0x1f30805)
#28 0x000055f109ee29b3 main (./build/bin/mlir-opt+0x1e7d9b3)
#29 0x00007f58851ff083 __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:342:3
#30 0x000055f109ee24ee _start (./build/bin/mlir-opt+0x1e7d4ee)
```
![]()
_______________________________________________
llvm-bugs mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-bugs
