| Issue |
178362
|
| Summary |
mlir-opt crashes with assertion failure in ShapedType::getNumElements when parsing memref.global with very large static shape
|
| Labels |
new issue
|
| Assignees |
|
| Reporter |
compilerStudyer
|
mlir-opt crashes with an assertion failure when parsing a memref.global that has a very large fully static shape.
The crash happens during parsing, before any transformation passes are run.
The failure is triggered by integer overflow in ShapedType::getNumElements, which asserts that the computed number of elements must be non-negative.
```
mlir-opt test.mlir
```
```mlir
module {
func.func @main() {
memref.global "private" constant @__constant_1x2x3x4x5x6x7x8x9x10x11x12x13x14x15x16x17x18x19x20x21x22x23x24x25x26x27x28x29x30x31x32x33x34x35x36x37x38x39x40x41x42x43x44x45x46x47x48x49x50x51x52x53x54x55x56x57x58x59x60x61x62x63x64x65x66x67x68x69x70x71x72x73x74x75x76x77x78x79x80x81x82x83x84x85x86x87x88x89x90x91x92x93x94x95x96x97x98x99x100x101x102x103x104x105x106x107x108x109x110x111x112x113x114x115x116x117x118x119x120x121x122x123x124x125x126x127x128x129x130x131x132x133x134x135x136x137x138x139x140x141x142x143x144x145x146x147x148x149x150x151x152x153x154 : memref<1x2x3x4x5x6x7x8x9x10x11x12x13x14x15x16x17x18x19x20x21x22x23x24x25x26x27x28x29x30x31x32x33x34x35x36x37x38x39x40x41x42x43x44x45x46x47x48x49x50x51x52x53x54x55x56x57x58x59x60x61x62x63x64x65x66x67x68x69x70x71x72x73x74x75x76x77x78x79x80x81x82x83x84x85x86x87x88x89x90x91x92x93x94x95x96x97x98x99x100x101x102x103x104x105x106x107x108x109x110x111x112x113x114x115x116x117x118x119x120x121x122x123x124x125x126x127x128x129x130x131x132x133x134x135x136x137x138x139x140x141x142x143x144x145x146x147x148x149x150x151x152x153x154xf32> = dense<1.000000e+00> {alignment = 64 : i64}
return
}
}
```
```
mlir-opt: mlir/lib/IR/BuiltinTypeInterfaces.cpp:41: static int64_t mlir::ShapedType::getNumElements(llvm::ArrayRef<long int>): Assertion `num >= 0 && "integer overflow in element count computation"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: mlir-opt test.mlir
1. MLIR Parser: custom op parser 'builtin.module'
2. MLIR Parser: custom op parser 'func.func'
3. MLIR Parser: custom op parser 'memref.global'
#0 0x00005bee74ab9e32 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (mlir-opt+0x252fe32)
#1 0x00005bee74ab65af llvm::sys::RunSignalHandlers() (mlir-opt+0x252c5af)
#2 0x00005bee74ab66fc SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x0000703bae645330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#4 0x0000703bae69eb2c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
#5 0x0000703bae69eb2c __pthread_kill_internal ./nptl/pthread_kill.c:78:10
#6 0x0000703bae69eb2c pthread_kill ./nptl/pthread_kill.c:89:10
#7 0x0000703bae64527e raise ./signal/../sysdeps/posix/raise.c:27:6
#8 0x0000703bae6288ff abort ./stdlib/abort.c:81:7
#9 0x0000703bae62881b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#10 0x0000703bae63b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#11 0x00005bee7c667580 llvm::SmallVectorBase<unsigned int>::set_size(unsigned long) (.part.0) Diagnostics.cpp:0:0
#12 0x00005bee7c6176ae mlir::DenseElementsAttr::isValidRawBuffer(mlir::ShapedType, llvm::ArrayRef<char>, bool&) (mlir-opt+0xa08d6ae)
#13 0x00005bee7c62473d mlir::DenseIntOrFPElementsAttr::getRaw(mlir::ShapedType, llvm::ArrayRef<char>) (mlir-opt+0xa09a73d)
#14 0x00005bee7c626209 mlir::DenseIntOrFPElementsAttr::getRaw(mlir::ShapedType, unsigned long, llvm::ArrayRef<llvm::APFloat>) (mlir-opt+0xa09c209)
#15 0x00005bee7c62661a mlir::DenseElementsAttr::get(mlir::ShapedType, llvm::ArrayRef<llvm::APFloat>) (mlir-opt+0xa09c61a)
```
![]()
_______________________________________________
llvm-bugs mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-bugs
