llvm / llvm/llvm-project

[mlir] member access within null pointer of type 'mlir::IRObjectWithUseList<mlir::OpOperand>'

Open
#221,638 1 comment 0 reactions 0 assignees View on GitHub
crash generated by fuzzer mlir
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

The following code:

```mlir
module {
func.func @main() {
%0 = test.cse_of_single_block_op inputs(%a, %b) {
}
}
```

Resulted in this output:

```
mlir/include/mlir/IR/UseDefLists.h:98:22: runtime error: member access within null pointer of type 'mlir::IRObjectWithUseList'
#0 in void mlir::detail::IROperandBase::insertInto>(mlir::IRObjectWithUseList*) mlir/include/mlir/IR/UseDefLists.h:98
#1 in mlir::IROperand::insertIntoCurrent()
#8 in mlir::Operation::create(mlir::OperationState const&) mlir/lib/IR/Operation.cpp
#9 in mlir::OpTrait::SingleBlockImplicitTerminator::Impl::buildTerminator(mlir::OpBuilder&, mlir::Location)
#11 in mlir::impl::ensureRegionTerminator(...)
#14 in test::TestCSEOfSingleBlockOp::parse(mlir::OpAsmParser&, mlir::OperationState&)
#18 in CustomOpAsmParser::parseOperation(mlir::OperationState&)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior mlir/include/mlir/IR/UseDefLists.h:98:22
```

To reproduce:
```
mlir-opt ./min.mlir
```

(no flags, and no pass pipeline; requires an mlir-opt built with the in-tree test dialect and `-fsanitize=undefined`)

Commit:
```
8c536a50e6f06e06031500e8933a34226cca1ec4
```

Operating System:
```
Ubuntu 22.04, Docker image fusion-fuzz-mlir:latest
```

Contributor guide

Open the contributing guide

Research direction

Start with mlir/include/mlir/IR/UseDefLists.h:98 and the Operation::create path in mlir/lib/IR/Operation.cpp, then reproduce the report using the supplied min.mlir and an UBSan-enabled mlir-opt with the in-tree test dialect. Trace the test.cse_of_single_block_op parsing and terminator construction; done means the reproducer no longer emits the reported undefined-behavior diagnostic.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.