llvm / llvm/llvm-project

[mlir] Assertion `&typeSample.getDialect() != typeSample.getContext()->getLoadedDialect<BuiltinDialect>() && "unexpected data layout entry for built-in type"' failed

Open
#222,356 3 comments 0 reactions 0 assignees View on GitHub
crash generated by fuzzer mlir
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

The following code:

```mlir
module attributes {dlti.dl_spec = #dlti.dl_spec} {
module attributes {dlti.dl_spec = #dlti.dl_spec<#dlti.dl_entry>} {
}
}
```

Resulted in this output:
```
mlir-opt: /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Dialect/DLTI/DLTI.cpp:338: LogicalResult combineOneSpec(DataLayoutSpecInterface, llvm::MapVector &, llvm::MapVector &): Assertion `&typeSample.getDialect() != typeSample.getContext()->getLoadedDialect() && "unexpected data layout entry for built-in type"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: ./llvm-mlir-build/bin/mlir-opt /tmp/test.mlir
#0 0x0000556f3d829b46 ___interceptor_backtrace (./llvm-mlir-build/bin/mlir-opt+0x734eb46)
#1 0x0000556f3d912ba7 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/lib/Support/Unix/Signals.inc:931:13
#2 0x0000556f3d9159fa llvm::sys::RunSignalHandlers() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/lib/Support/Signals.cpp:0:5
#3 0x0000556f3d9159fa SignalHandler(int, siginfo_t*, void*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/lib/Support/Unix/Signals.inc:457:3
#4 0x00007fc5e6270520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#5 0x00007fc5e62c49bc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969bc)
#6 0x00007fc5e6270476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
#7 0x00007fc5e62567f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
#8 0x00007fc5e625671b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
#9 0x00007fc5e6267e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#10 0x0000556f4e31b655 combineOneSpec(mlir::DataLayoutSpecInterface, llvm::MapVector, llvm::DenseMap, llvm::detail::DenseMapPair>, llvm::SmallVector>, 0u>, 0u>&, llvm::MapVector, llvm::detail::DenseMapPair>, llvm::SmallVector, 0u>, 0u>&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Dialect/DLTI/DLTI.cpp:336:5
#11 0x0000556f4e31a34d mlir::DataLayoutSpecAttr::combineWith(llvm::ArrayRef) const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Dialect/DLTI/DLTI.cpp:368:7
#12 0x0000556f4e32fb2c mlir::detail::DataLayoutSpecInterfaceInterfaceTraits::Model::combineWith(mlir::detail::DataLayoutSpecInterfaceInterfaceTraits::Concept const*, mlir::Attribute, llvm::ArrayRef) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-mlir-build/tools/mlir/include/mlir/Interfaces/DataLayoutAttrInterface.h.inc:712:60
#13 0x0000556f50f45d89 mlir::DataLayoutSpecInterface::combineWith(llvm::ArrayRef) const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-mlir-build/tools/mlir/include/mlir/Interfaces/DataLayoutAttrInterface.cpp.inc:32:14
#14 0x0000556f50f45d89 getCombinedDataLayout(mlir::Operation*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Interfaces/DataLayoutInterfaces.cpp:434:20
#15 0x0000556f50f451ab mlir::Attribute::operator!() const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/IR/Attributes.h:48:40
#16 0x0000556f50f451ab mlir::detail::verifyDataLayoutOp(mlir::Operation*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Interfaces/DataLayoutInterfaces.cpp:449:7
#17 0x0000556f4e31f5b4 mlir::DLTIDialect::verifyOperationAttribute(mlir::Operation*, mlir::NamedAttribute) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Dialect/DLTI/DLTI.cpp:658:14
#18 0x0000556f513be0d2 llvm::LogicalResult::failed() const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/Support/LogicalResult.h:43:43
#19 0x0000556f513be0d2 llvm::failed(llvm::LogicalResult) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/Support/LogicalResult.h:71:58
#20 0x0000556f513be0d2 (anonymous namespace)::OperationVerifier::verifyOnEntrance(mlir::Operation&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/IR/Verifier.cpp:307:11
#21 0x0000556f513be0d2 _ZZN12_GLOBAL__N_117OperationVerifier15verifyOperationERN4mlir9OperationEENK3$_2clIS2_EEDaPT_ /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/IR/Verifier.cpp:439:45
#22 0x0000556f513be0d2 _ZZN12_GLOBAL__N_117OperationVerifier15verifyOperationERN4mlir9OperationEENK3$_1clIZNS0_15verifyOperationES3_E3$_2EEDaOT_N4llvm12PointerUnionIJPS2_PNS1_5BlockEEEE /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/IR/Verifier.cpp:419:16
#23 0x0000556f513be0d2 (anonymous namespace)::OperationVerifier::verifyOperation(mlir::Operation&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/IR/Verifier.cpp:438:16
#24 0x0000556f513be0d2 (anonymous namespace)::OperationVerifier::verifyOpAndDominance(mlir::Operation&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/IR/Verifier.cpp:91:14
#25 0x0000556f513be936 (anonymous namespace)::OperationVerifier::verifyOnExit(mlir::Operation&)::$_0::operator()(mlir::Operation*) const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/IR/Verifier.cpp:368:9
#26 0x0000556f513be936 auto void mlir::parallelForEach(mlir::MLIRContext*, mlir::Operation**, mlir::Operation**, (anonymous namespace)::OperationVerifier::verifyOnExit(mlir::Operation&)::$_0&&)::'lambda'(mlir::Operation**&&)::operator()(mlir::Operation**&&) const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/IR/Threading.h:120:12
#27 0x0000556f513be936 llvm::LogicalResult mlir::failableParallelForEach(mlir::MLIRContext*, mlir::Operation**, mlir::Operation**, (anonymous namespace)::OperationVerifier::verifyOnExit(mlir::Operation&)::$_0&&)::'lambda'(mlir::Operation**&&)>(mlir::MLIRContext*, mlir::Operation**, mlir::Operation**, (anonymous namespace)::OperationVerifier::verifyOnExit(mlir::Operation&)::$_0&&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/IR/Threading.h:46:18
#28 0x0000556f513be936 void mlir::parallelForEach(mlir::MLIRContext*, mlir::Operation**, mlir::Operation**, (anonymous namespace)::OperationVerifier::verifyOnExit(mlir::Operation&)::$_0&&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/IR/Threading.h:119:9
#29 0x0000556f513be936 void mlir::parallelForEach&, (anonymous namespace)::OperationVerifier::verifyOnExit(mlir::Operation&)::$_0>(mlir::MLIRContext*, llvm::SmallVector&, (anonymous namespace)::OperationVerifier::verifyOnExit(mlir::Operation&)::$_0&&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/IR/Threading.h:131:3
```

An inner module whose `dlti.dl_spec` re-states an entry of the outer spec — here
`index = 32` written once in the sugared form and once as an explicit
`#dlti.dl_entry` — makes `combineOneSpec` assert while merging the two specs.
Both specs are individually well-formed and the IR verifies.

A closely related crash with the same shape, in the LLVM dialect's pointer-spec
reader rather than in `combineOneSpec`:

```mlir
module attributes {dlti.dl_spec = #dlti.dl_spec : vector<4xi64>>} {
module attributes {dlti.dl_spec = #dlti.dl_spec : vector<4xi64>>} {
}
}
```

```
mlir-opt: llvm/include/llvm/Support/Casting.h:566: ... [To = mlir::DenseIntElementsAttr, From = mlir::Attribute]: Assertion `isa(Val) && "cast() argument of incompatible type!"' failed.
#11 mlir::LLVM::extractPointerSpecValue(mlir::Attribute, mlir::LLVM::PtrDLEntryPos)
```

To reproduce:
```
mlir-opt --canonicalize ./min.mlir
```

Commit:
```
8c536a50e6f06e06031500e8933a34226cca1ec4
```

Operating System:
```
Ubuntu 22.04, Docker image fusion-fuzz-mlir:latest
```

Contributor guide

Open the contributing guide

Research direction

Start with combineOneSpec in mlir/lib/Dialect/DLTI/DLTI.cpp and the getCombinedDataLayout path in mlir/lib/Interfaces/DataLayoutInterfaces.cpp, reproducing with mlir-opt --canonicalize ./min.mlir. Also inspect LLVM::extractPointerSpecValue for the related pointer-spec crash. Done means both nested data-layout examples are handled without assertions and the input no longer crashes verification or canonicalization.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.