llvm / llvm/llvm-project

[mlir] Assertion 'this->_M_is_engaged()' failed

Open
#223,333 1 comment 0 reactions 0 assignees View on GitHub
crash generated by fuzzer mlir
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

The following code:

```mlir
func.func @f(%t: tensor<8xf32>) -> tensor<4xf32> {
%p = ub.poison : index
%s = tensor.extract_slice %t[%p] [4] [1] : tensor<8xf32> to tensor<4xf32>
return %s : tensor<4xf32>
}
```

Resulted in this output:
```
/usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/optional:439: _Tp &std::_Optional_base_impl>::_M_get() [_Tp = long, _Dp = std::_Optional_base]: Assertion 'this->_M_is_engaged()' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: ./projects/mlir/llvm-mlir-build/bin/mlir-opt --canonicalize /tmp/test.mlir
#0 0x00005608fb4cab46 ___interceptor_backtrace (./projects/mlir/llvm-mlir-build/bin/mlir-opt+0x734eb46)
#1 0x00005608fb5b3ba7 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/lib/Support/Unix/Signals.inc:931:13
#2 0x00005608fb5b69fa llvm::sys::RunSignalHandlers() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/lib/Support/Signals.cpp:0:5
#3 0x00005608fb5b69fa SignalHandler(int, siginfo_t*, void*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/lib/Support/Unix/Signals.inc:457:3
#4 0x00007f76da596520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#5 0x00007f76da5ea9bc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969bc)
#6 0x00007f76da596476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
#7 0x00007f76da57c7f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
#8 0x00005608fb57b5ac (./projects/mlir/llvm-mlir-build/bin/mlir-opt+0x73ff5ac)
#9 0x000056090ec3de1f std::_Optional_base_impl>::_M_get() /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/optional:439:2
#10 0x000056090ec3de1f std::optional::operator*() && /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/optional:935:32
#11 0x000056090ec3de1f mlir::foldDynamicIndexList(llvm::SmallVectorImpl&, bool, bool) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Dialect/Utils/StaticValueUtils.cpp:0:0
#12 0x000056090de29b86 llvm::LogicalResult::failed() const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/Support/LogicalResult.h:43:43
#13 0x000056090de29b86 llvm::failed(llvm::LogicalResult) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/Support/LogicalResult.h:71:58
#14 0x000056090de29b86 mlir::OpWithOffsetSizesAndStridesConstantArgumentFolder::matchAndRewrite(mlir::tensor::ExtractSliceOp, mlir::PatternRewriter&) const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/Interfaces/ViewLikeInterface.h:92:9
#15 0x000056090e7cc147 mlir::PatternApplicator::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&, llvm::function_ref, llvm::function_ref, llvm::function_ref)::$_0::operator()() const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Rewrite/PatternApplicator.cpp:0:31
#16 0x000056090e7cc147 void llvm::function_ref::callback_fn, llvm::function_ref, llvm::function_ref)::$_0>(long) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#17 0x000056090e7c149c mlir::PatternApplicator::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&, llvm::function_ref, llvm::function_ref, llvm::function_ref) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:0:12
#18 0x000056090e75a803 (anonymous namespace)::GreedyPatternRewriteDriver::processWorklist() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/GreedyPatternRewriteDriver.cpp:621:17
#19 0x000056090e758438 (anonymous namespace)::RegionPatternRewriteDriver::simplify(bool*) &&::$_2::operator()() const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/GreedyPatternRewriteDriver.cpp:0:31
#20 0x000056090e758438 void llvm::function_ref::callback_fn<(anonymous namespace)::RegionPatternRewriteDriver::simplify(bool*) &&::$_2>(long) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#21 0x000056090e750e35 (anonymous namespace)::RegionPatternRewriteDriver::simplify(bool*) && /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:0:12
#22 0x000056090e750e35 mlir::applyPatternsGreedily(mlir::Region&, mlir::FrozenRewritePatternSet const&, mlir::GreedyRewriteConfig, bool*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/GreedyPatternRewriteDriver.cpp:956:47
#23 0x00005608fb81661f mlir::applyPatternsGreedily(mlir::Operation*, mlir::FrozenRewritePatternSet const&, mlir::GreedyRewriteConfig, bool*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/Transforms/GreedyPatternRewriteDriver.h:241:15
#24 0x000056090e6009d2 (anonymous namespace)::Canonicalizer::runOnOperation() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Canonicalizer.cpp:90:9
#25 0x000056090e8b2b04 mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_3::operator()() const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:613:24
#26 0x000056090e8b2b04 void llvm::function_ref::callback_fn(long) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#27 0x000056090e89d18f mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:0:12
#28 0x000056090e89eba5 llvm::LogicalResult::failed() const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/Support/LogicalResult.h:43:43
#29 0x000056090e89eba5 llvm::failed(llvm::LogicalResult) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/Support/LogicalResult.h:71:58
#30 0x000056090e89eba5 mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:688:9
#31 0x000056090e8abe8b mlir::PassManager::runPasses(mlir::Operation*, mlir::AnalysisManager) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:1128:10
#32 0x000056090e8aae96 mlir::PassManager::run(mlir::Operation*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:1102:0
#33 0x00005608fb795b01 llvm::LogicalResult::failed() const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/Support/LogicalResult.h:43:43
#34 0x00005608fb795b01 llvm::failed(llvm::LogicalResult) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/Support/LogicalResult.h:71:58
#35 0x00005608fb795b01 performActions(llvm::raw_ostream&, std::shared_ptr const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:596:7
#36 0x00005608fb794144 processBuffer(llvm::raw_ostream&, std::unique_ptr>, llvm::MemoryBufferRef, mlir::MlirOptMainConfig const&, mlir::DialectRegistry&, mlir::SourceMgrDiagnosticVerifierHandler*, llvm::ThreadPoolInterface*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:0:12
#37 0x00005608fb794144 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_0::operator()(std::unique_ptr>, llvm::MemoryBufferRef, llvm::raw_ostream&) const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:784:12
#38 0x00005608fb794144 llvm::LogicalResult llvm::function_ref>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::callback_fn>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_0>(long, std::unique_ptr>, llvm::MemoryBufferRef const&, llvm::raw_ostream&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#39 0x000056090f09dea4 llvm::function_ref>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::operator()(std::unique_ptr>, llvm::MemoryBufferRef const&, llvm::raw_ostream&) const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#40 0x000056090f09dea4 mlir::splitAndProcessBuffer(std::unique_ptr>, llvm::function_ref>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Support/ToolUtilities.cpp:30:12
#41 0x00005608fb7797dd mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:789:26
#42 0x00005608fb77a35c mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:835:14
#43 0x00005608fb77ab11 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:851:10
#44 0x00005608fb56a7a8 llvm::LogicalResult::succeeded() const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/Support/LogicalResult.h:40:45
#45 0x00005608fb56a7a8 mlir::asMainReturnCode(llvm::LogicalResult) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/Tools/mlir-opt/MlirOptMain.h:436:12
#46 0x00005608fb56a7a8 main /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/tools/mlir-opt/mlir-opt.cpp:345:10
#47 0x00007f76da57dd90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#48 0x00007f76da57de40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#49 0x00005608fb4811b5 _start (./projects/mlir/llvm-mlir-build/bin/mlir-opt+0x73051b5)
Aborted
```

To reproduce: `mlir-opt --canonicalize test.mlir`

*This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)*

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure with mlir-opt --canonicalize test.mlir, then inspect mlir/lib/Dialect/Utils/StaticValueUtils.cpp and mlir/include/mlir/Interfaces/ViewLikeInterface.h, which appear in the stack trace. Trace the dynamic index folding for tensor.extract_slice and add regression coverage; done means the reproducer no longer aborts.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.