llvm / llvm/llvm-project

[mlir] Assertion `dynamicValues.size() == static_cast<size_t>(llvm::count_if( staticValues, ShapedType::isDynamic)) && "expected the rank of dynamic values to match the number of " "values known to be dynamic"' failed.

Open
#223,336 1 comment 0 reactions 0 assignees View on GitHub
crash generated by fuzzer mlir
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

The following code:

```mlir
module {
func.func @H_1c384501_A_e0ef377c_main() {
return
}
func.func @H_1c384501_B_d3599203_memref_subview(%arg0: memref<8x16x4xf32, strided<[64, 4, 1]>>, %arg1: memref<1x128x1x32x1xf32, strided<[4096, 32, 32, 1, 1]>>, %arg2: memref<8x16x4xf32, strided<[1, 64, 8], offset: 16>>, %arg3: index, %arg4: index, %arg5: index) {
return
}
func.func @H_1c384501__ffl_p6_index_boundary() -> index {
%large = arith.constant 9223372036854775807 : i64 // i64 MAX
%idx = arith.index_cast %large : i64 to index
%c1 = arith.constant 1 : index
%r = arith.addi %idx, %c1 : index
%i64 = arith.index_cast %r : index to i64
%i32 = arith.trunci %i64 : i64 to i32
%dd3599203_arg0 = ub.poison : memref<8x16x4xf32, strided<[64, 4, 1]>> // state fusion
%dd3599203_subview = memref.subview %dd3599203_arg0[%r, %r, %r] [%idx, %r, %c1] [%r, %r, %r] : memref<8x16x4xf32, strided<[64, 4, 1]>> to memref>
%dd3599203_subview_0 = memref.subview %dd3599203_subview[%r, %r, %r] [%idx, %idx, %idx] [%c1, %c1, %c1] : memref> to memref>
%back = arith.index_cast %i32 : i32 to index
return %back : index
}
}
```

Resulted in this output:
```
mlir-opt: /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Dialect/Utils/StaticValueUtils.cpp:226: SmallVector mlir::getMixedValues(ArrayRef, ValueRange, MLIRContext *): Assertion `dynamicValues.size() == static_cast(llvm::count_if( staticValues, ShapedType::isDynamic)) && "expected the rank of dynamic values to match the number of " "values known to be dynamic"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: ./projects/mlir/llvm-mlir-build/bin/mlir-opt --canonicalize /tmp/test.mlir
#0 0x00005609f0103b46 ___interceptor_backtrace (./projects/mlir/llvm-mlir-build/bin/mlir-opt+0x734eb46)
#1 0x00005609f01ecba7 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/lib/Support/Unix/Signals.inc:931:13
#2 0x00005609f01ef9fa llvm::sys::RunSignalHandlers() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/lib/Support/Signals.cpp:0:5
#3 0x00005609f01ef9fa SignalHandler(int, siginfo_t*, void*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/lib/Support/Unix/Signals.inc:457:3
#4 0x00007f7dbe52c520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#5 0x00007f7dbe5809bc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969bc)
#6 0x00007f7dbe52c476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
#7 0x00007f7dbe5127f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
#8 0x00007f7dbe51271b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
#9 0x00007f7dbe523e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#10 0x0000560a03871010 mlir::getMixedValues(llvm::ArrayRef, mlir::ValueRange, mlir::MLIRContext*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Dialect/Utils/StaticValueUtils.cpp:223:3
#11 0x0000560a038710b1 mlir::getMixedValues(llvm::ArrayRef, mlir::ValueRange, mlir::Builder&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Dialect/Utils/StaticValueUtils.cpp:242:3
#12 0x00005609f41f4ffb mlir::detail::OffsetSizeAndStrideOpInterfaceTrait::getMixedStrides() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-mlir-build/tools/mlir/include/mlir/Interfaces/ViewLikeInterface.h.inc:427:5
#13 0x0000560a02d3a03b mlir::OpWithOffsetSizesAndStridesConstantArgumentFolder::matchAndRewrite(mlir::memref::SubViewOp, mlir::PatternRewriter&) const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/Interfaces/ViewLikeInterface.h:0:47
#14 0x0000560a03405147 mlir::PatternApplicator::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&, llvm::function_ref, llvm::function_ref, llvm::function_ref)::$_0::operator()() const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Rewrite/PatternApplicator.cpp:0:31
#15 0x0000560a03405147 void llvm::function_ref::callback_fn, llvm::function_ref, llvm::function_ref)::$_0>(long) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#16 0x0000560a033fa49c mlir::PatternApplicator::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&, llvm::function_ref, llvm::function_ref, llvm::function_ref) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:0:12
#17 0x0000560a03393803 (anonymous namespace)::GreedyPatternRewriteDriver::processWorklist() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/GreedyPatternRewriteDriver.cpp:621:17
#18 0x0000560a03391438 (anonymous namespace)::RegionPatternRewriteDriver::simplify(bool*) &&::$_2::operator()() const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/GreedyPatternRewriteDriver.cpp:0:31
#19 0x0000560a03391438 void llvm::function_ref::callback_fn<(anonymous namespace)::RegionPatternRewriteDriver::simplify(bool*) &&::$_2>(long) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#20 0x0000560a03389e35 (anonymous namespace)::RegionPatternRewriteDriver::simplify(bool*) && /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:0:12
#21 0x0000560a03389e35 mlir::applyPatternsGreedily(mlir::Region&, mlir::FrozenRewritePatternSet const&, mlir::GreedyRewriteConfig, bool*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/GreedyPatternRewriteDriver.cpp:956:47
#22 0x00005609f044f61f mlir::applyPatternsGreedily(mlir::Operation*, mlir::FrozenRewritePatternSet const&, mlir::GreedyRewriteConfig, bool*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/Transforms/GreedyPatternRewriteDriver.h:241:15
#23 0x0000560a032399d2 (anonymous namespace)::Canonicalizer::runOnOperation() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Canonicalizer.cpp:90:9
#24 0x0000560a034ebb04 mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_3::operator()() const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:613:24
#25 0x0000560a034ebb04 void llvm::function_ref::callback_fn(long) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#26 0x0000560a034d618f mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:0:12
#27 0x0000560a034d7ba5 llvm::LogicalResult::failed() const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/Support/LogicalResult.h:43:43
#28 0x0000560a034d7ba5 llvm::failed(llvm::LogicalResult) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/Support/LogicalResult.h:71:58
#29 0x0000560a034d7ba5 mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:688:9
#30 0x0000560a034e4e8b mlir::PassManager::runPasses(mlir::Operation*, mlir::AnalysisManager) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:1128:10
#31 0x0000560a034e3e96 mlir::PassManager::run(mlir::Operation*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:1102:0
#32 0x00005609f03ceb01 llvm::LogicalResult::failed() const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/Support/LogicalResult.h:43:43
#33 0x00005609f03ceb01 llvm::failed(llvm::LogicalResult) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/Support/LogicalResult.h:71:58
#34 0x00005609f03ceb01 performActions(llvm::raw_ostream&, std::shared_ptr const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:596:7
#35 0x00005609f03cd144 processBuffer(llvm::raw_ostream&, std::unique_ptr>, llvm::MemoryBufferRef, mlir::MlirOptMainConfig const&, mlir::DialectRegistry&, mlir::SourceMgrDiagnosticVerifierHandler*, llvm::ThreadPoolInterface*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:0:12
#36 0x00005609f03cd144 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_0::operator()(std::unique_ptr>, llvm::MemoryBufferRef, llvm::raw_ostream&) const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:784:12
#37 0x00005609f03cd144 llvm::LogicalResult llvm::function_ref>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::callback_fn>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_0>(long, std::unique_ptr>, llvm::MemoryBufferRef const&, llvm::raw_ostream&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#38 0x0000560a03cd6ea4 llvm::function_ref>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::operator()(std::unique_ptr>, llvm::MemoryBufferRef const&, llvm::raw_ostream&) const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#39 0x0000560a03cd6ea4 mlir::splitAndProcessBuffer(std::unique_ptr>, llvm::function_ref>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Support/ToolUtilities.cpp:30:12
#40 0x00005609f03b27dd mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:789:26
#41 0x00005609f03b335c mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:835:14
#42 0x00005609f03b3b11 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:851:10
#43 0x00005609f01a37a8 llvm::LogicalResult::succeeded() const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/Support/LogicalResult.h:40:45
#44 0x00005609f01a37a8 mlir::asMainReturnCode(llvm::LogicalResult) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/Tools/mlir-opt/MlirOptMain.h:436:12
#45 0x00005609f01a37a8 main /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/tools/mlir-opt/mlir-opt.cpp:345:10
#46 0x00007f7dbe513d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#47 0x00007f7dbe513e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#48 0x00005609f00ba1b5 _start (./projects/mlir/llvm-mlir-build/bin/mlir-opt+0x73051b5)
Aborted
```

To reproduce: `mlir-opt --canonicalize test.mlir`

*This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)*

Contributor guide

Open the contributing guide

Research direction

Start with the reproducer and run mlir-opt --canonicalize as described. Trace the assertion in mlir/lib/Dialect/Utils/StaticValueUtils.cpp through ViewLikeInterface.h and the memref.subview canonicalization path; done means the input no longer aborts while preserving correct subview handling.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.