llvm / llvm/llvm-project

[mlir][tosa] `tosa-to-linalg` crashes on `tosa.rescale` with `i64` output type

Open
#224,020 2 comments 0 reactions 0 assignees View on GitHub
crash mlir
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

### Description

I encountered a crash when running the `tosa-to-linalg` pass on a `tosa.rescale` operation with an i64 output type.
It seems that the pass assumes the output bit width of `tosa.rescale` is no greater than `32` bits, but this condition is not checked before the lowering is performed, resulting in an assertion failure for an `i64` output type.

### Tested commit

[3b8ee89](https://github.com/llvm/llvm-project/commit/3b8ee89006f5a228fce75528f8dd80b4229abcc1)

### Test case

```mlir
module {
func.func @main(%arg0: tensor<1x4x4x1xi32>, %arg1: tensor<1xi16>, %arg2: tensor<1xi8>, %arg3: tensor<1xi32>, %arg4: tensor<1xi32>) -> tensor<1x8x8x3xi64> {
%0 = "tosa.const"() <{values = dense<1> : tensor<1x8x8x3xi64>}> : () -> tensor<1x8x8x3xi64>
%1 = "tosa.const"() <{values = dense<0> : tensor<1xi64>}> : () -> tensor<1xi64>
%2 = "tosa.const"() <{values = dense<0> : tensor<1xi64>}> : () -> tensor<1xi64>
%3 = tosa.rescale %0, %arg3, %arg2, %1, %2 {input_unsigned = true, output_unsigned = true, per_channel = false, rounding_mode = DOUBLE_ROUND, scale32 = true} : (tensor<1x8x8x3xi64>, tensor<1xi32>, tensor<1xi8>, tensor<1xi64>, tensor<1xi64>) -> tensor<1x8x8x3xi64>
return %3 : tensor<1x8x8x3xi64>
}
}
```

### Steps to reproduce

```
mlir-opt test.mlir --pass-pipeline=builtin.module(func.func(tosa-to-linalg))
```

### stack trace

```
mlir-opt: /home/workdir/llvm-project-latest/mlir/lib/Conversion/TosaToLinalg/TosaToLinalg.cpp:1708: auto (anonymous namespace)::RescaleConverter::matchAndRewrite(tosa::RescaleOp, PatternRewriter &)::(anonymous class)::operator()(OpBuilder &, Location, ValueRange) const: Assertion `outBitWidth <= 32 && "Unexpected output zeropoint bitwidth"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: ./mlir-opt test.mlir --pass-pipeline=builtin.module(func.func(tosa-to-linalg))
#0 0x0000557fe40d7d0b llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (./mlir-opt+0x1fc2d0b)
#1 0x0000557fe40d4b11 llvm::sys::RunSignalHandlers() (./mlir-opt+0x1fbfb11)
#2 0x0000557fe40d8a3b SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007f57e13b4520 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#4 0x00007f57e14089fc pthread_kill (/usr/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
#5 0x00007f57e13b4476 gsignal (/usr/lib/x86_64-linux-gnu/libc.so.6+0x42476)
#6 0x00007f57e139a7f3 abort (/usr/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
#7 0x00007f57e139a71b (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
#8 0x00007f57e13abe96 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#9 0x0000557fe7c7f50f void llvm::function_ref::callback_fn<(anonymous namespace)::RescaleConverter::matchAndRewrite(mlir::tosa::RescaleOp, mlir::PatternRewriter&) const::'lambda'(mlir::OpBuilder&, mlir::Location, mlir::ValueRange)>(long, mlir::OpBuilder&, mlir::Location, mlir::ValueRange) TosaToLinalg.cpp:0:0
#10 0x0000557fea1dcd8e buildGenericRegion(mlir::OpBuilder&, mlir::Location, mlir::Region&, mlir::ValueRange, mlir::ValueRange, llvm::function_ref) LinalgOps.cpp:0:0
#11 0x0000557fea1dd0da mlir::linalg::GenericOp::build(mlir::OpBuilder&, mlir::OperationState&, mlir::TypeRange, mlir::ValueRange, mlir::ValueRange, llvm::ArrayRef, llvm::ArrayRef, llvm::StringRef, llvm::StringRef, llvm::function_ref, llvm::ArrayRef) (./mlir-opt+0x80c80da)
#12 0x0000557fea2b6c37 mlir::linalg::GenericOp::create(mlir::OpBuilder&, mlir::Location, mlir::TypeRange, mlir::ValueRange, mlir::ValueRange, llvm::ArrayRef, llvm::ArrayRef, llvm::function_ref, llvm::ArrayRef) (./mlir-opt+0x81a1c37)
#13 0x0000557fe7c7e073 (anonymous namespace)::RescaleConverter::matchAndRewrite(mlir::tosa::RescaleOp, mlir::PatternRewriter&) const TosaToLinalg.cpp:0:0
#14 0x0000557fec27c6c8 void llvm::function_ref::callback_fn, llvm::function_ref, llvm::function_ref)::$_0>(long) PatternApplicator.cpp:0:0
#15 0x0000557fec278e2a mlir::PatternApplicator::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&, llvm::function_ref, llvm::function_ref, llvm::function_ref) (./mlir-opt+0xa163e2a)
#16 0x0000557fec22ef62 (anonymous namespace)::OperationLegalizer::legalize(mlir::Operation*) DialectConversion.cpp:0:0
#17 0x0000557fec22e750 mlir::OperationConverter::convert(mlir::Operation*, bool) (./mlir-opt+0xa119750)
#18 0x0000557fec22fc5e mlir::OperationConverter::applyConversion(llvm::ArrayRef) (./mlir-opt+0xa11ac5e)
#19 0x0000557fec23e4c9 void llvm::function_ref::callback_fn, mlir::ConversionTarget const&, mlir::FrozenRewritePatternSet const&, mlir::ConversionConfig, (anonymous namespace)::OpConversionMode)::$_0>(long) DialectConversion.cpp:0:0
#20 0x0000557fec235927 applyConversion(llvm::ArrayRef, mlir::ConversionTarget const&, mlir::FrozenRewritePatternSet const&, mlir::ConversionConfig, (anonymous namespace)::OpConversionMode) DialectConversion.cpp:0:0
#21 0x0000557fec235a6e mlir::applyFullConversion(mlir::Operation*, mlir::ConversionTarget const&, mlir::FrozenRewritePatternSet const&, mlir::ConversionConfig) (./mlir-opt+0xa120a6e)
#22 0x0000557fe7c4c7f1 (anonymous namespace)::TosaToLinalg::runOnOperation() TosaToLinalgPass.cpp:0:0
#23 0x0000557fec2d73ee mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) (./mlir-opt+0xa1c23ee)
#24 0x0000557fec2d8364 mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) (./mlir-opt+0xa1c3364)
#25 0x0000557fec2e2f3e auto void mlir::parallelForEach<__gnu_cxx::__normal_iterator>>, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_12>(mlir::MLIRContext*, __gnu_cxx::__normal_iterator>>, __gnu_cxx::__normal_iterator>>, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_12&&)::'lambda'(__gnu_cxx::__normal_iterator>>&&)::operator()(__gnu_cxx::__normal_iterator>>&&) const Pass.cpp:0:0
#26 0x0000557fec2daf38 mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool) (./mlir-opt+0xa1c5f38)
#27 0x0000557fec2d7744 mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) (./mlir-opt+0xa1c2744)
#28 0x0000557fec2d8364 mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) (./mlir-opt+0xa1c3364)
#29 0x0000557fec2df0fa mlir::PassManager::runPasses(mlir::Operation*, mlir::AnalysisManager) (./mlir-opt+0xa1ca0fa)
#30 0x0000557fec2dea5d mlir::PassManager::run(mlir::Operation*) (./mlir-opt+0xa1c9a5d)
#31 0x0000557fe418358f performActions(llvm::raw_ostream&, std::shared_ptr const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) MlirOptMain.cpp:0:0
#32 0x0000557fe4182761 llvm::LogicalResult llvm::function_ref>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::callback_fn>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_0>(long, std::unique_ptr>, llvm::MemoryBufferRef const&, llvm::raw_ostream&) MlirOptMain.cpp:0:0
#33 0x0000557fec631ec6 mlir::splitAndProcessBuffer(std::unique_ptr>, llvm::function_ref>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) (./mlir-opt+0xa51cec6)
#34 0x0000557fe4178ba6 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) (./mlir-opt+0x2063ba6)
#35 0x0000557fe4178f7a mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) (./mlir-opt+0x2063f7a)
#36 0x0000557fe41791eb mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) (./mlir-opt+0x20641eb)
#37 0x0000557fe40bd7cd main (./mlir-opt+0x1fa87cd)
#38 0x00007f57e139bd90 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#39 0x00007f57e139be40 __libc_start_main (/usr/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#40 0x0000557fe40bd325 _start (./mlir-opt+0x1fa8325)
Aborted (core dumped)
```

Contributor guide

Open the contributing guide

Research direction

Start in mlir/lib/Conversion/TosaToLinalg/TosaToLinalg.cpp at RescaleConverter::matchAndRewrite and reproduce the failure with the supplied test.mlir command. Trace the outBitWidth assertion for the i64 tosa.rescale case, then add or update regression coverage using the supplied operation. Done means the tosa-to-linalg pass handles this input without the reported assertion.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.