llvm / llvm/llvm-project

[mlir] integer overflow in mlir/lib/IR/AffineExpr.cpp

Open
#224,577 1 comment 0 reactions 0 assignees View on GitHub
crash generated by fuzzer mlir
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

The following code:

```mlir
module {
func.func @index_boundary() -> f32 {
%large = arith.constant 9223372036854775807 : i64
%idx = arith.index_cast %large : i64 to index
%c1 = arith.constant 1 : index
%r = arith.addi %idx, %c1 : index
%A = memref.alloc() : memref<64x64xf32>
%0 = affine.load %A[%r, %r - 1] : memref<64x64xf32>
return %0 : f32
}
}
```

Resulted in this output:
```
/home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/IR/AffineExpr.cpp:1372:12: runtime error: signed integer overflow: -9223372036854775808 + -1 cannot be represented in type 'long'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/IR/AffineExpr.cpp:1372:12
```

To reproduce: `mlir-opt --inline ./min.mlir`

*This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)*

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure with `mlir-opt --inline ./min.mlir`, then inspect the overflow report at `mlir/lib/IR/AffineExpr.cpp:1372` and trace the affine expression operation reached by the supplied MLIR input. Done means the reproducer no longer triggers signed integer overflow under UBSan while preserving the expected `mlir-opt` behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
74/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.