[mlir] integer overflow in mlir/lib/IR/AffineExpr.cpp
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
The following code:
```mlir
module {
func.func @index_boundary() -> f32 {
%large = arith.constant 9223372036854775807 : i64
%idx = arith.index_cast %large : i64 to index
%c1 = arith.constant 1 : index
%r = arith.addi %idx, %c1 : index
%A = memref.alloc() : memref<64x64xf32>
%0 = affine.load %A[%r, %r - 1] : memref<64x64xf32>
return %0 : f32
}
}
```
Resulted in this output:
```
/home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/IR/AffineExpr.cpp:1372:12: runtime error: signed integer overflow: -9223372036854775808 + -1 cannot be represented in type 'long'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/IR/AffineExpr.cpp:1372:12
```
To reproduce: `mlir-opt --inline ./min.mlir`
*This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)*
Contributor guide
Research direction
Reproduce the failure with `mlir-opt --inline ./min.mlir`, then inspect the overflow report at `mlir/lib/IR/AffineExpr.cpp:1372` and trace the affine expression operation reached by the supplied MLIR input. Done means the reproducer no longer triggers signed integer overflow under UBSan while preserving the expected `mlir-opt` behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 74/100