search

daphne-eu / daphne

DAPHNE: An Open and Extensible System Infrastructure for Integrated Data Analysis Pipelines
Apache License 2.0
67 stars 62 forks source link

VectorizeComputation pass fails when iterating over uses of old results #881

Closed philipportner closed 3 weeks ago

philipportner commented 3 weeks ago 
bin/daphne --vec test/api/cli/vectorized/pipeline_2.daphne
==================
WARNING: ThreadSanitizer: heap-use-after-free (pid=3006835)
  Read of size 8 at 0x7b20000035e0 by main thread:
    #0 mlir::ValueUseIterator<mlir::OpOperand>::operator++() /home/philipportner/daphne/thirdparty/installed/include/mlir/IR/UseDefLists.h:269 (daphne+0x1c8a803)
    #1 runOnOperation /home/philipportner/daphne/src/compiler/lowering/VectorizeComputationsPass.cpp:378 (daphne+0x1c8a803)
    #2 mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) <null> (daphne+0x23b460e)
    #3 startDAPHNE(int, char const**, DaphneLibResult*, int*, DaphneUserConfig&) /home/philipportner/daphne/src/api/internal/daphne_internal.cpp:590 (daphne+0x17ce256)
    #4 mainInternal(int, char const**, DaphneLibResult*) /home/philipportner/daphne/src/api/internal/daphne_internal.cpp:668 (daphne+0x17d5bee)
    #5 main /home/philipportner/daphne/src/api/cli/daphne.cpp:19 (daphne+0x17882a7)

  Previous write of size 8 at 0x7b20000035e0 by main thread:
    #0 free ../../../../src/libsanitizer/tsan/tsan_interceptors_posix.cpp:711 (libtsan.so.0+0x37ab8)
    #1 llvm::iplist_impl<llvm::simple_ilist<mlir::Operation>, llvm::ilist_traits<mlir::Operation> >::erase(llvm::ilist_iterator<llvm::ilist_detail::node_options<mlir::Operation, true, false, void>, false, false>) <null> (daphne+0x25a5736)
    #2 mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) <null> (daphne+0x23b460e)
    #3 startDAPHNE(int, char const**, DaphneLibResult*, int*, DaphneUserConfig&) /home/philipportner/daphne/src/api/internal/daphne_internal.cpp:590 (daphne+0x17ce256)
    #4 mainInternal(int, char const**, DaphneLibResult*) /home/philipportner/daphne/src/api/internal/daphne_internal.cpp:668 (daphne+0x17d5bee)
    #5 main /home/philipportner/daphne/src/api/cli/daphne.cpp:19 (daphne+0x17882a7)

SUMMARY: ThreadSanitizer: heap-use-after-free /home/philipportner/daphne/thirdparty/installed/include/mlir/IR/UseDefLists.h:269 in mlir::ValueUseIterator<mlir::OpOperand>::operator++()
philipportner commented 3 weeks ago

asan:

=================================================================
==3010750==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0000153a0 at pc 0x562d3c4c6797 bp 0x7ffe36dc5f00 sp 0x7ffe36dc5ef0
READ of size 8 at 0x60c0000153a0 thread T0
    #0 0x562d3c4c6796 in mlir::ValueUseIterator<mlir::OpOperand>::operator++() /home/philipportner/daphne/thirdparty/installed/include/mlir/IR/UseDefLists.h:269
    #1 0x562d3c4c6796 in runOnOperation /home/philipportner/daphne/src/compiler/lowering/VectorizeComputationsPass.cpp:378
    #2 0x562d3cd5f58e in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) (/home/philipportner/daphne/bin/daphne+0x316958e)
    #3 0x562d3cd5fbb8 in mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) (/home/philipportner/daphne/bin/daphne+0x3169bb8)
    #4 0x562d3cd64fa5 in mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_14::operator()(mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo&) const (/home/philipportner/daphne/bin/daphne+0x316efa5)
    #5 0x562d3cd64e2a in mlir::LogicalResult mlir::failableParallelForEach<__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_14&>(mlir::MLIRContext*, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_14&) (/home/philipportner/daphne/bin/daphne+0x316ee2a)
    #6 0x562d3cd60e6f in mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool) (/home/philipportner/daphne/bin/daphne+0x316ae6f)
    #7 0x562d3cd5f68d in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) (/home/philipportner/daphne/bin/daphne+0x316968d)
    #8 0x562d3cd5fbb8 in mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) (/home/philipportner/daphne/bin/daphne+0x3169bb8)
    #9 0x562d3cd61d54 in mlir::PassManager::run(mlir::Operation*) (/home/philipportner/daphne/bin/daphne+0x316bd54)
    #10 0x562d3b978e7c in DaphneIrExecutor::runPasses(mlir::ModuleOp) /home/philipportner/daphne/src/compiler/execution/DaphneIrExecutor.cpp:198
    #11 0x562d3b6be903 in startDAPHNE(int, char const**, DaphneLibResult*, int*, DaphneUserConfig&) /home/philipportner/daphne/src/api/internal/daphne_internal.cpp:590
    #12 0x562d3b6cf962 in mainInternal(int, char const**, DaphneLibResult*) /home/philipportner/daphne/src/api/internal/daphne_internal.cpp:668
    #13 0x7fb9740a4082 in __libc_start_main ../csu/libc-start.c:308
    #14 0x562d3b61822d in _start (/home/philipportner/daphne/bin/daphne+0x1a2222d)

0x60c0000153a0 is located 96 bytes inside of 128-byte region [0x60c000015340,0x60c0000153c0)
freed by thread T0 here:
    #0 0x7fb975f6340f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
    #1 0x562d3cf50436 in llvm::iplist_impl<llvm::simple_ilist<mlir::Operation>, llvm::ilist_traits<mlir::Operation> >::erase(llvm::ilist_iterator<llvm::ilist_detail::node_options<mlir::Operation, true, false, void>, false, false>) (/home/philipportner/daphne/bin/daphne+0x335a436)

previously allocated by thread T0 here:
    #0 0x7fb975f63808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
    #1 0x562d3cf4881f in mlir::Operation::create(mlir::Location, mlir::OperationName, mlir::TypeRange, mlir::ValueRange, mlir::NamedAttrList&&, mlir::BlockRange, unsigned int) (/home/philipportner/daphne/bin/daphne+0x335281f)
    #2 0x3ffffffff  (<unknown module>)

SUMMARY: AddressSanitizer: heap-use-after-free /home/philipportner/daphne/thirdparty/installed/include/mlir/IR/UseDefLists.h:269 in mlir::ValueUseIterator<mlir::OpOperand>::operator++()
Shadow bytes around the buggy address:
  0x0c187fffaa20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c187fffaa30: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c187fffaa40: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
  0x0c187fffaa50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c187fffaa60: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c187fffaa70: fd fd fd fd[fd]fd fd fd fa fa fa fa fa fa fa fa
  0x0c187fffaa80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffaa90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffaaa0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffaab0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fffaac0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3010750==ABORTING
philipportner commented 3 weeks ago

closed by #882