search

llvm / llvm-project

The LLVM Project is a collection of modular and reusable compiler and toolchain technologies.
http://llvm.org
Other
27.96k stars 11.53k forks source link

[MLIR]`-test-written-to` pass: `DataFlowSolver` triggers Segmentation fault in `AbstractSparseBackwardDataFlowAnalysis` #61715

Open BealZephyr opened 1 year ago

BealZephyr commented 1 year ago

Test with LLVM 16 steps to reproduce:

mlir-opt test.mlir -sparse-compiler -test-written-to

test case:

module {
  func.func @main(%arg1: memref<2x32x10x4096xf32>) {
    %alloc = memref.alloc() {alignment = 64 : i64} : memref<2x32x10x4096xf32>
    memref.copy %arg1, %alloc : memref<2x32x10x4096xf32> to memref<2x32x10x4096xf32>
    return 
  }
}

crash trace:

PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.  Program arguments: /home/ty/fuzzer/llvm-project-16/mlir/build/bin/mlir-opt test.mlir -sparse-compiler -test-written-to
 #0 0x0000000000481cad llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /home/ty/fuzzer/llvm-project-16/llvm/lib/Support/Unix/Signals.inc:567:11
 #1 0x000000000048213b PrintStackTraceSignalHandler(void*) /home/ty/fuzzer/llvm-project-16/llvm/lib/Support/Unix/Signals.inc:641:1
 #2 0x00000000004804d6 llvm::sys::RunSignalHandlers() /home/ty/fuzzer/llvm-project-16/llvm/lib/Support/Signals.cpp:104:5
 #3 0x0000000000482865 SignalHandler(int) /home/ty/fuzzer/llvm-project-16/llvm/lib/Support/Unix/Signals.inc:412:1
 #4 0x00007f29d825c980 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x12980)
 #5 0x0000000000530f10 llvm::PointerIntPair<llvm::ilist_node_base<true>*, 1u, unsigned int, llvm::PointerLikeTypeTraits<llvm::ilist_node_base<true>*>, llvm::PointerIntPairInfo<llvm::ilist_node_base<true>*, 1u, llvm::PointerLikeTypeTraits<llvm::ilist_node_base<true>*>>>::getPointer() const /home/ty/fuzzer/llvm-project-16/llvm/include/llvm/ADT/PointerIntPair.h:60:58
 #6 0x0000000000530ef5 llvm::ilist_node_base<true>::getPrev() const /home/ty/fuzzer/llvm-project-16/llvm/include/llvm/ADT/ilist_node_base.h:42:38
 #7 0x00000000005cc565 llvm::ilist_node_impl<llvm::ilist_detail::node_options<mlir::Block, true, false, void>>::getPrev() const /home/ty/fuzzer/llvm-project-16/llvm/include/llvm/ADT/ilist_node.h:71:5
 #8 0x00000000005cc52c llvm::ilist_sentinel<llvm::ilist_detail::node_options<mlir::Block, true, false, void>>::empty() const /home/ty/fuzzer/llvm-project-16/llvm/include/llvm/ADT/ilist_node.h:249:45
 #9 0x00000000005cc465 llvm::simple_ilist<mlir::Block>::empty() const /home/ty/fuzzer/llvm-project-16/llvm/include/llvm/ADT/simple_ilist.h:131:38
#10 0x00000000005b6735 mlir::Region::empty() /home/ty/fuzzer/llvm-project-16/mlir/include/mlir/IR/Region.h:60:18
#11 0x0000000003a554a0 mlir::dataflow::AbstractSparseBackwardDataFlowAnalysis::visitOperation(mlir::Operation*) /home/ty/fuzzer/llvm-project-16/mlir/lib/Analysis/DataFlow/SparseAnalysis.cpp:417:11
#12 0x0000000003a54cc7 mlir::dataflow::AbstractSparseBackwardDataFlowAnalysis::initializeRecursively(mlir::Operation*) /home/ty/fuzzer/llvm-project-16/mlir/lib/Analysis/DataFlow/SparseAnalysis.cpp:303:25
#13 0x0000000003a54dc4 mlir::dataflow::AbstractSparseBackwardDataFlowAnalysis::initializeRecursively(mlir::Operation*) /home/ty/fuzzer/llvm-project-16/mlir/lib/Analysis/DataFlow/SparseAnalysis.cpp:310:20
#14 0x0000000003a54dc4 mlir::dataflow::AbstractSparseBackwardDataFlowAnalysis::initializeRecursively(mlir::Operation*) /home/ty/fuzzer/llvm-project-16/mlir/lib/Analysis/DataFlow/SparseAnalysis.cpp:310:20
#15 0x0000000003a54c8d mlir::dataflow::AbstractSparseBackwardDataFlowAnalysis::initialize(mlir::Operation*) /home/ty/fuzzer/llvm-project-16/mlir/lib/Analysis/DataFlow/SparseAnalysis.cpp:297:10
#16 0x0000000003a2ef2b mlir::DataFlowSolver::initializeAndRun(mlir::Operation*) /home/ty/fuzzer/llvm-project-16/mlir/lib/Analysis/DataFlowFramework.cpp:70:25
#17 0x00000000032ddfc0 (anonymous namespace)::TestWrittenToPass::runOnOperation() /home/ty/fuzzer/llvm-project-16/mlir/test/lib/Analysis/DataFlow/TestBackwardDataFlowAnalysis.cpp:108:23
#18 0x0000000003a69757 mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) /home/ty/fuzzer/llvm-project-16/mlir/lib/Pass/Pass.cpp:471:21
#19 0x0000000003a69d6d mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) /home/ty/fuzzer/llvm-project-16/mlir/lib/Pass/Pass.cpp:534:16
#20 0x0000000003a6b6ac mlir::PassManager::runPasses(mlir::Operation*, mlir::AnalysisManager) /home/ty/fuzzer/llvm-project-16/mlir/lib/Pass/Pass.cpp:839:10
#21 0x0000000003a6b5d1 mlir::PassManager::run(mlir::Operation*) /home/ty/fuzzer/llvm-project-16/mlir/lib/Pass/Pass.cpp:819:60
#22 0x0000000003a61f32 performActions(llvm::raw_ostream&, bool, bool, std::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, llvm::function_ref<mlir::LogicalResult (mlir::PassManager&)>, bool, bool) /home/ty/fuzzer/llvm-project-16/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:91:17
#23 0x0000000003a61b8f processBuffer(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, bool, bool, bool, bool, bool, bool, llvm::function_ref<mlir::LogicalResult (mlir::PassManager&)>, mlir::DialectRegistry&, llvm::ThreadPool*) /home/ty/fuzzer/llvm-project-16/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:139:12
#24 0x0000000003a61948 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<mlir::LogicalResult (mlir::PassManager&)>, mlir::DialectRegistry&, bool, bool, bool, bool, bool, bool, bool)::$_0::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&) const /home/ty/fuzzer/llvm-project-16/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:181:12
#25 0x0000000003a6183d mlir::LogicalResult llvm::function_ref<mlir::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<mlir::LogicalResult (mlir::PassManager&)>, mlir::DialectRegistry&, bool, bool, bool, bool, bool, bool, bool)::$_0>(long, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&) /home/ty/fuzzer/llvm-project-16/llvm/include/llvm/ADT/STLFunctionalExtras.h:45:12
#26 0x0000000003b93a99 llvm::function_ref<mlir::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&) const /home/ty/fuzzer/llvm-project-16/llvm/include/llvm/ADT/STLFunctionalExtras.h:68:12
#27 0x0000000003b93075 mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<mlir::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>, llvm::raw_ostream&, bool, bool) /home/ty/fuzzer/llvm-project-16/mlir/lib/Support/ToolUtilities.cpp:28:12
#28 0x0000000003a60873 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<mlir::LogicalResult (mlir::PassManager&)>, mlir::DialectRegistry&, bool, bool, bool, bool, bool, bool, bool) /home/ty/fuzzer/llvm-project-16/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:186:10
#29 0x0000000003a60a0f mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::PassPipelineCLParser const&, mlir::DialectRegistry&, bool, bool, bool, bool, bool, bool, bool, bool) /home/ty/fuzzer/llvm-project-16/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:209:10
#30 0x0000000003a61651 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&, bool) /home/ty/fuzzer/llvm-project-16/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:306:14
#31 0x0000000000411609 main /home/ty/fuzzer/llvm-project-16/mlir/tools/mlir-opt/mlir-opt.cpp:271:7
#32 0x00007f29d712fc87 __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:344:0
#33 0x00000000004112ea _start (/home/ty/fuzzer/llvm-project-16/mlir/build/bin/mlir-opt+0x4112ea)
Segmentation fault      (core dumped)
llvmbot commented 1 year ago

@llvm/issue-subscribers-mlir