Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[mlir] --canonicalize causes segmentation fault in eraseUnreachableBlocks. #74461

Closed
Anonymous15592 opened this issue Dec 5, 2023 · 4 comments
Closed

[mlir] --canonicalize causes segmentation fault in eraseUnreachableBlocks. #74461

Anonymous15592 opened this issue Dec 5, 2023 · 4 comments
Assignees
@kuhar
Labels
crash Prefer [crash-on-valid] or [crash-on-invalid] mlir:spirv

Comments

@Anonymous15592
Copy link

git version: 383e350

system: Ubuntu 20.04.6 LTS (Focal Fossa)

reproduced with: mlir-opt --canonicalize a.mlir

a.mlir:

llvm.func @func2()  {
  cf.br ^bb4
^bb2:  // pred: ^bb0
  spirv.mlir.selection {
    spirv.Branch ^bb3
  ^bb3:  // 2 preds: ^bb1, ^bb2
    spirv.mlir.merge
  }
  cf.br ^bb4
^bb4:  // pred: ^bb3
  spirv.mlir.selection {
  }
  llvm.return 
}

trace:

PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /data/bin1/llvm-project/build/bin/mlir-opt --canonicalize a.mlir
 #0 0x000055caf59393ff llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/data/bin1/llvm-project/build/bin/mlir-opt+0x16573ff)
 #1 0x000055caf5936454 SignalHandler(int) Signals.cpp:0:0
 #2 0x00007fb5b33b6420 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14420)
 #3 0x000055caf870ebfb mlir::SuccessorRange::SuccessorRange(mlir::Block*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x442cbfb)
 #4 0x000055caf847134b llvm::iterator_range<llvm::po_iterator<mlir::Block*, llvm::SmallPtrSet<llvm::GraphTraits<mlir::Block*>::NodeRef, 8u>, false, llvm::GraphTraits<mlir::Block*>>> llvm::post_order<mlir::Block*>(mlir::Block* const&) (/data/bin1/llvm-project/build/bin/mlir-opt+0x418f34b)
 #5 0x000055caf87f90a3 mlir::RewriterBase::eraseOp(mlir::Operation*)::'lambda0'(mlir::Operation*)::operator()(mlir::Operation*) const (.isra.0) PatternMatch.cpp:0:0
 #6 0x000055caf87f9cb6 mlir::RewriterBase::eraseOp(mlir::Operation*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x4517cb6)
 #7 0x000055caf87f9b89 mlir::RewriterBase::eraseBlock(mlir::Block*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x4517b89)
 #8 0x000055caf86ab1db mlir::eraseUnreachableBlocks(mlir::RewriterBase&, llvm::MutableArrayRef<mlir::Region>) (/data/bin1/llvm-project/build/bin/mlir-opt+0x43c91db)
 #9 0x000055caf86b376a mlir::simplifyRegions(mlir::RewriterBase&, llvm::MutableArrayRef<mlir::Region>) (/data/bin1/llvm-project/build/bin/mlir-opt+0x43d176a)
#10 0x000055caf8694079 mlir::applyPatternsAndFoldGreedily(mlir::Region&, mlir::FrozenRewritePatternSet const&, mlir::GreedyRewriteConfig, bool*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x43b2079)
#11 0x000055caf85f8fea (anonymous namespace)::Canonicalizer::runOnOperation() Canonicalizer.cpp:0:0
#12 0x000055caf85d9f3e mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42f7f3e)
#13 0x000055caf85da41a mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42f841a)
#14 0x000055caf85dac44 mlir::PassManager::run(mlir::Operation*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42f8c44)
#15 0x000055caf85cb9b3 performActions(llvm::raw_ostream&, std::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) MlirOptMain.cpp:0:0
#16 0x000055caf85cce84 processBuffer(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::MlirOptMainConfig const&, mlir::DialectRegistry&, llvm::ThreadPool*) MlirOptMain.cpp:0:0
#17 0x000055caf85cd034 mlir::LogicalResult llvm::function_ref<mlir::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::'lambda'(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>(long, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&) MlirOptMain.cpp:0:0
#18 0x000055caf86cc324 mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<mlir::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>, llvm::raw_ostream&, bool, bool) (/data/bin1/llvm-project/build/bin/mlir-opt+0x43ea324)
#19 0x000055caf85c5897 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42e3897)
#20 0x000055caf85cd181 mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42eb181)
#21 0x000055caf85cd5e6 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42eb5e6)
#22 0x000055caf5870a7b main (/data/bin1/llvm-project/build/bin/mlir-opt+0x158ea7b)
#23 0x00007fb5b2e82083 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24083)
#24 0x000055caf590975e _start (/data/bin1/llvm-project/build/bin/mlir-opt+0x162775e)
Segmentation fault (core dumped)
@github-actions github-actions bot added the mlir label Dec 5, 2023
@EugeneZelenko EugeneZelenko added the crash Prefer [crash-on-valid] or [crash-on-invalid] label Dec 5, 2023
@Lewuathe
Copy link
Member

Lewuathe commented Dec 8, 2023

I'm not clearly sure what the root cause but it crashed in the middle of erasing the ^bb2 which is starting with spirv.mlir.selection.

llvm-project/mlir/lib/IR/PatternMatch.cpp

Line 349 in 847d845

for (Block *b : llvm::post_order(&r.front())) {

@llvmbot
Copy link
Collaborator

llvmbot commented Dec 8, 2023

@llvm/issue-subscribers-mlir-spirv

Author: anonymousMCS (anonymousMCS)

git version: 383e350

system: Ubuntu 20.04.6 LTS (Focal Fossa)

reproduced with: mlir-opt --canonicalize a.mlir

a.mlir:

llvm.func @<!-- -->func2()  {
  cf.br ^bb4
^bb2:  // pred: ^bb0
  spirv.mlir.selection {
    spirv.Branch ^bb3
  ^bb3:  // 2 preds: ^bb1, ^bb2
    spirv.mlir.merge
  }
  cf.br ^bb4
^bb4:  // pred: ^bb3
  spirv.mlir.selection {
  }
  llvm.return 
}

trace:

PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /data/bin1/llvm-project/build/bin/mlir-opt --canonicalize a.mlir
 #<!-- -->0 0x000055caf59393ff llvm::sys::PrintStackTrace(llvm::raw_ostream&amp;, int) (/data/bin1/llvm-project/build/bin/mlir-opt+0x16573ff)
 #<!-- -->1 0x000055caf5936454 SignalHandler(int) Signals.cpp:0:0
 #<!-- -->2 0x00007fb5b33b6420 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14420)
 #<!-- -->3 0x000055caf870ebfb mlir::SuccessorRange::SuccessorRange(mlir::Block*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x442cbfb)
 #<!-- -->4 0x000055caf847134b llvm::iterator_range&lt;llvm::po_iterator&lt;mlir::Block*, llvm::SmallPtrSet&lt;llvm::GraphTraits&lt;mlir::Block*&gt;::NodeRef, 8u&gt;, false, llvm::GraphTraits&lt;mlir::Block*&gt;&gt;&gt; llvm::post_order&lt;mlir::Block*&gt;(mlir::Block* const&amp;) (/data/bin1/llvm-project/build/bin/mlir-opt+0x418f34b)
 #<!-- -->5 0x000055caf87f90a3 mlir::RewriterBase::eraseOp(mlir::Operation*)::'lambda0'(mlir::Operation*)::operator()(mlir::Operation*) const (.isra.0) PatternMatch.cpp:0:0
 #<!-- -->6 0x000055caf87f9cb6 mlir::RewriterBase::eraseOp(mlir::Operation*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x4517cb6)
 #<!-- -->7 0x000055caf87f9b89 mlir::RewriterBase::eraseBlock(mlir::Block*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x4517b89)
 #<!-- -->8 0x000055caf86ab1db mlir::eraseUnreachableBlocks(mlir::RewriterBase&amp;, llvm::MutableArrayRef&lt;mlir::Region&gt;) (/data/bin1/llvm-project/build/bin/mlir-opt+0x43c91db)
 #<!-- -->9 0x000055caf86b376a mlir::simplifyRegions(mlir::RewriterBase&amp;, llvm::MutableArrayRef&lt;mlir::Region&gt;) (/data/bin1/llvm-project/build/bin/mlir-opt+0x43d176a)
#<!-- -->10 0x000055caf8694079 mlir::applyPatternsAndFoldGreedily(mlir::Region&amp;, mlir::FrozenRewritePatternSet const&amp;, mlir::GreedyRewriteConfig, bool*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x43b2079)
#<!-- -->11 0x000055caf85f8fea (anonymous namespace)::Canonicalizer::runOnOperation() Canonicalizer.cpp:0:0
#<!-- -->12 0x000055caf85d9f3e mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42f7f3e)
#<!-- -->13 0x000055caf85da41a mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&amp;, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42f841a)
#<!-- -->14 0x000055caf85dac44 mlir::PassManager::run(mlir::Operation*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42f8c44)
#<!-- -->15 0x000055caf85cb9b3 performActions(llvm::raw_ostream&amp;, std::shared_ptr&lt;llvm::SourceMgr&gt; const&amp;, mlir::MLIRContext*, mlir::MlirOptMainConfig const&amp;) MlirOptMain.cpp:0:0
#<!-- -->16 0x000055caf85cce84 processBuffer(llvm::raw_ostream&amp;, std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, mlir::MlirOptMainConfig const&amp;, mlir::DialectRegistry&amp;, llvm::ThreadPool*) MlirOptMain.cpp:0:0
#<!-- -->17 0x000055caf85cd034 mlir::LogicalResult llvm::function_ref&lt;mlir::LogicalResult (std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, llvm::raw_ostream&amp;)&gt;::callback_fn&lt;mlir::MlirOptMain(llvm::raw_ostream&amp;, std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, mlir::DialectRegistry&amp;, mlir::MlirOptMainConfig const&amp;)::'lambda'(std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, llvm::raw_ostream&amp;)&gt;(long, std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, llvm::raw_ostream&amp;) MlirOptMain.cpp:0:0
#<!-- -->18 0x000055caf86cc324 mlir::splitAndProcessBuffer(std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, llvm::function_ref&lt;mlir::LogicalResult (std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, llvm::raw_ostream&amp;)&gt;, llvm::raw_ostream&amp;, bool, bool) (/data/bin1/llvm-project/build/bin/mlir-opt+0x43ea324)
#<!-- -->19 0x000055caf85c5897 mlir::MlirOptMain(llvm::raw_ostream&amp;, std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, mlir::DialectRegistry&amp;, mlir::MlirOptMainConfig const&amp;) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42e3897)
#<!-- -->20 0x000055caf85cd181 mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&amp;) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42eb181)
#<!-- -->21 0x000055caf85cd5e6 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&amp;) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42eb5e6)
#<!-- -->22 0x000055caf5870a7b main (/data/bin1/llvm-project/build/bin/mlir-opt+0x158ea7b)
#<!-- -->23 0x00007fb5b2e82083 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24083)
#<!-- -->24 0x000055caf590975e _start (/data/bin1/llvm-project/build/bin/mlir-opt+0x162775e)
Segmentation fault (core dumped)

@EugeneZelenko EugeneZelenko removed the mlir label Dec 8, 2023
@kuhar kuhar self-assigned this Dec 8, 2023
@Anonymous15592 Anonymous15592 mentioned this issue Jan 9, 2024
Closed
@agentcooper
Copy link
Contributor

I couldn't reproduce this with an unregistered dialect. The following example has nested operations and works as expected:

func.func @func()  {
  cf.br ^bb4
^bb2:
  "dialect.op1" () ({
    cf.br ^bb3
  ^bb3:
    llvm.return
  }) : () -> ()
  cf.br ^bb4
^bb4:
  "dialect.op2" () ({
    "dialect.op3" () ({ }) : () -> ()
  }) : () -> ()
  llvm.return 
}
% ./bin/mlir-opt -allow-unregistered-dialect --canonicalize ./playground/custom.mlir
module {
  func.func @func() {
    "dialect.op2"() ({
      "dialect.op3"() ({
      }) : () -> ()
    }) : () -> ()
    llvm.return
  }
}

And if I replace spirv.Branch ^bb3 with cf.br ^bb3 in the original example, it also works as expected. So it looks like the problem is somehow related to how spirv.mlir.selection is defined.

@kuhar
Copy link
Member

kuhar commented May 19, 2024

This doesn't reproduce on ToM. Closing.

@kuhar kuhar closed this as completed May 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@kuhar kuhar

Labels
crash Prefer [crash-on-valid] or [crash-on-invalid] mlir:spirv
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@agentcooper @Lewuathe @joker-eph @kuhar @EugeneZelenko @llvmbot @Anonymous15592