<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/64727>64727</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [mlir][SparseTensor] Invalid free
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          banach-space
      </td>
    </tr>
</table>

<pre>
    Hi,

This is a direct follow-up of the discussion in https://reviews.llvm.org/D158012. There seem to be some cases of "double free" in the SparseTensor compiler. To reproduce (tested on AArch64, using SHA: af315097c6d9):

```mlir
mlir-opt /llvm-project/mlir/test/Integration/Dialect/SparseTensor/CPU/sparse_pack_libgen.mlir --sparse-compiler="enable-runtime-library=false" | /llvm-project/build/release/bin/mlir-cpu-runner -e entry -entry-point-result=void -shared-libs=llvm-project/build/release/lib/libmlir_c_runner_utils.so,/llvm-project/build/release/lib/libmlir_runner_utils.so
```

This crashes for me with the following message:
```
0.      Program arguments: /llvm-project/build/release/bin/mlir-cpu-runner -e entry -entry-point-result=void -shared-libs=/llvm-project/build/release/lib/libmlir_c_runner_utils.so,/llvm-project/build/release/lib/libmlir_runner_utils.so
 #0 0x0000ffff867f8a10 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (llvm-project/build/release/bin/../lib/libLLVMSupport.so.18git+0x1e8a10)
 #1 0x0000ffff867f6a10 llvm::sys::RunSignalHandlers() (/llvm-project/build/release/bin/../lib/libLLVMSupport.so.18git+0x1e6a10)
 #2 0x0000ffff867f8e30 SignalHandler(int) Signals.cpp:0:0
 #3 0x0000ffff913988fc (linux-vdso.so.1+0x8fc)
 #4 0x0000ffff861df200 __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #5 0x0000ffff8619a67c gsignal ./signal/../sysdeps/posix/raise.c:27:6
 #6 0x0000ffff86187130 abort ./stdlib/abort.c:81:7
 #7 0x0000ffff861d3308 __libc_message ./libio/../sysdeps/posix/libc_fatal.c:153:6
 #8 0x0000ffff861e957c ./malloc/malloc.c:5668:3
 #9 0x0000ffff861eb8b4 _int_free ./malloc/malloc.c:4687:2
#10 0x0000ffff861edc84 __libc_free ./malloc/malloc.c:3394:3
#11 0x0000ffff91173318
#12 0x0000ffff91173388
#13 0x0000ffff9114edec compileAndExecute((anonymous namespace)::Options&, mlir::Operation*, llvm::StringRef, (anonymous namespace)::CompileAndExecuteConfig, void**, std::unique_ptr<llvm::TargetMachine, std::default_delete<llvm::TargetMachine>>) JitRunner.cpp:0:0
#14 0x0000ffff9114b4d4 compileAndExecuteVoidFunction((anonymous namespace)::Options&, mlir::Operation*, llvm::StringRef, (anonymous namespace)::CompileAndExecuteConfig, std::unique_ptr<llvm::TargetMachine, std::default_delete<llvm::TargetMachine>>) JitRunner.cpp:0:0
#15 0x0000ffff91149c28 mlir::JitRunnerMain(int, char**, mlir::DialectRegistry const&, mlir::JitRunnerConfig) (/llvm-project/build/release/bin/../lib/libMLIRJitRunner.so.18git+0x19c28)
#16 0x0000aaaab4952de0 main (//llvm-project/build/release/bin/mlir-cpu-runner+0x12de0)
#17 0x0000ffff861873fc __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#18 0x0000ffff861874cc call_init ./csu/../csu/libc-start.c:128:20
#19 0x0000ffff861874cc __libc_start_main ./csu/../csu/libc-start.c:379:5
#20 0x0000aaaab4952c30 _start (/llvm-project/build/release/bin/mlir-cpu-runner+0x12c30)
Aborted (core dumped)
```

>From the [buildbot](https://lab.llvm.org/buildbot/#/builders/179/builds/7122):
```bash
SUMMARY: AddressSanitizer: double-free /home/tcwg-buildslave/workspace/tcwg-llvm-release/tcwg-jade-03/final/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 in __interceptor_free
```

Note that in order to trigger this, you will need to set `--sparse-compiler="enable-runtime-library=false"` (i.e. to use the so called "direct IR generation").

-Andrzej
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzMWFtv4zjS_TX0CyFDIiVLesiDOx6j-0Pn20aSGWCfBIosyeymSC1J5TK_fkHK96R7emaxiwEcW-Hl1KnDYhUp5pzsNcANKj6gYrNgk98Ze9MyzfgucSPjsGiNeL35KBG5RekGpev5-3EnHZYOMyykBe5xZ5Qyz8k0YtNhvwMspOOTc9JoLDXeeT86RNeIbBHZWniS8OyWSj0NS2N7RLabrKjSjCzx4w4sYAcwYG9wC9iZATBnDlyARoQIM7UKcGcBECEBPdh7GJl18AjaGYu5GUapwC7xo8EWRmvExAEjUnlwHgQ2Gq_Xlu9WOSK3eHJS9_jh4xrRNWYdzYq0LvlK1IjUgfSZ42iVzp9BSTs3hafEjB4jsg0eJaM1X4F7RLZxENkGo4hsP2kPvWVeGh08lkzNo86pI7K9_fIrIlsXG5uR8W-Nkm0PehnQcJLMPcnBR0Q3iBDQrFWQ2El7OUCiZGuZfUV00zHlok6ovH2HYTtJJeKSKGBh4LaVes884eMUEDVYnAAG7e0rTuJPMhqpfWLBTcojunkyUuDE7ZgFEYw7RDd_aEnJdv4OxhrezKaayUvlls6EkPsJvpco1xiXi_YmhLllbgcOd8biAfCz9LsYTXM4h6gYwDnWwykMLrHSJUrrL9b0lg2Y2X4aQPsQ6f9brf-8UP9FuTEiNMXpS5qmadd1XbUqu4plKQ7gQUi6dq9ufvhipfYPnvFvj5ZxQKQ6DbLsuTHOW2ADIquwUaX2iNR4P-onpF0uzyl__vzb3cM0jsb6pTPLrOqlR-RD-pJB4Bd2-9GB7MqB1XccuJ_0g-w1Ux-ZFgqsQ6Tac_z5CPhpmqtrmuRaZ6ApviCESLWXbW52Sz6OiK7T-HcEomdAdUbrqup4FFrq6SV5Es5ELpFH1fELEvkFiUx0JE1x04x-Z4GJ5ptUqpHDqCBsjpj_cHBYj14hsj0ftuSIrvMc0XW5OuEXl_g1W5Uc9y66E5Hmx4OQ7tUJGF2ANk6-BL2ZdBCxSYno-gx6dQldlRlNMWuN9TOwF_OyxKaIUGWB3QmhvHKe0rTCTcjZvNknD7xfXmm-TzGO75hnswZZQS-JVpdmoC5KHnEHppThx4c4u1itKkTX9DS9vpreVm2OG6l9E-rod4HyVRUEI_vcR2iWXgEJXuUHd38IRWmdnzgFqOwi5LKS0qw69ZI3vdVZ72W4ZjkI4Ieyv9bilxfgk4e4CSumjX4dzOSwZgPEY82-sNP1P8YQjm6fX2K93rfDoVKvQ89p5z94K3V_D11o_gP022tCt0Z3sg8zQxaP2BHeeTHPmLT81wTN6C2ityejj8z24O8Y30kNFxMEdGxSvhGgwMMPJtFfwofU-P-kv49p-20iCMrmV8q2ucjfKvubkWI7aT5L9LdV-W-ka3Gla81JdSbFcfYdCyVhztm3mO-YPYXJafj-9HgPvXThqMCNDmfMK32PoAdF_qO6dPf50_3JycvKFLw51oTg7iGxMsZYm9cFEZDigUm9Z_CXj0ezvQB3Ya-8TuS044e85DyzvuFMqSYyCF5xN71NxvuK9N6k5S6k_asMVl0bzTnHcYrU0l_bmR8DeBLB50RPQqYmZ4FSvwd64cl7TrwLTsuwRYojNkmvV4XTFM-ofy4y3l8UTk-Lsg4VE0SA5cYCFtMwgjit2Xtn8q01Qzx_o-JDtNwaj4oNItXlBVKx9vzyeBwaOumhIZ7FtllZHxrCv2VGyMWt7kCjZW43Nz38ene3vv9nOMOvhbDg3APT0svfw11rjefrZxJrHSLbnRmCKp4_98lsRbGn0PJs7Ld9npp7o7InHWPbVyYgSQPlTs4nmCv9D7e8xPrjVmSO6f1PMxfYJp7S9nmnIGHlw724CQUeLIfRGxur8w-0_3_jAfsd82GmsQJsuIB7K_s-PO6kC7nl1Uz4WSqFNYAIAxx4jFbpX72WolUaIkQuYRnQJgdx_Z2J2yiGD9m_Yvh0j3vQx4IRlnF57kCy1sL-Dl8X4oaKmtZsATfZqiZZWeVlvtjdpHUl8opkrMuyomU1oyWrS1G3RbeCtC0X8oakhKZVtkprmtN8WRS0ppSBIBUAA0B5CgOT6hh8C-ncBDervCTlQrEWlIsvUwjR8IxjZ2BabBb2Jq5sO_UO5amSzp_efyy89Cq-hYmpu9ig4sPFS4Figz_pJ6akiK89FpNVN5c7opd-N7VLboZ9DL0Npcgm7IHI9t8BAAD__5YXnK0">