<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/98008>98008</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [mlir] Transform interpreter crashes on `tile_using_for` for specific tiling sequence
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            mlir
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
            ubfx
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          ubfx
      </td>
    </tr>
</table>

<pre>
    Just stumbled on this, crashing when running the transform interpreter on it.

```mlir
module attributes {transform.with_named_sequence} {
  transform.named_sequence @__transform_main(%arg0: !transform.any_op {transform.readonly}) {
    %0 = transform.structured.match ops{["linalg.depthwise_conv_2d_nhwc_hwc"]} in %arg0 : (!transform.any_op) -> !transform.any_op
    %tiled_linalg_op, %loops = transform.structured.tile_using_for %0 tile_sizes [0, 4, 1, 4, 3, 1] interchange = [] : (!transform.any_op) -> (!transform.any_op, !transform.any_op)
    %tiled_linalg_op_0, %loops_1 = transform.structured.tile_using_for %tiled_linalg_op tile_sizes [0, 1, 0, 0, 1, 0] interchange = [] {"alloc-levels" = array<i64: 2, 1, 1>} : (!transform.any_op) -> (!transform.any_op, !transform.any_op)
    transform.yield 
  }
  func.func @main(%arg0: tensor<1x66x66x16xi8>, %arg1: tensor<3x3x16xi8>, %arg2: tensor<1x64x64x16xi64>) -> tensor<1x64x64x16xi64> {
    %0 = linalg.depthwise_conv_2d_nhwc_hwc {dilations = dense<1> : tensor<2xi64>, strides = dense<1> : tensor<2xi64>} ins(%arg0, %arg1 : tensor<1x66x66x16xi8>, tensor<3x3x16xi8>) outs(%arg2 : tensor<1x64x64x16xi64>) -> tensor<1x64x64x16xi64>
    return %0 : tensor<1x64x64x16xi64>
  }
}
```

stacktrace:
```
❯ ~/.local/bin/mlir-opt --transform-interpreter dw1_crash.mlir                                                                                                                                                                                                    ─╯
realloc(): invalid pointer
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /user/fschneider/.local/bin/mlir-opt --transform-interpreter dw1_crash.mlir
 #0 0x0000558402939e08 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/user/fschneider/.local/bin/mlir-opt+0x2f97e08)
 #1 0x0000558402937a3e llvm::sys::RunSignalHandlers() (/user/fschneider/.local/bin/mlir-opt+0x2f95a3e)
 #2 0x000055840293a7aa SignalHandler(int) Signals.cpp:0:0
 #3 0x00007fa812a54db0 __restore_rt (/lib64/libc.so.6+0x54db0)
 #4 0x00007fa812aa154c __pthread_kill_implementation (/lib64/libc.so.6+0xa154c)
 #5 0x00007fa812a54d06 gsignal (/lib64/libc.so.6+0x54d06)
 #6 0x00007fa812a287f3 abort (/lib64/libc.so.6+0x287f3)
 #7 0x00007fa812a29130 _IO_peekc_locked.cold (/lib64/libc.so.6+0x29130)
 #8 0x00007fa812aab617 (/lib64/libc.so.6+0xab617)
 #9 0x00007fa812aafe0c __libc_realloc (/lib64/libc.so.6+0xafe0c)
#10 0x00005584028f98a2 llvm::SmallVectorBase<unsigned int>::grow_pod(void*, unsigned long, unsigned long) (/user/fschneider/.local/bin/mlir-opt+0x2f578a2)
#11 0x00005584032cb96c mlir::transform::TileUsingForOp::apply(mlir::transform::TransformRewriter&, mlir::transform::TransformResults&, mlir::transform::TransformState&) (/user/fschneider/.local/bin/mlir-opt+0x392996c)
#12 0x000055840326aae0 mlir::transform::detail::TransformOpInterfaceInterfaceTraits::Model<mlir::transform::TileUsingForOp>::apply(mlir::transform::detail::TransformOpInterfaceInterfaceTraits::Concept const*, mlir::Operation*, mlir::transform::TransformRewriter&, mlir::transform::TransformResults&, mlir::transform::TransformState&) DialectExtension.cpp:0:0
#13 0x000055840724c8e1 mlir::transform::TransformState::applyTransform(mlir::transform::TransformOpInterface) (/user/fschneider/.local/bin/mlir-opt+0x78aa8e1)
#14 0x000055840484d3f1 applySequenceBlock(mlir::Block&, mlir::transform::FailurePropagationMode, mlir::transform::TransformState&, mlir::transform::TransformResults&) TransformOps.cpp:0:0
#15 0x0000558404851ce4 mlir::transform::NamedSequenceOp::apply(mlir::transform::TransformRewriter&, mlir::transform::TransformResults&, mlir::transform::TransformState&) (/user/fschneider/.local/bin/mlir-opt+0x4eafce4)
#16 0x00005584047f6630 mlir::transform::detail::TransformOpInterfaceInterfaceTraits::Model<mlir::transform::NamedSequenceOp>::apply(mlir::transform::detail::TransformOpInterfaceInterfaceTraits::Concept const*, mlir::Operation*, mlir::transform::TransformRewriter&, mlir::transform::TransformResults&, mlir::transform::TransformState&) TransformDialect.cpp:0:0
#17 0x000055840724c8e1 mlir::transform::TransformState::applyTransform(mlir::transform::TransformOpInterface) (/user/fschneider/.local/bin/mlir-opt+0x78aa8e1)
#18 0x00005584072591ae mlir::transform::applyTransforms(mlir::Operation*, mlir::transform::TransformOpInterface, mlir::RaggedArray<llvm::PointerUnion<mlir::Operation*, mlir::Attribute, mlir::Value>> const&, mlir::transform::TransformOptions const&, bool) (/user/fschneider/.local/bin/mlir-opt+0x78b71ae)
#19 0x000055840488ad95 mlir::transform::applyTransformNamedSequence(mlir::RaggedArray<llvm::PointerUnion<mlir::Operation*, mlir::Attribute, mlir::Value>>, mlir::transform::TransformOpInterface, mlir::ModuleOp, mlir::transform::TransformOptions const&) (/user/fschneider/.local/bin/mlir-opt+0x4ee8d95)
#20 0x0000558404886a1e (anonymous namespace)::InterpreterPass::runOnOperation() InterpreterPass.cpp:0:0
#21 0x00005584051ea432 mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) (/user/fschneider/.local/bin/mlir-opt+0x5848432)
#22 0x00005584051edbb7 mlir::PassManager::run(mlir::Operation*) (/user/fschneider/.local/bin/mlir-opt+0x584bbb7)
#23 0x00005584051e5bf6 performActions(llvm::raw_ostream&, std::__1::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) MlirOptMain.cpp:0:0
#24 0x00005584051e58e0 llvm::LogicalResult llvm::function_ref<llvm::LogicalResult (std::__1::unique_ptr<llvm::MemoryBuffer, std::__1::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::__1::unique_ptr<llvm::MemoryBuffer, std::__1::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_0>(long, std::__1::unique_ptr<llvm::MemoryBuffer, std::__1::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&) MlirOptMain.cpp:0:0
#25 0x0000558405278722 mlir::splitAndProcessBuffer(std::__1::unique_ptr<llvm::MemoryBuffer, std::__1::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::__1::unique_ptr<llvm::MemoryBuffer, std::__1::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) (/user/fschneider/.local/bin/mlir-opt+0x58d6722)
#26 0x00005584051e1658 mlir::MlirOptMain(llvm::raw_ostream&, std::__1::unique_ptr<llvm::MemoryBuffer, std::__1::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) (/user/fschneider/.local/bin/mlir-opt+0x583f658)
#27 0x00005584051e18e7 mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) (/user/fschneider/.local/bin/mlir-opt+0x583f8e7)
#28 0x00005584051e1b0a mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) (/user/fschneider/.local/bin/mlir-opt+0x583fb0a)
#29 0x00005584028e6fa7 main (/user/fschneider/.local/bin/mlir-opt+0x2f44fa7)
#30 0x00007fa812a3feb0 __libc_start_call_main (/lib64/libc.so.6+0x3feb0)
#31 0x00007fa812a3ff60 __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x3ff60)
#32 0x00005584028e6be5 _start (/user/fschneider/.local/bin/mlir-opt+0x2f44be5)
[1]    3032759 IOT instruction (core dumped)  ~/.local/bin/mlir-opt --transform-interpreter dw1_crash.mlir
```

</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzsWklv4zj2_zTMhYghUfshB2fx_1-DyiSoVPdVoKQnmVM0qSapLHOYzz4g5UV07KzdjUJhCi7Hot76ewspUlRr1gmAM5ScI0KGqn1EhKDk8oQOZinVmR05qWTzdPaPQRuszbCqODRYCmyWTCNygWtF9ZKJDj8sQWA1CGEvzBKwUVToVqoVZsKA6hUYUJaVmRkKLlEwX3-nwfhZcabGoZVsBg6YGqNYNRjQGGXnW3mzB2aWpaAraEoNfwwgakDZpaUZ2fFO98wnwygOynJ7t1xRJhDJEUmo6gIUzTEi4Y6ZiqdS9r5yBbSRgj-h7BKRYqoUY0SSAKPocqJfGzXUZlDQzFbU1Esse215HOKcCcq7WQO9WT4wDWUtxX1JmlIsH-py-VCP4bDOMYHXVuLRzPyApdagUxRdHfLCs9IwDk05qnd8F3aUS9nr4_ZbpnLQTHRlK9XorBvT7N82RMl5YAXF9ivc_orGy-RyTIN6SUUHTonFILl8mzuHb18cdJQUL_laBlNvy_A9_u6JOuS9czzYfq0vX_A-s4lAOZf1KYd74BoR4gioUvQJRRcsjS1EZCsuRNGVy_e_ErjdzScGvMGbOzbt1z_bQdQz-2Wr6nklGRBaKhRdhI9paj9h-shya_uIP1Vd6NFFj9EBGrIvK7YfS2dxudq6epzkSI2-WnyWr2GcGibFWBYNCA1WhZM6tYtszbnA2ijWwJs5XHHrCXY7ePCrOB4Br8ByMDuZ5Jmgd4O4A1CBGZTY4Pii2P2c2f3Y9PzpRKANrX8YRWtA0f7csL68Iqi4RPMF_g8iixmXNeWILCqbegs7fZzK3uDT023ynk6nnuYhLN10NbOk-Bf45_CIUR64HwmaL0acFLiG4uJf2BgxcU85a3AvHSAj1e3Xq_ndFdZDtWIGU1wNHVbQS2WwkXhpTK9tIMgCkUXHzHKoZrVcIbLg_H7z57RX8l9QG0QWTOsBNCILTEWDmaj50IBbCTjQcbWJ7nr2v7Phxs2w6rfhDmajX7dKdoquMFXdsAJh9NjqFoMGhcii1fVSAGvcxeeyYJ2iiEQBDh6DIAiSJI8DUkQFBDl2nkZzFM31kx5_3ComjLP9u0tVku-IFH0opTYK6AqR1NYnE8atEmwk3mM-IufBI2mLDIJ815cRicI9MzMawSEzvw3ijnWC8v-nouGgxmbwCUsSGoFnCdmzhGaUYk8nIvna_3FYz-reBjtw_7eCorWgrKV5SGgSN1WAy1KBNlJBqczaaM6qNB7_1jMtZ6kzzZF7hsW-PBomcY3LsjdLu3YrfzDOS7bqOdjUct39RQWO31OQPDM4SHGnnY-v2RqknqjUF0XyrI0wreQrTjs6T1C2J6gIowCXX27KHuBHXXJZ_4BmVks7lb8k2PJ5gvM9NKs0zF7Gy1J4Ioo9ES0ENiCWrVy3qpclWoatRFsEfrHmbZFTMqmCuxXl_HeojVTn1M2_g3CPOo0ryOhqJOuUfCh72SCS30vWIDK3Jbsl5VJ0BwY-XkNJllPi-eFVc0Tqqkhr7PqSM3DbwcbL74zDb3Y9upDqph_HaN_zJ0Ty40yby2_woJht_mNneguDHrhdRbyR_s5QA476oxBFBSmK1A818SFKKYXguDENGMr4nmE3_Rc7AbS0hu2P74oys-6V17IBjqKLNwN_9UbsP2TNhRQ19AbXUmizzsmdhpselOtZz-78FHG_ZJRDba4e7aqQSfG849uYRtOYZiSucwjfrGgH_fbGm_J_gvvHMzTLKc0h9DI0nnoT53ETtSF2Bt6ttx3Obfv1jFyPvIzwgjI-KLhVsqedC7rN1PcG5b0hL_AEsgNTtnU58V1Owhri42r-SVfQbLD4JRtXDLStIfbSIvUwyto0jf72xvUM-f91rmOB3w6uW9jhxM9-qc6V-94kRUjhuDe-5doz_f3B9ZyaMnyjXQfNfL37tVvU3Y7Prr8Jq2Wa88d1zzcbyP7w75QP4GrhapOrb0yYm37cDJpyVVLyz4SlykIKXlgKv7vmtCmSt4bFq3gvRH8rrp_MgWt3AHDTfzQqH-_jkDdFMo0GCfaikdIQrHgqpHhayUFjQVeg-7E6R9O-7DYcbqlet0c1iBsxAdU9j-9RHuw6xHtMSEKgcUQmuEyb9U3_Xd70VtS8ob2RaqvbSwZn1ds79FxQ_qSZvqaCdhbFTdpPno4-tdWR5HEeR97DESF7XjdVlWHfhY09B3303fmEZVVVZZ5l0Z5lSdWmuAdlk3Feu2R8ZV9Im2a8VZbheudmSRU0ZW-UV513clA1XHfqeLO6_vrl24UUBh6fT7rXnKmb3lxTJi6kaFnnFcnk7uHEi_cdzSGYPGd_lR2rKR-n3cl4OwiHQqmg9bzxGRDJn-MwCPbHAM9wuIaVVE_nQ9uO6fecsYGWDtyUDXCwk-0x5m1_Oh6fYrtQqinnFa1_lK3fGyfIvTvSf5-HO3vXi5pv0DFt1NPzHHopT0YSROIycILzzc7ITxq91_Pae35JSJZnZNpQdc-ZmYvmVskatN7Y_ZNk6y9RXS9STO_dGcVE9w3ao8Mf7-xNmhF_zkn3Gl6YJvnhMvn1y_7DsEZtmuQerNk-rDlkR2F1C4kLXC-pcvPZ_L0J8RoCn_EsB38pkO97VgX0T_Hsr3OhCqjnQuFvpkPa0gyvKBMf3uiO45Z6MG1P19ZHAFEL7ozHHQFoQ5Up7UxbTrQePgpwjJ7kcF9ym-5Jdq8mxMH_ff1yflGSGZklr6hoU18F2QeoggSPwj8BUQWT54zk3L0igzGOgohkSYG_3HzHTIyvo6yPqGqpwB2YQmMz4E84BD94yn7SnEVNERX0BM7CjARxlCRxdLI8q8M2i6qAxm0WtLQqKkriNgKgTU6jBMITdkYCEgdZkIdBnMTRLGtbgLCNEsjitI1bFAewoozPbNLPpOpO3KnxWZEHQX7CaQVcr99Gc-aNb6OpM3fUXA2dRnHAmTZ6J8Aww90bbI4hudxt5HjvnTmfQWOLZBr4r_agNMCtVFj3ULOW1dgwzkSHN2-NnQyKn338PHx07v6M_DcAAP__9aoASA">