<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/126213>126213</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [mlir] Crash in UseDefLists.h:198 when using --canonicalize
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            mlir
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          wangyongj1a
      </td>
    </tr>
</table>

<pre>
    I have the following MLIR program:
test.mlir:
```
module {
  func.func @func1() {
    %c0 = arith.constant 0 : index
    %c1 = arith.constant 1 : index
    %true = arith.constant true
    %alloc = memref.alloc() : memref<1x1x1xi1>
    cf.cond_br %true, ^bb1, ^bb2
  ^bb1:  // pred: ^bb0
 cf.br ^bb3(%true : i1)
  ^bb2:  // pred: ^bb0
    cf.br ^bb3(%true : i1)
  ^bb3(%0: i1):  // 2 preds: ^bb1, ^bb2
    cf.br ^bb4
  ^bb4:  // pred: ^bb3
    cf.br ^bb5
  ^bb5:  // 2 preds: ^bb4, ^bb6
    cf.cond_br %0, ^bb6, ^bb7
  ^bb6:  // pred: ^bb5
    memref.store %true, %alloc[%c0, %c0, %c0] : memref<1x1x1xi1>
    cf.br ^bb5
  ^bb7:  // pred: ^bb5
 cf.br ^bb8(%c0, %true : index, i1)
  ^bb8(%1: index, %2: i1):  // 2 preds: ^bb7, ^bb9
    %3 = arith.cmpi slt, %1, %c1 : index
    cf.cond_br %3, ^bb9, ^bb10
  ^bb9:  // pred: ^bb8
    %4 = arith.addi %1, %c1 : index
 cf.br ^bb8(%4, %2 : index, i1)
  ^bb10:  // pred: ^bb8
    vector.print %2 : i1
    return
  }
}
```
The above MLIR program will cause a crash when using the following command:
```
mlir-opt --canonicalize test.mlir
```
And the crash backtrace is:
```
mlir-opt: /data/tmp/v0207/llvm-project/mlir/include/mlir/IR/UseDefLists.h:198: mlir::IRObjectWithUseList<OperandType>::~IRObjectWithUseList() [with OperandType = mlir::OpOperand]: Assertion `use_empty() && "Cannot destroy a value that still has uses!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /data/tmp/v0207/llvm-project/build/bin/mlir-opt --canonicalize test.mlir
 #0 0x0000562b4a35d1df llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x170a1df)
 #1 0x0000562b4a35a234 SignalHandler(int) Signals.cpp:0:0
 #2 0x00007f84c1438420 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14420)
 #3 0x00007f84c0f0500b raise (/lib/x86_64-linux-gnu/libc.so.6+0x4300b)
 #4 0x00007f84c0ee4859 abort (/lib/x86_64-linux-gnu/libc.so.6+0x22859)
 #5 0x00007f84c0ee4729 (/lib/x86_64-linux-gnu/libc.so.6+0x22729)
 #6 0x00007f84c0ef5fd6 (/lib/x86_64-linux-gnu/libc.so.6+0x33fd6)
 #7 0x0000562b4d5511d7 mlir::Block::~Block() (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x48fe1d7)
 #8 0x0000562b4d551651 mlir::Block::erase() (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x48fe651)
 #9 0x0000562b4d641fce mlir::RewriterBase::inlineBlockBefore(mlir::Block*, mlir::Block*, llvm::ilist_iterator<llvm::ilist_detail::node_options<mlir::Operation, true, false, void, false, void>, false, false>, mlir::ValueRange) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x49eefce)
#10 0x0000562b4aa0e048 mlir::cf::BranchOp::canonicalize(mlir::cf::BranchOp, mlir::PatternRewriter&) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x1dbb048)
#11 0x0000562b4aa05d6f mlir::detail::OpOrInterfaceRewritePatternBase<mlir::cf::BranchOp>::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&) const (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x1db2d6f)
#12 0x0000562b50fc43d8 mlir::PatternApplicator::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&, llvm::function_ref<bool (mlir::Pattern const&)>, llvm::function_ref<void (mlir::Pattern const&)>, llvm::function_ref<llvm::LogicalResult (mlir::Pattern const&)>) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x83713d8)
#13 0x0000562b4d4c6120 (anonymous namespace)::GreedyPatternRewriteDriver::processWorklist() GreedyPatternRewriteDriver.cpp:0:0
#14 0x0000562b4d4c923b mlir::applyPatternsGreedily(mlir::Region&, mlir::FrozenRewritePatternSet const&, mlir::GreedyRewriteConfig, bool*) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x487623b)
#15 0x0000562b4d434a12 (anonymous namespace)::Canonicalizer::runOnOperation() Canonicalizer.cpp:0:0
#16 0x0000562b4d40cfb1 mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47b9fb1)
#17 0x0000562b4d40d44a mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47ba44a)
#18 0x0000562b4d40df84 mlir::PassManager::run(mlir::Operation*) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47baf84)
#19 0x0000562b4d3ff09b performActions(llvm::raw_ostream&, std::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) MlirOptMain.cpp:0:0
#20 0x0000562b4d3ffb02 processBuffer(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::MlirOptMainConfig const&, mlir::DialectRegistry&, llvm::ThreadPoolInterface*) MlirOptMain.cpp:0:0
#21 0x0000562b4d3ffd74 llvm::LogicalResult llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::'lambda'(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>(long, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&) MlirOptMain.cpp:0:0
#22 0x0000562b4d50876e mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x48b576e)
#23 0x0000562b4d3f6989 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47a3989)
#24 0x0000562b4d3ffee1 mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47acee1)
#25 0x0000562b4d4003a6 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47ad3a6)
#26 0x0000562b4a26f01b main (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x161c01b)
#27 0x00007f84c0ee6083 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24083)
#28 0x0000562b4a32daee _start (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x16daaee)
Aborted (core dumped)
```
My git version is 4d3148d92681c154de51379a0cf393f9af8e1d75.
</pre>
<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJzcWl1T4zjW_jXmRtUpSf6-4CIEeF-qmoKCnp3LlGwdJ5pWJK8kA5mL_e1bsp3YDglNz6RmZ7c_wJGOHj3n00d2mLVipQAug_gqiK8vWOPW2ly-MrXaarX6jbCLQvPt5R1asxdAbg2o0lLqV6FW6P7r3ROqjV4ZtgnCeYDnDqybbaQw3ccgwf0_PN9o3khAQXoV4DlCVaPKmf-Bggj73ySgWUDzvQBCAY1LjILwGjEj3HpWamUdUw75wTkSisPbSJQcEyXHRJ1p4JiwHx-kmJS6bMU2sDFQzdqBHctw3g8H4YK8-b-CBOFNv7ysPCpfFma3X0AXKIhvioLsr2gr3A-G_pLeBvQW1Qa4_9zOeNN5OI_kP4ctgZ0KcyRIQPMBiH4M1FH7JFY_jYepETZt0e0e_lCtyUbRABqdJBi-XxcP6-KPNo_2mydHHYBH87urdMBOTnKKe7g-AqzTBiYe7cPEZ4-P1n5sfBFffyJYjiicfkxqtCjr_LTfdPBnG_Z0cejYfgGZyAQ0pp_ydLo3YT4kSzjOp00tkJWuRyU7W7zPxamXwhHwPlvwQDs_aZFsIBKNiDDOxUcM3tsw2lniQ_sR_EMmL1A6bWa1EcqNAEk_bcA1RnWI6bWvlN3PUb38tgbECv0CkzKLXoWUqGSNBcRQaZhdo9c1KNRYX5Gn9bnUmw1T_EgtlsJ80bVDX76UTGklSibF74CG8j2VnyveQnf7Faz87gwrAQl7Grs1Cb3lzLGA3rpNHdDbF0xxGtBbKV82X2qjf4PSBfS23ZHeClXKhsMwcPcU0NtfLFxD9VVYZ2frIJyTPGvzqb_JhPO7p4fCA_0q3PoXC14yCBcPNRim-LdtDT7TWsl_HRPt63l89SrcGo2WdaV_v81D3c8F8bUnMLcWjBNaoSDBjYUlbGq33cHRJKAJCihdMKW0QxysM3qLGHphsvE3UuaQdd6Za2ZRY8EGlASUBjRFFRMS-CzA88evN_PnG2SbYiMcYqhoVshArY1DTqO1c3XrgTYQV8Ktm2JW6k1v4feGFtY2fqNbxBRHvb2Pedbv_exY-R3xZlN3TsYz1P557CORmVWzAeXsT3i6aITk_rdQvZt_FIYooCFG-A1jjOOEFhELY054hVoNW8_Yre0uHn22tbS_eSUCmg1Chr0utXUG2KZ1zgIJ5TpXZX-KfECv8BtJMSO86qtEQENyQJnRMELPYqWY_H-muAQT0Kxn0A3bWVl7S-P2f4dCe5S0yqKSRGEWUYyWSwPtjWhpXM9eiiKgt29ZskyiL1Ko5u3LSjXdRO3WBhifWT3DHdcoonhgGo73wBWOMS6QYcLCJ8BLD5u0sFGIcTHARhNYgCiLc1_PPsV5BEtpFucDbHwIm-5d-GnAlI4AkylgFVc8-TnAMKx4MgCmY8_zOCaEp6MyciV1-b0vR931rmKcIQyjrALC04FMdkgmiclxMmCYhXNzSWIycMknXJKIVCWMuDzBqxEOzJXn0Y4IJYWCluMVVNp4eofc6dyn8vHRIfmFFNYtPTpz2gTh4nCKg2NCdiNKc1jq2pd2G4SL8R3ArxdaefBdB1gxaduLFy34-4HwZjLWXXSDA_A__C3hiakVnM_6OUDlS6C3vq9H0xrKMOAoG1Eoq95-hqly_VD3o6OqPDH-O_GJPo_MOTBq59G23p6r0PKiwFE26EUO9Ip5Uo2ojB37UD-YO-XAVKyEnlxPtQu6xUf26HuIDXPleq54v35ilVGAzD9jkfbgeTa7UJ5Ug13oyC4xrsoo5Nl7QvO6lqLskuK82o3Tzx_v_cJldwIqtJZoAt0DdAbpjNMnyUkQn11_GmSY-KpXPs6fwDbSfQ73TBGdhSkJ-Siiw0mdjMqEUOy38rm43ejGIsU2YGvWpXfL8f8MAN9O_XBtxAv0OtRGl2Dtr9p8l0PTe3rVQS_iaUUHtHIaFqMYYHUtd1C2BRZyO7HjE6za4EmmwXNr9O-gpun4DG5k7rF0R7mXXmhViZUX8CHVhuXZbl5pQsNicEo81T6MGKE_cspiVD17-qZRD2qUSK0bJnJHLJ9M98ZlVZCTJe6bfqgfmbVzzup9WptGHYS0te-y-HR-zxWTWyvsPVNs5fN7Z_AFalT7_JCftZuO0iKvCjJYPz2wAI8i9tMWeBQ1-IbioKh50b1iydlNMq2T1t4p60x7btLmSCEdC3Q7dxM990dmQLk7Veldfpwx5tOCRREbrJ4dWr3KogOyO_WPRtnUemdkWWXRwHLaVoZVhfMC1WAqbTbzsuviPj4IWsf7g-SaGeDL2k1bxGfdmBLuVyYIb06Upfuvd08LrRy8uXdOvZfCPNTungnVFazxnQSNZt-nPsWHyhWYor6YXzVV1R4jP6Vbo8Q_G3in2z1stNnuoEbyHCrWSN8ZS3Bweo3vi24-r_BY7lowCaXz9wXrzPZd2_CtPbg-ai33XVsfSR8bjRwajacROnWr_yO9wV9n1NOuzfcdacmkLFj5fVmpSQs7MtLfMEiOO_-TWdOJBDSVbFNwFtD07-QVmkmtVn-tYT-g9INsodNHBDhLk_Gx3NZSuLnijwdF5z-h2n9hhn4oMZ57dkao1RNUJ4fP1toWcZoMTwZoeFAukzzLjyfi_1oZOVdHwsI8yweDRof3HwBy0qB9k1iuWdcOzn82LH5kjfNpWQIMPTk9OBFhHLLkLFr-VerwkCWDOpNDFqNJhUmBNkyoMz2fSUiJyXCgpOnBg-wEZyFaLqUoyqV1zLjlaPPPPtqOcBYOW2TTdxCUMwDUgZ9LKc4Y9KVkXmjjoH0mU2oD7Ysj4D2b0fvB-y1aCYdewFihFRIWRTwkUcZzmmSkJHHEISZhmjNcVmEeVjmrMiA8jWcX_DLkeZizC7gkaZjllGRpfLG-BMzLKorzMsswlIRlPIUciizJiggzml-IS4pp7BXEeUxIPCvTKC1IxlgJrKgyFkQYNkzImdd-ps3qon1XdkloQkl4IVkB0rZfkqG0eztJg_j6wly21iqalQ0iLNuXlHsEJ5xsv1jTLoiv0aJ9ySYUOvJOc_wWd_o67KIx8vKPv-rrNXi5pP8OAAD__xFizss">