[all-commits] [llvm/llvm-project] ee8259: [mlir][sparse] Fix use-after-free crash in SparseS...

[Mehdi Amini via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: ee8259dcca82849735225c8ea1b215ed7fef7648
      https://github.com/llvm/llvm-project/commit/ee8259dcca82849735225c8ea1b215ed7fef7648
  Author: Mehdi Amini <joker.eph at gmail.com>
  Date:   2026-03-03 (Tue, 03 Mar 2026)

  Changed paths:
    M mlir/lib/Dialect/SparseTensor/Transforms/SparseSpaceCollapse.cpp
    M mlir/test/Dialect/SparseTensor/sparse_space_collapse.mlir

  Log Message:
  -----------
  [mlir][sparse] Fix use-after-free crash in SparseSpaceCollapsePass (#184001)

The `SparseSpaceCollapsePass::runOnOperation()` was calling
`collapseSparseSpace()` inside the `func->walk(...)` callback. The
collapse erases the outer `IterateOp` (and all its nested ops including
inner `ExtractIterSpaceOp`s), while the walk iterator still holds a
reference to one of those nested ops as its current position. The walk
then tries to advance to the next op, which has already been freed,
causing a segfault.

Fix this by collecting all collapsable groups during the walk without
mutating the IR, then processing them after the walk completes.

Fixes #130021



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications