[all-commits] [llvm/llvm-project] 839dc4: [mlir][bufferization] Fix use-after-free in owners...

[Mehdi Amini via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 839dc4f7cfff5d240cc9274696efb056dd3847cd
      https://github.com/llvm/llvm-project/commit/839dc4f7cfff5d240cc9274696efb056dd3847cd
  Author: Mehdi Amini <joker.eph at gmail.com>
  Date:   2026-03-05 (Thu, 05 Mar 2026)

  Changed paths:
    M mlir/include/mlir/Dialect/Bufferization/IR/BufferDeallocationOpInterface.h
    M mlir/lib/Dialect/Bufferization/IR/BufferDeallocationOpInterface.cpp
    M mlir/lib/Dialect/Bufferization/Transforms/OwnershipBasedBufferDeallocation.cpp
    M mlir/test/Dialect/Bufferization/Transforms/OwnershipBasedBufferDeallocation/dealloc-branchop-interface.mlir

  Log Message:
  -----------
  [mlir][bufferization] Fix use-after-free in ownership-based buffer deallocation (#184118)

When `handleInterface(RegionBranchOpInterface)` processes an op such as
`scf.for`, it calls `appendOpResults` to clone the op with extra
ownership result types and erase the original. The `Liveness` analysis
is computed once before the transformation begins and may still
reference the old (now-freed) result values.

If the same block contains a `BranchOpInterface` terminator (e.g.,
`cf.br`) after the structured loop, `handleInterface(BranchOpInterface)`
calls `getMemrefsToRetain`, which iterates `liveness.getLiveOut()`. That
set may contain stale `Value` objects pointing to the erased op's
results. Calling `isMemref()` on such a value dereferences freed memory,
triggering a crash.

Fix by adding a `valueMapping` map to `DeallocationState`. Before
erasing the old op in `handleInterface(RegionBranchOpInterface)`, record
the old-to-new result mapping via `state.mapValue`. The
`getLiveMemrefsIn` and `getMemrefsToRetain` helpers translate stale
liveness values through this map before calling `isMemref`, so they
always operate on live pointers.

Fixes #119863

Assisted-by: Claude Code



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications