[all-commits] [llvm/llvm-project] cd9963: [mlir][bufferization] Fix stale BufferOriginAnalys...

[Vito Secona via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: cd99637821097c239b665793243d8e6a332fc719
      https://github.com/llvm/llvm-project/commit/cd99637821097c239b665793243d8e6a332fc719
  Author: Vito Secona <77039267+secona at users.noreply.github.com>
  Date:   2026-07-19 (Sun, 19 Jul 2026)

  Changed paths:
    M mlir/lib/Dialect/Bufferization/Transforms/BufferDeallocationSimplification.cpp
    M mlir/test/Dialect/Bufferization/Transforms/buffer-deallocation-simplification.mlir

  Log Message:
  -----------
  [mlir][bufferization] Fix stale BufferOriginAnalysis in BufferDeallocationSimplification (#210105)

Fixes #205228

This change fixes a use-after-free bug in the
BufferDeallocationSimplification pipeline caused by the greedy pattern
rewriter deleting operation tracked by the BufferOriginAnalysis.
BufferViewFlowAnalysis (internally used by BufferOriginAnalysis) creates
the dependencies map once during initialization. In this specific case,
the folder removed the `memref.cast` ops making later uses a
use-after-free bug.

Below is the snippet of running the pass using
`-debug-only=greedy-rewriter`. It erases a `memref.cast` and crashes in
RemoveDeallocMemrefsContainedInRetained.

```
...
[greedy-rewriter:1] //===-------------------------------------------===//
[greedy-rewriter:1] Processing operation : 'memref.cast'(0x654d43d18670) {
[greedy-rewriter:1]   %4 = "memref.cast"(%3) : (memref<?x?xf32, 1>) -> memref<4x4xf32, 1>
[greedy-rewriter:1] 
[greedy-rewriter:1] } -> success : operation was folded
[greedy-rewriter:1] //===-------------------------------------------===//
[greedy-rewriter:1] ** Replace : 'memref.cast'(0x654d43d18670)
[greedy-rewriter:1] ** Modified: 'scf.yield'(0x654d43c97bb0)
[greedy-rewriter:1] ** Erase   : 'memref.cast'(0x654d43d18670)
...
[greedy-rewriter:1] Processing operation : 'bufferization.dealloc'(0x654d43cbd7d0) {
[greedy-rewriter:1]   %5 = "bufferization.dealloc"(%4#0, %1, %3) <{operandSegmentSizes = array<i32: 1, 1, 1>}> : (memref<f32, 1>, i1, memref<4x4xf32, 1>) -> i1
[greedy-rewriter:1] 
[greedy-rewriter:1] 
[greedy-rewriter:1]   * Pattern (anonymous namespace)::RemoveDeallocMemrefsContainedInRetained : 'bufferization.dealloc -> ()' {
```

The fix is to disable folding and split the canonicalization patterns to
run separately. This way, the patterns that rely on BufferOriginAnalysis
still work because folding was disabled and BufferOriginAnalysis never
invalidated. Then, the canonicalization patterns still benefit from
folding.



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications