[all-commits] [llvm/llvm-project] 3d6ae4: [MLIR] Fix infinite loop in tryFold in Graph Regio...

[Mehdi Amini via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 3d6ae4bdf4c6d45d5e2f2c55c06f84568fde0fe0
      https://github.com/llvm/llvm-project/commit/3d6ae4bdf4c6d45d5e2f2c55c06f84568fde0fe0
  Author: Mehdi Amini <joker.eph at gmail.com>
  Date:   2026-09-11 (Fri, 11 Sep 2026)

  Changed paths:
    M mlir/lib/IR/Builders.cpp
    M mlir/test/Transforms/test-legalizer.mlir

  Log Message:
  -----------
  [MLIR] Fix infinite loop in tryFold in Graph Regions (#189232)

In a graph region (e.g. the module body), an op may use its own result
as an operand, creating a circular SSA dependency. When such an op was
passed to OpBuilder::tryFold, the do-while loop could spin forever:

1. foldCommutative moved the constant operand to the RHS (in-place fold,
foldResults still empty).
2. The next fold call returned the op's own result, signalling an
in-place fold, but foldSingleResultHook re-ran trait folds, found
nothing to swap, and returned success with empty foldResults.
  3. Step 2 repeated without end.

Fix: cap the number of in-place fold iterations at 64. Legitimate chains
are very short in practice (foldCommutative swaps once, then the op folds to
a value or constant), so the cap is never reached for correct IR. For the
circular-SSA case the loop now terminates and tryFold returns failure,
letting dialect conversion fall through to a conversion pattern instead of
looping.

An alternative could be for each iteration of the loop, snapshot the
operand list and attributes/properties. If a fold returns empty results
but the operands are unchanged, we have reached a fixpoint. Stop the
loop and return failure.
However this is more expensive for the common case, while fixing an edge
case.

Fixes #159675

Assisted-by: Claude Code



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications