[Mlir-commits] [mlir] [mlir][bufferization] Fix ownership computation of unknown ops (PR #70773)

[Matthias Springer]

matthias-springer wrote:

> If I remember correctly it currently deallocates %a at the end of the function potentially leading to a use after free.

That's the behavior that I would expect. This is actually a pattern that I saw frequently in partial bufferization test cases with One-Shot Bufferize when it still inserted deallocation ops.

What's returned by the function is a tensor, so there is no use-after-free (yet). Only when the `to_tensor`+`func.return` gets bufferized, there would be a use-after-free, so this is a problem of the bufferization pass, not the deallocation pass. You can write such IR manually and hand it over to the bufferization pass, without ever running the deallocation pass.

The bufferization pass would have to insert a new allocation here (which it does not do at the moment). I think the buffer deallocation pass design is fine here. We generally discourage the use of `to_memref`/`to_tensor` and we may want to tighten it a bit more (in the documentation) to prevent cases like this one.


https://github.com/llvm/llvm-project/pull/70773