[Mlir-commits] [mlir] [mlir][SCF] Do not access erased operation in `scf.while` lowering (PR #150741)
Matthias Springer
llvmlistbot at llvm.org
Sat Jul 26 01:33:54 PDT 2025
https://github.com/matthias-springer created https://github.com/llvm/llvm-project/pull/150741
Do not access the erased `scf.while` operation in the lowering pattern. That won't work anymore in a One-Shot Dialect Conversion and triggers a use-after-free sanitizer error.
After the One-Shot Dialect Conversion refactoring, a `ConversionPatternRewriter` will behave more like a normal `PatternRewriter`.
>From f12ed7e2e1c2639ffa1d560ffbcb8a68ebc296d1 Mon Sep 17 00:00:00 2001
From: Matthias Springer <me at m-sp.org>
Date: Sat, 26 Jul 2025 08:31:52 +0000
Subject: [PATCH] [mlir][SCF] Do not access erased operation in scf.while
lowering
Do not access the erased cf.cond_br operation in the lowering pattern. That won't work anymore in a One-Shot Dialect Conversion and triggers a use-after-free sanitizer error.
After the One-Shot Dialect Conversion refactoring, a ConversionPatternRewriter will behave more like a normal PatternRewriter.
---
mlir/lib/Conversion/SCFToControlFlow/SCFToControlFlow.cpp | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/mlir/lib/Conversion/SCFToControlFlow/SCFToControlFlow.cpp b/mlir/lib/Conversion/SCFToControlFlow/SCFToControlFlow.cpp
index 240491a51d2b9..807be7e1003c0 100644
--- a/mlir/lib/Conversion/SCFToControlFlow/SCFToControlFlow.cpp
+++ b/mlir/lib/Conversion/SCFToControlFlow/SCFToControlFlow.cpp
@@ -582,6 +582,7 @@ LogicalResult WhileLowering::matchAndRewrite(WhileOp whileOp,
// block. This should be reconsidered if we allow break/continue in SCF.
rewriter.setInsertionPointToEnd(before);
auto condOp = cast<ConditionOp>(before->getTerminator());
+ SmallVector<Value> args = llvm::to_vector(condOp.getArgs());
rewriter.replaceOpWithNewOp<cf::CondBranchOp>(condOp, condOp.getCondition(),
after, condOp.getArgs(),
continuation, ValueRange());
@@ -593,7 +594,7 @@ LogicalResult WhileLowering::matchAndRewrite(WhileOp whileOp,
// Replace the op with values "yielded" from the "before" region, which are
// visible by dominance.
- rewriter.replaceOp(whileOp, condOp.getArgs());
+ rewriter.replaceOp(whileOp, args);
return success();
}
More information about the Mlir-commits
mailing list