[Mlir-commits] [mlir] [mlir][CSE] Delete dead code immediately in CSE pass (PR #190926)
Matthias Springer
llvmlistbot at llvm.org
Thu Apr 9 02:58:38 PDT 2026
matthias-springer wrote:
fyi, this is a use after free:
```
mspringer at 9989af7-lcedt:~/llvm-project$ build/bin/mlir-opt d.mlir -cse
=================================================================
==2385854==ERROR: AddressSanitizer: heap-use-after-free on address 0x5080000037d4 at pc 0x630a437828cf bp 0x7ffc0a8d92d0 sp 0x7ffc0a8d92c8
READ of size 4 at 0x5080000037d4 thread T0
#0 0x630a437828ce in mlir::Operation::getResults() /home/mspringer/llvm-project/mlir/include/mlir/IR/Operation.h:442:12
#1 0x630a437828ce in mlir::Operation::use_empty() /home/mspringer/llvm-project/mlir/include/mlir/IR/Operation.h:878:29
#2 0x630a437828ce in mlir::RewriterBase::eraseOp(mlir::Operation*) /home/mspringer/llvm-project/mlir/lib/IR/PatternMatch.cpp:156:3
#3 0x630a42daab9f in (anonymous namespace)::CSEDriver::simplify(mlir::Operation*, bool*) /home/mspringer/llvm-project/mlir/lib/Transforms/CSE.cpp:401:14
#4 0x630a42db0d58 in (anonymous namespace)::CSE::runOnOperation() /home/mspringer/llvm-project/mlir/lib/Transforms/CSE.cpp:430:10
#5 0x630a42ff9735 in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_3::operator()() const /home/mspringer/llvm-project/mlir/lib/Pass/Pass.cpp:612:19
#6 0x630a42ff9735 in void llvm::function_ref<void ()>::callback_fn<mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_3>(long) /home/mspringer/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#7 0x630a42ff9735 in llvm::function_ref<void ()>::operator()() const /home/mspringer/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#8 0x630a42ff9735 in void mlir::MLIRContext::executeAction<mlir::PassExecutionAction, mlir::Pass&>(llvm::function_ref<void ()>, llvm::ArrayRef<mlir::IRUnit>, mlir::Pass&) /home/mspringer/llvm-project/mlir/include/mlir/IR/MLIRContext.h:290:7
#9 0x630a42ff9735 in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) /home/mspringer/llvm-project/mlir/lib/Pass/Pass.cpp:606:23
#10 0x630a42ffb803 in mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) /home/mspringer/llvm-project/mlir/lib/Pass/Pass.cpp:688:16
#11 0x630a43009363 in mlir::PassManager::runPasses(mlir::Operation*, mlir::AnalysisManager) /home/mspringer/llvm-project/mlir/lib/Pass/Pass.cpp:1123:10
#12 0x630a43007c28 in mlir::PassManager::run(mlir::Operation*) /home/mspringer/llvm-project/mlir/lib/Pass/Pass.cpp:1097:60
#13 0x630a3021f7c7 in performActions(llvm::raw_ostream&, std::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) /home/mspringer/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:596:17
#14 0x630a3021d8f9 in processBuffer(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef, mlir::MlirOptMainConfig const&, mlir::DialectRegistry&, mlir::SourceMgrDiagnosticVerifierHandler*, llvm::ThreadPoolInterface*) /home/mspringer/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:681:12
#15 0x630a3021d8f9 in mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_0::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef, llvm::raw_ostream&) const /home/mspringer/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:779:12
#16 0x630a3021d8f9 in llvm::LogicalResult llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_0>(long, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&) /home/mspringer/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#17 0x630a437ff948 in llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&) const /home/mspringer/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#18 0x630a437ff948 in mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) /home/mspringer/llvm-project/mlir/lib/Support/ToolUtilities.cpp:30:12
#19 0x630a30216b82 in mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) /home/mspringer/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:784:26
#20 0x630a30217416 in mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) /home/mspringer/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:830:14
#21 0x630a30217ac4 in mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) /home/mspringer/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:846:10
#22 0x630a30030e90 in main /home/mspringer/llvm-project/mlir/tools/mlir-opt/mlir-opt.cpp:343:33
#23 0x70d71e42a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#24 0x70d71e42a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#25 0x630a2ff55224 in _start (/home/mspringer/llvm-project/build/bin/mlir-opt+0xae6a224) (BuildId: da690c9a5614e28c)
0x5080000037d4 is located 52 bytes inside of 96-byte region [0x5080000037a0,0x508000003800)
freed by thread T0 here:
#0 0x630a2ffefdda in free (/home/mspringer/llvm-project/build/bin/mlir-opt+0xaf04dda) (BuildId: da690c9a5614e28c)
#1 0x630a43579938 in llvm::iplist_impl<llvm::simple_ilist<mlir::Operation>, llvm::ilist_traits<mlir::Operation>>::erase(llvm::ilist_iterator<llvm::ilist_detail::node_options<mlir::Operation, true, false, void, false, void>, false, false>) /home/mspringer/llvm-project/llvm/include/llvm/ADT/ilist.h:205:5
#2 0x630a43574b43 in llvm::iplist_impl<llvm::simple_ilist<mlir::Operation>, llvm::ilist_traits<mlir::Operation>>::pop_back() /home/mspringer/llvm-project/llvm/include/llvm/ADT/ilist.h:257:25
#3 0x630a43574b43 in mlir::Block::clear() /home/mspringer/llvm-project/mlir/include/mlir/IR/Block.h:45:18
#4 0x630a43574b43 in mlir::Block::~Block() /home/mspringer/llvm-project/mlir/lib/IR/Block.cpp:22:3
#5 0x630a4378bd24 in llvm::ilist_alloc_traits<mlir::Block>::deleteNode(mlir::Block*) /home/mspringer/llvm-project/llvm/include/llvm/ADT/ilist.h:42:39
#6 0x630a4378bd24 in llvm::iplist_impl<llvm::simple_ilist<mlir::Block>, llvm::ilist_traits<mlir::Block>>::erase(llvm::ilist_iterator<llvm::ilist_detail::node_options<mlir::Block, true, false, void, false, void>, false, false>) /home/mspringer/llvm-project/llvm/include/llvm/ADT/ilist.h:205:5
#7 0x630a43788b3a in llvm::iplist_impl<llvm::simple_ilist<mlir::Block>, llvm::ilist_traits<mlir::Block>>::erase(llvm::ilist_iterator<llvm::ilist_detail::node_options<mlir::Block, true, false, void, false, void>, false, false>, llvm::ilist_iterator<llvm::ilist_detail::node_options<mlir::Block, true, false, void, false, void>, false, false>) /home/mspringer/llvm-project/llvm/include/llvm/ADT/ilist.h:242:15
#8 0x630a43788b3a in llvm::iplist_impl<llvm::simple_ilist<mlir::Block>, llvm::ilist_traits<mlir::Block>>::clear() /home/mspringer/llvm-project/llvm/include/llvm/ADT/ilist.h:246:18
#9 0x630a43788b3a in llvm::iplist_impl<llvm::simple_ilist<mlir::Block>, llvm::ilist_traits<mlir::Block>>::~iplist_impl() /home/mspringer/llvm-project/llvm/include/llvm/ADT/ilist.h:147:20
#10 0x630a43788b3a in mlir::Region::~Region() /home/mspringer/llvm-project/mlir/lib/IR/Region.cpp:20:1
#11 0x630a4374f217 in mlir::Operation::~Operation() /home/mspringer/llvm-project/mlir/lib/IR/Operation.cpp:199:12
#12 0x630a437517eb in mlir::Operation::destroy() /home/mspringer/llvm-project/mlir/lib/IR/Operation.cpp:210:9
#13 0x630a437517eb in llvm::ilist_traits<mlir::Operation>::deleteNode(mlir::Operation*) /home/mspringer/llvm-project/mlir/lib/IR/Operation.cpp:484:7
#14 0x630a43579938 in llvm::iplist_impl<llvm::simple_ilist<mlir::Operation>, llvm::ilist_traits<mlir::Operation>>::erase(llvm::ilist_iterator<llvm::ilist_detail::node_options<mlir::Operation, true, false, void, false, void>, false, false>) /home/mspringer/llvm-project/llvm/include/llvm/ADT/ilist.h:205:5
#15 0x630a43782843 in mlir::RewriterBase::eraseOp(mlir::Operation*) /home/mspringer/llvm-project/mlir/lib/IR/PatternMatch.cpp:166:9
#16 0x630a42dac1fb in (anonymous namespace)::CSEDriver::simplifyOperation(llvm::ScopedHashTable<mlir::Operation*, mlir::Operation*, (anonymous namespace)::SimpleOperationInfo, llvm::RecyclingAllocator<llvm::BumpPtrAllocatorImpl<llvm::MallocAllocator, 4096ul, 4096ul, 128ul>, llvm::ScopedHashTableVal<mlir::Operation*, mlir::Operation*>, 32ul, 8ul>>&, mlir::Operation*, bool) /home/mspringer/llvm-project/mlir/lib/Transforms/CSE.cpp:265:14
#17 0x630a42dac1fb in (anonymous namespace)::CSEDriver::simplifyBlock(llvm::ScopedHashTable<mlir::Operation*, mlir::Operation*, (anonymous namespace)::SimpleOperationInfo, llvm::RecyclingAllocator<llvm::BumpPtrAllocatorImpl<llvm::MallocAllocator, 4096ul, 4096ul, 128ul>, llvm::ScopedHashTableVal<mlir::Operation*, mlir::Operation*>, 32ul, 8ul>>&, mlir::Block*, bool) /home/mspringer/llvm-project/mlir/lib/Transforms/CSE.cpp:331:19
#18 0x630a42dab764 in (anonymous namespace)::CSEDriver::simplifyRegion(llvm::ScopedHashTable<mlir::Operation*, mlir::Operation*, (anonymous namespace)::SimpleOperationInfo, llvm::RecyclingAllocator<llvm::BumpPtrAllocatorImpl<llvm::MallocAllocator, 4096ul, 4096ul, 128ul>, llvm::ScopedHashTableVal<mlir::Operation*, mlir::Operation*>, 32ul, 8ul>>&, mlir::Region&) /home/mspringer/llvm-project/mlir/lib/Transforms/CSE.cpp:348:5
#19 0x630a42dac04d in (anonymous namespace)::CSEDriver::simplifyBlock(llvm::ScopedHashTable<mlir::Operation*, mlir::Operation*, (anonymous namespace)::SimpleOperationInfo, llvm::RecyclingAllocator<llvm::BumpPtrAllocatorImpl<llvm::MallocAllocator, 4096ul, 4096ul, 128ul>, llvm::ScopedHashTableVal<mlir::Operation*, mlir::Operation*>, 32ul, 8ul>>&, mlir::Block*, bool) /home/mspringer/llvm-project/mlir/lib/Transforms/CSE.cpp:322:11
#20 0x630a42dab764 in (anonymous namespace)::CSEDriver::simplifyRegion(llvm::ScopedHashTable<mlir::Operation*, mlir::Operation*, (anonymous namespace)::SimpleOperationInfo, llvm::RecyclingAllocator<llvm::BumpPtrAllocatorImpl<llvm::MallocAllocator, 4096ul, 4096ul, 128ul>, llvm::ScopedHashTableVal<mlir::Operation*, mlir::Operation*>, 32ul, 8ul>>&, mlir::Region&) /home/mspringer/llvm-project/mlir/lib/Transforms/CSE.cpp:348:5
#21 0x630a42daaaca in (anonymous namespace)::CSEDriver::simplify(mlir::Operation*, bool*) /home/mspringer/llvm-project/mlir/lib/Transforms/CSE.cpp:397:5
#22 0x630a42db0d58 in (anonymous namespace)::CSE::runOnOperation() /home/mspringer/llvm-project/mlir/lib/Transforms/CSE.cpp:430:10
#23 0x630a42ff9735 in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_3::operator()() const /home/mspringer/llvm-project/mlir/lib/Pass/Pass.cpp:612:19
#24 0x630a42ff9735 in void llvm::function_ref<void ()>::callback_fn<mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_3>(long) /home/mspringer/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#25 0x630a42ff9735 in llvm::function_ref<void ()>::operator()() const /home/mspringer/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#26 0x630a42ff9735 in void mlir::MLIRContext::executeAction<mlir::PassExecutionAction, mlir::Pass&>(llvm::function_ref<void ()>, llvm::ArrayRef<mlir::IRUnit>, mlir::Pass&) /home/mspringer/llvm-project/mlir/include/mlir/IR/MLIRContext.h:290:7
#27 0x630a42ff9735 in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) /home/mspringer/llvm-project/mlir/lib/Pass/Pass.cpp:606:23
#28 0x630a42ffb803 in mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) /home/mspringer/llvm-project/mlir/lib/Pass/Pass.cpp:688:16
#29 0x630a43009363 in mlir::PassManager::runPasses(mlir::Operation*, mlir::AnalysisManager) /home/mspringer/llvm-project/mlir/lib/Pass/Pass.cpp:1123:10
#30 0x630a43007c28 in mlir::PassManager::run(mlir::Operation*) /home/mspringer/llvm-project/mlir/lib/Pass/Pass.cpp:1097:60
#31 0x630a3021f7c7 in performActions(llvm::raw_ostream&, std::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) /home/mspringer/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:596:17
#32 0x630a3021d8f9 in processBuffer(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef, mlir::MlirOptMainConfig const&, mlir::DialectRegistry&, mlir::SourceMgrDiagnosticVerifierHandler*, llvm::ThreadPoolInterface*) /home/mspringer/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:681:12
#33 0x630a3021d8f9 in mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_0::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef, llvm::raw_ostream&) const /home/mspringer/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:779:12
#34 0x630a3021d8f9 in llvm::LogicalResult llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_0>(long, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&) /home/mspringer/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#35 0x630a437ff948 in llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&) const /home/mspringer/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#36 0x630a437ff948 in mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) /home/mspringer/llvm-project/mlir/lib/Support/ToolUtilities.cpp:30:12
#37 0x630a30216b82 in mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) /home/mspringer/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:784:26
#38 0x630a30217416 in mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) /home/mspringer/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:830:14
#39 0x630a30217ac4 in mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) /home/mspringer/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:846:10
#40 0x630a30030e90 in main /home/mspringer/llvm-project/mlir/tools/mlir-opt/mlir-opt.cpp:343:33
#41 0x70d71e42a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#42 0x70d71e42a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#43 0x630a2ff55224 in _start (/home/mspringer/llvm-project/build/bin/mlir-opt+0xae6a224) (BuildId: da690c9a5614e28c)
```
https://github.com/llvm/llvm-project/pull/190926
More information about the Mlir-commits
mailing list