[Mlir-commits] [mlir] Fix #177829 mlir-opt --convert-vector-to-llvm crashes on vector.insert with out-of-bounds index (PR #179116)

[llvmlistbot at llvm.org]

llvmbot wrote:


<!--LLVM PR SUMMARY COMMENT-->

@llvm/pr-subscribers-mlir

Author: None (rishabhmadan19)

<details>
<summary>Changes</summary>

Prevent an assertion/crash in the Vector-to-LLVM conversion when lowering vector.insert into an n-D vector represented as a nested LLVM aggregate.

In the vector.insert lowering, the code used vector::getAsIntegers(positionOf1DVectorWithinAggregate) to build the constant index list for llvm.extractvalue / llvm.insertvalue. This helper asserts if any position is not an Attribute. However, vector.insert positions can be provided as dynamic operands (Value), even when they are compile-time constants (e.g., %c257 = arith.constant 257 : index). In such cases, the conversion attempted to treat a Value as a constant attribute and crashed.

---
Full diff: https://github.com/llvm/llvm-project/pull/179116.diff


1 Files Affected:

- (modified) mlir/lib/Conversion/VectorToLLVM/ConvertVectorToLLVM.cpp (+21) 


``````````diff
diff --git a/mlir/lib/Conversion/VectorToLLVM/ConvertVectorToLLVM.cpp b/mlir/lib/Conversion/VectorToLLVM/ConvertVectorToLLVM.cpp
index 05d541fe80356..b404260be27b6 100644
--- a/mlir/lib/Conversion/VectorToLLVM/ConvertVectorToLLVM.cpp
+++ b/mlir/lib/Conversion/VectorToLLVM/ConvertVectorToLLVM.cpp
@@ -1237,6 +1237,27 @@ class VectorInsertOpConversion
     ArrayRef<OpFoldResult> positionOf1DVectorWithinAggregate(
         positionVec.begin(),
         insertIntoInnermostDim ? positionVec.size() - 1 : positionVec.size());
+    
+    if (isNestedAggregate) {
+      std::optional<SmallVector<int64_t>> maybeAggPos;
+      maybeAggPos =
+          mlir::getConstantIntValues(positionOf1DVectorWithinAggregate);
+      if (!maybeAggPos) {
+        return rewriter.notifyMatchFailure(
+            insertOp, "non-constant aggregate position for extract/insertvalue");
+      }
+
+      // Bounds check against the aggregate dimensions we index into.
+      for (int64_t i = 0, e = static_cast<int64_t>(maybeAggPos->size()); i < e; ++i) {
+        int64_t idx = (*maybeAggPos)[i];
+        int64_t dim = destVectorType.getDimSize(i);
+        if (idx < 0 || idx >= dim) {
+          return rewriter.notifyMatchFailure(insertOp,
+                                            "out-of-bounds aggregate position");
+        }
+      }
+    }
+
     OpFoldResult positionOfScalarWithin1DVector;
     if (destVectorType.getRank() == 0) {
       // Since the LLVM type converter converts 0D vectors to 1D vectors, we

``````````

</details>


https://github.com/llvm/llvm-project/pull/179116