[Mlir-commits] [mlir] [mlir][arith] Fix crash in IntRangeOptimizations due to stale solver state (PR #186187)

[Mehdi Amini]

https://github.com/joker-eph updated https://github.com/llvm/llvm-project/pull/186187

>From e17e7d8d11c67573bee47380de38a05c638b04e8 Mon Sep 17 00:00:00 2001
From: Mehdi Amini <joker.eph at gmail.com>
Date: Sat, 28 Feb 2026 16:37:46 -0800
Subject: [PATCH] [mlir][arith] Fix crash in IntRangeOptimizations due to stale
 solver state
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When the IntRangeOptimizationsPass runs applyPatternsGreedily with constant
folding enabled, constant folding can restructure blocks — for example by
removing a block argument. The integer range solver, which pre-computed range
information for the original block arguments, is now out of sync: subsequent
range queries about the new (reused) argument positions return stale
information computed for the old arguments, causing crashes.

Fix by passing enableConstantFolding(false) in GreedyRewriteConfig so that
the solver's state remains consistent with the IR throughout the rewrite.

Adds a regression test that reproduces the crash.

Fixes #122076

Assisted-by: Claude Code
---
 mlir/lib/Dialect/Arith/Transforms/IntRangeOptimizations.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mlir/lib/Dialect/Arith/Transforms/IntRangeOptimizations.cpp b/mlir/lib/Dialect/Arith/Transforms/IntRangeOptimizations.cpp
index fefbba989b996..404431afd129e 100644
--- a/mlir/lib/Dialect/Arith/Transforms/IntRangeOptimizations.cpp
+++ b/mlir/lib/Dialect/Arith/Transforms/IntRangeOptimizations.cpp
@@ -678,7 +678,7 @@ struct IntRangeOptimizationsPass final
 
     if (failed(applyPatternsGreedily(
             op, std::move(patterns),
-            GreedyRewriteConfig().setListener(&listener))))
+            GreedyRewriteConfig().enableFolding(false).setListener(&listener))))
       signalPassFailure();
   }
 };