[MLIR][Tensor] --linalg-fold-unit-extent-dims crashes with assertion failure "invalid index for shaped type" in FoldEmptyTensorWithDimOp.

[tju-chenyaosuo]

git version: eaff3a7

command to reproduce: mlir-opt --linalg-fold-unit-extent-dims a.mlir

a.mlir:

func.func @func1() -> index {
  %3 = tensor.empty() : tensor<19x15x1xf16>
  %idx10 = index.constant 10
  %dim_162 = tensor.dim %3, %idx10 : tensor<19x15x1xf16>  // index out-of-bounds
  return %dim_162 : index
}

stack trace:

mlir-opt: /data2/src/llvm-project/build/tools/mlir/include/mlir/IR/BuiltinTypeInterfaces.h.inc:242: bool mlir::detail::ShapedTypeTrait<ConcreteType>::isDynamicDim(unsigned int) const [with ConcreteType = mlir::RankedTensorType]: Assertion `idx < getRank() && "invalid index for shaped type"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /data2/src/llvm-project/build/bin/mlir-opt --linalg-fold-unit-extent-dims a.mlir
 #0 0x0000557113fa73cf llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/data2/src/llvm-project/build/bin/mlir-opt+0x15853cf)
 #1 0x0000557113fa4434 SignalHandler(int) Signals.cpp:0:0
 #2 0x00007fc8af79e420 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14420)
 #3 0x00007fc8af26b00b raise (/lib/x86_64-linux-gnu/libc.so.6+0x4300b)
 #4 0x00007fc8af24a859 abort (/lib/x86_64-linux-gnu/libc.so.6+0x22859)
 #5 0x00007fc8af24a729 (/lib/x86_64-linux-gnu/libc.so.6+0x22729)
 #6 0x00007fc8af25bfd6 (/lib/x86_64-linux-gnu/libc.so.6+0x33fd6)
 #7 0x00005571144f3c8d (/data2/src/llvm-project/build/bin/mlir-opt+0x1ad1c8d)
 #8 0x000055711614677d (anonymous namespace)::FoldEmptyTensorWithDimOp::matchAndRewrite(mlir::tensor::DimOp, mlir::PatternRewriter&) const TensorOps.cpp:0:0
 #9 0x00005571144ebe2f mlir::detail::OpOrInterfaceRewritePatternBase<mlir::tensor::DimOp>::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&) const (/data2/src/llvm-project/build/bin/mlir-opt+0x1ac9e2f)
#10 0x000055711a470f10 mlir::PatternApplicator::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&, llvm::function_ref<bool (mlir::Pattern const&)>, llvm::function_ref<void (mlir::Pattern const&)>, llvm::function_ref<llvm::LogicalResult (mlir::Pattern const&)>) (/data2/src/llvm-project/build/bin/mlir-opt+0x7a4ef10)
#11 0x00005571172e2e08 (anonymous namespace)::GreedyPatternRewriteDriver::processWorklist() GreedyPatternRewriteDriver.cpp:0:0
#12 0x00005571172e5c5b mlir::applyPatternsAndFoldGreedily(mlir::Region&, mlir::FrozenRewritePatternSet const&, mlir::GreedyRewriteConfig, bool*) (/data2/src/llvm-project/build/bin/mlir-opt+0x48c3c5b)
#13 0x0000557114cfbf9c (anonymous namespace)::LinalgFoldUnitExtentDimsPass::runOnOperation() DropUnitDims.cpp:0:0
#14 0x000055711722f351 mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) (/data2/src/llvm-project/build/bin/mlir-opt+0x480d351)
#15 0x000055711722f82a mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) (/data2/src/llvm-project/build/bin/mlir-opt+0x480d82a)
#16 0x0000557117230374 mlir::PassManager::run(mlir::Operation*) (/data2/src/llvm-project/build/bin/mlir-opt+0x480e374)
#17 0x000055711722187b performActions(llvm::raw_ostream&, std::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) MlirOptMain.cpp:0:0
#18 0x0000557117222244 processBuffer(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::MlirOptMainConfig const&, mlir::DialectRegistry&, llvm::ThreadPoolInterface*) MlirOptMain.cpp:0:0
#19 0x00005571172223f4 llvm::LogicalResult llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::'lambda'(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>(long, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&) MlirOptMain.cpp:0:0
#20 0x0000557117329e3e mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) (/data2/src/llvm-project/build/bin/mlir-opt+0x4907e3e)
#21 0x0000557117219c99 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) (/data2/src/llvm-project/build/bin/mlir-opt+0x47f7c99)
#22 0x0000557117222561 mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) (/data2/src/llvm-project/build/bin/mlir-opt+0x4800561)
#23 0x0000557117222a26 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) (/data2/src/llvm-project/build/bin/mlir-opt+0x4800a26)
#24 0x0000557113ebeaab main (/data2/src/llvm-project/build/bin/mlir-opt+0x149caab)
#25 0x00007fc8af24c083 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24083)
#26 0x0000557113f7a5be _start (/data2/src/llvm-project/build/bin/mlir-opt+0x15585be)
Aborted (core dumped)

[llvmbot]

Hi!

This issue may be a good introductory issue for people new to working on LLVM. If you would like to work on this issue, your first steps are:

1. Check that no other contributor has already been assigned to this issue. If you believe that no one is actually working on it despite an assignment, ping the person. After one week without a response, the assignee may be changed.
2. In the comments of this issue, request for it to be assigned to you, or just create a pull request after following the steps below. Mention this issue in the description of the pull request.
3. Fix the issue locally.
4. Run the test suite locally. Remember that the subdirectories under test/ create fine-grained testing targets, so you can e.g. use make check-clang-ast to only run Clang's AST tests.
5. Create a Git commit.
6. Run git clang-format HEAD~1 to format your changes.
7. Open a pull request to the upstream repository on GitHub. Detailed instructions can be found in GitHub's documentation. Mention this issue in the description of the pull request.

If you have any further questions about this issue, don't hesitate to ask via a comment in the thread below.

[llvmbot]

@llvm/issue-subscribers-good-first-issue

Author: tju-chenyaosuo (tju-chenyaosuo)

git version: eaff3a7

command to reproduce: mlir-opt --linalg-fold-unit-extent-dims a.mlir

a.mlir:

func.func @<!-- -->func1() -&gt; index {
  %3 = tensor.empty() : tensor&lt;19x15x1xf16&gt;
  %idx10 = index.constant 10
  %dim_162 = tensor.dim %3, %idx10 : tensor&lt;19x15x1xf16&gt;  // index out-of-bounds
  return %dim_162 : index
}

stack trace:

mlir-opt: /data2/src/llvm-project/build/tools/mlir/include/mlir/IR/BuiltinTypeInterfaces.h.inc:242: bool mlir::detail::ShapedTypeTrait<ConcreteType>::isDynamicDim(unsigned int) const [with ConcreteType = mlir::RankedTensorType]: Assertion `idx < getRank() && "invalid index for shaped type"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /data2/src/llvm-project/build/bin/mlir-opt --linalg-fold-unit-extent-dims a.mlir
 #<!-- -->0 0x0000557113fa73cf llvm::sys::PrintStackTrace(llvm::raw_ostream&amp;, int) (/data2/src/llvm-project/build/bin/mlir-opt+0x15853cf)
 #<!-- -->1 0x0000557113fa4434 SignalHandler(int) Signals.cpp:0:0
 #<!-- -->2 0x00007fc8af79e420 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14420)
 #<!-- -->3 0x00007fc8af26b00b raise (/lib/x86_64-linux-gnu/libc.so.6+0x4300b)
 #<!-- -->4 0x00007fc8af24a859 abort (/lib/x86_64-linux-gnu/libc.so.6+0x22859)
 #<!-- -->5 0x00007fc8af24a729 (/lib/x86_64-linux-gnu/libc.so.6+0x22729)
 #<!-- -->6 0x00007fc8af25bfd6 (/lib/x86_64-linux-gnu/libc.so.6+0x33fd6)
 #<!-- -->7 0x00005571144f3c8d (/data2/src/llvm-project/build/bin/mlir-opt+0x1ad1c8d)
 #<!-- -->8 0x000055711614677d (anonymous namespace)::FoldEmptyTensorWithDimOp::matchAndRewrite(mlir::tensor::DimOp, mlir::PatternRewriter&amp;) const TensorOps.cpp:0:0
 #<!-- -->9 0x00005571144ebe2f mlir::detail::OpOrInterfaceRewritePatternBase&lt;mlir::tensor::DimOp&gt;::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&amp;) const (/data2/src/llvm-project/build/bin/mlir-opt+0x1ac9e2f)
#<!-- -->10 0x000055711a470f10 mlir::PatternApplicator::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&amp;, llvm::function_ref&lt;bool (mlir::Pattern const&amp;)&gt;, llvm::function_ref&lt;void (mlir::Pattern const&amp;)&gt;, llvm::function_ref&lt;llvm::LogicalResult (mlir::Pattern const&amp;)&gt;) (/data2/src/llvm-project/build/bin/mlir-opt+0x7a4ef10)
#<!-- -->11 0x00005571172e2e08 (anonymous namespace)::GreedyPatternRewriteDriver::processWorklist() GreedyPatternRewriteDriver.cpp:0:0
#<!-- -->12 0x00005571172e5c5b mlir::applyPatternsAndFoldGreedily(mlir::Region&amp;, mlir::FrozenRewritePatternSet const&amp;, mlir::GreedyRewriteConfig, bool*) (/data2/src/llvm-project/build/bin/mlir-opt+0x48c3c5b)
#<!-- -->13 0x0000557114cfbf9c (anonymous namespace)::LinalgFoldUnitExtentDimsPass::runOnOperation() DropUnitDims.cpp:0:0
#<!-- -->14 0x000055711722f351 mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) (/data2/src/llvm-project/build/bin/mlir-opt+0x480d351)
#<!-- -->15 0x000055711722f82a mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&amp;, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) (/data2/src/llvm-project/build/bin/mlir-opt+0x480d82a)
#<!-- -->16 0x0000557117230374 mlir::PassManager::run(mlir::Operation*) (/data2/src/llvm-project/build/bin/mlir-opt+0x480e374)
#<!-- -->17 0x000055711722187b performActions(llvm::raw_ostream&amp;, std::shared_ptr&lt;llvm::SourceMgr&gt; const&amp;, mlir::MLIRContext*, mlir::MlirOptMainConfig const&amp;) MlirOptMain.cpp:0:0
#<!-- -->18 0x0000557117222244 processBuffer(llvm::raw_ostream&amp;, std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, mlir::MlirOptMainConfig const&amp;, mlir::DialectRegistry&amp;, llvm::ThreadPoolInterface*) MlirOptMain.cpp:0:0
#<!-- -->19 0x00005571172223f4 llvm::LogicalResult llvm::function_ref&lt;llvm::LogicalResult (std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, llvm::raw_ostream&amp;)&gt;::callback_fn&lt;mlir::MlirOptMain(llvm::raw_ostream&amp;, std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, mlir::DialectRegistry&amp;, mlir::MlirOptMainConfig const&amp;)::'lambda'(std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, llvm::raw_ostream&amp;)&gt;(long, std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, llvm::raw_ostream&amp;) MlirOptMain.cpp:0:0
#<!-- -->20 0x0000557117329e3e mlir::splitAndProcessBuffer(std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, llvm::function_ref&lt;llvm::LogicalResult (std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, llvm::raw_ostream&amp;)&gt;, llvm::raw_ostream&amp;, llvm::StringRef, llvm::StringRef) (/data2/src/llvm-project/build/bin/mlir-opt+0x4907e3e)
#<!-- -->21 0x0000557117219c99 mlir::MlirOptMain(llvm::raw_ostream&amp;, std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, mlir::DialectRegistry&amp;, mlir::MlirOptMainConfig const&amp;) (/data2/src/llvm-project/build/bin/mlir-opt+0x47f7c99)
#<!-- -->22 0x0000557117222561 mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&amp;) (/data2/src/llvm-project/build/bin/mlir-opt+0x4800561)
#<!-- -->23 0x0000557117222a26 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&amp;) (/data2/src/llvm-project/build/bin/mlir-opt+0x4800a26)
#<!-- -->24 0x0000557113ebeaab main (/data2/src/llvm-project/build/bin/mlir-opt+0x149caab)
#<!-- -->25 0x00007fc8af24c083 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24083)
#<!-- -->26 0x0000557113f7a5be _start (/data2/src/llvm-project/build/bin/mlir-opt+0x15585be)
Aborted (core dumped)

[lipracer]

Out of range emitError. I think we can solve this problem.

[brod4910]

Isn't this correct behavior for the FoldEmptyTensorWithDimOp pattern since the index is out of range for the shape with 3 dimensions? Or am I missing something?

The specifications of the tensor.dim op do say that If the dimension index is out of bounds, the behavior is undefined. I'm assuming that we shouldn't crash here and we should instead return failure or match failure from the pattern?

If that is the case and this isn't expected behavior then I'm happy to pick this up as my first issue!

[lipracer]

Indeed, this is UB, mlir::UBDialect may be able to handle it, but it has not yet been widely accepted, and not processing it may also be a way.

[brod4910]

Sweet, I'll take a crack at it then. You can assign this to me

[IanWood1]

Similar logic here:

llvm-project/mlir/lib/Dialect/Tensor/IR/TensorOps.cpp

Lines 747 to 751 in 864902e

	// Out of bound indices produce undefined behavior but are still valid IR.
	// Don't choke on them.
	int64_t indexVal = index.getInt();
	if (indexVal < 0 || indexVal >= tensorType.getRank())
	return {};

Also maybe a verifier would be good here? But I'm unsure if this is how UB should be handled

[brod4910]

@IanWood1 there is a great discussion about this on why a verifier shouldn't handle this sort of behavior here: #112196