[mlir] --canonicalize causes segmentation fault in eraseUnreachableBlocks.

git version: 383e350

system: Ubuntu 20.04.6 LTS (Focal Fossa)

reproduced with: mlir-opt --canonicalize a.mlir

a.mlir:

llvm.func @func2()  {
  cf.br ^bb4
^bb2:  // pred: ^bb0
  spirv.mlir.selection {
    spirv.Branch ^bb3
  ^bb3:  // 2 preds: ^bb1, ^bb2
    spirv.mlir.merge
  }
  cf.br ^bb4
^bb4:  // pred: ^bb3
  spirv.mlir.selection {
  }
  llvm.return 
}

trace:

PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /data/bin1/llvm-project/build/bin/mlir-opt --canonicalize a.mlir
 #0 0x000055caf59393ff llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/data/bin1/llvm-project/build/bin/mlir-opt+0x16573ff)
 #1 0x000055caf5936454 SignalHandler(int) Signals.cpp:0:0
 #2 0x00007fb5b33b6420 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14420)
 #3 0x000055caf870ebfb mlir::SuccessorRange::SuccessorRange(mlir::Block*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x442cbfb)
 #4 0x000055caf847134b llvm::iterator_range<llvm::po_iterator<mlir::Block*, llvm::SmallPtrSet<llvm::GraphTraits<mlir::Block*>::NodeRef, 8u>, false, llvm::GraphTraits<mlir::Block*>>> llvm::post_order<mlir::Block*>(mlir::Block* const&) (/data/bin1/llvm-project/build/bin/mlir-opt+0x418f34b)
 #5 0x000055caf87f90a3 mlir::RewriterBase::eraseOp(mlir::Operation*)::'lambda0'(mlir::Operation*)::operator()(mlir::Operation*) const (.isra.0) PatternMatch.cpp:0:0
 #6 0x000055caf87f9cb6 mlir::RewriterBase::eraseOp(mlir::Operation*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x4517cb6)
 #7 0x000055caf87f9b89 mlir::RewriterBase::eraseBlock(mlir::Block*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x4517b89)
 #8 0x000055caf86ab1db mlir::eraseUnreachableBlocks(mlir::RewriterBase&, llvm::MutableArrayRef<mlir::Region>) (/data/bin1/llvm-project/build/bin/mlir-opt+0x43c91db)
 #9 0x000055caf86b376a mlir::simplifyRegions(mlir::RewriterBase&, llvm::MutableArrayRef<mlir::Region>) (/data/bin1/llvm-project/build/bin/mlir-opt+0x43d176a)
#10 0x000055caf8694079 mlir::applyPatternsAndFoldGreedily(mlir::Region&, mlir::FrozenRewritePatternSet const&, mlir::GreedyRewriteConfig, bool*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x43b2079)
#11 0x000055caf85f8fea (anonymous namespace)::Canonicalizer::runOnOperation() Canonicalizer.cpp:0:0
#12 0x000055caf85d9f3e mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42f7f3e)
#13 0x000055caf85da41a mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42f841a)
#14 0x000055caf85dac44 mlir::PassManager::run(mlir::Operation*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42f8c44)
#15 0x000055caf85cb9b3 performActions(llvm::raw_ostream&, std::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) MlirOptMain.cpp:0:0
#16 0x000055caf85cce84 processBuffer(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::MlirOptMainConfig const&, mlir::DialectRegistry&, llvm::ThreadPool*) MlirOptMain.cpp:0:0
#17 0x000055caf85cd034 mlir::LogicalResult llvm::function_ref<mlir::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::'lambda'(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>(long, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&) MlirOptMain.cpp:0:0
#18 0x000055caf86cc324 mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<mlir::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>, llvm::raw_ostream&, bool, bool) (/data/bin1/llvm-project/build/bin/mlir-opt+0x43ea324)
#19 0x000055caf85c5897 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42e3897)
#20 0x000055caf85cd181 mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42eb181)
#21 0x000055caf85cd5e6 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42eb5e6)
#22 0x000055caf5870a7b main (/data/bin1/llvm-project/build/bin/mlir-opt+0x158ea7b)
#23 0x00007fb5b2e82083 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24083)
#24 0x000055caf590975e _start (/data/bin1/llvm-project/build/bin/mlir-opt+0x162775e)
Segmentation fault (core dumped)

[Lewuathe]

I'm not clearly sure what the root cause but it crashed in the middle of erasing the ^bb2 which is starting with spirv.mlir.selection.

llvm-project/mlir/lib/IR/PatternMatch.cpp

Line 349 in 847d845

for (Block *b : llvm::post_order(&r.front())) {

[llvmbot]

@llvm/issue-subscribers-mlir-spirv

Author: anonymousMCS (anonymousMCS)

git version: 383e350

system: Ubuntu 20.04.6 LTS (Focal Fossa)

reproduced with: mlir-opt --canonicalize a.mlir

a.mlir:

llvm.func @<!-- -->func2()  {
  cf.br ^bb4
^bb2:  // pred: ^bb0
  spirv.mlir.selection {
    spirv.Branch ^bb3
  ^bb3:  // 2 preds: ^bb1, ^bb2
    spirv.mlir.merge
  }
  cf.br ^bb4
^bb4:  // pred: ^bb3
  spirv.mlir.selection {
  }
  llvm.return 
}

trace:

PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /data/bin1/llvm-project/build/bin/mlir-opt --canonicalize a.mlir
 #<!-- -->0 0x000055caf59393ff llvm::sys::PrintStackTrace(llvm::raw_ostream&amp;, int) (/data/bin1/llvm-project/build/bin/mlir-opt+0x16573ff)
 #<!-- -->1 0x000055caf5936454 SignalHandler(int) Signals.cpp:0:0
 #<!-- -->2 0x00007fb5b33b6420 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14420)
 #<!-- -->3 0x000055caf870ebfb mlir::SuccessorRange::SuccessorRange(mlir::Block*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x442cbfb)
 #<!-- -->4 0x000055caf847134b llvm::iterator_range&lt;llvm::po_iterator&lt;mlir::Block*, llvm::SmallPtrSet&lt;llvm::GraphTraits&lt;mlir::Block*&gt;::NodeRef, 8u&gt;, false, llvm::GraphTraits&lt;mlir::Block*&gt;&gt;&gt; llvm::post_order&lt;mlir::Block*&gt;(mlir::Block* const&amp;) (/data/bin1/llvm-project/build/bin/mlir-opt+0x418f34b)
 #<!-- -->5 0x000055caf87f90a3 mlir::RewriterBase::eraseOp(mlir::Operation*)::'lambda0'(mlir::Operation*)::operator()(mlir::Operation*) const (.isra.0) PatternMatch.cpp:0:0
 #<!-- -->6 0x000055caf87f9cb6 mlir::RewriterBase::eraseOp(mlir::Operation*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x4517cb6)
 #<!-- -->7 0x000055caf87f9b89 mlir::RewriterBase::eraseBlock(mlir::Block*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x4517b89)
 #<!-- -->8 0x000055caf86ab1db mlir::eraseUnreachableBlocks(mlir::RewriterBase&amp;, llvm::MutableArrayRef&lt;mlir::Region&gt;) (/data/bin1/llvm-project/build/bin/mlir-opt+0x43c91db)
 #<!-- -->9 0x000055caf86b376a mlir::simplifyRegions(mlir::RewriterBase&amp;, llvm::MutableArrayRef&lt;mlir::Region&gt;) (/data/bin1/llvm-project/build/bin/mlir-opt+0x43d176a)
#<!-- -->10 0x000055caf8694079 mlir::applyPatternsAndFoldGreedily(mlir::Region&amp;, mlir::FrozenRewritePatternSet const&amp;, mlir::GreedyRewriteConfig, bool*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x43b2079)
#<!-- -->11 0x000055caf85f8fea (anonymous namespace)::Canonicalizer::runOnOperation() Canonicalizer.cpp:0:0
#<!-- -->12 0x000055caf85d9f3e mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42f7f3e)
#<!-- -->13 0x000055caf85da41a mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&amp;, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42f841a)
#<!-- -->14 0x000055caf85dac44 mlir::PassManager::run(mlir::Operation*) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42f8c44)
#<!-- -->15 0x000055caf85cb9b3 performActions(llvm::raw_ostream&amp;, std::shared_ptr&lt;llvm::SourceMgr&gt; const&amp;, mlir::MLIRContext*, mlir::MlirOptMainConfig const&amp;) MlirOptMain.cpp:0:0
#<!-- -->16 0x000055caf85cce84 processBuffer(llvm::raw_ostream&amp;, std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, mlir::MlirOptMainConfig const&amp;, mlir::DialectRegistry&amp;, llvm::ThreadPool*) MlirOptMain.cpp:0:0
#<!-- -->17 0x000055caf85cd034 mlir::LogicalResult llvm::function_ref&lt;mlir::LogicalResult (std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, llvm::raw_ostream&amp;)&gt;::callback_fn&lt;mlir::MlirOptMain(llvm::raw_ostream&amp;, std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, mlir::DialectRegistry&amp;, mlir::MlirOptMainConfig const&amp;)::'lambda'(std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, llvm::raw_ostream&amp;)&gt;(long, std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, llvm::raw_ostream&amp;) MlirOptMain.cpp:0:0
#<!-- -->18 0x000055caf86cc324 mlir::splitAndProcessBuffer(std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, llvm::function_ref&lt;mlir::LogicalResult (std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, llvm::raw_ostream&amp;)&gt;, llvm::raw_ostream&amp;, bool, bool) (/data/bin1/llvm-project/build/bin/mlir-opt+0x43ea324)
#<!-- -->19 0x000055caf85c5897 mlir::MlirOptMain(llvm::raw_ostream&amp;, std::unique_ptr&lt;llvm::MemoryBuffer, std::default_delete&lt;llvm::MemoryBuffer&gt;&gt;, mlir::DialectRegistry&amp;, mlir::MlirOptMainConfig const&amp;) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42e3897)
#<!-- -->20 0x000055caf85cd181 mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&amp;) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42eb181)
#<!-- -->21 0x000055caf85cd5e6 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&amp;) (/data/bin1/llvm-project/build/bin/mlir-opt+0x42eb5e6)
#<!-- -->22 0x000055caf5870a7b main (/data/bin1/llvm-project/build/bin/mlir-opt+0x158ea7b)
#<!-- -->23 0x00007fb5b2e82083 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24083)
#<!-- -->24 0x000055caf590975e _start (/data/bin1/llvm-project/build/bin/mlir-opt+0x162775e)
Segmentation fault (core dumped)

[agentcooper]

I couldn't reproduce this with an unregistered dialect. The following example has nested operations and works as expected:

func.func @func()  {
  cf.br ^bb4
^bb2:
  "dialect.op1" () ({
    cf.br ^bb3
  ^bb3:
    llvm.return
  }) : () -> ()
  cf.br ^bb4
^bb4:
  "dialect.op2" () ({
    "dialect.op3" () ({ }) : () -> ()
  }) : () -> ()
  llvm.return 
}

% ./bin/mlir-opt -allow-unregistered-dialect --canonicalize ./playground/custom.mlir
module {
  func.func @func() {
    "dialect.op2"() ({
      "dialect.op3"() ({
      }) : () -> ()
    }) : () -> ()
    llvm.return
  }
}

And if I replace spirv.Branch ^bb3 with cf.br ^bb3 in the original example, it also works as expected. So it looks like the problem is somehow related to how spirv.mlir.selection is defined.

[kuhar]

This doesn't reproduce on ToM. Closing.