Skip to content

[mlir][affine] Fix dim index out of bounds crash #73266

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 28, 2023
Merged

[mlir][affine] Fix dim index out of bounds crash #73266

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 25 additions & 14 deletions mlir/lib/Dialect/Affine/IR/AffineOps.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -319,7 +319,13 @@ bool mlir::affine::isValidDim(Value value, Region *region) {
template <typename AnyMemRefDefOp>
static bool isMemRefSizeValidSymbol(AnyMemRefDefOp memrefDefOp, unsigned index,
Region *region) {
auto memRefType = memrefDefOp.getType();
MemRefType memRefType = memrefDefOp.getType();

// Dimension index is out of bounds.
if (index >= memRefType.getRank()) {
return false;
}

// Statically shaped.
if (!memRefType.isDynamicDim(index))
return true;
Expand Down Expand Up @@ -1651,19 +1657,22 @@ LogicalResult AffineDmaStartOp::verifyInvariantsImpl() {
if (!idx.getType().isIndex())
return emitOpError("src index to dma_start must have 'index' type");
if (!isValidAffineIndexOperand(idx, scope))
return emitOpError("src index must be a dimension or symbol identifier");
return emitOpError(
"src index must be a valid dimension or symbol identifier");
}
for (auto idx : getDstIndices()) {
if (!idx.getType().isIndex())
return emitOpError("dst index to dma_start must have 'index' type");
if (!isValidAffineIndexOperand(idx, scope))
return emitOpError("dst index must be a dimension or symbol identifier");
return emitOpError(
"dst index must be a valid dimension or symbol identifier");
}
for (auto idx : getTagIndices()) {
if (!idx.getType().isIndex())
return emitOpError("tag index to dma_start must have 'index' type");
if (!isValidAffineIndexOperand(idx, scope))
return emitOpError("tag index must be a dimension or symbol identifier");
return emitOpError(
"tag index must be a valid dimension or symbol identifier");
}
return success();
}
Expand Down Expand Up @@ -1752,7 +1761,8 @@ LogicalResult AffineDmaWaitOp::verifyInvariantsImpl() {
if (!idx.getType().isIndex())
return emitOpError("index to dma_wait must have 'index' type");
if (!isValidAffineIndexOperand(idx, scope))
return emitOpError("index must be a dimension or symbol identifier");
return emitOpError(
"index must be a valid dimension or symbol identifier");
}
return success();
}
Expand Down Expand Up @@ -2913,8 +2923,7 @@ static void composeSetAndOperands(IntegerSet &set,
}

/// Canonicalize an affine if op's conditional (integer set + operands).
LogicalResult AffineIfOp::fold(FoldAdaptor,
SmallVectorImpl<OpFoldResult> &) {
LogicalResult AffineIfOp::fold(FoldAdaptor, SmallVectorImpl<OpFoldResult> &) {
auto set = getIntegerSet();
SmallVector<Value, 4> operands(getOperands());
composeSetAndOperands(set, operands);
Expand Down Expand Up @@ -3005,18 +3014,19 @@ static LogicalResult
verifyMemoryOpIndexing(Operation *op, AffineMapAttr mapAttr,
Operation::operand_range mapOperands,
MemRefType memrefType, unsigned numIndexOperands) {
AffineMap map = mapAttr.getValue();
if (map.getNumResults() != memrefType.getRank())
return op->emitOpError("affine map num results must equal memref rank");
if (map.getNumInputs() != numIndexOperands)
return op->emitOpError("expects as many subscripts as affine map inputs");
AffineMap map = mapAttr.getValue();
if (map.getNumResults() != memrefType.getRank())
return op->emitOpError("affine map num results must equal memref rank");
if (map.getNumInputs() != numIndexOperands)
return op->emitOpError("expects as many subscripts as affine map inputs");

Region *scope = getAffineScope(op);
for (auto idx : mapOperands) {
if (!idx.getType().isIndex())
return op->emitOpError("index to load must have 'index' type");
if (!isValidAffineIndexOperand(idx, scope))
return op->emitOpError("index must be a dimension or symbol identifier");
return op->emitOpError(
"index must be a valid dimension or symbol identifier");
}

return success();
Expand Down Expand Up @@ -3605,7 +3615,8 @@ LogicalResult AffinePrefetchOp::verify() {
Region *scope = getAffineScope(*this);
for (auto idx : getMapOperands()) {
if (!isValidAffineIndexOperand(idx, scope))
return emitOpError("index must be a dimension or symbol identifier");
return emitOpError(
"index must be a valid dimension or symbol identifier");
}
return success();
}
Expand Down
12 changes: 12 additions & 0 deletions mlir/test/Conversion/FuncToSPIRV/func-ops-to-spirv.mlir
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,3 +49,15 @@ func.func @call_functions(%arg0: index) -> index {
}

// -----

func.func @dim_index_out_of_bounds() {
%c6 = arith.constant 6 : index
%alloc_4 = memref.alloc() : memref<4xi64>
%dim = memref.dim %alloc_4, %c6 : memref<4xi64>
%alloca_100 = memref.alloca() : memref<100xi64>
// expected-error@+1 {{'affine.vector_load' op index must be a valid dimension or symbol identifier}}
%70 = affine.vector_load %alloca_100[%dim] : memref<100xi64>, vector<31xi64>
return
}

// -----
4 changes: 2 additions & 2 deletions mlir/test/Dialect/Affine/invalid.mlir
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ func.func @affine_load_invalid_dim(%M : memref<10xi32>) {
"unknown"() ({
^bb0(%arg: index):
affine.load %M[%arg] : memref<10xi32>
// expected-error@-1 {{index must be a dimension or symbol identifier}}
// expected-error@-1 {{index must be a valid dimension or symbol identifier}}
cf.br ^bb1
^bb1:
cf.br ^bb1
Expand Down Expand Up @@ -521,7 +521,7 @@ func.func @dynamic_dimension_index() {
%idx = "unknown.test"() : () -> (index)
%memref = "unknown.test"() : () -> memref<?x?xf32>
%dim = memref.dim %memref, %idx : memref<?x?xf32>
// expected-error @below {{op index must be a dimension or symbol identifier}}
// expected-error @below {{op index must be a valid dimension or symbol identifier}}
affine.load %memref[%dim, %dim] : memref<?x?xf32>
"unknown.terminator"() : () -> ()
}) : () -> ()
Expand Down
12 changes: 6 additions & 6 deletions mlir/test/Dialect/Affine/load-store-invalid.mlir
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ func.func @load_non_affine_index(%arg0 : index) {
%0 = memref.alloc() : memref<10xf32>
affine.for %i0 = 0 to 10 {
%1 = arith.muli %i0, %arg0 : index
// expected-error@+1 {{op index must be a dimension or symbol identifier}}
// expected-error@+1 {{op index must be a valid dimension or symbol identifier}}
%v = affine.load %0[%1] : memref<10xf32>
}
return
Expand All @@ -50,7 +50,7 @@ func.func @store_non_affine_index(%arg0 : index) {
%1 = arith.constant 11.0 : f32
affine.for %i0 = 0 to 10 {
%2 = arith.muli %i0, %arg0 : index
// expected-error@+1 {{op index must be a dimension or symbol identifier}}
// expected-error@+1 {{op index must be a valid dimension or symbol identifier}}
affine.store %1, %0[%2] : memref<10xf32>
}
return
Expand Down Expand Up @@ -84,7 +84,7 @@ func.func @dma_start_non_affine_src_index(%arg0 : index) {
%c64 = arith.constant 64 : index
affine.for %i0 = 0 to 10 {
%3 = arith.muli %i0, %arg0 : index
// expected-error@+1 {{op src index must be a dimension or symbol identifier}}
// expected-error@+1 {{op src index must be a valid dimension or symbol identifier}}
affine.dma_start %0[%3], %1[%i0], %2[%c0], %c64
: memref<100xf32>, memref<100xf32, 2>, memref<1xi32, 4>
}
Expand All @@ -101,7 +101,7 @@ func.func @dma_start_non_affine_dst_index(%arg0 : index) {
%c64 = arith.constant 64 : index
affine.for %i0 = 0 to 10 {
%3 = arith.muli %i0, %arg0 : index
// expected-error@+1 {{op dst index must be a dimension or symbol identifier}}
// expected-error@+1 {{op dst index must be a valid dimension or symbol identifier}}
affine.dma_start %0[%i0], %1[%3], %2[%c0], %c64
: memref<100xf32>, memref<100xf32, 2>, memref<1xi32, 4>
}
Expand All @@ -118,7 +118,7 @@ func.func @dma_start_non_affine_tag_index(%arg0 : index) {
%c64 = arith.constant 64 : index
affine.for %i0 = 0 to 10 {
%3 = arith.muli %i0, %arg0 : index
// expected-error@+1 {{op tag index must be a dimension or symbol identifier}}
// expected-error@+1 {{op tag index must be a valid dimension or symbol identifier}}
affine.dma_start %0[%i0], %1[%arg0], %2[%3], %c64
: memref<100xf32>, memref<100xf32, 2>, memref<1xi32, 4>
}
Expand All @@ -135,7 +135,7 @@ func.func @dma_wait_non_affine_tag_index(%arg0 : index) {
%c64 = arith.constant 64 : index
affine.for %i0 = 0 to 10 {
%3 = arith.muli %i0, %arg0 : index
// expected-error@+1 {{op index must be a dimension or symbol identifier}}
// expected-error@+1 {{op index must be a valid dimension or symbol identifier}}
affine.dma_wait %2[%3], %c64 : memref<1xi32, 4>
}
return
Expand Down