[mlir] Crash when using --test-vector-unrolling-patterns

[AnonymousBugreporter1]

I have the following MLIR program:
test.mlir:

module {
  func.func @func1() {
    %cst_25 = arith.constant dense<3.718400e+04> : vector<4x2x2xf16>
    %cst_26 = arith.constant dense<1.000000e+00> : vector<24x2x2xf32>
    %47 = vector.fma %cst_26, %cst_26, %cst_26 : vector<24x2x2xf32>
    %818 = scf.execute_region -> vector<24x2x2xf32> {
        scf.yield %47 : vector<24x2x2xf32>
      }
    %823 = vector.extract_strided_slice %cst_25 {offsets = [2], sizes = [1], strides = [1]} : vector<4x2x2xf16> to vector<1x2x2xf16>
    return
  }
}

The above MLIR program will cause a crash when using the following command:

mlir-opt --test-vector-unrolling-patterns test.mlir

And the crash backtrace is:

mlir-opt: /data/tmp/v0207/llvm-project/mlir/lib/Dialect/Vector/IR/VectorOps.cpp:3536: mlir::Type inferStridedSliceOpResultType(mlir::VectorType, mlir::ArrayAttr, mlir::ArrayAttr, mlir::ArrayAttr): Assertion `offsets.size() == sizes.size() && offsets.size() == strides.size()' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /data/tmp/v0207/llvm-project/build/bin/mlir-opt --test-vector-unrolling-patterns test.mlir
 #0 0x0000562344a6b1df llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x170a1df)
 #1 0x0000562344a68234 SignalHandler(int) Signals.cpp:0:0
 #2 0x00007f4eee883420 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14420)
 #3 0x00007f4eee35000b raise (/lib/x86_64-linux-gnu/libc.so.6+0x4300b)
 #4 0x00007f4eee32f859 abort (/lib/x86_64-linux-gnu/libc.so.6+0x22859)
 #5 0x00007f4eee32f729 (/lib/x86_64-linux-gnu/libc.so.6+0x22729)
 #6 0x00007f4eee340fd6 (/lib/x86_64-linux-gnu/libc.so.6+0x33fd6)
 #7 0x000056234719ac01 inferStridedSliceOpResultType(mlir::VectorType, mlir::ArrayAttr, mlir::ArrayAttr, mlir::ArrayAttr) VectorOps.cpp:0:0
 #8 0x00005623471bed6d mlir::vector::ExtractStridedSliceOp::build(mlir::OpBuilder&, mlir::OperationState&, mlir::Value, llvm::ArrayRef<long>, llvm::ArrayRef<long>, llvm::ArrayRef<long>) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x3e5dd6d)
 #9 0x00005623472bba44 (anonymous namespace)::UnrollElementwisePattern::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&) const (.part.0) VectorUnroll.cpp:0:0
#10 0x000056234b6d23d8 mlir::PatternApplicator::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&, llvm::function_ref<bool (mlir::Pattern const&)>, llvm::function_ref<void (mlir::Pattern const&)>, llvm::function_ref<llvm::LogicalResult (mlir::Pattern const&)>) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x83713d8)
#11 0x0000562347bd4120 (anonymous namespace)::GreedyPatternRewriteDriver::processWorklist() GreedyPatternRewriteDriver.cpp:0:0
#12 0x0000562347bd723b mlir::applyPatternsGreedily(mlir::Region&, mlir::FrozenRewritePatternSet const&, mlir::GreedyRewriteConfig, bool*) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x487623b)
#13 0x00005623483454f2 mlir::applyPatternsGreedily(mlir::Operation*, mlir::FrozenRewritePatternSet const&, mlir::GreedyRewriteConfig, bool*) (.constprop.0) TestVectorTransforms.cpp:0:0
#14 0x00005623483509df (anonymous namespace)::TestVectorUnrollingPatterns::runOnOperation() TestVectorTransforms.cpp:0:0
#15 0x0000562347b1afb1 mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47b9fb1)
#16 0x0000562347b1b44a mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47ba44a)
#17 0x0000562347b1b7ce mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::'lambda'(mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo&)::operator()(mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo&) const Pass.cpp:0:0
#18 0x0000562347b1a4b5 mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47b94b5)
#19 0x0000562347b1acdb mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47b9cdb)
#20 0x0000562347b1b44a mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47ba44a)
#21 0x0000562347b1bf84 mlir::PassManager::run(mlir::Operation*) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47baf84)
#22 0x0000562347b0d09b performActions(llvm::raw_ostream&, std::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) MlirOptMain.cpp:0:0
#23 0x0000562347b0db02 processBuffer(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::MlirOptMainConfig const&, mlir::DialectRegistry&, llvm::ThreadPoolInterface*) MlirOptMain.cpp:0:0
#24 0x0000562347b0dd74 llvm::LogicalResult llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::'lambda'(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>(long, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&) MlirOptMain.cpp:0:0
#25 0x0000562347c1676e mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x48b576e)
#26 0x0000562347b04989 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47a3989)
#27 0x0000562347b0dee1 mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47acee1)
#28 0x0000562347b0e3a6 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47ad3a6)
#29 0x000056234497d01b main (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x161c01b)
#30 0x00007f4eee331083 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24083)
#31 0x0000562344a3baee _start (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x16daaee)
Aborted (core dumped)

My git version is 4d3148d.

[llvmbot]

@llvm/issue-subscribers-mlir

Author: None (wangyongj1a)

I have the following MLIR program: test.mlir: ``` module { func.func @func1() { %cst_25 = arith.constant dense<3.718400e+04> : vector<4x2x2xf16> %cst_26 = arith.constant dense<1.000000e+00> : vector<24x2x2xf32> %47 = vector.fma %cst_26, %cst_26, %cst_26 : vector<24x2x2xf32> %818 = scf.execute_region -> vector<24x2x2xf32> { scf.yield %47 : vector<24x2x2xf32> } %823 = vector.extract_strided_slice %cst_25 {offsets = [2], sizes = [1], strides = [1]} : vector<4x2x2xf16> to vector<1x2x2xf16> return } } ``` The above MLIR program will cause a crash when using the following command: ``` mlir-opt --test-vector-unrolling-patterns test.mlir ``` And the crash backtrace is: ``` mlir-opt: /data/tmp/v0207/llvm-project/mlir/lib/Dialect/Vector/IR/VectorOps.cpp:3536: mlir::Type inferStridedSliceOpResultType(mlir::VectorType, mlir::ArrayAttr, mlir::ArrayAttr, mlir::ArrayAttr): Assertion `offsets.size() == sizes.size() && offsets.size() == strides.size()' failed. PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace. Stack dump: 0. Program arguments: /data/tmp/v0207/llvm-project/build/bin/mlir-opt --test-vector-unrolling-patterns test.mlir #0 0x0000562344a6b1df llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x170a1df) #1 0x0000562344a68234 SignalHandler(int) Signals.cpp:0:0 #2 0x00007f4eee883420 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14420) #3 0x00007f4eee35000b raise (/lib/x86_64-linux-gnu/libc.so.6+0x4300b) #4 0x00007f4eee32f859 abort (/lib/x86_64-linux-gnu/libc.so.6+0x22859) #5 0x00007f4eee32f729 (/lib/x86_64-linux-gnu/libc.so.6+0x22729) #6 0x00007f4eee340fd6 (/lib/x86_64-linux-gnu/libc.so.6+0x33fd6) #7 0x000056234719ac01 inferStridedSliceOpResultType(mlir::VectorType, mlir::ArrayAttr, mlir::ArrayAttr, mlir::ArrayAttr) VectorOps.cpp:0:0 #8 0x00005623471bed6d mlir::vector::ExtractStridedSliceOp::build(mlir::OpBuilder&, mlir::OperationState&, mlir::Value, llvm::ArrayRef<long>, llvm::ArrayRef<long>, llvm::ArrayRef<long>) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x3e5dd6d) #9 0x00005623472bba44 (anonymous namespace)::UnrollElementwisePattern::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&) const (.part.0) VectorUnroll.cpp:0:0 #10 0x000056234b6d23d8 mlir::PatternApplicator::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&, llvm::function_ref<bool (mlir::Pattern const&)>, llvm::function_ref<void (mlir::Pattern const&)>, llvm::function_ref<llvm::LogicalResult (mlir::Pattern const&)>) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x83713d8) #11 0x0000562347bd4120 (anonymous namespace)::GreedyPatternRewriteDriver::processWorklist() GreedyPatternRewriteDriver.cpp:0:0 #12 0x0000562347bd723b mlir::applyPatternsGreedily(mlir::Region&, mlir::FrozenRewritePatternSet const&, mlir::GreedyRewriteConfig, bool*) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x487623b) #13 0x00005623483454f2 mlir::applyPatternsGreedily(mlir::Operation*, mlir::FrozenRewritePatternSet const&, mlir::GreedyRewriteConfig, bool*) (.constprop.0) TestVectorTransforms.cpp:0:0 #14 0x00005623483509df (anonymous namespace)::TestVectorUnrollingPatterns::runOnOperation() TestVectorTransforms.cpp:0:0 #15 0x0000562347b1afb1 mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47b9fb1) #16 0x0000562347b1b44a mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47ba44a) #17 0x0000562347b1b7ce mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::'lambda'(mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo&)::operator()(mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo&) const Pass.cpp:0:0 #18 0x0000562347b1a4b5 mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47b94b5) #19 0x0000562347b1acdb mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47b9cdb) #20 0x0000562347b1b44a mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47ba44a) #21 0x0000562347b1bf84 mlir::PassManager::run(mlir::Operation*) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47baf84) #22 0x0000562347b0d09b performActions(llvm::raw_ostream&, std::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) MlirOptMain.cpp:0:0 #23 0x0000562347b0db02 processBuffer(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::MlirOptMainConfig const&, mlir::DialectRegistry&, llvm::ThreadPoolInterface*) MlirOptMain.cpp:0:0 #24 0x0000562347b0dd74 llvm::LogicalResult llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::'lambda'(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>(long, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&) MlirOptMain.cpp:0:0 #25 0x0000562347c1676e mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x48b576e) #26 0x0000562347b04989 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47a3989) #27 0x0000562347b0dee1 mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47acee1) #28 0x0000562347b0e3a6 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x47ad3a6) #29 0x000056234497d01b main (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x161c01b) #30 0x00007f4eee331083 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24083) #31 0x0000562344a3baee _start (/data/tmp/v0207/llvm-project/build/bin/mlir-opt+0x16daaee) Aborted (core dumped) ``` My git version is 4d3148d.

[Prakhar-Dixit]

I want to contribute to this project. Can this issue be assigned to me?
@wangyongj1a @banach-space

[Lewuathe]

Apparently, UnrollElementwisePattern.matchAndRewrite tries to create ExtractStridedSliceOp inside.

llvm-project/mlir/lib/Dialect/Vector/Transforms/VectorUnroll.cpp

Lines 458 to 460 in f1627e1

	extractOperands.push_back(
	rewriter.createOrFold<vector::ExtractStridedSliceOp>(
	loc, operand.get(), offsets, *targetShape, strides));

But the passed offsets and strides are invalid.

I reduced the code to be minimal here. Looks like the crash happens around scf.execute_region.

module {
  func.func @func1() {
    %cst_26 = arith.constant dense<1.000000e+00> : vector<3x2x2xf32>
    %47 = vector.fma %cst_26, %cst_26, %cst_26 : vector<3x2x2xf32>
    %818 = scf.execute_region -> vector<3x2x2xf32> {
      scf.yield %47 : vector<3x2x2xf32>
    }
    return
  }
}

@Prakhar-Dixit Of course, you can take it! Thank you for taking a look into this issue.

[Prakhar-Dixit]

Thanks for your valuable input @Lewuathe . However, I believe the crash is occurring around vector.fma because during unrolling, it tries to extract subvectors using the ExtractStridedSliceOp, which seems to be causing the issue.

I’m still unsure why the IR progresses despite having invalid inputs, as verifying invariants should be the verifier’s responsibility, yet it doesn’t seem to be enforcing them properly.

Would it be appropriate to add a check within the pass itself to validate these three attributes? Since they are being created within UnrollElementwisePattern, and in this specific case, I am observing that the offsets’ size is inconsistent with that of targetShape & strides .

For instance, the given IR involves vector<3x2x2>, which generates an offsets array {0,0,0} of size 3 whereas targetShape is {2 ,2 } of size 2 and similarly strides-size is {1,1} again of size 2.

Should we introduce a check in UnrollElementwisePattern which will prevent crashes, or would it be better to enforce some constraints ensuring that options.nativeShape(op) in getTargetShape returns a shape of the same rank as the original vector?

@banach-space @Lewuathe

[banach-space]

Thanks for the investigation! Let me share my findings.

The only existing test for this pass (and that exercises vector.fma) is using 2D vectors:

llvm-project/mlir/test/Dialect/Vector/vector-unroll-options.mlir

Lines 184 to 186 in 41be5bb

	func.func @vector_fma(%a: vector<4x4xf32>, %b: vector<4x4xf32>, %c: vector<4x4xf32>) -> vector<4x4xf32> {
	%0 = vector.fma %a, %b, %c: vector<4x4xf32>
	return %0 : vector<4x4xf32>

The target shape is vector<2x2xf32>, so also a 2D vector. However, in the example above, the input is a 3D vector: vector<24x2x2xf32>. So, it sounds like we end up trying to "extract a 2D strided slice" from a 3D vector. However, that's not supported:

• https://mlir.llvm.org/docs/Dialects/Vector/#vectorextract_strided_slice-vectorextractstridedsliceop

Takes an n-D vector, k-D offsets integer array attribute, a k-sized sizes integer array attribute, a k-sized strides integer array attribute and extracts the n-D subvector at the proper offset.

We should be extracting a 3D slice instead. I believe that's the bug here.

My suggestion - bail out if the "rank of the input vector" != "rank of the target vector". If this functionality is needed, we can iterate.

-Andrzej

[Prakhar-Dixit]

I have added the necessary check. Please review PR #127706. @banach-space