[MLIR]`mlir-runner` crashes when calling `printMemrefI32`

[sweead]

test commit: d1e43f6

step to reproduce:

mlir-runner test.mlir -e main -entry-point-result=void -shared-libs=/home/workdir/llvm-project/build/lib/libmlir_runner_utils.so

Minimal MLIR program (test.mlir):

module {
  llvm.func @malloc(i64) -> !llvm.ptr
  llvm.func @printMemrefI32(i64, !llvm.ptr) attributes {sym_visibility = "private"}
  llvm.func @main() {
    %0 = llvm.mlir.constant(1 : index) : i64
    %1 = llvm.alloca %0 x !llvm.struct<(ptr, ptr, i64)> : (i64) -> !llvm.ptr
    %2 = llvm.mlir.poison : !llvm.struct<(i64, ptr)>
    %3 = llvm.insertvalue %0, %2[0] : !llvm.struct<(i64, ptr)> 
    %4 = llvm.insertvalue %1, %3[1] : !llvm.struct<(i64, ptr)> 
    %5 = llvm.extractvalue %4[0] : !llvm.struct<(i64, ptr)> 
    %6 = llvm.extractvalue %4[1] : !llvm.struct<(i64, ptr)> 
    llvm.call @printMemrefI32(%5, %6) : (i64, !llvm.ptr) -> ()
    llvm.return
  }
}

Crash backtrace:

Unranked Memref base@ = 0x616d5f72696c6d5f rank = 1 offset = 140734854360681 sizes = [139904937754669] strides = [40] data = 
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /home/workdir/llvm-project/build/bin/mlir-runner test.mlir -e main -entry-point-result=void -shared-libs=/home/workdir/llvm-project/build/lib/libmlir_runner_utils.so
 #0 0x000056212b955f38 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/workdir/llvm-project/build/bin/mlir-runner+0x434f38)
 #1 0x000056212b953835 llvm::sys::RunSignalHandlers() (/home/workdir/llvm-project/build/bin/mlir-runner+0x432835)
 #2 0x000056212b956ce1 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #3 0x00007f3e27b9c520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007f3e2634a1c7 impl::MemRefDataPrinter<int>::print(std::ostream&, int*, long, long, long, long const*, long const*) (/home/workdir/llvm-project/build/lib/libmlir_runner_utils.so+0x81c7)
 #5 0x00007f3e2634a1b2 impl::MemRefDataPrinter<int>::print(std::ostream&, int*, long, long, long, long const*, long const*) (/home/workdir/llvm-project/build/lib/libmlir_runner_utils.so+0x81b2)
 #6 0x00007f3e2634a0e6 void impl::printMemRef<int>(DynamicMemRefType<int> const&) (/home/workdir/llvm-project/build/lib/libmlir_runner_utils.so+0x80e6)
 #7 0x00007f3e26347e0e printMemrefI32 (/home/workdir/llvm-project/build/lib/libmlir_runner_utils.so+0x5e0e)
 #8 0x00007f3e281e0018
 #9 0x00007f3e281e002d
#10 0x000056212be57226 compileAndExecute((anonymous namespace)::Options&, mlir::Operation*, llvm::StringRef, (anonymous namespace)::CompileAndExecuteConfig, void**, std::unique_ptr<llvm::TargetMachine, std::default_delete<llvm::TargetMachine>>) JitRunner.cpp:0:0
#11 0x000056212be54d3d compileAndExecuteVoidFunction((anonymous namespace)::Options&, mlir::Operation*, llvm::StringRef, (anonymous namespace)::CompileAndExecuteConfig, std::unique_ptr<llvm::TargetMachine, std::default_delete<llvm::TargetMachine>>) JitRunner.cpp:0:0
#12 0x000056212be53046 mlir::JitRunnerMain(int, char**, mlir::DialectRegistry const&, mlir::JitRunnerConfig) (/home/workdir/llvm-project/build/bin/mlir-runner+0x932046)
#13 0x000056212b7584d7 main (/home/workdir/llvm-project/build/bin/mlir-runner+0x2374d7)
#14 0x00007f3e27b83d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#15 0x00007f3e27b83e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#16 0x000056212b757fb5 _start (/home/workdir/llvm-project/build/bin/mlir-runner+0x236fb5)
Segmentation fault (core dumped)

[llvmbot]

@llvm/issue-subscribers-mlir

Author: Anonymous_reporter (sweead)

test commit: [d1e43f6](https://github.com/llvm/llvm-project/commit/d1e43f6c1a28c3c64b3655be1fc1aff1029c48c8)

step to reproduce:

mlir-runner test.mlir -e main -entry-point-result=void -shared-libs=/home/workdir/llvm-project/build/lib/libmlir_runner_utils.so

Minimal MLIR program (test.mlir):

module {
  llvm.func @<!-- -->malloc(i64) -&gt; !llvm.ptr
  llvm.func @<!-- -->printMemrefI32(i64, !llvm.ptr) attributes {sym_visibility = "private"}
  llvm.func @<!-- -->main() {
    %0 = llvm.mlir.constant(1 : index) : i64
    %1 = llvm.alloca %0 x !llvm.struct&lt;(ptr, ptr, i64)&gt; : (i64) -&gt; !llvm.ptr
    %2 = llvm.mlir.poison : !llvm.struct&lt;(i64, ptr)&gt;
    %3 = llvm.insertvalue %0, %2[0] : !llvm.struct&lt;(i64, ptr)&gt; 
    %4 = llvm.insertvalue %1, %3[1] : !llvm.struct&lt;(i64, ptr)&gt; 
    %5 = llvm.extractvalue %4[0] : !llvm.struct&lt;(i64, ptr)&gt; 
    %6 = llvm.extractvalue %4[1] : !llvm.struct&lt;(i64, ptr)&gt; 
    llvm.call @<!-- -->printMemrefI32(%5, %6) : (i64, !llvm.ptr) -&gt; ()
    llvm.return
  }
}

Crash backtrace:

Unranked Memref base@ = 0x616d5f72696c6d5f rank = 1 offset = 140734854360681 sizes = [139904937754669] strides = [40] data = 
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /home/workdir/llvm-project/build/bin/mlir-runner test.mlir -e main -entry-point-result=void -shared-libs=/home/workdir/llvm-project/build/lib/libmlir_runner_utils.so
 #<!-- -->0 0x000056212b955f38 llvm::sys::PrintStackTrace(llvm::raw_ostream&amp;, int) (/home/workdir/llvm-project/build/bin/mlir-runner+0x434f38)
 #<!-- -->1 0x000056212b953835 llvm::sys::RunSignalHandlers() (/home/workdir/llvm-project/build/bin/mlir-runner+0x432835)
 #<!-- -->2 0x000056212b956ce1 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #<!-- -->3 0x00007f3e27b9c520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #<!-- -->4 0x00007f3e2634a1c7 impl::MemRefDataPrinter&lt;int&gt;::print(std::ostream&amp;, int*, long, long, long, long const*, long const*) (/home/workdir/llvm-project/build/lib/libmlir_runner_utils.so+0x81c7)
 #<!-- -->5 0x00007f3e2634a1b2 impl::MemRefDataPrinter&lt;int&gt;::print(std::ostream&amp;, int*, long, long, long, long const*, long const*) (/home/workdir/llvm-project/build/lib/libmlir_runner_utils.so+0x81b2)
 #<!-- -->6 0x00007f3e2634a0e6 void impl::printMemRef&lt;int&gt;(DynamicMemRefType&lt;int&gt; const&amp;) (/home/workdir/llvm-project/build/lib/libmlir_runner_utils.so+0x80e6)
 #<!-- -->7 0x00007f3e26347e0e printMemrefI32 (/home/workdir/llvm-project/build/lib/libmlir_runner_utils.so+0x5e0e)
 #<!-- -->8 0x00007f3e281e0018
 #<!-- -->9 0x00007f3e281e002d
#<!-- -->10 0x000056212be57226 compileAndExecute((anonymous namespace)::Options&amp;, mlir::Operation*, llvm::StringRef, (anonymous namespace)::CompileAndExecuteConfig, void**, std::unique_ptr&lt;llvm::TargetMachine, std::default_delete&lt;llvm::TargetMachine&gt;&gt;) JitRunner.cpp:0:0
#<!-- -->11 0x000056212be54d3d compileAndExecuteVoidFunction((anonymous namespace)::Options&amp;, mlir::Operation*, llvm::StringRef, (anonymous namespace)::CompileAndExecuteConfig, std::unique_ptr&lt;llvm::TargetMachine, std::default_delete&lt;llvm::TargetMachine&gt;&gt;) JitRunner.cpp:0:0
#<!-- -->12 0x000056212be53046 mlir::JitRunnerMain(int, char**, mlir::DialectRegistry const&amp;, mlir::JitRunnerConfig) (/home/workdir/llvm-project/build/bin/mlir-runner+0x932046)
#<!-- -->13 0x000056212b7584d7 main (/home/workdir/llvm-project/build/bin/mlir-runner+0x2374d7)
#<!-- -->14 0x00007f3e27b83d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#<!-- -->15 0x00007f3e27b83e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#<!-- -->16 0x000056212b757fb5 _start (/home/workdir/llvm-project/build/bin/mlir-runner+0x236fb5)
Segmentation fault (core dumped)

[CoTinker]

It segfault in

llvm-project/mlir/include/mlir/ExecutionEngine/RunnerUtils.h

Line 177 in 10b323b

os << base[offset];

(gdb) p base + offset
$1 = (int *) 0x20000014a7b52
(gdb) x/4x 0x20000014a7b52
0x20000014a7b52:        Cannot access memory at address 0x20000014a7b52

[joker-eph]

I'm confused, what do you expect this code to actually do?

[sweead]

@joker-eph I'm testing MLIR and found that a very long IR caused this crash. To make it easier to isolate the problem, I reduced it to a minimal test case. If I submit an issue in the future, I can include the original IR.

[joker-eph]

I would encourage you to try to understand what the code is doing first, it seems to me that you're trying to print from some random pointer.

Please re-open if you believe this should work.