Issue
Project · Status · Date
No issues match the current filter.
#22175
Assertion:(call->func->common.fn_flags & (1 << 12)) ? (zval_get_type(&(*(ret))) == 10) : !(zval_get_type(&(*(ret))) == 10)
php
CRASH 134
2026-05-29
Aparent_aBparent_bA·Bbothnewnovel / fused
1A·B
<?php2new
try {3A
class foo {4A
public function &b() {5A·B
}6A·B
}7A
$foo = new foo;8A
$a = 'b';9new
try { zend_call_method_if_exists($foo,$a,$a); } catch (\Throwable $e) {};10new
} catch (\Throwable $_ffl_e) {}Aparent_aBparent_bA·Bbothnewnovel / fused
1A·B
<?php2new
try {3A
error_reporting(E_ALL);4A
class foo {5A
public $x = array(1);6A
public function &b() {7A
return $this->x;8A·B
}9A·B
}10A
$foo = new foo;11A
$a = 'b';12A
var_dump($foo->$a()[0]);13A
$h = &$foo->$a();14A
$h[] = 2;15A
var_dump($foo->$a());16B
function findNthMostRepeatedElement(array $numbers, int $position): int {17B
validateInput($numbers, $position);18B
$result = null;19B
$counter = [];20B
foreach ($numbers as $i) {21B
if (!isset($counter[$i])) {22B
$counter[$i] = 1;23B
} else {24B
$counter[$i]++;25A·B
}26A·B
}27B
foreach ($counter as $candidate => $count) {28B
if ($count === $position) {29B
$result = $candidate;30B
break;31A·B
}32A·B
}33B
validateResult($result);34B
return $result;35A·B
}36B
function validateInput(array $numbers, int $position): void {37B
if (count($numbers) === 0 || $position <= 0) {38B
throw new InvalidArgumentException("You can't pass empty arrays or position values less than 1 as parameter.");39A·B
}40A·B
}41B
function validateResult(?int $result): void {42B
if ($result === null) {43B
throw new InvalidArgumentException("There are no elements repeated n times in the array passed as argument");44A·B
}45A·B
}46B
$numbers = [1, 2, 2, 3, 3, 3, 4];47B
$position = 2;48B
$result = findNthMostRepeatedElement($numbers, $position);49B
echo $result;50new
var_dump(get_defined_vars());51new
try { zend_call_method_if_exists($h,$x,$fusion); } catch (\Throwable $e) {};52new
try { zend_call_method_if_exists($foo,$a,$a); } catch (\Throwable $e) {};53new
try { zend_call_method_if_exists($fusion,$x,$a); } catch (\Throwable $e) {};54new
try { zend_call_method_if_exists($fusion,$a,$x); } catch (\Throwable $e) {};55new
try { zend_call_method_if_exists($a,$foo,$fusion); } catch (\Throwable $e) {};56new
} catch (\Throwable $_ffl_e) {}php: Zend/zend_vm_execute.h:1334: const zend_op *ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER(zend_execute_data *, const zend_op *): Assertion `(call->func->common.fn_flags & (1 << 12)) ? (zval_get_type(&(*(ret))) == 10) : !(zval_get_type(&(*(ret))) == 10)' failed.
Aborted (core dumped)
int(1)
array(2) {
[0]=>
int(1)
[1]=>
int(2)
}
2array(13) {
["argv"]=>
array(1) {
[0]=>
string(68) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/a3ef0eae.php"
}
["argc"]=>
int(1)
["_GET"]=>
array(0) {
}
["_POST"]=>
array(0) {
}
["_COOKIE"]=>
array(0) {
}
["_FILES"]=>
array(0) {
}
["_SERVER"]=>
array(26) {
["LESSOPEN"]=>
string(22) "| /usr/bin/lesspipe %s"
["TMUX"]=>
string(27) "/tmp/tmux-1000/default,31,0"
["HOSTNAME"]=>
string(12) "9ed0f369a397"
["SHLVL"]=>
string(1) "2"
["HOME"]=>
string(10) "/home/fuzz"
["OLDPWD"]=>
string(20) "/home/fuzz/WorkSpace"
["TERM_PROGRAM_VERSION"]=>
string(4) "3.2a"
["LC_CTYPE"]=>
string(7) "C.UTF-8"
["_"]=>
string(16) "/usr/bin/python3"
["TERM"]=>
string(6) "screen"
["PATH"]=>
string(60) "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
["LS_COLORS"]=>
string(1508) "rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:"
["TERM_PROGRAM"]=>
string(4) "tmux"
["SHELL"]=>
string(7) "/bin/sh"
["LESSCLOSE"]=>
string(23) "/usr/bin/lesspipe %s %s"
["PWD"]=>
string(55) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared"
["TMUX_PANE"]=>
string(2) "%0"
["PHP_SELF"]=>
string(68) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/a3ef0eae.php"
["SCRIPT_NAME"]=>
string(68) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/a3ef0eae.php"
["SCRIPT_FILENAME"]=>
string(68) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/a3ef0eae.php"
["PATH_TRANSLATED"]=>
string(68) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/a3ef0eae.php"
["DOCUMENT_ROOT"]=>
string(0) ""
["REQUEST_TIME_FLOAT"]=>
float(1779803226.926147)
["REQUEST_TIME"]=>
int(1779803226)
["argv"]=>
array(1) {
[0]=>
string(68) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/a3ef0eae.php"
}
["argc"]=>
int(1)
}
["foo"]=>
object(foo)#1 (1) {
["x"]=>
&array(2) {
[0]=>
int(1)
[1]=>
int(2)
}
}
["a"]=>
string(1) "b"
["h"]=>
&array(2) {
[0]=>
int(1)
[1]=>
int(2)
}
["numbers"]=>
array(7) {
[0]=>
int(1)
[1]=>
int(2)
[2]=>
int(2)
[3]=>
int(3)
[4]=>
int(3)
[5]=>
int(3)
[6]=>
int(4)
}
["position"]=>
int(2)
["result"]=>
int(2)
}
Warning: Undefined variable $x in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/a3ef0eae.php on line 51
Warning: Undefined variable $fusion in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/a3ef0eae.php on line 51<?php
error_reporting(E_ALL);
class foo {
public $x = array(1);
public function &b() {
return $this->x;
}
}
$foo = new foo;
$a = 'b';
var_dump($foo->$a()[0]);
$h = &$foo->$a();
$h[] = 2;
var_dump($foo->$a());
?><?php
function findNthMostRepeatedElement(array $numbers, int $position): int {
validateInput($numbers, $position);
$result = null;
$counter = [];
foreach ($numbers as $i) {
if (!isset($counter[$i])) {
$counter[$i] = 1;
} else {
$counter[$i]++;
}
}
foreach ($counter as $candidate => $count) {
if ($count === $position) {
$result = $candidate;
break;
}
}
validateResult($result);
return $result;
}
function validateInput(array $numbers, int $position): void {
if (count($numbers) === 0 || $position <= 0) {
throw new InvalidArgumentException("You can't pass empty arrays or position values less than 1 as parameter.");
}
}
function validateResult(?int $result): void {
if ($result === null) {
throw new InvalidArgumentException("There are no elements repeated n times in the array passed as argument");
}
}
$numbers = [1, 2, 2, 3, 3, 3, 4];
$position = 2;
$result = findNthMostRepeatedElement($numbers, $position);
echo $result;
#22142
Assertion:0
php
CRASH 134
2026-05-25
Aparent_aBparent_bA·Bbothnewnovel / fused
1A·B
<?php2new
try {3new
try { $cls = new LibXMLError(); } catch (\Throwable $_e) { $cls = new stdClass(); }4new
try { deflate_init($fusion,$cls); } catch (\Throwable $e) {};5new
} catch (\Throwable $_ffl_e) {}Aparent_aBparent_bA·Bbothnewnovel / fused
1A·B
<?php2new
try {3new
try { $cls = new LibXMLError(); } catch (\Throwable $_e) { $cls = new stdClass(); }4new
try { $clsAttr=$cls->code; } catch (\Throwable $_e) {}5A
class LType {6A
public string $name;7A
public function __construct(string $name) { $this->name = $name; }8A·B
}9A
class LTypes {10A
public static LType $Bool;11A
public static LType $Date;12A
public static LType $Time;13A
public static LType $Number;14A
public static LType $String;15A
public static LType $Array;16A
public static LType $Map;17A
public static LType $Null;18A
public static LType $Object;19A·B
}20A
LTypes::$Bool = new LType('Bool');21A
LTypes::$Date = new LType('Date');22A
LTypes::$Time = new LType('Time');23A
LTypes::$Number = new LType('Number');24A
LTypes::$String = new LType('String');25A
LTypes::$Array = new LType('Array');26A
LTypes::$Map = new LType('Map');27A
LTypes::$Null = new LType('Null');28A
LTypes::$Object = new LType('Object');29A
class LObject {30A
public LType $type;31A
protected $value;32A
public function __construct($value = null, ?LType $type = null) { $this->value = $value; $this->type = $type ?? LTypes::$Object; }33A
public function getValue() { return $this->value; }34A·B
}35A
class LNumber extends LObject { public function __construct($v) { parent::__construct((float)$v, LTypes::$Number); } }36A
class LString extends LObject { public function __construct($v) { parent::__construct((string)$v, LTypes::$String); } }37A
class LBool extends LObject { public function __construct($v) { parent::__construct((bool)$v, LTypes::$Bool); } }38A
class LArray extends LObject { public function __construct($v) { parent::__construct($v, LTypes::$Array); } }39A
class LMap extends LObject { public function __construct($v) { parent::__construct($v, LTypes::$Map); } }40A
$args = [1, 2.5, "3", true, null, [new LNumber(4), new LString("5")], ["a" => 1, "b" => 2]];41A
for ($i = 0; $i < count($args); $i++) {42A
$v = $args[$i];43A
if ($v === null) $args[$i] = new LObject(null, LTypes::$Null);44A
elseif (is_int($v) || is_float($v)) $args[$i] = new LNumber($v);45A
elseif (is_string($v)) $args[$i] = new LString($v);46A
elseif (is_bool($v)) $args[$i] = new LBool($v);47A
elseif (is_array($v) && array_keys($v) === range(0, count($v) - 1)) $args[$i] = new LArray($v);48A
elseif (is_array($v)) $args[$i] = new LMap($v);49A·B
}50A
$out = [];51A
foreach ($args as $v) $out[] = $v instanceof LObject ? $v->getValue() : $v;52A
echo json_encode($out), PHP_EOL;53B
class Player {54B
public $name;55B
public $world;56B
function __construct($name, $world) {57B
$this->name = $name;58B
$this->world = $world;59A·B
}60B
function teleport($location) {61B
// Simulate teleporting the player62B
echo "Teleported " . $this->name . " to " . $location->x . "," . $location->y . "," . $location->z . "\n";63A·B
}64A·B
}65B
class Location {66B
public $world;67B
public $x;68B
public $y;69B
public $z;70B
function __construct($world, $x, $y, $z) {71B
$this->world = $world;72B
$this->x = $x;73B
$this->y = $y;74B
$this->z = $z;75A·B
}76A·B
}77B
function getInteger($value, $min, $max) {78B
$intValue = intval($value);79B
if ($intValue < $min || $intValue > $max) {80B
return null;81A·B
}82B
return $intValue;83A·B
}84B
$world = "world";85B
$player = new Player("Steve", $world);86B
$args = ["Steve", "30000001", "0", "30000001"]; // simulate input args87B
if (count($args) < 1 || count($args) > 4) {88B
echo "Usage: /tp [player] <target>\n/tp [player] <x> <y> <z>\n";89B
exit;90A·B
}91B
if (count($args) == 1 || count($args) == 3) {92B
// Simulating sender being a player93B
} else {94B
$target = new Player($args[0], $world); // simulate getting target player95A·B
}96B
if (!isset($target)) {97B
echo "Player not found: " . $args[0] . "\n";98A·B
}99B
if (count($args) < 3) {100B
// Simulate finding target player101B
$target = new Player($args[count($args) - 1], $world); // simulate getting target player102B
if (!isset($target)) {103B
echo "Can't find user " . $args[count($args) - 1] . ". No tp.\n";104A·B
}105B
$player->teleport($target);106B
} else if ($player->world != null) {107B
$x = getInteger($args[count($args) - 3], -30000000, 30000000);108B
$y = getInteger($args[count($args) - 2], 0, 256);109B
$z = getInteger($args[count($args) - 1], -30000000, 30000000);110B
$location = new Location($player->world, $x, $y, $z);111B
$player->teleport($location);112A·B
}113new
var_dump(get_defined_vars());114new
try { deflate_init($fusion,$fusion); } catch (\Throwable $e) {};115new
try { deflate_init($cls,$cls); } catch (\Throwable $e) {};116new
try { deflate_init($clsAttr,$fusion); } catch (\Throwable $e) {};117new
try { deflate_init($clsAttr,$clsAttr); } catch (\Throwable $e) {};118new
try { deflate_init($fusion,$cls); } catch (\Throwable $e) {};119new
} catch (\Throwable $_ffl_e) {}php: /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_operators.c:463: zend_long zendi_try_get_long(const zval *, _Bool *): Assertion `0' failed.
Aborted (core dumped)
[1,2.5,"3",true,null,[{"type":{"name":"Number"}},{"type":{"name":"String"}}],{"a":1,"b":2}]
Teleported Steve to ,0,
array(20) {
["argv"]=>
array(1) {
[0]=>
string(68) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/cbc05c9b.php"
}
["argc"]=>
int(1)
["_GET"]=>
array(0) {
}
["_POST"]=>
array(0) {
}
["_COOKIE"]=>
array(0) {
}
["_FILES"]=>
array(0) {
}
["_SERVER"]=>
array(26) {
["LESSOPEN"]=>
string(22) "| /usr/bin/lesspipe %s"
["TMUX"]=>
string(27) "/tmp/tmux-1000/default,31,0"
["HOSTNAME"]=>
string(12) "9ed0f369a397"
["SHLVL"]=>
string(1) "2"
["HOME"]=>
string(10) "/home/fuzz"
["OLDPWD"]=>
string(20) "/home/fuzz/WorkSpace"
["TERM_PROGRAM_VERSION"]=>
string(4) "3.2a"
["LC_CTYPE"]=>
string(7) "C.UTF-8"
["_"]=>
string(16) "/usr/bin/python3"
["TERM"]=>
string(6) "screen"
["PATH"]=>
string(60) "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
["LS_COLORS"]=>
string(1508) "rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:"
["TERM_PROGRAM"]=>
string(4) "tmux"
["SHELL"]=>
string(7) "/bin/sh"
["LESSCLOSE"]=>
string(23) "/usr/bin/lesspipe %s %s"
["PWD"]=>
string(55) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared"
["TMUX_PANE"]=>
string(2) "%0"
["PHP_SELF"]=>
string(68) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/cbc05c9b.php"
["SCRIPT_NAME"]=>
string(68) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/cbc05c9b.php"
["SCRIPT_FILENAME"]=>
string(68) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/cbc05c9b.php"
["PATH_TRANSLATED"]=>
string(68) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/cbc05c9b.php"
["DOCUMENT_ROOT"]=>
string(0) ""
["REQUEST_TIME_FLOAT"]=>
float(1.7796E+9)
["REQUEST_TIME"]=>
int(1779626154)
["argv"]=>
array(1) {
[0]=>
string(68) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/cbc05c9b.php"
}
["argc"]=>
int(1)
}
["cls"]=>
object(LibXMLError)#1 (0) {
["level"]=>
uninitialized(int)
["code"]=>
uninitialized(int)
["column"]=>
uninitialized(int)
["message"]=>
uninitialized(string)
["file"]=>
uninitialized(string)
["line"]=>
uninitialized(int)
}
["_e"]=>
object(Error)#2 (7) {
["message":protected]=>
string(76) "Typed property LibXMLError::$code must not be accessed before initialization"
["string":"Error":private]=>
string(0) ""
["code":protected]=>
int(0)
["file":protected]=>
string(68) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/cbc05c9b.php"
["line":protected]=>
int(4)
["trace":"Error":private]=>
array(0) {
}
["previous":"Error":private]=>
NULL
}
["args"]=>
array(4) {
[0]=>
string(5) "Steve"
[1]=>
string(8) "30000001"
[2]=>
string(1) "0"
[3]=>
string(8) "30000001"
}
["i"]=>
int(7)
["v"]=>
object(LMap)#20 (2) {
["type"]=>
object(LType)#9 (1) {
["name"]=>
string(3) "Map"
}
["value":protected]=>
array(2) {
["a"]=>
int(1)
["b"]=>
int(2)
}
}
["out"]=>
array(7) {
[0]=>
float(1)
[1]=>
float(2.5)
[2]=>
string(1) "3"
[3]=>
bool(true)
[4]=>
NULL
[5]=>
array(2) {
[0]=>
object(LNumber)#12 (2) {
["type"]=>
object(LType)#6 (1) {
["name"]=>
string(6) "Number"
}
["value":protected]=>
float(4)
}
[1]=>
object(LString)#13 (2) {
["type"]=>
object(LType)#7 (1) {
["name"]=>
string(6) "String"
}
["value":protected]=>
string(1) "5"
}
}
[6]=>
array(2) {
["a"]=>
int(1)
["b"]=>
int(2)
}
}
["world"]=>
string(5) "world"
["player"]=>
object(Player)#21 (2) {
["name"]=>
string(5) "Steve"
["world"]=>
string(5) "world"
}
["target"]=>
object(Player)#19 (2) {
["name"]=>
string(5) "Steve"
["world"]=>
string(5) "world"
}
["x"]=>
NULL
["y"]=>
int(0)
["z"]=>
NULL
["location"]=>
object(Location)#18 (4) {
["world"]=>
string(5) "world"
["x"]=>
NULL
["y"]=>
int(0)
["z"]=>
NULL
}
}
Warning: Undefined variable $fusion in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/cbc05c9b.php on line 114
Warning: Undefined variable $fusion in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/cbc05c9b.php on line 114
Deprecated: deflate_init(): Passing null to parameter #1 ($encoding) of type int is deprecated in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/cbc05c9b.php on line 114
Warning: Undefined variable $clsAttr in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/cbc05c9b.php on line 116
Warning: Undefined variable $fusion in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/cbc05c9b.php on line 116
Deprecated: deflate_init(): Passing null to parameter #1 ($encoding) of type int is deprecated in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/cbc05c9b.php on line 116
Warning: Undefined variable $clsAttr in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/cbc05c9b.php on line 117
Warning: Undefined variable $clsAttr in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/cbc05c9b.php on line 117
Deprecated: deflate_init(): Passing null to parameter #1 ($encoding) of type int is deprecated in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/cbc05c9b.php on line 117
Warning: Undefined variable $fusion in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/cbc05c9b.php on line 118
Deprecated: deflate_init(): Passing null to parameter #1 ($encoding) of type int is deprecated in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/cbc05c9b.php on line 118<?php
class LType {
public string $name;
public function __construct(string $name) { $this->name = $name; }
}
class LTypes {
public static LType $Bool;
public static LType $Date;
public static LType $Time;
public static LType $Number;
public static LType $String;
public static LType $Array;
public static LType $Map;
public static LType $Null;
public static LType $Object;
}
LTypes::$Bool = new LType('Bool');
LTypes::$Date = new LType('Date');
LTypes::$Time = new LType('Time');
LTypes::$Number = new LType('Number');
LTypes::$String = new LType('String');
LTypes::$Array = new LType('Array');
LTypes::$Map = new LType('Map');
LTypes::$Null = new LType('Null');
LTypes::$Object = new LType('Object');
class LObject {
public LType $type;
protected $value;
public function __construct($value = null, ?LType $type = null) { $this->value = $value; $this->type = $type ?? LTypes::$Object; }
public function getValue() { return $this->value; }
}
class LNumber extends LObject { public function __construct($v) { parent::__construct((float)$v, LTypes::$Number); } }
class LString extends LObject { public function __construct($v) { parent::__construct((string)$v, LTypes::$String); } }
class LBool extends LObject { public function __construct($v) { parent::__construct((bool)$v, LTypes::$Bool); } }
class LArray extends LObject { public function __construct($v) { parent::__construct($v, LTypes::$Array); } }
class LMap extends LObject { public function __construct($v) { parent::__construct($v, LTypes::$Map); } }
$args = [1, 2.5, "3", true, null, [new LNumber(4), new LString("5")], ["a" => 1, "b" => 2]];
for ($i = 0; $i < count($args); $i++) {
$v = $args[$i];
if ($v === null) $args[$i] = new LObject(null, LTypes::$Null);
elseif (is_int($v) || is_float($v)) $args[$i] = new LNumber($v);
elseif (is_string($v)) $args[$i] = new LString($v);
elseif (is_bool($v)) $args[$i] = new LBool($v);
elseif (is_array($v) && array_keys($v) === range(0, count($v) - 1)) $args[$i] = new LArray($v);
elseif (is_array($v)) $args[$i] = new LMap($v);
}
$out = [];
foreach ($args as $v) $out[] = $v instanceof LObject ? $v->getValue() : $v;
echo json_encode($out), PHP_EOL;
?><?php
class Player {
public $name;
public $world;
function __construct($name, $world) {
$this->name = $name;
$this->world = $world;
}
function teleport($location) {
// Simulate teleporting the player
echo "Teleported " . $this->name . " to " . $location->x . "," . $location->y . "," . $location->z . "\n";
}
}
class Location {
public $world;
public $x;
public $y;
public $z;
function __construct($world, $x, $y, $z) {
$this->world = $world;
$this->x = $x;
$this->y = $y;
$this->z = $z;
}
}
function getInteger($value, $min, $max) {
$intValue = intval($value);
if ($intValue < $min || $intValue > $max) {
return null;
}
return $intValue;
}
$world = "world";
$player = new Player("Steve", $world);
$args = ["Steve", "30000001", "0", "30000001"]; // simulate input args
if (count($args) < 1 || count($args) > 4) {
echo "Usage: /tp [player] <target>\n/tp [player] <x> <y> <z>\n";
exit;
}
if (count($args) == 1 || count($args) == 3) {
// Simulating sender being a player
} else {
$target = new Player($args[0], $world); // simulate getting target player
}
if (!isset($target)) {
echo "Player not found: " . $args[0] . "\n";
}
if (count($args) < 3) {
// Simulate finding target player
$target = new Player($args[count($args) - 1], $world); // simulate getting target player
if (!isset($target)) {
echo "Can't find user " . $args[count($args) - 1] . ". No tp.\n";
}
$player->teleport($target);
} else if ($player->world != null) {
$x = getInteger($args[count($args) - 3], -30000000, 30000000);
$y = getInteger($args[count($args) - 2], 0, 256);
$z = getInteger($args[count($args) - 1], -30000000, 30000000);
$location = new Location($player->world, $x, $y, $z);
$player->teleport($location);
}
#22112
Assertion:!(((zend_executor_globals *) (((char*) _tsrm_ls_cache)+(executor_globals_offset)))->exception)
php
CRASH 134
2026-05-25
Aparent_aBparent_bA·Bbothnewnovel / fused
1A·B
<?php2new
try {3A
function Error2Exception($errno, $errstr, $errfile, $errline)4A
{5A
throw new MyException($errstr, $errno, $errfile, $errline);6A·B
}7A
set_error_handler('Error2Exception');8B
$nan = fdiv(0, 0);9B
function implicit_to_bool(bool $v) {10A·B
}11B
implicit_to_bool($nan);12new
} catch (\Throwable $_ffl_e) {}Aparent_aBparent_bA·Bbothnewnovel / fused
1A·B
<?php2new
try {3A
interface Catchable4A
{5A·B
}6A
class MyException extends Exception implements Catchable7A
{8A
function __construct($errstr, $errno, $errfile, $errline)9A
{10A
parent::__construct($errstr, $errno);11A
$this->file = $errfile;12A
$this->line = $errline;13A·B
}14A·B
}15A
function Error2Exception($errno, $errstr, $errfile, $errline)16A
{17A
throw new MyException($errstr, $errno, $errfile, $errline);18A·B
}19A
$err_msg = 'no exception';20A
set_error_handler('Error2Exception');21A
try22A
{23A
$con = fopen('/tmp/a_file_that_does_not_exist','r');24A·B
}25A
catch (Catchable $e)26A
{27A
echo "Catchable\n";28A·B
}29A
catch (Exception $e)30A
{31A
echo "Exception\n";32A·B
}33new
$fusion = $e;34B
$nan = fdiv(0, 0);35B
var_dump($nan);36B
function implicit_to_bool(bool $v) {37B
var_dump($v);38A·B
}39new
function implicit_to_string(string $fusion) {40B
var_dump($v);41A·B
}42B
implicit_to_bool($nan);43B
implicit_to_string($nan);44B
var_dump((int) $nan);45B
var_dump((bool) $nan);46B
var_dump((string) $nan);47B
var_dump((array) $nan);48B
var_dump((object) $nan);49B
$types = [50B
'null',51B
'bool',52B
'int',53B
'string',54B
'array',55B
'object',56B
];57B
foreach ($types as $type) {58B
$nan = fdiv(0, 0);59B
settype($nan, $type);60B
var_dump($nan);61A·B
}62new
var_dump(get_defined_vars());63new
} catch (\Throwable $_ffl_e) {}php: Zend/zend_vm_execute.h:2817: const zend_op *zend_verify_recv_arg_type_helper_SPEC(zend_execute_data *, const zend_op *, zval *): Assertion `!(((zend_executor_globals *) (((char*) _tsrm_ls_cache)+(executor_globals_offset)))->exception)' failed.
Aborted (core dumped)
Catchable
float(NAN)<?php
interface Catchable
{
}
class MyException extends Exception implements Catchable
{
function __construct($errstr, $errno, $errfile, $errline)
{
parent::__construct($errstr, $errno);
$this->file = $errfile;
$this->line = $errline;
}
}
function Error2Exception($errno, $errstr, $errfile, $errline)
{
throw new MyException($errstr, $errno, $errfile, $errline);
}
$err_msg = 'no exception';
set_error_handler('Error2Exception');
try
{
$con = fopen('/tmp/a_file_that_does_not_exist','r');
}
catch (Catchable $e)
{
echo "Catchable\n";
}
catch (Exception $e)
{
echo "Exception\n";
}
?><?php
$nan = fdiv(0, 0);
var_dump($nan);
function implicit_to_bool(bool $v) {
var_dump($v);
}
function implicit_to_string(string $v) {
var_dump($v);
}
implicit_to_bool($nan);
implicit_to_string($nan);
var_dump((int) $nan);
var_dump((bool) $nan);
var_dump((string) $nan);
var_dump((array) $nan);
var_dump((object) $nan);
$types = [
'null',
'bool',
'int',
'string',
'array',
'object',
];
foreach ($types as $type) {
$nan = fdiv(0, 0);
settype($nan, $type);
var_dump($nan);
}
?>
#89196
Assertion failed: ((numMissing + numExtra + numWrong > 0) && "Should not call this function with nothing to diagnose"), function diagnoseArgumentLabelError at MiscDiagnostics.cpp:2973.
swift
CRASH 134
2026-05-17
Aparent_aBparent_bA·Bbothnewnovel / fused
1B
func foo(a: Int) {}2B
func foo(q: String = "", a: Int) {}3
4A
foo {} a: {}Aparent_aBparent_bA·Bbothnewnovel / fused
1new
// --- Seed A ---2A
// RUN: %empty-directory(%t)3A
// RUN: split-file %s %t4A
// RUN: %sourcekitd-test -req=find-rename-ranges -rename-spec %t/spec.json %t/main.swift | %FileCheck %s5
6A
// REQUIRES: swift_swift_parser7
8A
//--- main.swift9A
func foo() {}10
11A
// Make sure we don't crash on the unrelated comment refs:12A
// foo()13A
// foo(0)14A
// foo(a: 0)15A
// foo {}16A
// foo {} a: {}17
18A
// Nor when written in code:19A
foo()20A
foo(0)21A
foo(a: 0)22A
foo {}23A
foo {} a: {}24
25A
// CHECK: source.edit.kind.active:26A
// CHECK-NEXT: 1:6-1:9 source.refactoring.range.kind.basename27A
// CHECK-NEXT: source.edit.kind.comment:28A
// CHECK-NEXT: 4:4-4:7 source.refactoring.range.kind.basename29A
// CHECK-NEXT: source.edit.kind.unknown:30A
// CHECK-NEXT: 5:4-5:7 source.refactoring.range.kind.basename31A
// CHECK-NEXT: source.edit.kind.unknown:32A
// CHECK-NEXT: 6:4-6:7 source.refactoring.range.kind.basename33A
// CHECK-NEXT: source.edit.kind.unknown:34A
// CHECK-NEXT: 7:4-7:7 source.refactoring.range.kind.basename35A
// CHECK-NEXT: source.edit.kind.unknown:36A
// CHECK-NEXT: 8:4-8:7 source.refactoring.range.kind.basename37A
// CHECK-NEXT: source.edit.kind.active:38A
// CHECK-NEXT: 11:1-11:4 source.refactoring.range.kind.basename39A
// CHECK-NEXT: source.edit.kind.mismatch:40A
// CHECK-NEXT: source.edit.kind.mismatch:41A
// CHECK-NEXT: source.edit.kind.mismatch:42A
// CHECK-NEXT: source.edit.kind.mismatch:43
44A
//--- spec.json45A
[46A
{47A
"key.name": "foo()",48A
"key.locations": [49A
{50A
"key.line": 1,51A
"key.column": 6,52A
"key.nametype": source.syntacticrename.definition53A
},54A
{55A
"key.line": 4,56A
"key.column": 4,57A
"key.nametype": source.syntacticrename.unknown58A
},59A
{60A
"key.line": 5,61A
"key.column": 4,62A
"key.nametype": source.syntacticrename.unknown63A
},64A
{65A
"key.line": 6,66A
"key.column": 4,67A
"key.nametype": source.syntacticrename.unknown68A
},69A
{70A
"key.line": 7,71A
"key.column": 4,72A
"key.nametype": source.syntacticrename.unknown73A
},74A
{75A
"key.line": 8,76A
"key.column": 4,77A
"key.nametype": source.syntacticrename.unknown78A
},79A
{80A
"key.line": 11,81A
"key.column": 1,82A
"key.nametype": source.syntacticrename.call83A
},84A
{85A
"key.line": 12,86A
"key.column": 1,87A
"key.nametype": source.syntacticrename.call88A
},89A
{90A
"key.line": 13,91A
"key.column": 1,92A
"key.nametype": source.syntacticrename.call93A
},94A
{95A
"key.line": 14,96A
"key.column": 1,97A
"key.nametype": source.syntacticrename.call98A
},99A
{100A
"key.line": 15,101A
"key.column": 1,102A
"key.nametype": source.syntacticrename.call103A
},104A
]105A
}106A
]107
108new
// --- Seed B ---109B
// RUN: %target-swift-frontend -emit-sil -verify %s | %FileCheck %s110
111B
func foo(a: Int) {}112B
func foo(q: String = "", a: Int) {}113
114B
// CHECK: function_ref @$s12rdar362268743foo1aySi_tF : $@convention(thin) (Int) -> ()115B
foo(a: 42)116
117B
func bar(a: Int, c: Int) {}118B
func bar(a: Int, b: Int = 0, c: Int) {}119
120B
// CHECK: function_ref @$s12rdar362268743bar1a1cySi_SitF : $@convention(thin) (Int, Int) -> ()121B
bar(a: 0, c: 42)122new
var _ffl_sentinel: Int = 0123new
// --- Bug Primitive ---124
125new
// P9: @resultBuilder control-flow desugaring stress126new
@resultBuilder127new
struct _FflHTML {128new
static func buildBlock(_ parts: String...) -> String { parts.joined() }129new
static func buildOptional(_ part: String?) -> String { part ?? "" }130new
static func buildEither(first: String) -> String { "<first>\(first)</first>" }131new
static func buildEither(second: String) -> String { "<second>\(second)</second>" }132new
static func buildArray(_ parts: [String]) -> String { parts.joined(separator: "\n") }133A
}134new
func _ffl_p9_render(_ flag: Bool, items: [String]) -> String {135new
@_FflHTML var body: String {136new
"<root>"137new
if flag {138new
"<active/>"139new
} else {140new
"<inactive/>"141A
}142new
for item in items {143new
"<item>\(item)</item>"144A
}145new
if items.isEmpty {146new
"<empty/>"147A
}148new
"</root>"149A
}150new
return body151A
}152new
do {153new
let _ffl_desc = String(describing: _ffl_sentinel)154new
let _ffl_items = _ffl_desc.split(separator: " ").map(String.init)155new
_ = _ffl_p9_render(_ffl_items.isEmpty, items: _ffl_items)156A
}/home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpr_80ts7d/eaaf8edc.swift:49:15: error: consecutive statements on a line must be separated by ';'
47 | [
48 | {
49 | "key.name": "foo()",
| `- error: consecutive statements on a line must be separated by ';'
50 | "key.locations": [
51 | {
/home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpr_80ts7d/eaaf8edc.swift:49:15: error: expected expression
47 | [
48 | {
49 | "key.name": "foo()",
| `- error: expected expression
50 | "key.locations": [
51 | {
/home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpr_80ts7d/eaaf8edc.swift:22:5: error: missing argument label 'a:' in call
20 | // Nor when written in code:
21 | foo()
22 | foo(0)
| `- error: missing argument label 'a:' in call
23 | foo(a: 0)
24 | foo {}
Assertion failed: ((numMissing + numExtra + numWrong > 0) && "Should not call this function with nothing to diagnose"), function diagnoseArgumentLabelError at MiscDiagnostics.cpp:2973.
(to display assertion configuration options: -Xllvm -assert-help)
Please submit a bug report (https://swift.org/contributing/#reporting-bugs) and include the crash backtrace.
Stack dump:
0. Program arguments: /usr/bin/swift-frontend -typecheck -wmo -sil-verify-all -enable-experimental-feature VariadicGenerics /home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpr_80ts7d/eaaf8edc.swift
1. Swift version 6.5-dev (LLVM 7c86461e21cca7e, Swift 6da4da7153e8252)
2. Compiling with effective version 5.10
3. While evaluating request TypeCheckPrimaryFileRequest(source_file "/home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpr_80ts7d/eaaf8edc.swift")
4. While type-checking statement at [/home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpr_80ts7d/eaaf8edc.swift:25:1 - line:25:12] RangeText="foo {} a: {"
5. While type-checking expression at [/home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpr_80ts7d/eaaf8edc.swift:25:1 - line:25:12] RangeText="foo {} a: {"
6. While type-checking-target starting at /home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpr_80ts7d/eaaf8edc.swift:25:1
7. Assertion failed: ((numMissing + numExtra + numWrong > 0) && "Should not call this function with nothing to diagnose"), function diagnoseArgumentLabelError at MiscDiagnostics.cpp:2973.
| (to display assertion configuration options: -Xllvm -assert-help)
#0 0x0000559e35cf1a58 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/usr/bin/swift-frontend+0x8bc7a58)
#1 0x0000559e35cef275 llvm::sys::RunSignalHandlers() (/usr/bin/swift-frontend+0x8bc5275)
#2 0x0000559e35cf2811 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007f0b27adf330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#4 0x00007f0b27b38b2c pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x9eb2c)
#5 0x00007f0b27adf27e raise (/lib/x86_64-linux-gnu/libc.so.6+0x4527e)
#6 0x00007f0b27ac28ff abort (/lib/x86_64-linux-gnu/libc.so.6+0x288ff)
#7 0x0000559e2fe13e72 (/usr/bin/swift-frontend+0x2ce9e72)
#8 0x0000559e2fe13e24 (/usr/bin/swift-frontend+0x2ce9e24)
#9 0x0000559e2f1b6144 swift::diagnoseArgumentLabelError(swift::ASTContext&, swift::ArgumentList const*, llvm::ArrayRef<swift::Identifier>, swift::ParameterContext, swift::InFlightDiagnostic*) (/usr/bin/swift-frontend+0x208c144)
#10 0x0000559e2f1059cc swift::constraints::RelabelArguments::diagnose(swift::constraints::Solution const&, bool) const (/usr/bin/swift-frontend+0x1fdb9cc)
#11 0x0000559e2f495b4f swift::constraints::ConstraintSystem::applySolutionFixes(swift::constraints::Solution const&) (/usr/bin/swift-frontend+0x236bb4f)
#12 0x0000559e2f4965a2 swift::constraints::ConstraintSystem::applySolution(swift::constraints::Solution&, swift::constraints::SyntacticElementTarget) (/usr/bin/swift-frontend+0x236c5a2)
#13 0x0000559e2f2a0e23 swift::TypeChecker::typeCheckTarget(swift::constraints::SyntacticElementTarget&, swift::optionset::OptionSet<swift::TypeCheckExprFlags, unsigned int>, swift::DiagnosticTransaction*) (/usr/bin/swift-frontend+0x2176e23)
#14 0x0000559e2f2a0c41 swift::TypeChecker::typeCheckExpression(swift::constraints::SyntacticElementTarget&, swift::optionset::OptionSet<swift::TypeCheckExprFlags, unsigned int>, swift::DiagnosticTransaction*) (/usr/bin/swift-frontend+0x2176c41)
#15 0x0000559e2f2a0b16 swift::TypeChecker::typeCheckExpression(swift::Expr*&, swift::DeclContext*, swift::constraints::ContextualTypeInfo, swift::optionset::OptionSet<swift::TypeCheckExprFlags, unsigned int>) (/usr/bin/swift-frontend+0x2176b16)
#16 0x0000559e2f3a6d3b (anonymous namespace)::StmtChecker::typeCheckASTNode(swift::ASTNode&) TypeCheckStmt.cpp:0:0
#17 0x0000559e2f3ad97c swift::ASTVisitor<(anonymous namespace)::StmtChecker, void, swift::Stmt*, void, void, void, void>::visit(swift::Stmt*) TypeCheckStmt.cpp:0:0
#18 0x0000559e2f3b01cc bool (anonymous namespace)::StmtChecker::typeCheckStmt<swift::BraceStmt>(swift::BraceStmt*&) TypeCheckStmt.cpp:0:0
#19 0x0000559e2f3a8b46 swift::TypeChecker::typeCheckTopLevelCodeDecl(swift::TopLevelCodeDecl*) (/usr/bin/swift-frontend+0x227eb46)
#20 0x0000559e2f4274ca swift::TypeCheckPrimaryFileRequest::evaluate(swift::Evaluator&, swift::SourceFile*) const (/usr/bin/swift-frontend+0x22fd4ca)
#21 0x0000559e2f42be6b swift::TypeCheckPrimaryFileRequest::OutputType swift::Evaluator::getResultUncached<swift::TypeCheckPrimaryFileRequest, swift::TypeCheckPrimaryFileRequest::OutputType swift::evaluateOrDefault<swift::TypeCheckPrimaryFileRequest>(swift::Evaluator&, swift::TypeCheckPrimaryFileRequest, swift::TypeCheckPrimaryFileRequest::OutputType)::'lambda'()>(swift::TypeCheckPrimaryFileRequest const&, swift::TypeCheckPrimaryFileRequest::OutputType swift::evaluateOrDefault<swift::TypeCheckPrimaryFileRequest>(swift::Evaluator&, swift::TypeCheckPrimaryFileRequest, swift::TypeCheckPrimaryFileRequest::OutputType)::'lambda'()) crtstuff.c:0:0
#22 0x0000559e2f4273d8 swift::performTypeChecking(swift::SourceFile&) (/usr/bin/swift-frontend+0x22fd3d8)
#23 0x0000559e2def2499 bool llvm::function_ref<bool (swift::SourceFile&)>::callback_fn<swift::CompilerInstance::performSema()::$_10>(long, swift::SourceFile&) Frontend.cpp:0:0
#24 0x0000559e2dee690e swift::CompilerInstance::forEachFileToTypeCheck(llvm::function_ref<bool (swift::SourceFile&)>) (/usr/bin/swift-frontend+0xdbc90e)
#25 0x0000559e2dee668b swift::CompilerInstance::performSema() (/usr/bin/swift-frontend+0xdbc68b)
#26 0x0000559e2db50f32 withSemanticAnalysis(swift::CompilerInstance&, swift::FrontendObserver*, llvm::function_ref<bool (swift::CompilerInstance&)>, bool) FrontendTool.cpp:0:0
#27 0x0000559e2db3e9a5 performCompile(swift::CompilerInstance&, int&, swift::FrontendObserver*, llvm::ArrayRef<char const*>) FrontendTool.cpp:0:0
#28 0x0000559e2db3b62e swift::performFrontend(llvm::ArrayRef<char const*>, char const*, void*, swift::FrontendObserver*) (/usr/bin/swift-frontend+0xa1162e)
#29 0x0000559e2d85fd21 swift::mainEntry(int, char const**) (/usr/bin/swift-frontend+0x735d21)
#30 0x00007f0b27ac41ca (/lib/x86_64-linux-gnu/libc.so.6+0x2a1ca)
#31 0x00007f0b27ac428b __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28b)
#32 0x0000559e2d85ec15 _start (/usr/bin/swift-frontend+0x734c15)
*** Signal 6: Backtracing from 0x7f0b27bc128d... done ***
*** Program crashed: Aborted at 0x00007f0b27bc128d ***
Platform: x86_64 Linux (Ubuntu 24.04.4 LTS)
Thread 0 "swift-frontend" crashed:
0 0x00007f0b27bc128d <unknown> in libc.so.6
Registers:
rax 0x0000000000000000 0
rdx 0x0000000000000006 6
rcx 0x00007f0b27bc128d 48 3d 01 f0 ff ff 73 01 c3 48 8b 0d 5b bb 0d 00 H=·ðÿÿs·ÃH··[»··
rbx 0x0000000000000006 6
rsi 0x000000000017fad3 1571539
rdi 0x000000000017fad3 1571539
rbp 0x000000000017fad3 1571539
rsp 0x0000559e790c8328 3b 28 cf 35 9e 55 00 00 b0 85 0c 79 9e 55 00 00 ;(Ï5·U··°··y·U··
r8 0x0000559e790c85b0 06 00 00 00 00 00 00 00 fa ff ff ff 00 00 00 00 ········úÿÿÿ····
r9 0x0000559e790c85b0 06 00 00 00 00 00 00 00 fa ff ff ff 00 00 00 00 ········úÿÿÿ····
r10 0x0000559e790c85b0 06 00 00 00 00 00 00 00 fa ff ff ff 00 00 00 00 ········úÿÿÿ····
r11 0x0000000000000246 582
r12 0x0000000000000006 6
r13 0x000000000000001a 26
r14 0x0000000000000000 0
r15 0x0000559e790c83c8 ff ff ff 7f fe ff ff ff 00 00 00 00 00 00 00 00 ÿÿÿ·þÿÿÿ········
rip 0x00007f0b27bc128d 48 3d 01 f0 ff ff 73 01 c3 48 8b 0d 5b bb 0d 00 H=·ðÿÿs·ÃH··[»··
rflags 0x0000000000000246 ZF PF
cs 0x0033 fs 0x0000 gs 0x0000
Images (29 omitted):
0x00007f0b27a9a000–0x00007f0b27c49d39 8e9fd827446c24067541ac5390e6f527fb5947bb libc.so.6 /usr/lib/x86_64-linux-gnu/libc.so.6
Backtrace took 0.00s
Aborted (core dumped)// RUN: %empty-directory(%t)
// RUN: split-file %s %t
// RUN: %sourcekitd-test -req=find-rename-ranges -rename-spec %t/spec.json %t/main.swift | %FileCheck %s
// REQUIRES: swift_swift_parser
//--- main.swift
func foo() {}
// Make sure we don't crash on the unrelated comment refs:
// foo()
// foo(0)
// foo(a: 0)
// foo {}
// foo {} a: {}
// Nor when written in code:
foo()
foo(0)
foo(a: 0)
foo {}
foo {} a: {}
// CHECK: source.edit.kind.active:
// CHECK-NEXT: 1:6-1:9 source.refactoring.range.kind.basename
// CHECK-NEXT: source.edit.kind.comment:
// CHECK-NEXT: 4:4-4:7 source.refactoring.range.kind.basename
// CHECK-NEXT: source.edit.kind.unknown:
// CHECK-NEXT: 5:4-5:7 source.refactoring.range.kind.basename
// CHECK-NEXT: source.edit.kind.unknown:
// CHECK-NEXT: 6:4-6:7 source.refactoring.range.kind.basename
// CHECK-NEXT: source.edit.kind.unknown:
// CHECK-NEXT: 7:4-7:7 source.refactoring.range.kind.basename
// CHECK-NEXT: source.edit.kind.unknown:
// CHECK-NEXT: 8:4-8:7 source.refactoring.range.kind.basename
// CHECK-NEXT: source.edit.kind.active:
// CHECK-NEXT: 11:1-11:4 source.refactoring.range.kind.basename
// CHECK-NEXT: source.edit.kind.mismatch:
// CHECK-NEXT: source.edit.kind.mismatch:
// CHECK-NEXT: source.edit.kind.mismatch:
// CHECK-NEXT: source.edit.kind.mismatch:
//--- spec.json
[
{
"key.name": "foo()",
"key.locations": [
{
"key.line": 1,
"key.column": 6,
"key.nametype": source.syntacticrename.definition
},
{
"key.line": 4,
"key.column": 4,
"key.nametype": source.syntacticrename.unknown
},
{
"key.line": 5,
"key.column": 4,
"key.nametype": source.syntacticrename.unknown
},
{
"key.line": 6,
"key.column": 4,
"key.nametype": source.syntacticrename.unknown
},
{
"key.line": 7,
"key.column": 4,
"key.nametype": source.syntacticrename.unknown
},
{
"key.line": 8,
"key.column": 4,
"key.nametype": source.syntacticrename.unknown
},
{
"key.line": 11,
"key.column": 1,
"key.nametype": source.syntacticrename.call
},
{
"key.line": 12,
"key.column": 1,
"key.nametype": source.syntacticrename.call
},
{
"key.line": 13,
"key.column": 1,
"key.nametype": source.syntacticrename.call
},
{
"key.line": 14,
"key.column": 1,
"key.nametype": source.syntacticrename.call
},
{
"key.line": 15,
"key.column": 1,
"key.nametype": source.syntacticrename.call
},
]
}
]// RUN: %target-swift-frontend -emit-sil -verify %s | %FileCheck %s
func foo(a: Int) {}
func foo(q: String = "", a: Int) {}
// CHECK: function_ref @$s12rdar362268743foo1aySi_tF : $@convention(thin) (Int) -> ()
foo(a: 42)
func bar(a: Int, c: Int) {}
func bar(a: Int, b: Int = 0, c: Int) {}
// CHECK: function_ref @$s12rdar362268743bar1a1cySi_SitF : $@convention(thin) (Int, Int) -> ()
bar(a: 0, c: 42)
#22071
Assertion:addr != 0
php
CRASH 134
2026-05-17
Aparent_aBparent_bA·Bbothnewnovel / fused
1A·B
<?php2A
try {3A
$e = enum_exists('UnitEnum') ? UnitEnum::cases() : [];4new
} catch (\Throwable $_ffl_e) {}Aparent_aBparent_bA·Bbothnewnovel / fused
1A·B
<?php2A
declare(strict_types=1);3A
try {4A
$nan = NAN;5A
$inf = INF;6A
$ninf = -INF;7A
$values = [0, 1, -1, PHP_INT_MAX, PHP_INT_MIN, 1.0, 1.5, $nan, $inf, $ninf, "0", "1", "-1", "1e309", "foo", "", null, true, false, [], [1, 2], ["a" => 1], " 42 ", "042", "0x10"];8A
foreach ($values as $v) {9A
is_nan(is_float($v) ? $v : (float)$v);10A
is_finite(is_float($v) ? $v : (float)$v);11A
gettype($v);12A
settype($v, 'string');13A
settype($v, 'array');14A
settype($v, 'object');15A·B
}16A
$a = ["x" => 1, "y" => [2, 3], "z" => ["k" => "v"]];17A
$b = $a;18A
$b["y"][1] = 99;19A
$b["z"]["k"] = "w";20A
$c = $a;21A
$c[] = 4;22A
unset($c["x"]);23A
$e = enum_exists('UnitEnum') ? UnitEnum::cases() : [];24A
$map = [];25A
foreach ($e as $case) {26A
$map[$case->name] = $case->name;27A·B
}28A
$nested = ["a" => ["b" => ["c" => 1]]];29A
$ref = &$nested["a"]["b"];30A
$ref["d"] = 2;31A
$s = "abc";32A
for ($i = 0; $i < 3; $i++) {33A
$s .= $i;34A
$s = substr($s, 0, strlen($s));35A·B
}36A
$x = 0;37A
while ($x < 5) {38A
if ($x === 2) {39A
$x++;40A
continue;41A·B
}42A
if ($x === 4) {43A
break;44A·B
}45A
$x++;46A·B
}47A
try {48A
throw new ArgumentException("value");49A
} catch (Throwable $t) {50A·B
}51A
echo "";52B
function foo() {53B
$a = array(); // [rc1, array]54B
$a = 1; // [rc1, long, reg]55B
$x = $a;56B
var_dump($x);57A·B
}58B
foo();59new
var_dump(get_defined_vars());60new
try { imagearc($fusion,$x,$fusion,$fusion,$fusion,$x,$a,$fusion); } catch (\Throwable $e) {};61new
try { imagearc($x,$a,$a,$a,$x,$fusion,$fusion,$x); } catch (\Throwable $e) {};62new
try { imagearc($a,$fusion,$a,$a,$fusion,$x,$x,$fusion); } catch (\Throwable $e) {};63new
try { imagearc($fusion,$x,$x,$a,$fusion,$fusion,$a,$fusion); } catch (\Throwable $e) {};64new
try { imagearc($x,$fusion,$fusion,$a,$fusion,$fusion,$a,$x); } catch (\Throwable $e) {};65new
} catch (\Throwable $_ffl_e) {}php: ext/opcache/jit/zend_jit_ir.c:554: ir_ref jit_CONST_FUNC_PROTO(zend_jit_ctx *, uintptr_t, ir_ref): Assertion `addr != 0' failed.
Aborted (core dumped)<?php
declare(strict_types=1);
$nan = NAN;
$inf = INF;
$ninf = -INF;
$values = [0, 1, -1, PHP_INT_MAX, PHP_INT_MIN, 1.0, 1.5, $nan, $inf, $ninf, "0", "1", "-1", "1e309", "foo", "", null, true, false, [], [1, 2], ["a" => 1], " 42 ", "042", "0x10"];
foreach ($values as $v) {
is_nan(is_float($v) ? $v : (float)$v);
is_finite(is_float($v) ? $v : (float)$v);
gettype($v);
settype($v, 'string');
settype($v, 'array');
settype($v, 'object');
}
$a = ["x" => 1, "y" => [2, 3], "z" => ["k" => "v"]];
$b = $a;
$b["y"][1] = 99;
$b["z"]["k"] = "w";
$c = $a;
$c[] = 4;
unset($c["x"]);
$e = enum_exists('UnitEnum') ? UnitEnum::cases() : [];
$map = [];
foreach ($e as $case) {
$map[$case->name] = $case->name;
}
$nested = ["a" => ["b" => ["c" => 1]]];
$ref = &$nested["a"]["b"];
$ref["d"] = 2;
$s = "abc";
for ($i = 0; $i < 3; $i++) {
$s .= $i;
$s = substr($s, 0, strlen($s));
}
$x = 0;
while ($x < 5) {
if ($x === 2) {
$x++;
continue;
}
if ($x === 4) {
break;
}
$x++;
}
try {
throw new ArgumentException("value");
} catch (Throwable $t) {
}
echo "";
?><?php
function foo() {
$a = array(); // [rc1, array]
$a = 1; // [rc1, long, reg]
$x = $a;
var_dump($x);
}
foo();
?>
#197970
Assertion:succeeded(result) && "expected ConstantLike op to be foldable"
llvm
CRASH 134
2026-05-15
Aparent_aBparent_bA·Bbothnewnovel / fused
1new
spirv.ARM.Graph @g() -> (!spirv.arm.tensor<1xi8>) {2new
%0 = spirv.ARM.GraphConstant {graph_constant_id = 0 : i32} : !spirv.arm.tensor<1xi8>3new
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<1xi8>4A·B
}Aparent_aBparent_bA·Bbothnewnovel / fused
1new
// FUSED MLIR (FFL) A: e7dffb98 B: 742da7252
3new
// ===== Section A =====4B
module {5A
//===----------------------------------------------------------------------===//6A
// spirv.TOSA.ArgMax - PRO-INT7A
//===----------------------------------------------------------------------===//8
9A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {10A
spirv.GlobalVariable @argmax_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<3x28x17x17xi8>, UniformConstant>11A
spirv.GlobalVariable @argmax_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<3x28x17xi32>, UniformConstant>12A
spirv.ARM.GraphEntryPoint @argmax_int, @argmax_int_arg_0, @argmax_int_res_013A
spirv.ARM.Graph @argmax_int(%arg0: !spirv.arm.tensor<3x28x17x17xi8>) -> (!spirv.arm.tensor<3x28x17xi32>) {14A
%2 = spirv.Tosa.ArgMax axis = 3, nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<3x28x17x17xi8> -> !spirv.arm.tensor<3x28x17xi32>15A
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<3x28x17xi32>16A·B
}17A·B
}18
19
20A
//===----------------------------------------------------------------------===//21A
// spirv.TOSA.ArgMax - PRO-FP22A
//===----------------------------------------------------------------------===//23
24A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {25A
spirv.GlobalVariable @argmax_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<2x2x7x14xf32>, UniformConstant>26A
spirv.GlobalVariable @argmax_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<2x2x14xi32>, UniformConstant>27A
spirv.ARM.GraphEntryPoint @argmax_fp, @argmax_fp_arg_0, @argmax_fp_res_028A
spirv.ARM.Graph @argmax_fp(%arg0: !spirv.arm.tensor<2x2x7x14xf32>) -> (!spirv.arm.tensor<2x2x14xi32>) {29A
%2 = spirv.Tosa.ArgMax axis = 2, nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<2x2x7x14xf32> -> !spirv.arm.tensor<2x2x14xi32>30A
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<2x2x14xi32>31A·B
}32A·B
}33
34
35A
//===----------------------------------------------------------------------===//36A
// spirv.TOSA.AvgPool2D - PRO-INT37A
//===----------------------------------------------------------------------===//38
39A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {40A
spirv.GlobalVariable @avgpool2d_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x3x65537x1xi8>, UniformConstant>41A
spirv.GlobalVariable @avgpool2d_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x2x32768x1xi8>, UniformConstant>42A
spirv.ARM.GraphEntryPoint @avgpool2d_int, @avgpool2d_int_arg_0, @avgpool2d_int_res_043A
spirv.ARM.Graph @avgpool2d_int(%arg0: !spirv.arm.tensor<1x3x65537x1xi8>) -> (!spirv.arm.tensor<1x2x32768x1xi8>) {44A
%4 = spirv.Constant dense<125> : !spirv.arm.tensor<1xi8>45A
%5 = spirv.Constant dense<-90> : !spirv.arm.tensor<1xi8>46A
%6 = spirv.Tosa.AvgPool2D kernel = [3, 3], stride = [1, 2], pad = [0, 1, 0, 0], acc_type = <INT32>, %arg0, %4, %5 : !spirv.arm.tensor<1x3x65537x1xi8>, !spirv.arm.tensor<1xi8>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<1x2x32768x1xi8>47A
spirv.ARM.GraphOutputs %6 : !spirv.arm.tensor<1x2x32768x1xi8>48A·B
}49A·B
}50
51
52A
//===----------------------------------------------------------------------===//53A
// spirv.TOSA.AvgPool2D - PRO-FP54A
//===----------------------------------------------------------------------===//55
56A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {57A
spirv.GlobalVariable @avgpool2d_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x2x65533x2xf32>, UniformConstant>58A
spirv.GlobalVariable @avgpool2d_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x2x65532x2xf32>, UniformConstant>59A
spirv.ARM.GraphEntryPoint @avgpool2d_fp, @avgpool2d_fp_arg_0, @avgpool2d_fp_res_060A
spirv.ARM.Graph @avgpool2d_fp(%arg0: !spirv.arm.tensor<1x2x65533x2xf32>) -> (!spirv.arm.tensor<1x2x65532x2xf32>) {61A
%4 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf32>62A
%5 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf32>63A
%6 = spirv.Tosa.AvgPool2D kernel = [2, 2], stride = [1, 1], pad = [1, 0, 0, 0], acc_type = <FP32>, %arg0, %4, %5 : !spirv.arm.tensor<1x2x65533x2xf32>, !spirv.arm.tensor<1xf32>, !spirv.arm.tensor<1xf32> -> !spirv.arm.tensor<1x2x65532x2xf32>64A
spirv.ARM.GraphOutputs %6 : !spirv.arm.tensor<1x2x65532x2xf32>65A·B
}66A·B
}67
68
69A
//===----------------------------------------------------------------------===//70A
// spirv.TOSA.Conv2D - PRO-INT71A
//===----------------------------------------------------------------------===//72
73A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {74A
spirv.GlobalVariable @conv2d_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x65535x3x1xi8>, UniformConstant>75A
spirv.GlobalVariable @conv2d_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<7x1x1x1xi8>, UniformConstant>76A
spirv.GlobalVariable @conv2d_int_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<1xi32>, UniformConstant>77A
spirv.GlobalVariable @conv2d_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x65536x2x7xi32>, UniformConstant>78A
spirv.ARM.GraphEntryPoint @conv2d_int, @conv2d_int_arg_0, @conv2d_int_arg_1, @conv2d_int_arg_2, @conv2d_int_res_079A
spirv.ARM.Graph @conv2d_int(%arg0: !spirv.arm.tensor<1x65535x3x1xi8>, %arg1: !spirv.arm.tensor<7x1x1x1xi8>, %arg2: !spirv.arm.tensor<1xi32>) -> (!spirv.arm.tensor<1x65536x2x7xi32>) {80A
%5 = spirv.Constant dense<35> : !spirv.arm.tensor<1xi8>81A
%6 = spirv.Constant dense<57> : !spirv.arm.tensor<1xi8>82A
%7 = spirv.Tosa.Conv2D pad = [1, 0, 0, 0], stride = [1, 2], dilation = [7, 1], acc_type = <INT32>, local_bound = false, %arg0, %arg1, %arg2, %5, %6 : !spirv.arm.tensor<1x65535x3x1xi8>, !spirv.arm.tensor<7x1x1x1xi8>, !spirv.arm.tensor<1xi32>, !spirv.arm.tensor<1xi8>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<1x65536x2x7xi32>83A
spirv.ARM.GraphOutputs %7 : !spirv.arm.tensor<1x65536x2x7xi32>84A·B
}85A·B
}86
87
88A
//===----------------------------------------------------------------------===//89A
// spirv.TOSA.Conv2D - PRO-FP90A
//===----------------------------------------------------------------------===//91
92A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {93A
spirv.GlobalVariable @conv2d_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x34x18x27xf16>, UniformConstant>94A
spirv.GlobalVariable @conv2d_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<11x1x1x27xf16>, UniformConstant>95A
spirv.GlobalVariable @conv2d_fp_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<11xf16>, UniformConstant>96A
spirv.GlobalVariable @conv2d_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x34x18x11xf16>, UniformConstant>97A
spirv.ARM.GraphEntryPoint @conv2d_fp, @conv2d_fp_arg_0, @conv2d_fp_arg_1, @conv2d_fp_arg_2, @conv2d_fp_res_098A
spirv.ARM.Graph @conv2d_fp(%arg0: !spirv.arm.tensor<1x34x18x27xf16>, %arg1: !spirv.arm.tensor<11x1x1x27xf16>, %arg2: !spirv.arm.tensor<11xf16>) -> (!spirv.arm.tensor<1x34x18x11xf16>) {99A
%5 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf16>100A
%6 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf16>101A
%7 = spirv.Tosa.Conv2D pad = [0, 0, 0, 0], stride = [1, 1], dilation = [1, 1], acc_type = <FP16>, local_bound = true, %arg0, %arg1, %arg2, %5, %6 : !spirv.arm.tensor<1x34x18x27xf16>, !spirv.arm.tensor<11x1x1x27xf16>, !spirv.arm.tensor<11xf16>, !spirv.arm.tensor<1xf16>, !spirv.arm.tensor<1xf16> -> !spirv.arm.tensor<1x34x18x11xf16>102A
spirv.ARM.GraphOutputs %7 : !spirv.arm.tensor<1x34x18x11xf16>103A·B
}104A·B
}105
106
107A
//===----------------------------------------------------------------------===//108A
// spirv.TOSA.Conv3D - PRO-INT109A
//===----------------------------------------------------------------------===//110
111A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {112A
spirv.GlobalVariable @conv3d_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x9x21x14x1xi8>, UniformConstant>113A
spirv.GlobalVariable @conv3d_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<2x1x2x1x1xi8>, UniformConstant>114A
spirv.GlobalVariable @conv3d_int_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<1xi32>, UniformConstant>115A
spirv.GlobalVariable @conv3d_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x9x20x14x2xi32>, UniformConstant>116A
spirv.ARM.GraphEntryPoint @conv3d_int, @conv3d_int_arg_0, @conv3d_int_arg_1, @conv3d_int_arg_2, @conv3d_int_res_0117A
spirv.ARM.Graph @conv3d_int(%arg0: !spirv.arm.tensor<1x9x21x14x1xi8>, %arg1: !spirv.arm.tensor<2x1x2x1x1xi8>, %arg2: !spirv.arm.tensor<1xi32>) -> (!spirv.arm.tensor<1x9x20x14x2xi32>) {118A
%5 = spirv.Constant dense<123> : !spirv.arm.tensor<1xi8>119A
%6 = spirv.Constant dense<121> : !spirv.arm.tensor<1xi8>120A
%7 = spirv.Tosa.Conv3D pad = [0, 0, 0, 0, 0, 0], stride = [1, 1, 1], dilation = [1, 1, 1], acc_type = <INT32>, local_bound = false, %arg0, %arg1, %arg2, %5, %6 : !spirv.arm.tensor<1x9x21x14x1xi8>, !spirv.arm.tensor<2x1x2x1x1xi8>, !spirv.arm.tensor<1xi32>, !spirv.arm.tensor<1xi8>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<1x9x20x14x2xi32>121A
spirv.ARM.GraphOutputs %7 : !spirv.arm.tensor<1x9x20x14x2xi32>122A·B
}123A·B
}124
125
126A
//===----------------------------------------------------------------------===//127A
// spirv.TOSA.Conv3D - PRO-FP128A
//===----------------------------------------------------------------------===//129
130A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {131A
spirv.GlobalVariable @conv3d_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x2x65539x1x2xf32>, UniformConstant>132A
spirv.GlobalVariable @conv3d_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x1x1x1x2xf32>, UniformConstant>133A
spirv.GlobalVariable @conv3d_fp_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<1xf32>, UniformConstant>134A
spirv.GlobalVariable @conv3d_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x3x65540x2x1xf32>, UniformConstant>135A
spirv.ARM.GraphEntryPoint @conv3d_fp, @conv3d_fp_arg_0, @conv3d_fp_arg_1, @conv3d_fp_arg_2, @conv3d_fp_res_0136A
spirv.ARM.Graph @conv3d_fp(%arg0: !spirv.arm.tensor<1x2x65539x1x2xf32>, %arg1: !spirv.arm.tensor<1x1x1x1x2xf32>, %arg2: !spirv.arm.tensor<1xf32>) -> (!spirv.arm.tensor<1x3x65540x2x1xf32>) {137A
%5 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf32>138A
%6 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf32>139A
%7 = spirv.Tosa.Conv3D pad = [0, 1, 1, 0, 0, 1], stride = [1, 1, 1], dilation = [1, 1, 7], acc_type = <FP32>, local_bound = false, %arg0, %arg1, %arg2, %5, %6 : !spirv.arm.tensor<1x2x65539x1x2xf32>, !spirv.arm.tensor<1x1x1x1x2xf32>, !spirv.arm.tensor<1xf32>, !spirv.arm.tensor<1xf32>, !spirv.arm.tensor<1xf32> -> !spirv.arm.tensor<1x3x65540x2x1xf32>140A
spirv.ARM.GraphOutputs %7 : !spirv.arm.tensor<1x3x65540x2x1xf32>141A·B
}142A·B
}143
144
145A
//===----------------------------------------------------------------------===//146A
// spirv.TOSA.DepthwiseConv2D - PRO-INT147A
//===----------------------------------------------------------------------===//148
149A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {150A
spirv.GlobalVariable @depthwiseconv2d_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x4x65537x1xi8>, UniformConstant>151A
spirv.GlobalVariable @depthwiseconv2d_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x3x1x4xi8>, UniformConstant>152A
spirv.GlobalVariable @depthwiseconv2d_int_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<4xi32>, UniformConstant>153A
spirv.GlobalVariable @depthwiseconv2d_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x4x32762x4xi32>, UniformConstant>154A
spirv.ARM.GraphEntryPoint @depthwiseconv2d_int, @depthwiseconv2d_int_arg_0, @depthwiseconv2d_int_arg_1, @depthwiseconv2d_int_arg_2, @depthwiseconv2d_int_res_0155A
spirv.ARM.Graph @depthwiseconv2d_int(%arg0: !spirv.arm.tensor<1x4x65537x1xi8>, %arg1: !spirv.arm.tensor<1x3x1x4xi8>, %arg2: !spirv.arm.tensor<4xi32>) -> (!spirv.arm.tensor<1x4x32762x4xi32>) {156A
%5 = spirv.Constant dense<58> : !spirv.arm.tensor<1xi8>157A
%6 = spirv.Constant dense<-106> : !spirv.arm.tensor<1xi8>158A
%7 = spirv.Tosa.DepthwiseConv2D pad = [0, 0, 0, 0], stride = [1, 2], dilation = [7, 7], acc_type = <INT32>, local_bound = false, %arg0, %arg1, %arg2, %5, %6 : !spirv.arm.tensor<1x4x65537x1xi8>, !spirv.arm.tensor<1x3x1x4xi8>, !spirv.arm.tensor<4xi32>, !spirv.arm.tensor<1xi8>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<1x4x32762x4xi32>159A
spirv.ARM.GraphOutputs %7 : !spirv.arm.tensor<1x4x32762x4xi32>160A·B
}161A·B
}162
163
164A
//===----------------------------------------------------------------------===//165A
// spirv.TOSA.DepthwiseConv2D - PRO-FP166A
//===----------------------------------------------------------------------===//167
168A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {169A
spirv.GlobalVariable @depthwiseconv2d_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x65540x1x3xf32>, UniformConstant>170A
spirv.GlobalVariable @depthwiseconv2d_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x1x3x1xf32>, UniformConstant>171A
spirv.GlobalVariable @depthwiseconv2d_fp_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<1xf32>, UniformConstant>172A
spirv.GlobalVariable @depthwiseconv2d_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x65541x2x3xf32>, UniformConstant>173A
spirv.ARM.GraphEntryPoint @depthwiseconv2d_fp, @depthwiseconv2d_fp_arg_0, @depthwiseconv2d_fp_arg_1, @depthwiseconv2d_fp_arg_2, @depthwiseconv2d_fp_res_0174A
spirv.ARM.Graph @depthwiseconv2d_fp(%arg0: !spirv.arm.tensor<1x65540x1x3xf32>, %arg1: !spirv.arm.tensor<1x1x3x1xf32>, %arg2: !spirv.arm.tensor<1xf32>) -> (!spirv.arm.tensor<1x65541x2x3xf32>) {175A
%5 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf32>176A
%6 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf32>177A
%7 = spirv.Tosa.DepthwiseConv2D pad = [0, 1, 1, 1], stride = [1, 2], dilation = [1, 7], acc_type = <FP32>, local_bound = true, %arg0, %arg1, %arg2, %5, %6 : !spirv.arm.tensor<1x65540x1x3xf32>, !spirv.arm.tensor<1x1x3x1xf32>, !spirv.arm.tensor<1xf32>, !spirv.arm.tensor<1xf32>, !spirv.arm.tensor<1xf32> -> !spirv.arm.tensor<1x65541x2x3xf32>178A
spirv.ARM.GraphOutputs %7 : !spirv.arm.tensor<1x65541x2x3xf32>179A·B
}180A·B
}181
182
183A
//===----------------------------------------------------------------------===//184A
// spirv.TOSA.FFT2D - EXT-FFT185A
//===----------------------------------------------------------------------===//186
187A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {188A
spirv.GlobalVariable @fft2d_fft_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x32x32xf32>, UniformConstant>189A
spirv.GlobalVariable @fft2d_fft_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x32x32xf32>, UniformConstant>190A
spirv.GlobalVariable @fft2d_fft_res_0 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<1x32x32xf32>, UniformConstant>191A
spirv.GlobalVariable @fft2d_fft_res_1 bind(0, 3) : !spirv.ptr<!spirv.arm.tensor<1x32x32xf32>, UniformConstant>192A
spirv.ARM.GraphEntryPoint @fft2d_fft, @fft2d_fft_arg_0, @fft2d_fft_arg_1, @fft2d_fft_res_0, @fft2d_fft_res_1193A
spirv.ARM.Graph @fft2d_fft(%arg0: !spirv.arm.tensor<1x32x32xf32>, %arg1: !spirv.arm.tensor<1x32x32xf32>) -> (!spirv.arm.tensor<1x32x32xf32>, !spirv.arm.tensor<1x32x32xf32>) {194A
%out = spirv.Tosa.FFT2D inverse = true, local_bound = false, %arg0, %arg1 : !spirv.arm.tensor<1x32x32xf32>, !spirv.arm.tensor<1x32x32xf32> -> !spirv.struct<(!spirv.arm.tensor<1x32x32xf32>, !spirv.arm.tensor<1x32x32xf32>)>195A
%out0 = spirv.CompositeExtract %out[0 : i32] : !spirv.struct<(!spirv.arm.tensor<1x32x32xf32>, !spirv.arm.tensor<1x32x32xf32>)>196A
%out1 = spirv.CompositeExtract %out[1 : i32] : !spirv.struct<(!spirv.arm.tensor<1x32x32xf32>, !spirv.arm.tensor<1x32x32xf32>)>197A
spirv.ARM.GraphOutputs %out0, %out1 : !spirv.arm.tensor<1x32x32xf32>, !spirv.arm.tensor<1x32x32xf32>198A·B
}199A·B
}200
201
202A
//===----------------------------------------------------------------------===//203A
// spirv.TOSA.MatMul - PRO-INT204A
//===----------------------------------------------------------------------===//205
206A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {207A
spirv.GlobalVariable @matmul_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<8x2x3xi8>, UniformConstant>208A
spirv.GlobalVariable @matmul_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<8x3x8xi8>, UniformConstant>209A
spirv.GlobalVariable @matmul_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<8x2x8xi32>, UniformConstant>210A
spirv.ARM.GraphEntryPoint @matmul_int, @matmul_int_arg_0, @matmul_int_arg_1, @matmul_int_res_0211A
spirv.ARM.Graph @matmul_int(%arg0: !spirv.arm.tensor<8x2x3xi8>, %arg1: !spirv.arm.tensor<8x3x8xi8>) -> (!spirv.arm.tensor<8x2x8xi32>) {212A
%0 = spirv.Constant dense<0> : !spirv.arm.tensor<1xi8>213A
%1 = spirv.Constant dense<0> : !spirv.arm.tensor<1xi8>214A
%2 = spirv.Tosa.MatMul %arg0, %arg1, %0, %1 : !spirv.arm.tensor<8x2x3xi8>, !spirv.arm.tensor<8x3x8xi8>, !spirv.arm.tensor<1xi8>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<8x2x8xi32>215A
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<8x2x8xi32>216A·B
}217A·B
}218
219
220A
//===----------------------------------------------------------------------===//221A
// spirv.TOSA.MatMul - PRO-FP222A
//===----------------------------------------------------------------------===//223
224A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {225A
spirv.GlobalVariable @matmul_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<15x39x50xf16>, UniformConstant>226A
spirv.GlobalVariable @matmul_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<15x50x24xf16>, UniformConstant>227A
spirv.GlobalVariable @matmul_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<15x39x24xf16>, UniformConstant>228A
spirv.ARM.GraphEntryPoint @matmul_fp, @matmul_fp_arg_0, @matmul_fp_arg_1, @matmul_fp_res_0229A
spirv.ARM.Graph @matmul_fp(%arg0: !spirv.arm.tensor<15x39x50xf16>, %arg1: !spirv.arm.tensor<15x50x24xf16>) -> (!spirv.arm.tensor<15x39x24xf16>) {230A
%0 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf16>231A
%1 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf16>232A
%2 = spirv.Tosa.MatMul %arg0, %arg1, %0, %1 : !spirv.arm.tensor<15x39x50xf16>, !spirv.arm.tensor<15x50x24xf16>, !spirv.arm.tensor<1xf16>, !spirv.arm.tensor<1xf16> -> !spirv.arm.tensor<15x39x24xf16>233A
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<15x39x24xf16>234A·B
}235A·B
}236
237
238A
//===----------------------------------------------------------------------===//239A
// spirv.TOSA.MaxPool2D - PRO-INT240A
//===----------------------------------------------------------------------===//241
242A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {243A
spirv.GlobalVariable @maxpool2d_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x3x65537x1xi8>, UniformConstant>244A
spirv.GlobalVariable @maxpool2d_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x2x32769x1xi8>, UniformConstant>245A
spirv.ARM.GraphEntryPoint @maxpool2d_int, @maxpool2d_int_arg_0, @maxpool2d_int_res_0246A
spirv.ARM.Graph @maxpool2d_int(%arg0: !spirv.arm.tensor<1x3x65537x1xi8>) -> (!spirv.arm.tensor<1x2x32769x1xi8>) {247A
%4 = spirv.Tosa.MaxPool2D kernel = [3, 2], stride = [1, 2], pad = [1, 0, 0, 1], nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<1x3x65537x1xi8> -> !spirv.arm.tensor<1x2x32769x1xi8>248A
spirv.ARM.GraphOutputs %4 : !spirv.arm.tensor<1x2x32769x1xi8>249A·B
}250A·B
}251
252
253A
//===----------------------------------------------------------------------===//254A
// spirv.TOSA.MaxPool2D - PRO-FP255A
//===----------------------------------------------------------------------===//256
257A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {258A
spirv.GlobalVariable @maxpool2d_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x6x65536x1xf32>, UniformConstant>259A
spirv.GlobalVariable @maxpool2d_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x3x32769x1xf32>, UniformConstant>260A
spirv.ARM.GraphEntryPoint @maxpool2d_fp, @maxpool2d_fp_arg_0, @maxpool2d_fp_res_0261A
spirv.ARM.Graph @maxpool2d_fp(%arg0: !spirv.arm.tensor<1x6x65536x1xf32>) -> (!spirv.arm.tensor<1x3x32769x1xf32>) {262A
%4 = spirv.Tosa.MaxPool2D kernel = [3, 2], stride = [2, 2], pad = [1, 0, 1, 1], nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<1x6x65536x1xf32> -> !spirv.arm.tensor<1x3x32769x1xf32>263A
spirv.ARM.GraphOutputs %4 : !spirv.arm.tensor<1x3x32769x1xf32>264A·B
}265A·B
}266
267
268A
//===----------------------------------------------------------------------===//269A
// spirv.TOSA.RFFT2D - EXT-FFT270A
//===----------------------------------------------------------------------===//271
272A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {273A
spirv.GlobalVariable @rfft2d_fft_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x32x32xf32>, UniformConstant>274A
spirv.GlobalVariable @rfft2d_fft_res_0 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x32x17xf32>, UniformConstant>275A
spirv.GlobalVariable @rfft2d_fft_res_1 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<1x32x17xf32>, UniformConstant>276A
spirv.ARM.GraphEntryPoint @rfft2d_fft, @rfft2d_fft_arg_0, @rfft2d_fft_res_0, @rfft2d_fft_res_1277A
spirv.ARM.Graph @rfft2d_fft(%arg0: !spirv.arm.tensor<1x32x32xf32>) -> (!spirv.arm.tensor<1x32x17xf32>, !spirv.arm.tensor<1x32x17xf32>) {278A
%out = spirv.Tosa.RFFT2D local_bound = false, %arg0 : !spirv.arm.tensor<1x32x32xf32> -> !spirv.struct<(!spirv.arm.tensor<1x32x17xf32>, !spirv.arm.tensor<1x32x17xf32>)>279A
%out0 = spirv.CompositeExtract %out[0 : i32] : !spirv.struct<(!spirv.arm.tensor<1x32x17xf32>, !spirv.arm.tensor<1x32x17xf32>)>280A
%out1 = spirv.CompositeExtract %out[1 : i32] : !spirv.struct<(!spirv.arm.tensor<1x32x17xf32>, !spirv.arm.tensor<1x32x17xf32>)>281A
spirv.ARM.GraphOutputs %out0, %out1 : !spirv.arm.tensor<1x32x17xf32>, !spirv.arm.tensor<1x32x17xf32>282A·B
}283A·B
}284
285
286A
//===----------------------------------------------------------------------===//287A
// spirv.TOSA.TransposeConv2D - PRO-INT288A
//===----------------------------------------------------------------------===//289
290A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {291A
spirv.GlobalVariable @transposeconv2d_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x13x33x3xi16>, UniformConstant>292A
spirv.GlobalVariable @transposeconv2d_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<11x1x3x3xi8>, UniformConstant>293A
spirv.GlobalVariable @transposeconv2d_int_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<1xi64>, UniformConstant>294A
spirv.GlobalVariable @transposeconv2d_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x13x35x11xi64>, UniformConstant>295A
spirv.ARM.GraphEntryPoint @transposeconv2d_int, @transposeconv2d_int_arg_0, @transposeconv2d_int_arg_1, @transposeconv2d_int_arg_2, @transposeconv2d_int_res_0296A
spirv.ARM.Graph @transposeconv2d_int(%arg0: !spirv.arm.tensor<1x13x33x3xi16>, %arg1: !spirv.arm.tensor<11x1x3x3xi8>, %arg2: !spirv.arm.tensor<1xi64>) -> (!spirv.arm.tensor<1x13x35x11xi64>) {297A
%4 = spirv.Constant dense<0> : !spirv.arm.tensor<1xi16>298A
%5 = spirv.Constant dense<88> : !spirv.arm.tensor<1xi8>299A
%6 = spirv.Tosa.TransposeConv2D out_pad = [0, 0, 0, 0], stride = [1, 1], acc_type = <INT48>, local_bound = false, %arg0, %arg1, %arg2, %4, %5 : !spirv.arm.tensor<1x13x33x3xi16>, !spirv.arm.tensor<11x1x3x3xi8>, !spirv.arm.tensor<1xi64>, !spirv.arm.tensor<1xi16>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<1x13x35x11xi64>300A
spirv.ARM.GraphOutputs %6 : !spirv.arm.tensor<1x13x35x11xi64>301A·B
}302A·B
}303
304
305A
//===----------------------------------------------------------------------===//306A
// spirv.TOSA.TransposeConv2D - PRO-FP307A
//===----------------------------------------------------------------------===//308
309A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {310A
spirv.GlobalVariable @transposeconv2d_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<10x24x9x13xf16>, UniformConstant>311A
spirv.GlobalVariable @transposeconv2d_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<14x1x1x13xf16>, UniformConstant>312A
spirv.GlobalVariable @transposeconv2d_fp_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<14xf16>, UniformConstant>313A
spirv.GlobalVariable @transposeconv2d_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<10x25x65x14xf16>, UniformConstant>314A
spirv.ARM.GraphEntryPoint @transposeconv2d_fp, @transposeconv2d_fp_arg_0, @transposeconv2d_fp_arg_1, @transposeconv2d_fp_arg_2, @transposeconv2d_fp_res_0315A
spirv.ARM.Graph @transposeconv2d_fp(%arg0: !spirv.arm.tensor<10x24x9x13xf16>, %arg1: !spirv.arm.tensor<14x1x1x13xf16>, %arg2: !spirv.arm.tensor<14xf16>) -> (!spirv.arm.tensor<10x25x65x14xf16>) {316A
%4 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf16>317A
%5 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf16>318A
%6 = spirv.Tosa.TransposeConv2D out_pad = [0, 1, 0, 0], stride = [1, 8], acc_type = <FP16>, local_bound = true, %arg0, %arg1, %arg2, %4, %5 : !spirv.arm.tensor<10x24x9x13xf16>, !spirv.arm.tensor<14x1x1x13xf16>, !spirv.arm.tensor<14xf16>, !spirv.arm.tensor<1xf16>, !spirv.arm.tensor<1xf16> -> !spirv.arm.tensor<10x25x65x14xf16>319A
spirv.ARM.GraphOutputs %6 : !spirv.arm.tensor<10x25x65x14xf16>320A·B
}321A·B
}322
323
324A
//===----------------------------------------------------------------------===//325A
// spirv.TOSA.Clamp - PRO-INT326A
//===----------------------------------------------------------------------===//327
328A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {329A
spirv.GlobalVariable @clamp_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<27x44x55xi8>, UniformConstant>330A
spirv.GlobalVariable @clamp_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<27x44x55xi8>, UniformConstant>331A
spirv.ARM.GraphEntryPoint @clamp_int, @clamp_int_arg_0, @clamp_int_res_0332A
spirv.ARM.Graph @clamp_int(%arg0: !spirv.arm.tensor<27x44x55xi8>) -> (!spirv.arm.tensor<27x44x55xi8>) {333A
%3 = spirv.Tosa.Clamp min_val = -102 : i8, max_val = -100 : i8, nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<27x44x55xi8> -> !spirv.arm.tensor<27x44x55xi8>334A
spirv.ARM.GraphOutputs %3 : !spirv.arm.tensor<27x44x55xi8>335A·B
}336A·B
}337
338
339A
//===----------------------------------------------------------------------===//340A
// spirv.TOSA.Clamp - PRO-FP341A
//===----------------------------------------------------------------------===//342
343A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {344A
spirv.GlobalVariable @clamp_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<18x5x17x6xf32>, UniformConstant>345A
spirv.GlobalVariable @clamp_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<18x5x17x6xf32>, UniformConstant>346A
spirv.ARM.GraphEntryPoint @clamp_fp, @clamp_fp_arg_0, @clamp_fp_res_0347A
spirv.ARM.Graph @clamp_fp(%arg0: !spirv.arm.tensor<18x5x17x6xf32>) -> (!spirv.arm.tensor<18x5x17x6xf32>) {348A
%3 = spirv.Tosa.Clamp min_val = -1.19339396E+38 : f32, max_val = 2.38255944E+38 : f32, nan_mode = <Ignore>, %arg0 : !spirv.arm.tensor<18x5x17x6xf32> -> !spirv.arm.tensor<18x5x17x6xf32>349A
spirv.ARM.GraphOutputs %3 : !spirv.arm.tensor<18x5x17x6xf32>350A·B
}351A·B
}352
353
354A
//===----------------------------------------------------------------------===//355A
// spirv.TOSA.Erf - PRO-FP356A
//===----------------------------------------------------------------------===//357
358A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {359A
spirv.GlobalVariable @erf_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<47x38x51xf32>, UniformConstant>360A
spirv.GlobalVariable @erf_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<47x38x51xf32>, UniformConstant>361A
spirv.ARM.GraphEntryPoint @erf_fp, @erf_fp_arg_0, @erf_fp_res_0362A
spirv.ARM.Graph @erf_fp(%arg0: !spirv.arm.tensor<47x38x51xf32>) -> (!spirv.arm.tensor<47x38x51xf32>) {363A
%0 = spirv.Tosa.Erf %arg0 : !spirv.arm.tensor<47x38x51xf32> -> !spirv.arm.tensor<47x38x51xf32>364A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<47x38x51xf32>365A·B
}366A·B
}367
368
369A
//===----------------------------------------------------------------------===//370A
// spirv.TOSA.Sigmoid - PRO-FP371A
//===----------------------------------------------------------------------===//372
373A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {374A
spirv.GlobalVariable @sigmoid_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<28x43x45xf32>, UniformConstant>375A
spirv.GlobalVariable @sigmoid_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<28x43x45xf32>, UniformConstant>376A
spirv.ARM.GraphEntryPoint @sigmoid_fp, @sigmoid_fp_arg_0, @sigmoid_fp_res_0377A
spirv.ARM.Graph @sigmoid_fp(%arg0: !spirv.arm.tensor<28x43x45xf32>) -> (!spirv.arm.tensor<28x43x45xf32>) {378A
%0 = spirv.Tosa.Sigmoid %arg0 : !spirv.arm.tensor<28x43x45xf32> -> !spirv.arm.tensor<28x43x45xf32>379A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<28x43x45xf32>380A·B
}381A·B
}382
383
384A
//===----------------------------------------------------------------------===//385A
// spirv.TOSA.Tanh - PRO-FP386A
//===----------------------------------------------------------------------===//387
388A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {389A
spirv.GlobalVariable @tanh_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<46x50x36xf16>, UniformConstant>390A
spirv.GlobalVariable @tanh_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<46x50x36xf16>, UniformConstant>391A
spirv.ARM.GraphEntryPoint @tanh_fp, @tanh_fp_arg_0, @tanh_fp_res_0392A
spirv.ARM.Graph @tanh_fp(%arg0: !spirv.arm.tensor<46x50x36xf16>) -> (!spirv.arm.tensor<46x50x36xf16>) {393A
%0 = spirv.Tosa.Tanh %arg0 : !spirv.arm.tensor<46x50x36xf16> -> !spirv.arm.tensor<46x50x36xf16>394A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<46x50x36xf16>395A·B
}396A·B
}397
398
399A
//===----------------------------------------------------------------------===//400A
// spirv.TOSA.Add - PRO-INT401A
//===----------------------------------------------------------------------===//402
403A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {404A
spirv.GlobalVariable @add_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<4x7x3x10xi32>, UniformConstant>405A
spirv.GlobalVariable @add_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<4x7x3x1xi32>, UniformConstant>406A
spirv.GlobalVariable @add_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<4x7x3x10xi32>, UniformConstant>407A
spirv.ARM.GraphEntryPoint @add_int, @add_int_arg_0, @add_int_arg_1, @add_int_res_0408A
spirv.ARM.Graph @add_int(%arg0: !spirv.arm.tensor<4x7x3x10xi32>, %arg1: !spirv.arm.tensor<4x7x3x1xi32>) -> (!spirv.arm.tensor<4x7x3x10xi32>) {409A
%0 = spirv.Tosa.Add %arg0, %arg1 : !spirv.arm.tensor<4x7x3x10xi32>, !spirv.arm.tensor<4x7x3x1xi32> -> !spirv.arm.tensor<4x7x3x10xi32>410A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<4x7x3x10xi32>411A·B
}412A·B
}413
414
415A
//===----------------------------------------------------------------------===//416A
// spirv.TOSA.Add - PRO-FP417A
//===----------------------------------------------------------------------===//418
419A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {420A
spirv.GlobalVariable @add_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<26x37x18xf16>, UniformConstant>421A
spirv.GlobalVariable @add_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x37x18xf16>, UniformConstant>422A
spirv.GlobalVariable @add_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<26x37x18xf16>, UniformConstant>423A
spirv.ARM.GraphEntryPoint @add_fp, @add_fp_arg_0, @add_fp_arg_1, @add_fp_res_0424A
spirv.ARM.Graph @add_fp(%arg0: !spirv.arm.tensor<26x37x18xf16>, %arg1: !spirv.arm.tensor<1x37x18xf16>) -> (!spirv.arm.tensor<26x37x18xf16>) {425A
%0 = spirv.Tosa.Add %arg0, %arg1 : !spirv.arm.tensor<26x37x18xf16>, !spirv.arm.tensor<1x37x18xf16> -> !spirv.arm.tensor<26x37x18xf16>426A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<26x37x18xf16>427A·B
}428A·B
}429
430
431A
//===----------------------------------------------------------------------===//432A
// spirv.TOSA.ArithmeticRightShift - PRO-INT433A
//===----------------------------------------------------------------------===//434
435A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {436A
spirv.GlobalVariable @arithmeticrightshift_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x47x22xi16>, UniformConstant>437A
spirv.GlobalVariable @arithmeticrightshift_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<49x47x22xi16>, UniformConstant>438A
spirv.GlobalVariable @arithmeticrightshift_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<49x47x22xi16>, UniformConstant>439A
spirv.ARM.GraphEntryPoint @arithmeticrightshift_int, @arithmeticrightshift_int_arg_0, @arithmeticrightshift_int_arg_1, @arithmeticrightshift_int_res_0440A
spirv.ARM.Graph @arithmeticrightshift_int(%arg0: !spirv.arm.tensor<1x47x22xi16>, %arg1: !spirv.arm.tensor<49x47x22xi16>) -> (!spirv.arm.tensor<49x47x22xi16>) {441A
%1 = spirv.Tosa.ArithmeticRightShift round = true, %arg0, %arg1 : !spirv.arm.tensor<1x47x22xi16>, !spirv.arm.tensor<49x47x22xi16> -> !spirv.arm.tensor<49x47x22xi16>442A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<49x47x22xi16>443A·B
}444A·B
}445
446
447A
//===----------------------------------------------------------------------===//448A
// spirv.TOSA.BitwiseAnd - PRO-INT449A
//===----------------------------------------------------------------------===//450
451A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {452A
spirv.GlobalVariable @bitwiseand_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<4x1x7x12xi16>, UniformConstant>453A
spirv.GlobalVariable @bitwiseand_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<4x13x7x12xi16>, UniformConstant>454A
spirv.GlobalVariable @bitwiseand_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<4x13x7x12xi16>, UniformConstant>455A
spirv.ARM.GraphEntryPoint @bitwiseand_int, @bitwiseand_int_arg_0, @bitwiseand_int_arg_1, @bitwiseand_int_res_0456A
spirv.ARM.Graph @bitwiseand_int(%arg0: !spirv.arm.tensor<4x1x7x12xi16>, %arg1: !spirv.arm.tensor<4x13x7x12xi16>) -> (!spirv.arm.tensor<4x13x7x12xi16>) {457A
%0 = spirv.Tosa.BitwiseAnd %arg0, %arg1 : !spirv.arm.tensor<4x1x7x12xi16>, !spirv.arm.tensor<4x13x7x12xi16> -> !spirv.arm.tensor<4x13x7x12xi16>458A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<4x13x7x12xi16>459A·B
}460A·B
}461
462
463A
//===----------------------------------------------------------------------===//464A
// spirv.TOSA.BitwiseOr - PRO-INT465A
//===----------------------------------------------------------------------===//466
467A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {468A
spirv.GlobalVariable @bitwiseor_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<11x30x23xi32>, UniformConstant>469A
spirv.GlobalVariable @bitwiseor_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x30x23xi32>, UniformConstant>470A
spirv.GlobalVariable @bitwiseor_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<11x30x23xi32>, UniformConstant>471A
spirv.ARM.GraphEntryPoint @bitwiseor_int, @bitwiseor_int_arg_0, @bitwiseor_int_arg_1, @bitwiseor_int_res_0472A
spirv.ARM.Graph @bitwiseor_int(%arg0: !spirv.arm.tensor<11x30x23xi32>, %arg1: !spirv.arm.tensor<1x30x23xi32>) -> (!spirv.arm.tensor<11x30x23xi32>) {473A
%0 = spirv.Tosa.BitwiseOr %arg0, %arg1 : !spirv.arm.tensor<11x30x23xi32>, !spirv.arm.tensor<1x30x23xi32> -> !spirv.arm.tensor<11x30x23xi32>474A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<11x30x23xi32>475A·B
}476A·B
}477
478
479A
//===----------------------------------------------------------------------===//480A
// spirv.TOSA.BitwiseXor - PRO-INT481A
//===----------------------------------------------------------------------===//482
483A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {484A
spirv.GlobalVariable @bitwisexor_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<4x8x13x9xi16>, UniformConstant>485A
spirv.GlobalVariable @bitwisexor_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<4x8x1x9xi16>, UniformConstant>486A
spirv.GlobalVariable @bitwisexor_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<4x8x13x9xi16>, UniformConstant>487A
spirv.ARM.GraphEntryPoint @bitwisexor_int, @bitwisexor_int_arg_0, @bitwisexor_int_arg_1, @bitwisexor_int_res_0488A
spirv.ARM.Graph @bitwisexor_int(%arg0: !spirv.arm.tensor<4x8x13x9xi16>, %arg1: !spirv.arm.tensor<4x8x1x9xi16>) -> (!spirv.arm.tensor<4x8x13x9xi16>) {489A
%0 = spirv.Tosa.BitwiseXor %arg0, %arg1 : !spirv.arm.tensor<4x8x13x9xi16>, !spirv.arm.tensor<4x8x1x9xi16> -> !spirv.arm.tensor<4x8x13x9xi16>490A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<4x8x13x9xi16>491A·B
}492A·B
}493
494
495A
//===----------------------------------------------------------------------===//496A
// spirv.TOSA.IntDiv - PRO-INT or PRO-FP497A
//===----------------------------------------------------------------------===//498
499A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {500A
spirv.GlobalVariable @intdiv_any_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x65533x1xi32>, UniformConstant>501A
spirv.GlobalVariable @intdiv_any_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<2x65533x1xi32>, UniformConstant>502A
spirv.GlobalVariable @intdiv_any_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<2x65533x1xi32>, UniformConstant>503A
spirv.ARM.GraphEntryPoint @intdiv_any, @intdiv_any_arg_0, @intdiv_any_arg_1, @intdiv_any_res_0504A
spirv.ARM.Graph @intdiv_any(%arg0: !spirv.arm.tensor<1x65533x1xi32>, %arg1: !spirv.arm.tensor<2x65533x1xi32>) -> (!spirv.arm.tensor<2x65533x1xi32>) {505A
%0 = spirv.Tosa.IntDiv %arg0, %arg1 : !spirv.arm.tensor<1x65533x1xi32>, !spirv.arm.tensor<2x65533x1xi32> -> !spirv.arm.tensor<2x65533x1xi32>506A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<2x65533x1xi32>507A·B
}508A·B
}509
510
511A
//===----------------------------------------------------------------------===//512A
// spirv.TOSA.LogicalAnd - PRO-INT or PRO-FP513A
//===----------------------------------------------------------------------===//514
515A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {516A
spirv.GlobalVariable @logicaland_any_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<2x1x7x11xi1>, UniformConstant>517A
spirv.GlobalVariable @logicaland_any_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<2x4x7x11xi1>, UniformConstant>518A
spirv.GlobalVariable @logicaland_any_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<2x4x7x11xi1>, UniformConstant>519A
spirv.ARM.GraphEntryPoint @logicaland_any, @logicaland_any_arg_0, @logicaland_any_arg_1, @logicaland_any_res_0520A
spirv.ARM.Graph @logicaland_any(%arg0: !spirv.arm.tensor<2x1x7x11xi1>, %arg1: !spirv.arm.tensor<2x4x7x11xi1>) -> (!spirv.arm.tensor<2x4x7x11xi1>) {521A
%0 = spirv.Tosa.LogicalAnd %arg0, %arg1 : !spirv.arm.tensor<2x1x7x11xi1>, !spirv.arm.tensor<2x4x7x11xi1> -> !spirv.arm.tensor<2x4x7x11xi1>522A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<2x4x7x11xi1>523A·B
}524A·B
}525
526
527A
//===----------------------------------------------------------------------===//528A
// spirv.TOSA.LogicalLeftShift - PRO-INT or PRO-FP529A
//===----------------------------------------------------------------------===//530
531A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {532A
spirv.GlobalVariable @logicalleftshift_any_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<7x1x11x4xi8>, UniformConstant>533A
spirv.GlobalVariable @logicalleftshift_any_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<7x8x11x4xi8>, UniformConstant>534A
spirv.GlobalVariable @logicalleftshift_any_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<7x8x11x4xi8>, UniformConstant>535A
spirv.ARM.GraphEntryPoint @logicalleftshift_any, @logicalleftshift_any_arg_0, @logicalleftshift_any_arg_1, @logicalleftshift_any_res_0536A
spirv.ARM.Graph @logicalleftshift_any(%arg0: !spirv.arm.tensor<7x1x11x4xi8>, %arg1: !spirv.arm.tensor<7x8x11x4xi8>) -> (!spirv.arm.tensor<7x8x11x4xi8>) {537A
%0 = spirv.Tosa.LogicalLeftShift %arg0, %arg1 : !spirv.arm.tensor<7x1x11x4xi8>, !spirv.arm.tensor<7x8x11x4xi8> -> !spirv.arm.tensor<7x8x11x4xi8>538A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<7x8x11x4xi8>539A·B
}540A·B
}541
542
543A
//===----------------------------------------------------------------------===//544A
// spirv.TOSA.LogicalRightShift - PRO-INT or PRO-FP545A
//===----------------------------------------------------------------------===//546
547A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {548A
spirv.GlobalVariable @logicalrightshift_any_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<6x13x1x19xi8>, UniformConstant>549A
spirv.GlobalVariable @logicalrightshift_any_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<6x13x6x19xi8>, UniformConstant>550A
spirv.GlobalVariable @logicalrightshift_any_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<6x13x6x19xi8>, UniformConstant>551A
spirv.ARM.GraphEntryPoint @logicalrightshift_any, @logicalrightshift_any_arg_0, @logicalrightshift_any_arg_1, @logicalrightshift_any_res_0552A
spirv.ARM.Graph @logicalrightshift_any(%arg0: !spirv.arm.tensor<6x13x1x19xi8>, %arg1: !spirv.arm.tensor<6x13x6x19xi8>) -> (!spirv.arm.tensor<6x13x6x19xi8>) {553A
%0 = spirv.Tosa.LogicalRightShift %arg0, %arg1 : !spirv.arm.tensor<6x13x1x19xi8>, !spirv.arm.tensor<6x13x6x19xi8> -> !spirv.arm.tensor<6x13x6x19xi8>554A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<6x13x6x19xi8>555A·B
}556A·B
}557
558
559A
//===----------------------------------------------------------------------===//560A
// spirv.TOSA.LogicalOr - PRO-INT or PRO-FP561A
//===----------------------------------------------------------------------===//562
563A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {564A
spirv.GlobalVariable @logicalor_any_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<3x6x12x5xi1>, UniformConstant>565A
spirv.GlobalVariable @logicalor_any_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<3x6x1x5xi1>, UniformConstant>566A
spirv.GlobalVariable @logicalor_any_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<3x6x12x5xi1>, UniformConstant>567A
spirv.ARM.GraphEntryPoint @logicalor_any, @logicalor_any_arg_0, @logicalor_any_arg_1, @logicalor_any_res_0568A
spirv.ARM.Graph @logicalor_any(%arg0: !spirv.arm.tensor<3x6x12x5xi1>, %arg1: !spirv.arm.tensor<3x6x1x5xi1>) -> (!spirv.arm.tensor<3x6x12x5xi1>) {569A
%0 = spirv.Tosa.LogicalOr %arg0, %arg1 : !spirv.arm.tensor<3x6x12x5xi1>, !spirv.arm.tensor<3x6x1x5xi1> -> !spirv.arm.tensor<3x6x12x5xi1>570A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<3x6x12x5xi1>571A·B
}572A·B
}573
574
575A
//===----------------------------------------------------------------------===//576A
// spirv.TOSA.LogicalXor - PRO-INT or PRO-FP577A
//===----------------------------------------------------------------------===//578
579A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {580A
spirv.GlobalVariable @logicalxor_any_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<11x4x9x12xi1>, UniformConstant>581A
spirv.GlobalVariable @logicalxor_any_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<11x4x9x1xi1>, UniformConstant>582A
spirv.GlobalVariable @logicalxor_any_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<11x4x9x12xi1>, UniformConstant>583A
spirv.ARM.GraphEntryPoint @logicalxor_any, @logicalxor_any_arg_0, @logicalxor_any_arg_1, @logicalxor_any_res_0584A
spirv.ARM.Graph @logicalxor_any(%arg0: !spirv.arm.tensor<11x4x9x12xi1>, %arg1: !spirv.arm.tensor<11x4x9x1xi1>) -> (!spirv.arm.tensor<11x4x9x12xi1>) {585A
%0 = spirv.Tosa.LogicalXor %arg0, %arg1 : !spirv.arm.tensor<11x4x9x12xi1>, !spirv.arm.tensor<11x4x9x1xi1> -> !spirv.arm.tensor<11x4x9x12xi1>586A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<11x4x9x12xi1>587A·B
}588A·B
}589
590
591A
//===----------------------------------------------------------------------===//592A
// spirv.TOSA.Maximum - PRO-INT593A
//===----------------------------------------------------------------------===//594
595A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {596A
spirv.GlobalVariable @maximum_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x2x65533x1xi32>, UniformConstant>597A
spirv.GlobalVariable @maximum_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x2x65533x2xi32>, UniformConstant>598A
spirv.GlobalVariable @maximum_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x2x65533x2xi32>, UniformConstant>599A
spirv.ARM.GraphEntryPoint @maximum_int, @maximum_int_arg_0, @maximum_int_arg_1, @maximum_int_res_0600A
spirv.ARM.Graph @maximum_int(%arg0: !spirv.arm.tensor<1x2x65533x1xi32>, %arg1: !spirv.arm.tensor<1x2x65533x2xi32>) -> (!spirv.arm.tensor<1x2x65533x2xi32>) {601A
%1 = spirv.Tosa.Maximum nan_mode = <Propagate>, %arg0, %arg1 : !spirv.arm.tensor<1x2x65533x1xi32>, !spirv.arm.tensor<1x2x65533x2xi32> -> !spirv.arm.tensor<1x2x65533x2xi32>602A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<1x2x65533x2xi32>603A·B
}604A·B
}605
606
607A
//===----------------------------------------------------------------------===//608A
// spirv.TOSA.Maximum - PRO-FP609A
//===----------------------------------------------------------------------===//610
611A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {612A
spirv.GlobalVariable @maximum_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x12x14x7xf16>, UniformConstant>613A
spirv.GlobalVariable @maximum_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<11x12x14x7xf16>, UniformConstant>614A
spirv.GlobalVariable @maximum_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<11x12x14x7xf16>, UniformConstant>615A
spirv.ARM.GraphEntryPoint @maximum_fp, @maximum_fp_arg_0, @maximum_fp_arg_1, @maximum_fp_res_0616A
spirv.ARM.Graph @maximum_fp(%arg0: !spirv.arm.tensor<1x12x14x7xf16>, %arg1: !spirv.arm.tensor<11x12x14x7xf16>) -> (!spirv.arm.tensor<11x12x14x7xf16>) {617A
%1 = spirv.Tosa.Maximum nan_mode = <Ignore>, %arg0, %arg1 : !spirv.arm.tensor<1x12x14x7xf16>, !spirv.arm.tensor<11x12x14x7xf16> -> !spirv.arm.tensor<11x12x14x7xf16>618A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<11x12x14x7xf16>619A·B
}620A·B
}621
622
623A
//===----------------------------------------------------------------------===//624A
// spirv.TOSA.Minimum - PRO-INT625A
//===----------------------------------------------------------------------===//626
627A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {628A
spirv.GlobalVariable @minimum_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<15x2x10x11xi32>, UniformConstant>629A
spirv.GlobalVariable @minimum_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<15x1x10x11xi32>, UniformConstant>630A
spirv.GlobalVariable @minimum_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<15x2x10x11xi32>, UniformConstant>631A
spirv.ARM.GraphEntryPoint @minimum_int, @minimum_int_arg_0, @minimum_int_arg_1, @minimum_int_res_0632A
spirv.ARM.Graph @minimum_int(%arg0: !spirv.arm.tensor<15x2x10x11xi32>, %arg1: !spirv.arm.tensor<15x1x10x11xi32>) -> (!spirv.arm.tensor<15x2x10x11xi32>) {633A
%1 = spirv.Tosa.Minimum nan_mode = <Propagate>, %arg0, %arg1 : !spirv.arm.tensor<15x2x10x11xi32>, !spirv.arm.tensor<15x1x10x11xi32> -> !spirv.arm.tensor<15x2x10x11xi32>634A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<15x2x10x11xi32>635A·B
}636A·B
}637
638
639A
//===----------------------------------------------------------------------===//640A
// spirv.TOSA.Minimum - PRO-FP641A
//===----------------------------------------------------------------------===//642
643A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {644A
spirv.GlobalVariable @minimum_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x65531x2x1xf32>, UniformConstant>645A
spirv.GlobalVariable @minimum_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x1x2x1xf32>, UniformConstant>646A
spirv.GlobalVariable @minimum_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x65531x2x1xf32>, UniformConstant>647A
spirv.ARM.GraphEntryPoint @minimum_fp, @minimum_fp_arg_0, @minimum_fp_arg_1, @minimum_fp_res_0648A
spirv.ARM.Graph @minimum_fp(%arg0: !spirv.arm.tensor<1x65531x2x1xf32>, %arg1: !spirv.arm.tensor<1x1x2x1xf32>) -> (!spirv.arm.tensor<1x65531x2x1xf32>) {649A
%1 = spirv.Tosa.Minimum nan_mode = <Propagate>, %arg0, %arg1 : !spirv.arm.tensor<1x65531x2x1xf32>, !spirv.arm.tensor<1x1x2x1xf32> -> !spirv.arm.tensor<1x65531x2x1xf32>650A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<1x65531x2x1xf32>651A·B
}652A·B
}653
654
655A
//===----------------------------------------------------------------------===//656A
// spirv.TOSA.Mul - PRO-INT657A
//===----------------------------------------------------------------------===//658
659A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {660A
spirv.GlobalVariable @mul_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<34x21x39xi32>, UniformConstant>661A
spirv.GlobalVariable @mul_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<34x21x1xi32>, UniformConstant>662A
spirv.GlobalVariable @mul_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<34x21x39xi32>, UniformConstant>663A
spirv.ARM.GraphEntryPoint @mul_int, @mul_int_arg_0, @mul_int_arg_1, @mul_int_res_0664A
spirv.ARM.Graph @mul_int(%arg0: !spirv.arm.tensor<34x21x39xi32>, %arg1: !spirv.arm.tensor<34x21x1xi32>) -> (!spirv.arm.tensor<34x21x39xi32>) {665A
%0 = spirv.Constant dense<31> : !spirv.arm.tensor<1xi8>666A
%1 = spirv.Tosa.Mul %arg0, %arg1, %0 : !spirv.arm.tensor<34x21x39xi32>, !spirv.arm.tensor<34x21x1xi32>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<34x21x39xi32>667A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<34x21x39xi32>668A·B
}669A·B
}670
671
672A
//===----------------------------------------------------------------------===//673A
// spirv.TOSA.Mul - PRO-FP674A
//===----------------------------------------------------------------------===//675
676A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {677A
spirv.GlobalVariable @mul_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<57x1x55xf16>, UniformConstant>678A
spirv.GlobalVariable @mul_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<57x37x55xf16>, UniformConstant>679A
spirv.GlobalVariable @mul_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<57x37x55xf16>, UniformConstant>680A
spirv.ARM.GraphEntryPoint @mul_fp, @mul_fp_arg_0, @mul_fp_arg_1, @mul_fp_res_0681A
spirv.ARM.Graph @mul_fp(%arg0: !spirv.arm.tensor<57x1x55xf16>, %arg1: !spirv.arm.tensor<57x37x55xf16>) -> (!spirv.arm.tensor<57x37x55xf16>) {682A
%0 = spirv.Constant dense<0> : !spirv.arm.tensor<1xi8>683A
%1 = spirv.Tosa.Mul %arg0, %arg1, %0 : !spirv.arm.tensor<57x1x55xf16>, !spirv.arm.tensor<57x37x55xf16>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<57x37x55xf16>684A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<57x37x55xf16>685A·B
}686A·B
}687
688
689A
//===----------------------------------------------------------------------===//690A
// spirv.TOSA.Pow - PRO-FP691A
//===----------------------------------------------------------------------===//692
693A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {694A
spirv.GlobalVariable @pow_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x52x53xf16>, UniformConstant>695A
spirv.GlobalVariable @pow_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<44x52x53xf16>, UniformConstant>696A
spirv.GlobalVariable @pow_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<44x52x53xf16>, UniformConstant>697A
spirv.ARM.GraphEntryPoint @pow_fp, @pow_fp_arg_0, @pow_fp_arg_1, @pow_fp_res_0698A
spirv.ARM.Graph @pow_fp(%arg0: !spirv.arm.tensor<1x52x53xf16>, %arg1: !spirv.arm.tensor<44x52x53xf16>) -> (!spirv.arm.tensor<44x52x53xf16>) {699A
%0 = spirv.Tosa.Pow %arg0, %arg1 : !spirv.arm.tensor<1x52x53xf16>, !spirv.arm.tensor<44x52x53xf16> -> !spirv.arm.tensor<44x52x53xf16>700A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<44x52x53xf16>701A·B
}702A·B
}703
704
705A
//===----------------------------------------------------------------------===//706A
// spirv.TOSA.Sub - PRO-INT707A
//===----------------------------------------------------------------------===//708
709A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {710A
spirv.GlobalVariable @sub_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<6x10x6x6xi32>, UniformConstant>711A
spirv.GlobalVariable @sub_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x10x6x6xi32>, UniformConstant>712A
spirv.GlobalVariable @sub_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<6x10x6x6xi32>, UniformConstant>713A
spirv.ARM.GraphEntryPoint @sub_int, @sub_int_arg_0, @sub_int_arg_1, @sub_int_res_0714A
spirv.ARM.Graph @sub_int(%arg0: !spirv.arm.tensor<6x10x6x6xi32>, %arg1: !spirv.arm.tensor<1x10x6x6xi32>) -> (!spirv.arm.tensor<6x10x6x6xi32>) {715A
%0 = spirv.Tosa.Sub %arg0, %arg1 : !spirv.arm.tensor<6x10x6x6xi32>, !spirv.arm.tensor<1x10x6x6xi32> -> !spirv.arm.tensor<6x10x6x6xi32>716A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<6x10x6x6xi32>717A·B
}718A·B
}719
720
721A
//===----------------------------------------------------------------------===//722A
// spirv.TOSA.Sub - PRO-FP723A
//===----------------------------------------------------------------------===//724
725A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {726A
spirv.GlobalVariable @sub_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x10x13x12xf16>, UniformConstant>727A
spirv.GlobalVariable @sub_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<6x10x13x12xf16>, UniformConstant>728A
spirv.GlobalVariable @sub_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<6x10x13x12xf16>, UniformConstant>729A
spirv.ARM.GraphEntryPoint @sub_fp, @sub_fp_arg_0, @sub_fp_arg_1, @sub_fp_res_0730A
spirv.ARM.Graph @sub_fp(%arg0: !spirv.arm.tensor<1x10x13x12xf16>, %arg1: !spirv.arm.tensor<6x10x13x12xf16>) -> (!spirv.arm.tensor<6x10x13x12xf16>) {731A
%0 = spirv.Tosa.Sub %arg0, %arg1 : !spirv.arm.tensor<1x10x13x12xf16>, !spirv.arm.tensor<6x10x13x12xf16> -> !spirv.arm.tensor<6x10x13x12xf16>732A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<6x10x13x12xf16>733A·B
}734A·B
}735
736
737A
//===----------------------------------------------------------------------===//738A
// spirv.TOSA.Table - PRO-INT739A
//===----------------------------------------------------------------------===//740
741A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {742A
spirv.GlobalVariable @table_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<3x2x15x7xi8>, UniformConstant>743A
spirv.GlobalVariable @table_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<3x2x15x7xi8>, UniformConstant>744A
spirv.ARM.GraphEntryPoint @table_int, @table_int_arg_0, @table_int_res_0745A
spirv.ARM.Graph @table_int(%arg0: !spirv.arm.tensor<3x2x15x7xi8>) -> (!spirv.arm.tensor<3x2x15x7xi8>) {746A
%0 = spirv.ARM.GraphConstant {graph_constant_id = 0 : i32} : !spirv.arm.tensor<256xi8>747A
%1 = spirv.Tosa.Table %arg0, %0 : !spirv.arm.tensor<3x2x15x7xi8>, !spirv.arm.tensor<256xi8> -> !spirv.arm.tensor<3x2x15x7xi8>748A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<3x2x15x7xi8>749A·B
}750A·B
}751
752
753A
//===----------------------------------------------------------------------===//754A
// spirv.TOSA.Abs - PRO-INT755A
//===----------------------------------------------------------------------===//756
757A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {758A
spirv.GlobalVariable @abs_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<5x1x4x4xi32>, UniformConstant>759A
spirv.GlobalVariable @abs_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<5x1x4x4xi32>, UniformConstant>760A
spirv.ARM.GraphEntryPoint @abs_int, @abs_int_arg_0, @abs_int_res_0761A
spirv.ARM.Graph @abs_int(%arg0: !spirv.arm.tensor<5x1x4x4xi32>) -> (!spirv.arm.tensor<5x1x4x4xi32>) {762A
%0 = spirv.Tosa.Abs %arg0 : !spirv.arm.tensor<5x1x4x4xi32> -> !spirv.arm.tensor<5x1x4x4xi32>763A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<5x1x4x4xi32>764A·B
}765A·B
}766
767
768A
//===----------------------------------------------------------------------===//769A
// spirv.TOSA.Abs - PRO-FP770A
//===----------------------------------------------------------------------===//771
772A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {773A
spirv.GlobalVariable @abs_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<3x6x14x8xf16>, UniformConstant>774A
spirv.GlobalVariable @abs_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<3x6x14x8xf16>, UniformConstant>775A
spirv.ARM.GraphEntryPoint @abs_fp, @abs_fp_arg_0, @abs_fp_res_0776A
spirv.ARM.Graph @abs_fp(%arg0: !spirv.arm.tensor<3x6x14x8xf16>) -> (!spirv.arm.tensor<3x6x14x8xf16>) {777A
%0 = spirv.Tosa.Abs %arg0 : !spirv.arm.tensor<3x6x14x8xf16> -> !spirv.arm.tensor<3x6x14x8xf16>778A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<3x6x14x8xf16>779A·B
}780A·B
}781
782
783A
//===----------------------------------------------------------------------===//784A
// spirv.TOSA.BitwiseNot - PRO-INT785A
//===----------------------------------------------------------------------===//786
787A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {788A
spirv.GlobalVariable @bitwisenot_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<12x56x50xi32>, UniformConstant>789A
spirv.GlobalVariable @bitwisenot_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<12x56x50xi32>, UniformConstant>790A
spirv.ARM.GraphEntryPoint @bitwisenot_int, @bitwisenot_int_arg_0, @bitwisenot_int_res_0791A
spirv.ARM.Graph @bitwisenot_int(%arg0: !spirv.arm.tensor<12x56x50xi32>) -> (!spirv.arm.tensor<12x56x50xi32>) {792A
%0 = spirv.Tosa.BitwiseNot %arg0 : !spirv.arm.tensor<12x56x50xi32> -> !spirv.arm.tensor<12x56x50xi32>793A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<12x56x50xi32>794A·B
}795A·B
}796
797
798A
//===----------------------------------------------------------------------===//799A
// spirv.TOSA.Ceil - PRO-FP800A
//===----------------------------------------------------------------------===//801
802A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {803A
spirv.GlobalVariable @ceil_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<46x55x53xf16>, UniformConstant>804A
spirv.GlobalVariable @ceil_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<46x55x53xf16>, UniformConstant>805A
spirv.ARM.GraphEntryPoint @ceil_fp, @ceil_fp_arg_0, @ceil_fp_res_0806A
spirv.ARM.Graph @ceil_fp(%arg0: !spirv.arm.tensor<46x55x53xf16>) -> (!spirv.arm.tensor<46x55x53xf16>) {807A
%0 = spirv.Tosa.Ceil %arg0 : !spirv.arm.tensor<46x55x53xf16> -> !spirv.arm.tensor<46x55x53xf16>808A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<46x55x53xf16>809A·B
}810A·B
}811
812
813A
//===----------------------------------------------------------------------===//814A
// spirv.TOSA.Clz - PRO-INT815A
//===----------------------------------------------------------------------===//816
817A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {818A
spirv.GlobalVariable @clz_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<14x10x7x5xi32>, UniformConstant>819A
spirv.GlobalVariable @clz_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<14x10x7x5xi32>, UniformConstant>820A
spirv.ARM.GraphEntryPoint @clz_int, @clz_int_arg_0, @clz_int_res_0821A
spirv.ARM.Graph @clz_int(%arg0: !spirv.arm.tensor<14x10x7x5xi32>) -> (!spirv.arm.tensor<14x10x7x5xi32>) {822A
%0 = spirv.Tosa.Clz %arg0 : !spirv.arm.tensor<14x10x7x5xi32> -> !spirv.arm.tensor<14x10x7x5xi32>823A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<14x10x7x5xi32>824A·B
}825A·B
}826
827
828A
//===----------------------------------------------------------------------===//829A
// spirv.TOSA.Cos - PRO-FP830A
//===----------------------------------------------------------------------===//831
832A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {833A
spirv.GlobalVariable @cos_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<44x49x51xf32>, UniformConstant>834A
spirv.GlobalVariable @cos_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<44x49x51xf32>, UniformConstant>835A
spirv.ARM.GraphEntryPoint @cos_fp, @cos_fp_arg_0, @cos_fp_res_0836A
spirv.ARM.Graph @cos_fp(%arg0: !spirv.arm.tensor<44x49x51xf32>) -> (!spirv.arm.tensor<44x49x51xf32>) {837A
%0 = spirv.Tosa.Cos %arg0 : !spirv.arm.tensor<44x49x51xf32> -> !spirv.arm.tensor<44x49x51xf32>838A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<44x49x51xf32>839A·B
}840A·B
}841
842
843A
//===----------------------------------------------------------------------===//844A
// spirv.TOSA.Exp - PRO-FP845A
//===----------------------------------------------------------------------===//846
847A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {848A
spirv.GlobalVariable @exp_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<37x53x47xf32>, UniformConstant>849A
spirv.GlobalVariable @exp_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<37x53x47xf32>, UniformConstant>850A
spirv.ARM.GraphEntryPoint @exp_fp, @exp_fp_arg_0, @exp_fp_res_0851A
spirv.ARM.Graph @exp_fp(%arg0: !spirv.arm.tensor<37x53x47xf32>) -> (!spirv.arm.tensor<37x53x47xf32>) {852A
%0 = spirv.Tosa.Exp %arg0 : !spirv.arm.tensor<37x53x47xf32> -> !spirv.arm.tensor<37x53x47xf32>853A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<37x53x47xf32>854A·B
}855A·B
}856
857
858A
//===----------------------------------------------------------------------===//859A
// spirv.TOSA.Floor - PRO-FP860A
//===----------------------------------------------------------------------===//861
862A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {863A
spirv.GlobalVariable @floor_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<40x52x42xf32>, UniformConstant>864A
spirv.GlobalVariable @floor_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<40x52x42xf32>, UniformConstant>865A
spirv.ARM.GraphEntryPoint @floor_fp, @floor_fp_arg_0, @floor_fp_res_0866A
spirv.ARM.Graph @floor_fp(%arg0: !spirv.arm.tensor<40x52x42xf32>) -> (!spirv.arm.tensor<40x52x42xf32>) {867A
%0 = spirv.Tosa.Floor %arg0 : !spirv.arm.tensor<40x52x42xf32> -> !spirv.arm.tensor<40x52x42xf32>868A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<40x52x42xf32>869A·B
}870A·B
}871
872
873A
//===----------------------------------------------------------------------===//874A
// spirv.TOSA.Log - PRO-FP875A
//===----------------------------------------------------------------------===//876
877A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {878A
spirv.GlobalVariable @log_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<45x43x36xf16>, UniformConstant>879A
spirv.GlobalVariable @log_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<45x43x36xf16>, UniformConstant>880A
spirv.ARM.GraphEntryPoint @log_fp, @log_fp_arg_0, @log_fp_res_0881A
spirv.ARM.Graph @log_fp(%arg0: !spirv.arm.tensor<45x43x36xf16>) -> (!spirv.arm.tensor<45x43x36xf16>) {882A
%0 = spirv.Tosa.Log %arg0 : !spirv.arm.tensor<45x43x36xf16> -> !spirv.arm.tensor<45x43x36xf16>883A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<45x43x36xf16>884A·B
}885A·B
}886
887
888A
//===----------------------------------------------------------------------===//889A
// spirv.TOSA.LogicalNot - PRO-INT or PRO-FP890A
//===----------------------------------------------------------------------===//891
892A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {893A
spirv.GlobalVariable @logicalnot_any_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<54x26x10xi1>, UniformConstant>894A
spirv.GlobalVariable @logicalnot_any_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<54x26x10xi1>, UniformConstant>895A
spirv.ARM.GraphEntryPoint @logicalnot_any, @logicalnot_any_arg_0, @logicalnot_any_res_0896A
spirv.ARM.Graph @logicalnot_any(%arg0: !spirv.arm.tensor<54x26x10xi1>) -> (!spirv.arm.tensor<54x26x10xi1>) {897A
%0 = spirv.Tosa.LogicalNot %arg0 : !spirv.arm.tensor<54x26x10xi1> -> !spirv.arm.tensor<54x26x10xi1>898A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<54x26x10xi1>899A·B
}900A·B
}901
902
903A
//===----------------------------------------------------------------------===//904A
// spirv.TOSA.Negate - PRO-INT905A
//===----------------------------------------------------------------------===//906
907A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {908A
spirv.GlobalVariable @negate_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<3x1x65540x1xi8>, UniformConstant>909A
spirv.GlobalVariable @negate_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<3x1x65540x1xi8>, UniformConstant>910A
spirv.ARM.GraphEntryPoint @negate_int, @negate_int_arg_0, @negate_int_res_0911A
spirv.ARM.Graph @negate_int(%arg0: !spirv.arm.tensor<3x1x65540x1xi8>) -> (!spirv.arm.tensor<3x1x65540x1xi8>) {912A
%0 = spirv.Constant dense<111> : !spirv.arm.tensor<1xi8>913A
%1 = spirv.Constant dense<-32> : !spirv.arm.tensor<1xi8>914A
%2 = spirv.Tosa.Negate %arg0, %0, %1 : !spirv.arm.tensor<3x1x65540x1xi8>, !spirv.arm.tensor<1xi8>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<3x1x65540x1xi8>915A
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<3x1x65540x1xi8>916A·B
}917A·B
}918
919
920A
//===----------------------------------------------------------------------===//921A
// spirv.TOSA.Negate - PRO-FP922A
//===----------------------------------------------------------------------===//923
924A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {925A
spirv.GlobalVariable @negate_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<2x7x15x13xf16>, UniformConstant>926A
spirv.GlobalVariable @negate_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<2x7x15x13xf16>, UniformConstant>927A
spirv.ARM.GraphEntryPoint @negate_fp, @negate_fp_arg_0, @negate_fp_res_0928A
spirv.ARM.Graph @negate_fp(%arg0: !spirv.arm.tensor<2x7x15x13xf16>) -> (!spirv.arm.tensor<2x7x15x13xf16>) {929A
%0 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf16>930A
%1 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf16>931A
%2 = spirv.Tosa.Negate %arg0, %0, %1 : !spirv.arm.tensor<2x7x15x13xf16>, !spirv.arm.tensor<1xf16>, !spirv.arm.tensor<1xf16> -> !spirv.arm.tensor<2x7x15x13xf16>932A
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<2x7x15x13xf16>933A·B
}934A·B
}935
936
937A
//===----------------------------------------------------------------------===//938A
// spirv.TOSA.Reciprocal - PRO-FP939A
//===----------------------------------------------------------------------===//940
941A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {942A
spirv.GlobalVariable @reciprocal_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<38x47x44xf32>, UniformConstant>943A
spirv.GlobalVariable @reciprocal_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<38x47x44xf32>, UniformConstant>944A
spirv.ARM.GraphEntryPoint @reciprocal_fp, @reciprocal_fp_arg_0, @reciprocal_fp_res_0945A
spirv.ARM.Graph @reciprocal_fp(%arg0: !spirv.arm.tensor<38x47x44xf32>) -> (!spirv.arm.tensor<38x47x44xf32>) {946A
%0 = spirv.Tosa.Reciprocal %arg0 : !spirv.arm.tensor<38x47x44xf32> -> !spirv.arm.tensor<38x47x44xf32>947A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<38x47x44xf32>948A·B
}949A·B
}950
951
952A
//===----------------------------------------------------------------------===//953A
// spirv.TOSA.Rsqrt - PRO-FP954A
//===----------------------------------------------------------------------===//955
956A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {957A
spirv.GlobalVariable @rsqrt_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<40x57x56xf32>, UniformConstant>958A
spirv.GlobalVariable @rsqrt_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<40x57x56xf32>, UniformConstant>959A
spirv.ARM.GraphEntryPoint @rsqrt_fp, @rsqrt_fp_arg_0, @rsqrt_fp_res_0960A
spirv.ARM.Graph @rsqrt_fp(%arg0: !spirv.arm.tensor<40x57x56xf32>) -> (!spirv.arm.tensor<40x57x56xf32>) {961A
%0 = spirv.Tosa.Rsqrt %arg0 : !spirv.arm.tensor<40x57x56xf32> -> !spirv.arm.tensor<40x57x56xf32>962A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<40x57x56xf32>963A·B
}964A·B
}965
966
967A
//===----------------------------------------------------------------------===//968A
// spirv.TOSA.Sin - PRO-FP969A
//===----------------------------------------------------------------------===//970
971A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {972A
spirv.GlobalVariable @sin_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<49x38x58xf16>, UniformConstant>973A
spirv.GlobalVariable @sin_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<49x38x58xf16>, UniformConstant>974A
spirv.ARM.GraphEntryPoint @sin_fp, @sin_fp_arg_0, @sin_fp_res_0975A
spirv.ARM.Graph @sin_fp(%arg0: !spirv.arm.tensor<49x38x58xf16>) -> (!spirv.arm.tensor<49x38x58xf16>) {976A
%0 = spirv.Tosa.Sin %arg0 : !spirv.arm.tensor<49x38x58xf16> -> !spirv.arm.tensor<49x38x58xf16>977A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<49x38x58xf16>978A·B
}979A·B
}980
981
982A
//===----------------------------------------------------------------------===//983A
// spirv.TOSA.Select - PRO-INT984A
//===----------------------------------------------------------------------===//985
986A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {987A
spirv.GlobalVariable @select_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<4x1x4x5xi1>, UniformConstant>988A
spirv.GlobalVariable @select_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<4x6x4x5xi8>, UniformConstant>989A
spirv.GlobalVariable @select_int_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<4x6x4x5xi8>, UniformConstant>990A
spirv.GlobalVariable @select_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<4x6x4x5xi8>, UniformConstant>991A
spirv.ARM.GraphEntryPoint @select_int, @select_int_arg_0, @select_int_arg_1, @select_int_arg_2, @select_int_res_0992A
spirv.ARM.Graph @select_int(%arg0: !spirv.arm.tensor<4x1x4x5xi1>, %arg1: !spirv.arm.tensor<4x6x4x5xi8>, %arg2: !spirv.arm.tensor<4x6x4x5xi8>) -> (!spirv.arm.tensor<4x6x4x5xi8>) {993A
%0 = spirv.Tosa.Select %arg0, %arg1, %arg2 : !spirv.arm.tensor<4x1x4x5xi1>, !spirv.arm.tensor<4x6x4x5xi8>, !spirv.arm.tensor<4x6x4x5xi8> -> !spirv.arm.tensor<4x6x4x5xi8>994A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<4x6x4x5xi8>995A·B
}996A·B
}997
998
999A
//===----------------------------------------------------------------------===//1000A
// spirv.TOSA.Select - PRO-FP1001A
//===----------------------------------------------------------------------===//1002
1003A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1004A
spirv.GlobalVariable @select_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<9x2x15x8xi1>, UniformConstant>1005A
spirv.GlobalVariable @select_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<9x2x15x8xf16>, UniformConstant>1006A
spirv.GlobalVariable @select_fp_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<9x1x15x8xf16>, UniformConstant>1007A
spirv.GlobalVariable @select_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<9x2x15x8xf16>, UniformConstant>1008A
spirv.ARM.GraphEntryPoint @select_fp, @select_fp_arg_0, @select_fp_arg_1, @select_fp_arg_2, @select_fp_res_01009A
spirv.ARM.Graph @select_fp(%arg0: !spirv.arm.tensor<9x2x15x8xi1>, %arg1: !spirv.arm.tensor<9x2x15x8xf16>, %arg2: !spirv.arm.tensor<9x1x15x8xf16>) -> (!spirv.arm.tensor<9x2x15x8xf16>) {1010A
%0 = spirv.Tosa.Select %arg0, %arg1, %arg2 : !spirv.arm.tensor<9x2x15x8xi1>, !spirv.arm.tensor<9x2x15x8xf16>, !spirv.arm.tensor<9x1x15x8xf16> -> !spirv.arm.tensor<9x2x15x8xf16>1011A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<9x2x15x8xf16>1012A·B
}1013A·B
}1014
1015
1016A
//===----------------------------------------------------------------------===//1017A
// spirv.TOSA.Equal - PRO-INT1018A
//===----------------------------------------------------------------------===//1019
1020A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1021A
spirv.GlobalVariable @equal_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<51x28x59xi32>, UniformConstant>1022A
spirv.GlobalVariable @equal_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<51x1x59xi32>, UniformConstant>1023A
spirv.GlobalVariable @equal_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<51x28x59xi1>, UniformConstant>1024A
spirv.ARM.GraphEntryPoint @equal_int, @equal_int_arg_0, @equal_int_arg_1, @equal_int_res_01025A
spirv.ARM.Graph @equal_int(%arg0: !spirv.arm.tensor<51x28x59xi32>, %arg1: !spirv.arm.tensor<51x1x59xi32>) -> (!spirv.arm.tensor<51x28x59xi1>) {1026A
%0 = spirv.Tosa.Equal %arg0, %arg1 : !spirv.arm.tensor<51x28x59xi32>, !spirv.arm.tensor<51x1x59xi32> -> !spirv.arm.tensor<51x28x59xi1>1027A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<51x28x59xi1>1028A·B
}1029A·B
}1030
1031
1032A
//===----------------------------------------------------------------------===//1033A
// spirv.TOSA.Equal - PRO-FP1034A
//===----------------------------------------------------------------------===//1035
1036A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1037A
spirv.GlobalVariable @equal_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<16x11x5x3xf32>, UniformConstant>1038A
spirv.GlobalVariable @equal_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<16x1x5x3xf32>, UniformConstant>1039A
spirv.GlobalVariable @equal_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<16x11x5x3xi1>, UniformConstant>1040A
spirv.ARM.GraphEntryPoint @equal_fp, @equal_fp_arg_0, @equal_fp_arg_1, @equal_fp_res_01041A
spirv.ARM.Graph @equal_fp(%arg0: !spirv.arm.tensor<16x11x5x3xf32>, %arg1: !spirv.arm.tensor<16x1x5x3xf32>) -> (!spirv.arm.tensor<16x11x5x3xi1>) {1042A
%0 = spirv.Tosa.Equal %arg0, %arg1 : !spirv.arm.tensor<16x11x5x3xf32>, !spirv.arm.tensor<16x1x5x3xf32> -> !spirv.arm.tensor<16x11x5x3xi1>1043A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<16x11x5x3xi1>1044A·B
}1045A·B
}1046
1047
1048A
//===----------------------------------------------------------------------===//1049A
// spirv.TOSA.Greater - PRO-INT1050A
//===----------------------------------------------------------------------===//1051
1052A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1053A
spirv.GlobalVariable @greater_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<11x10x10x2xi32>, UniformConstant>1054A
spirv.GlobalVariable @greater_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<11x10x10x1xi32>, UniformConstant>1055A
spirv.GlobalVariable @greater_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<11x10x10x2xi1>, UniformConstant>1056A
spirv.ARM.GraphEntryPoint @greater_int, @greater_int_arg_0, @greater_int_arg_1, @greater_int_res_01057A
spirv.ARM.Graph @greater_int(%arg0: !spirv.arm.tensor<11x10x10x2xi32>, %arg1: !spirv.arm.tensor<11x10x10x1xi32>) -> (!spirv.arm.tensor<11x10x10x2xi1>) {1058A
%0 = spirv.Tosa.Greater %arg0, %arg1 : !spirv.arm.tensor<11x10x10x2xi32>, !spirv.arm.tensor<11x10x10x1xi32> -> !spirv.arm.tensor<11x10x10x2xi1>1059A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<11x10x10x2xi1>1060A·B
}1061A·B
}1062
1063
1064A
//===----------------------------------------------------------------------===//1065A
// spirv.TOSA.Greater - PRO-FP1066A
//===----------------------------------------------------------------------===//1067
1068A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1069A
spirv.GlobalVariable @greater_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<6x3x12x4xf16>, UniformConstant>1070A
spirv.GlobalVariable @greater_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<6x3x1x4xf16>, UniformConstant>1071A
spirv.GlobalVariable @greater_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<6x3x12x4xi1>, UniformConstant>1072A
spirv.ARM.GraphEntryPoint @greater_fp, @greater_fp_arg_0, @greater_fp_arg_1, @greater_fp_res_01073A
spirv.ARM.Graph @greater_fp(%arg0: !spirv.arm.tensor<6x3x12x4xf16>, %arg1: !spirv.arm.tensor<6x3x1x4xf16>) -> (!spirv.arm.tensor<6x3x12x4xi1>) {1074A
%0 = spirv.Tosa.Greater %arg0, %arg1 : !spirv.arm.tensor<6x3x12x4xf16>, !spirv.arm.tensor<6x3x1x4xf16> -> !spirv.arm.tensor<6x3x12x4xi1>1075A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<6x3x12x4xi1>1076A·B
}1077A·B
}1078
1079
1080A
//===----------------------------------------------------------------------===//1081A
// spirv.TOSA.GreaterEqual - PRO-INT1082A
//===----------------------------------------------------------------------===//1083
1084A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1085A
spirv.GlobalVariable @greaterequal_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<10x17x7x1xi32>, UniformConstant>1086A
spirv.GlobalVariable @greaterequal_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<10x17x7x16xi32>, UniformConstant>1087A
spirv.GlobalVariable @greaterequal_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<10x17x7x16xi1>, UniformConstant>1088A
spirv.ARM.GraphEntryPoint @greaterequal_int, @greaterequal_int_arg_0, @greaterequal_int_arg_1, @greaterequal_int_res_01089A
spirv.ARM.Graph @greaterequal_int(%arg0: !spirv.arm.tensor<10x17x7x1xi32>, %arg1: !spirv.arm.tensor<10x17x7x16xi32>) -> (!spirv.arm.tensor<10x17x7x16xi1>) {1090A
%0 = spirv.Tosa.GreaterEqual %arg0, %arg1 : !spirv.arm.tensor<10x17x7x1xi32>, !spirv.arm.tensor<10x17x7x16xi32> -> !spirv.arm.tensor<10x17x7x16xi1>1091A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<10x17x7x16xi1>1092A·B
}1093A·B
}1094
1095
1096A
//===----------------------------------------------------------------------===//1097A
// spirv.TOSA.GreaterEqual - PRO-FP1098A
//===----------------------------------------------------------------------===//1099
1100A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1101A
spirv.GlobalVariable @greaterequal_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<3x17x6x3xf32>, UniformConstant>1102A
spirv.GlobalVariable @greaterequal_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x17x6x3xf32>, UniformConstant>1103A
spirv.GlobalVariable @greaterequal_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<3x17x6x3xi1>, UniformConstant>1104A
spirv.ARM.GraphEntryPoint @greaterequal_fp, @greaterequal_fp_arg_0, @greaterequal_fp_arg_1, @greaterequal_fp_res_01105A
spirv.ARM.Graph @greaterequal_fp(%arg0: !spirv.arm.tensor<3x17x6x3xf32>, %arg1: !spirv.arm.tensor<1x17x6x3xf32>) -> (!spirv.arm.tensor<3x17x6x3xi1>) {1106A
%0 = spirv.Tosa.GreaterEqual %arg0, %arg1 : !spirv.arm.tensor<3x17x6x3xf32>, !spirv.arm.tensor<1x17x6x3xf32> -> !spirv.arm.tensor<3x17x6x3xi1>1107A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<3x17x6x3xi1>1108A·B
}1109A·B
}1110
1111
1112A
//===----------------------------------------------------------------------===//1113A
// spirv.TOSA.ReduceAll - PRO-INT or PRO-FP1114A
//===----------------------------------------------------------------------===//1115
1116A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1117A
spirv.GlobalVariable @reduceall_any_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<18x22x23x12xi1>, UniformConstant>1118A
spirv.GlobalVariable @reduceall_any_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<18x22x1x12xi1>, UniformConstant>1119A
spirv.ARM.GraphEntryPoint @reduceall_any, @reduceall_any_arg_0, @reduceall_any_res_01120A
spirv.ARM.Graph @reduceall_any(%arg0: !spirv.arm.tensor<18x22x23x12xi1>) -> (!spirv.arm.tensor<18x22x1x12xi1>) {1121A
%1 = spirv.Tosa.ReduceAll axis = 2, %arg0 : !spirv.arm.tensor<18x22x23x12xi1> -> !spirv.arm.tensor<18x22x1x12xi1>1122A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<18x22x1x12xi1>1123A·B
}1124A·B
}1125
1126
1127A
//===----------------------------------------------------------------------===//1128A
// spirv.TOSA.ReduceAny - PRO-INT or PRO-FP1129A
//===----------------------------------------------------------------------===//1130
1131A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1132A
spirv.GlobalVariable @reduceany_any_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<25x13x30x8xi1>, UniformConstant>1133A
spirv.GlobalVariable @reduceany_any_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<25x13x1x8xi1>, UniformConstant>1134A
spirv.ARM.GraphEntryPoint @reduceany_any, @reduceany_any_arg_0, @reduceany_any_res_01135A
spirv.ARM.Graph @reduceany_any(%arg0: !spirv.arm.tensor<25x13x30x8xi1>) -> (!spirv.arm.tensor<25x13x1x8xi1>) {1136A
%1 = spirv.Tosa.ReduceAny axis = 2, %arg0 : !spirv.arm.tensor<25x13x30x8xi1> -> !spirv.arm.tensor<25x13x1x8xi1>1137A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<25x13x1x8xi1>1138A·B
}1139A·B
}1140
1141
1142A
//===----------------------------------------------------------------------===//1143A
// spirv.TOSA.ReduceMax - PRO-INT1144A
//===----------------------------------------------------------------------===//1145
1146A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1147A
spirv.GlobalVariable @reducemax_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<8x30x12x3xi8>, UniformConstant>1148A
spirv.GlobalVariable @reducemax_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<8x30x1x3xi8>, UniformConstant>1149A
spirv.ARM.GraphEntryPoint @reducemax_int, @reducemax_int_arg_0, @reducemax_int_res_01150A
spirv.ARM.Graph @reducemax_int(%arg0: !spirv.arm.tensor<8x30x12x3xi8>) -> (!spirv.arm.tensor<8x30x1x3xi8>) {1151A
%2 = spirv.Tosa.ReduceMax axis = 2, nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<8x30x12x3xi8> -> !spirv.arm.tensor<8x30x1x3xi8>1152A
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<8x30x1x3xi8>1153A·B
}1154A·B
}1155
1156
1157A
//===----------------------------------------------------------------------===//1158A
// spirv.TOSA.ReduceMax - PRO-FP1159A
//===----------------------------------------------------------------------===//1160
1161A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1162A
spirv.GlobalVariable @reducemax_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<16x20x10xf16>, UniformConstant>1163A
spirv.GlobalVariable @reducemax_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<16x20x1xf16>, UniformConstant>1164A
spirv.ARM.GraphEntryPoint @reducemax_fp, @reducemax_fp_arg_0, @reducemax_fp_res_01165A
spirv.ARM.Graph @reducemax_fp(%arg0: !spirv.arm.tensor<16x20x10xf16>) -> (!spirv.arm.tensor<16x20x1xf16>) {1166A
%2 = spirv.Tosa.ReduceMax axis = 2, nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<16x20x10xf16> -> !spirv.arm.tensor<16x20x1xf16>1167A
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<16x20x1xf16>1168A·B
}1169A·B
}1170
1171
1172A
//===----------------------------------------------------------------------===//1173A
// spirv.TOSA.ReduceMin - PRO-INT1174A
//===----------------------------------------------------------------------===//1175
1176A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1177A
spirv.GlobalVariable @reducemin_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<2x5x5x1xi8>, UniformConstant>1178A
spirv.GlobalVariable @reducemin_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<2x5x1x1xi8>, UniformConstant>1179A
spirv.ARM.GraphEntryPoint @reducemin_int, @reducemin_int_arg_0, @reducemin_int_res_01180A
spirv.ARM.Graph @reducemin_int(%arg0: !spirv.arm.tensor<2x5x5x1xi8>) -> (!spirv.arm.tensor<2x5x1x1xi8>) {1181A
%2 = spirv.Tosa.ReduceMin axis = 2, nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<2x5x5x1xi8> -> !spirv.arm.tensor<2x5x1x1xi8>1182A
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<2x5x1x1xi8>1183A·B
}1184A·B
}1185
1186
1187A
//===----------------------------------------------------------------------===//1188A
// spirv.TOSA.ReduceMin - PRO-FP1189A
//===----------------------------------------------------------------------===//1190
1191A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1192A
spirv.GlobalVariable @reducemin_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<27x10x25x9xf16>, UniformConstant>1193A
spirv.GlobalVariable @reducemin_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<27x10x1x9xf16>, UniformConstant>1194A
spirv.ARM.GraphEntryPoint @reducemin_fp, @reducemin_fp_arg_0, @reducemin_fp_res_01195A
spirv.ARM.Graph @reducemin_fp(%arg0: !spirv.arm.tensor<27x10x25x9xf16>) -> (!spirv.arm.tensor<27x10x1x9xf16>) {1196A
%2 = spirv.Tosa.ReduceMin axis = 2, nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<27x10x25x9xf16> -> !spirv.arm.tensor<27x10x1x9xf16>1197A
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<27x10x1x9xf16>1198A·B
}1199A·B
}1200
1201
1202A
//===----------------------------------------------------------------------===//1203A
// spirv.TOSA.ReduceProduct - PRO-FP1204A
//===----------------------------------------------------------------------===//1205
1206A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1207A
spirv.GlobalVariable @reduceproduct_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<2x16x25xf16>, UniformConstant>1208A
spirv.GlobalVariable @reduceproduct_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<2x16x1xf16>, UniformConstant>1209A
spirv.ARM.GraphEntryPoint @reduceproduct_fp, @reduceproduct_fp_arg_0, @reduceproduct_fp_res_01210A
spirv.ARM.Graph @reduceproduct_fp(%arg0: !spirv.arm.tensor<2x16x25xf16>) -> (!spirv.arm.tensor<2x16x1xf16>) {1211A
%1 = spirv.Tosa.ReduceProduct axis = 2, %arg0 : !spirv.arm.tensor<2x16x25xf16> -> !spirv.arm.tensor<2x16x1xf16>1212A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<2x16x1xf16>1213A·B
}1214A·B
}1215
1216
1217A
//===----------------------------------------------------------------------===//1218A
// spirv.TOSA.ReduceSum - PRO-INT1219A
//===----------------------------------------------------------------------===//1220
1221A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1222A
spirv.GlobalVariable @reducesum_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<20x24x22xi32>, UniformConstant>1223A
spirv.GlobalVariable @reducesum_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<20x1x22xi32>, UniformConstant>1224A
spirv.ARM.GraphEntryPoint @reducesum_int, @reducesum_int_arg_0, @reducesum_int_res_01225A
spirv.ARM.Graph @reducesum_int(%arg0: !spirv.arm.tensor<20x24x22xi32>) -> (!spirv.arm.tensor<20x1x22xi32>) {1226A
%1 = spirv.Tosa.ReduceSum axis = 1, %arg0 : !spirv.arm.tensor<20x24x22xi32> -> !spirv.arm.tensor<20x1x22xi32>1227A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<20x1x22xi32>1228A·B
}1229A·B
}1230
1231
1232A
//===----------------------------------------------------------------------===//1233A
// spirv.TOSA.ReduceSum - PRO-FP1234A
//===----------------------------------------------------------------------===//1235
1236A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1237A
spirv.GlobalVariable @reducesum_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<32x32x33xf32>, UniformConstant>1238A
spirv.GlobalVariable @reducesum_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<32x1x33xf32>, UniformConstant>1239A
spirv.ARM.GraphEntryPoint @reducesum_fp, @reducesum_fp_arg_0, @reducesum_fp_res_01240A
spirv.ARM.Graph @reducesum_fp(%arg0: !spirv.arm.tensor<32x32x33xf32>) -> (!spirv.arm.tensor<32x1x33xf32>) {1241A
%1 = spirv.Tosa.ReduceSum axis = 1, %arg0 : !spirv.arm.tensor<32x32x33xf32> -> !spirv.arm.tensor<32x1x33xf32>1242A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<32x1x33xf32>1243A·B
}1244A·B
}1245
1246
1247A
//===----------------------------------------------------------------------===//1248A
// spirv.TOSA.Concat - PRO-INT1249A
//===----------------------------------------------------------------------===//1250
1251A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1252A
spirv.GlobalVariable @concat_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<12x13x3x14xi8>, UniformConstant>1253A
spirv.GlobalVariable @concat_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<12x13x3x14xi8>, UniformConstant>1254A
spirv.GlobalVariable @concat_int_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<12x13x3x14xi8>, UniformConstant>1255A
spirv.GlobalVariable @concat_int_arg_3 bind(0, 3) : !spirv.ptr<!spirv.arm.tensor<12x13x3x14xi8>, UniformConstant>1256A
spirv.GlobalVariable @concat_int_res_0 bind(0, 4) : !spirv.ptr<!spirv.arm.tensor<12x13x12x14xi8>, UniformConstant>1257A
spirv.ARM.GraphEntryPoint @concat_int, @concat_int_arg_0, @concat_int_arg_1, @concat_int_arg_2, @concat_int_arg_3, @concat_int_res_01258A
spirv.ARM.Graph @concat_int(%arg0: !spirv.arm.tensor<12x13x3x14xi8>, %arg1: !spirv.arm.tensor<12x13x3x14xi8>, %arg2: !spirv.arm.tensor<12x13x3x14xi8>, %arg3: !spirv.arm.tensor<12x13x3x14xi8>) -> (!spirv.arm.tensor<12x13x12x14xi8>) {1259A
%1 = spirv.Tosa.Concat axis = 2, %arg0, %arg1, %arg2, %arg3 : !spirv.arm.tensor<12x13x3x14xi8>, !spirv.arm.tensor<12x13x3x14xi8>, !spirv.arm.tensor<12x13x3x14xi8>, !spirv.arm.tensor<12x13x3x14xi8> -> !spirv.arm.tensor<12x13x12x14xi8>1260A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<12x13x12x14xi8>1261A·B
}1262A·B
}1263
1264
1265A
//===----------------------------------------------------------------------===//1266A
// spirv.TOSA.Concat - PRO-FP1267A
//===----------------------------------------------------------------------===//1268
1269A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1270A
spirv.GlobalVariable @concat_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<40x31x19xf32>, UniformConstant>1271A
spirv.GlobalVariable @concat_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<40x15x19xf32>, UniformConstant>1272A
spirv.GlobalVariable @concat_fp_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<40x16x19xf32>, UniformConstant>1273A
spirv.GlobalVariable @concat_fp_res_0 bind(0, 3) : !spirv.ptr<!spirv.arm.tensor<40x62x19xf32>, UniformConstant>1274A
spirv.ARM.GraphEntryPoint @concat_fp, @concat_fp_arg_0, @concat_fp_arg_1, @concat_fp_arg_2, @concat_fp_res_01275A
spirv.ARM.Graph @concat_fp(%arg0: !spirv.arm.tensor<40x31x19xf32>, %arg1: !spirv.arm.tensor<40x15x19xf32>, %arg2: !spirv.arm.tensor<40x16x19xf32>) -> (!spirv.arm.tensor<40x62x19xf32>) {1276A
%1 = spirv.Tosa.Concat axis = 1, %arg0, %arg1, %arg2 : !spirv.arm.tensor<40x31x19xf32>, !spirv.arm.tensor<40x15x19xf32>, !spirv.arm.tensor<40x16x19xf32> -> !spirv.arm.tensor<40x62x19xf32>1277A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<40x62x19xf32>1278A·B
}1279A·B
}1280
1281
1282A
//===----------------------------------------------------------------------===//1283A
// spirv.TOSA.Pad - PRO-INT1284A
//===----------------------------------------------------------------------===//1285
1286A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1287A
spirv.GlobalVariable @pad_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<4x7xi8>, UniformConstant>1288A
spirv.GlobalVariable @pad_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<21x19xi8>, UniformConstant>1289A
spirv.ARM.GraphEntryPoint @pad_int, @pad_int_arg_0, @pad_int_res_01290A
spirv.ARM.Graph @pad_int(%arg0: !spirv.arm.tensor<4x7xi8>) -> (!spirv.arm.tensor<21x19xi8>) {1291A
%0 = spirv.Constant dense<[10, 7, 6, 6]> : !spirv.arm.tensor<4xi32>1292A
%1 = spirv.Constant dense<-76> : !spirv.arm.tensor<1xi8>1293A
%2 = spirv.Tosa.Pad %arg0, %0, %1 : !spirv.arm.tensor<4x7xi8>, !spirv.arm.tensor<4xi32>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<21x19xi8>1294A
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<21x19xi8>1295A·B
}1296A·B
}1297
1298
1299A
//===----------------------------------------------------------------------===//1300A
// spirv.TOSA.Pad - PRO-FP1301A
//===----------------------------------------------------------------------===//1302
1303A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1304A
spirv.GlobalVariable @pad_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<2x9x2x3xf32>, UniformConstant>1305A
spirv.GlobalVariable @pad_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<4x9x4x4xf32>, UniformConstant>1306A
spirv.ARM.GraphEntryPoint @pad_fp, @pad_fp_arg_0, @pad_fp_res_01307A
spirv.ARM.Graph @pad_fp(%arg0: !spirv.arm.tensor<2x9x2x3xf32>) -> (!spirv.arm.tensor<4x9x4x4xf32>) {1308A
%0 = spirv.Constant dense<[1, 1, 0, 0, 1, 1, 0, 1]> : !spirv.arm.tensor<8xi32>1309A
%1 = spirv.Constant dense<1.21630913E+38> : !spirv.arm.tensor<1xf32>1310A
%2 = spirv.Tosa.Pad %arg0, %0, %1 : !spirv.arm.tensor<2x9x2x3xf32>, !spirv.arm.tensor<8xi32>, !spirv.arm.tensor<1xf32> -> !spirv.arm.tensor<4x9x4x4xf32>1311A
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<4x9x4x4xf32>1312A·B
}1313A·B
}1314
1315
1316A
//===----------------------------------------------------------------------===//1317A
// spirv.TOSA.Reshape - PRO-INT1318A
//===----------------------------------------------------------------------===//1319
1320A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1321A
spirv.GlobalVariable @reshape_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<25x6x29x35xi16>, UniformConstant>1322A
spirv.GlobalVariable @reshape_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<125x6x7x29xi16>, UniformConstant>1323A
spirv.ARM.GraphEntryPoint @reshape_int, @reshape_int_arg_0, @reshape_int_res_01324A
spirv.ARM.Graph @reshape_int(%arg0: !spirv.arm.tensor<25x6x29x35xi16>) -> (!spirv.arm.tensor<125x6x7x29xi16>) {1325A
%0 = spirv.Constant dense<[125, 6, 7, 29]> : !spirv.arm.tensor<4xi32>1326A
%1 = spirv.Tosa.Reshape %arg0, %0 : !spirv.arm.tensor<25x6x29x35xi16>, !spirv.arm.tensor<4xi32> -> !spirv.arm.tensor<125x6x7x29xi16>1327A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<125x6x7x29xi16>1328A·B
}1329A·B
}1330
1331
1332A
//===----------------------------------------------------------------------===//1333A
// spirv.TOSA.Reshape - PRO-FP1334A
//===----------------------------------------------------------------------===//1335
1336A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1337A
spirv.GlobalVariable @reshape_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x2x7x2xf32>, UniformConstant>1338A
spirv.GlobalVariable @reshape_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<2x1x14xf32>, UniformConstant>1339A
spirv.ARM.GraphEntryPoint @reshape_fp, @reshape_fp_arg_0, @reshape_fp_res_01340A
spirv.ARM.Graph @reshape_fp(%arg0: !spirv.arm.tensor<1x2x7x2xf32>) -> (!spirv.arm.tensor<2x1x14xf32>) {1341A
%0 = spirv.Constant dense<[2, 1, 14]> : !spirv.arm.tensor<3xi32>1342A
%1 = spirv.Tosa.Reshape %arg0, %0 : !spirv.arm.tensor<1x2x7x2xf32>, !spirv.arm.tensor<3xi32> -> !spirv.arm.tensor<2x1x14xf32>1343A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<2x1x14xf32>1344A·B
}1345A·B
}1346
1347
1348A
//===----------------------------------------------------------------------===//1349A
// spirv.TOSA.Reverse - PRO-INT1350A
//===----------------------------------------------------------------------===//1351
1352A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1353A
spirv.GlobalVariable @reverse_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<20x5x28x31xi32>, UniformConstant>1354A
spirv.GlobalVariable @reverse_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<20x5x28x31xi32>, UniformConstant>1355A
spirv.ARM.GraphEntryPoint @reverse_int, @reverse_int_arg_0, @reverse_int_res_01356A
spirv.ARM.Graph @reverse_int(%arg0: !spirv.arm.tensor<20x5x28x31xi32>) -> (!spirv.arm.tensor<20x5x28x31xi32>) {1357A
%1 = spirv.Tosa.Reverse axis = 2, %arg0 : !spirv.arm.tensor<20x5x28x31xi32> -> !spirv.arm.tensor<20x5x28x31xi32>1358A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<20x5x28x31xi32>1359A·B
}1360A·B
}1361
1362
1363A
//===----------------------------------------------------------------------===//1364A
// spirv.TOSA.Reverse - PRO-FP1365A
//===----------------------------------------------------------------------===//1366
1367A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1368A
spirv.GlobalVariable @reverse_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<21x34x47xf32>, UniformConstant>1369A
spirv.GlobalVariable @reverse_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<21x34x47xf32>, UniformConstant>1370A
spirv.ARM.GraphEntryPoint @reverse_fp, @reverse_fp_arg_0, @reverse_fp_res_01371A
spirv.ARM.Graph @reverse_fp(%arg0: !spirv.arm.tensor<21x34x47xf32>) -> (!spirv.arm.tensor<21x34x47xf32>) {1372A
%1 = spirv.Tosa.Reverse axis = 1, %arg0 : !spirv.arm.tensor<21x34x47xf32> -> !spirv.arm.tensor<21x34x47xf32>1373A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<21x34x47xf32>1374A·B
}1375A·B
}1376
1377
1378A
//===----------------------------------------------------------------------===//1379A
// spirv.TOSA.Slice - PRO-INT1380A
//===----------------------------------------------------------------------===//1381
1382A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1383A
spirv.GlobalVariable @slice_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<32x19x41xi8>, UniformConstant>1384A
spirv.GlobalVariable @slice_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<21x5x2xi8>, UniformConstant>1385A
spirv.ARM.GraphEntryPoint @slice_int, @slice_int_arg_0, @slice_int_res_01386A
spirv.ARM.Graph @slice_int(%arg0: !spirv.arm.tensor<32x19x41xi8>) -> (!spirv.arm.tensor<21x5x2xi8>) {1387A
%0 = spirv.Constant dense<[8, 11, 39]> : !spirv.arm.tensor<3xi32>1388A
%1 = spirv.Constant dense<[21, 5, 2]> : !spirv.arm.tensor<3xi32>1389A
%2 = spirv.Tosa.Slice %arg0, %0, %1 : !spirv.arm.tensor<32x19x41xi8>, !spirv.arm.tensor<3xi32>, !spirv.arm.tensor<3xi32> -> !spirv.arm.tensor<21x5x2xi8>1390A
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<21x5x2xi8>1391A·B
}1392A·B
}1393
1394
1395A
//===----------------------------------------------------------------------===//1396A
// spirv.TOSA.Slice - PRO-FP1397A
//===----------------------------------------------------------------------===//1398
1399A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1400A
spirv.GlobalVariable @slice_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<30x45x29xf32>, UniformConstant>1401A
spirv.GlobalVariable @slice_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<5x12x11xf32>, UniformConstant>1402A
spirv.ARM.GraphEntryPoint @slice_fp, @slice_fp_arg_0, @slice_fp_res_01403A
spirv.ARM.Graph @slice_fp(%arg0: !spirv.arm.tensor<30x45x29xf32>) -> (!spirv.arm.tensor<5x12x11xf32>) {1404A
%0 = spirv.Constant dense<[21, 20, 10]> : !spirv.arm.tensor<3xi32>1405A
%1 = spirv.Constant dense<[5, 12, 11]> : !spirv.arm.tensor<3xi32>1406A
%2 = spirv.Tosa.Slice %arg0, %0, %1 : !spirv.arm.tensor<30x45x29xf32>, !spirv.arm.tensor<3xi32>, !spirv.arm.tensor<3xi32> -> !spirv.arm.tensor<5x12x11xf32>1407A
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<5x12x11xf32>1408A·B
}1409A·B
}1410
1411
1412A
//===----------------------------------------------------------------------===//1413A
// spirv.TOSA.Tile - PRO-INT1414A
//===----------------------------------------------------------------------===//1415
1416A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1417A
spirv.GlobalVariable @tile_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<10x28x21xi16>, UniformConstant>1418A
spirv.GlobalVariable @tile_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<10x28x63xi16>, UniformConstant>1419A
spirv.ARM.GraphEntryPoint @tile_int, @tile_int_arg_0, @tile_int_res_01420A
spirv.ARM.Graph @tile_int(%arg0: !spirv.arm.tensor<10x28x21xi16>) -> (!spirv.arm.tensor<10x28x63xi16>) {1421A
%0 = spirv.Constant dense<[1, 1, 3]> : !spirv.arm.tensor<3xi32>1422A
%1 = spirv.Tosa.Tile %arg0, %0 : !spirv.arm.tensor<10x28x21xi16>, !spirv.arm.tensor<3xi32> -> !spirv.arm.tensor<10x28x63xi16>1423A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<10x28x63xi16>1424A·B
}1425A·B
}1426
1427
1428A
//===----------------------------------------------------------------------===//1429A
// spirv.TOSA.Tile - PRO-FP1430A
//===----------------------------------------------------------------------===//1431
1432A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1433A
spirv.GlobalVariable @tile_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<31x19x5xf16>, UniformConstant>1434A
spirv.GlobalVariable @tile_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<62x57x10xf16>, UniformConstant>1435A
spirv.ARM.GraphEntryPoint @tile_fp, @tile_fp_arg_0, @tile_fp_res_01436A
spirv.ARM.Graph @tile_fp(%arg0: !spirv.arm.tensor<31x19x5xf16>) -> (!spirv.arm.tensor<62x57x10xf16>) {1437A
%0 = spirv.Constant dense<[2, 3, 2]> : !spirv.arm.tensor<3xi32>1438A
%1 = spirv.Tosa.Tile %arg0, %0 : !spirv.arm.tensor<31x19x5xf16>, !spirv.arm.tensor<3xi32> -> !spirv.arm.tensor<62x57x10xf16>1439A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<62x57x10xf16>1440A·B
}1441A·B
}1442
1443
1444A
//===----------------------------------------------------------------------===//1445A
// spirv.TOSA.Transpose - PRO-INT1446A
//===----------------------------------------------------------------------===//1447
1448A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1449A
spirv.GlobalVariable @transpose_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<14x28x1x61xi16>, UniformConstant>1450A
spirv.GlobalVariable @transpose_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x14x28x61xi16>, UniformConstant>1451A
spirv.ARM.GraphEntryPoint @transpose_int, @transpose_int_arg_0, @transpose_int_res_01452A
spirv.ARM.Graph @transpose_int(%arg0: !spirv.arm.tensor<14x28x1x61xi16>) -> (!spirv.arm.tensor<1x14x28x61xi16>) {1453A
%1 = spirv.Tosa.Transpose perms = [2, 0, 1, 3], %arg0 : !spirv.arm.tensor<14x28x1x61xi16> -> !spirv.arm.tensor<1x14x28x61xi16>1454A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<1x14x28x61xi16>1455A·B
}1456A·B
}1457
1458
1459A
//===----------------------------------------------------------------------===//1460A
// spirv.TOSA.Transpose - PRO-FP1461A
//===----------------------------------------------------------------------===//1462
1463A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1464A
spirv.GlobalVariable @transpose_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<42x22x49xi1>, UniformConstant>1465A
spirv.GlobalVariable @transpose_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<49x42x22xi1>, UniformConstant>1466A
spirv.ARM.GraphEntryPoint @transpose_fp, @transpose_fp_arg_0, @transpose_fp_res_01467A
spirv.ARM.Graph @transpose_fp(%arg0: !spirv.arm.tensor<42x22x49xi1>) -> (!spirv.arm.tensor<49x42x22xi1>) {1468A
%1 = spirv.Tosa.Transpose perms = [2, 0, 1], %arg0 : !spirv.arm.tensor<42x22x49xi1> -> !spirv.arm.tensor<49x42x22xi1>1469A
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<49x42x22xi1>1470A·B
}1471A·B
}1472
1473
1474A
//===----------------------------------------------------------------------===//1475A
// spirv.TOSA.Gather - PRO-INT1476A
//===----------------------------------------------------------------------===//1477
1478A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1479A
spirv.GlobalVariable @gather_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<31x11x45xi32>, UniformConstant>1480A
spirv.GlobalVariable @gather_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<31x15xi32>, UniformConstant>1481A
spirv.GlobalVariable @gather_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<31x15x45xi32>, UniformConstant>1482A
spirv.ARM.GraphEntryPoint @gather_int, @gather_int_arg_0, @gather_int_arg_1, @gather_int_res_01483A
spirv.ARM.Graph @gather_int(%arg0: !spirv.arm.tensor<31x11x45xi32>, %arg1: !spirv.arm.tensor<31x15xi32>) -> (!spirv.arm.tensor<31x15x45xi32>) {1484A
%0 = spirv.Tosa.Gather %arg0, %arg1 : !spirv.arm.tensor<31x11x45xi32>, !spirv.arm.tensor<31x15xi32> -> !spirv.arm.tensor<31x15x45xi32>1485A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<31x15x45xi32>1486A·B
}1487A·B
}1488
1489
1490A
//===----------------------------------------------------------------------===//1491A
// spirv.TOSA.Gather - PRO-FP1492A
//===----------------------------------------------------------------------===//1493
1494A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1495A
spirv.GlobalVariable @gather_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<59x61x19xf32>, UniformConstant>1496A
spirv.GlobalVariable @gather_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<59x65xi32>, UniformConstant>1497A
spirv.GlobalVariable @gather_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<59x65x19xf32>, UniformConstant>1498A
spirv.ARM.GraphEntryPoint @gather_fp, @gather_fp_arg_0, @gather_fp_arg_1, @gather_fp_res_01499A
spirv.ARM.Graph @gather_fp(%arg0: !spirv.arm.tensor<59x61x19xf32>, %arg1: !spirv.arm.tensor<59x65xi32>) -> (!spirv.arm.tensor<59x65x19xf32>) {1500A
%0 = spirv.Tosa.Gather %arg0, %arg1 : !spirv.arm.tensor<59x61x19xf32>, !spirv.arm.tensor<59x65xi32> -> !spirv.arm.tensor<59x65x19xf32>1501A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<59x65x19xf32>1502A·B
}1503A·B
}1504
1505
1506A
//===----------------------------------------------------------------------===//1507A
// spirv.TOSA.Scatter - PRO-INT1508A
//===----------------------------------------------------------------------===//1509
1510A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1511A
spirv.GlobalVariable @scatter_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<34x28x54xi32>, UniformConstant>1512A
spirv.GlobalVariable @scatter_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<34x18xi32>, UniformConstant>1513A
spirv.GlobalVariable @scatter_int_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<34x18x54xi32>, UniformConstant>1514A
spirv.GlobalVariable @scatter_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<34x28x54xi32>, UniformConstant>1515A
spirv.ARM.GraphEntryPoint @scatter_int, @scatter_int_arg_0, @scatter_int_arg_1, @scatter_int_arg_2, @scatter_int_res_01516A
spirv.ARM.Graph @scatter_int(%arg0: !spirv.arm.tensor<34x28x54xi32>, %arg1: !spirv.arm.tensor<34x18xi32>, %arg2: !spirv.arm.tensor<34x18x54xi32>) -> (!spirv.arm.tensor<34x28x54xi32>) {1517A
%0 = spirv.Tosa.Scatter %arg0, %arg1, %arg2 : !spirv.arm.tensor<34x28x54xi32>, !spirv.arm.tensor<34x18xi32>, !spirv.arm.tensor<34x18x54xi32> -> !spirv.arm.tensor<34x28x54xi32>1518A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<34x28x54xi32>1519A·B
}1520A·B
}1521
1522
1523A
//===----------------------------------------------------------------------===//1524A
// spirv.TOSA.Scatter - PRO-FP1525A
//===----------------------------------------------------------------------===//1526
1527A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1528A
spirv.GlobalVariable @scatter_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<18x34x25xf16>, UniformConstant>1529A
spirv.GlobalVariable @scatter_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<18x20xi32>, UniformConstant>1530A
spirv.GlobalVariable @scatter_fp_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<18x20x25xf16>, UniformConstant>1531A
spirv.GlobalVariable @scatter_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<18x34x25xf16>, UniformConstant>1532A
spirv.ARM.GraphEntryPoint @scatter_fp, @scatter_fp_arg_0, @scatter_fp_arg_1, @scatter_fp_arg_2, @scatter_fp_res_01533A
spirv.ARM.Graph @scatter_fp(%arg0: !spirv.arm.tensor<18x34x25xf16>, %arg1: !spirv.arm.tensor<18x20xi32>, %arg2: !spirv.arm.tensor<18x20x25xf16>) -> (!spirv.arm.tensor<18x34x25xf16>) {1534A
%0 = spirv.Tosa.Scatter %arg0, %arg1, %arg2 : !spirv.arm.tensor<18x34x25xf16>, !spirv.arm.tensor<18x20xi32>, !spirv.arm.tensor<18x20x25xf16> -> !spirv.arm.tensor<18x34x25xf16>1535A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<18x34x25xf16>1536A·B
}1537A·B
}1538
1539
1540A
//===----------------------------------------------------------------------===//1541A
// spirv.TOSA.Resize - PRO-INT1542A
//===----------------------------------------------------------------------===//1543
1544A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1545A
spirv.GlobalVariable @resize_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x1x31x55xi8>, UniformConstant>1546A
spirv.GlobalVariable @resize_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x1x278x55xi8>, UniformConstant>1547A
spirv.ARM.GraphEntryPoint @resize_int, @resize_int_arg_0, @resize_int_res_01548A
spirv.ARM.Graph @resize_int(%arg0: !spirv.arm.tensor<1x1x31x55xi8>) -> (!spirv.arm.tensor<1x1x278x55xi8>) {1549A
%1 = spirv.Constant dense<[16, 1, 9, 1]> : !spirv.arm.tensor<4xi32>1550A
%2 = spirv.Constant dense<0> : !spirv.arm.tensor<2xi32>1551A
%3 = spirv.Constant dense<[0, 7]> : !spirv.arm.tensor<2xi32>1552A
%4 = spirv.Tosa.Resize mode = <NearestNeighbor>, %arg0, %1, %2, %3 : !spirv.arm.tensor<1x1x31x55xi8>, !spirv.arm.tensor<4xi32>, !spirv.arm.tensor<2xi32>, !spirv.arm.tensor<2xi32> -> !spirv.arm.tensor<1x1x278x55xi8>1553A
spirv.ARM.GraphOutputs %4 : !spirv.arm.tensor<1x1x278x55xi8>1554A·B
}1555A·B
}1556
1557
1558A
//===----------------------------------------------------------------------===//1559A
// spirv.TOSA.Resize - PRO-FP1560A
//===----------------------------------------------------------------------===//1561
1562A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1563A
spirv.GlobalVariable @resize_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x48x33x63xf32>, UniformConstant>1564A
spirv.GlobalVariable @resize_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x753x297x63xf32>, UniformConstant>1565A
spirv.ARM.GraphEntryPoint @resize_fp, @resize_fp_arg_0, @resize_fp_res_01566A
spirv.ARM.Graph @resize_fp(%arg0: !spirv.arm.tensor<1x48x33x63xf32>) -> (!spirv.arm.tensor<1x753x297x63xf32>) {1567A
%1 = spirv.Constant dense<[16, 1, 9, 1]> : !spirv.arm.tensor<4xi32>1568A
%2 = spirv.Constant dense<0> : !spirv.arm.tensor<2xi32>1569A
%3 = spirv.Constant dense<[0, 8]> : !spirv.arm.tensor<2xi32>1570A
%4 = spirv.Tosa.Resize mode = <Bilinear>, %arg0, %1, %2, %3 : !spirv.arm.tensor<1x48x33x63xf32>, !spirv.arm.tensor<4xi32>, !spirv.arm.tensor<2xi32>, !spirv.arm.tensor<2xi32> -> !spirv.arm.tensor<1x753x297x63xf32>1571A
spirv.ARM.GraphOutputs %4 : !spirv.arm.tensor<1x753x297x63xf32>1572A·B
}1573A·B
}1574
1575
1576A
//===----------------------------------------------------------------------===//1577A
// spirv.TOSA.Cast - PRO-INT1578A
//===----------------------------------------------------------------------===//1579
1580A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1581A
spirv.GlobalVariable @cast_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x65538x1x2xi8>, UniformConstant>1582A
spirv.GlobalVariable @cast_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x65538x1x2xi32>, UniformConstant>1583A
spirv.ARM.GraphEntryPoint @cast_int, @cast_int_arg_0, @cast_int_res_01584A
spirv.ARM.Graph @cast_int(%arg0: !spirv.arm.tensor<1x65538x1x2xi8>) -> (!spirv.arm.tensor<1x65538x1x2xi32>) {1585A
%0 = spirv.Tosa.Cast %arg0 : !spirv.arm.tensor<1x65538x1x2xi8> -> !spirv.arm.tensor<1x65538x1x2xi32>1586A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<1x65538x1x2xi32>1587A·B
}1588A·B
}1589
1590
1591A
//===----------------------------------------------------------------------===//1592A
// spirv.TOSA.Cast - PRO-FP1593A
//===----------------------------------------------------------------------===//1594
1595A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1596A
spirv.GlobalVariable @cast_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<11x5x14x4xf32>, UniformConstant>1597A
spirv.GlobalVariable @cast_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<11x5x14x4xf16>, UniformConstant>1598A
spirv.ARM.GraphEntryPoint @cast_fp, @cast_fp_arg_0, @cast_fp_res_01599A
spirv.ARM.Graph @cast_fp(%arg0: !spirv.arm.tensor<11x5x14x4xf32>) -> (!spirv.arm.tensor<11x5x14x4xf16>) {1600A
%0 = spirv.Tosa.Cast %arg0 : !spirv.arm.tensor<11x5x14x4xf32> -> !spirv.arm.tensor<11x5x14x4xf16>1601A
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<11x5x14x4xf16>1602A·B
}1603A·B
}1604
1605
1606A
//===----------------------------------------------------------------------===//1607A
// spirv.TOSA.Rescale - PRO-INT1608A
//===----------------------------------------------------------------------===//1609
1610A
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {1611A
spirv.GlobalVariable @rescale_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<17x29x19xi16>, UniformConstant>1612A
spirv.GlobalVariable @rescale_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<17x29x19xi16>, UniformConstant>1613A
spirv.ARM.GraphEntryPoint @rescale_int, @rescale_int_arg_0, @rescale_int_res_01614A
spirv.ARM.Graph @rescale_int(%arg0: !spirv.arm.tensor<17x29x19xi16>) -> (!spirv.arm.tensor<17x29x19xi16>) {1615A
%5 = spirv.Constant dense<1866149760> : !spirv.arm.tensor<1xi32>1616A
%6 = spirv.Constant dense<31> : !spirv.arm.tensor<1xi8>1617A
%7 = spirv.Constant dense<0> : !spirv.arm.tensor<1xi16>1618A
%8 = spirv.Constant dense<0> : !spirv.arm.tensor<1xi16>1619A
%9 = spirv.Tosa.Rescale scale32 = true, rounding_mode = <DoubleRound>, per_channel = false, input_unsigned = false, output_unsigned = true, %arg0, %5, %6, %7, %8 : !spirv.arm.tensor<17x29x19xi16>, !spirv.arm.tensor<1xi32>, !spirv.arm.tensor<1xi8>, !spirv.arm.tensor<1xi16>, !spirv.arm.tensor<1xi16> -> !spirv.arm.tensor<17x29x19xi16>1620A
spirv.ARM.GraphOutputs %9 : !spirv.arm.tensor<17x29x19xi16>1621A·B
}1622A·B
}1623A·B
}1624
1625A
// -----1626
1627new
// ===== Section B =====1628B
module {1629B
// WHEN CREATING A NEW TEST, PLEASE JUST COPY & PASTE WITHOUT EDITS.1630B
//1631B
// Set-up that's shared across all tests in this directory. In principle, this1632B
// config could be moved to lit.local.cfg. However, there are downstream users that1633B
// do not use these LIT config files. Hence why this is kept inline.1634B
//1635B
// DEFINE: %{sparsifier_opts} = enable-runtime-library=true1636B
// DEFINE: %{sparsifier_opts_sve} = enable-arm-sve=true %{sparsifier_opts}1637B
// DEFINE: %{compile} = mlir-opt %s --sparsifier="%{sparsifier_opts}"1638B
// DEFINE: %{compile_sve} = mlir-opt %s --sparsifier="%{sparsifier_opts_sve}"1639B
// DEFINE: %{run_libs} = -shared-libs=%mlir_c_runner_utils,%mlir_runner_utils1640B
// DEFINE: %{run_libs_sve} = -shared-libs=%native_mlir_runner_utils,%native_mlir_c_runner_utils1641B
// DEFINE: %{run_opts} = -e main -entry-point-result=void1642B
// DEFINE: %{run} = mlir-runner %{run_opts} %{run_libs}1643B
// DEFINE: %{run_sve} = %mcr_aarch64_cmd --march=aarch64 --mattr="+sve" %{run_opts} %{run_libs_sve}1644B
//1645B
// DEFINE: %{env} =1646
1647
1648B
//1649B
// Do the same run, but now with direct IR generation.1650B
// REDEFINE: %{sparsifier_opts} = enable-runtime-library=false1651B
//1652B
// Do the same run, but now with direct IR generation and vectorization.1653B
// REDEFINE: %{sparsifier_opts} = enable-runtime-library=false vl=2 reassociate-fp-reductions=true enable-index-optimizations=true1654B
//1655B
// Do the same run, but now with direct IR generation and VLA vectorization.1656
1657B
#CSR = #sparse_tensor.encoding<{1658B
map = (d0, d1) -> (d0 : dense,1659B
d1 : compressed)1660B
}>1661
1662B
#DCSR = #sparse_tensor.encoding<{1663B
map = (d0, d1) -> (d0 : compressed,1664B
d1 : compressed)1665B
}>1666
1667B
// An example of a 2D convolution with sparse data and filter.1668B
module {1669new
func.func @B_742da725_conv2d(%input: tensor<10x10xi32>,1670B
%filter: tensor<5x5xi32>,1671B
%output: tensor<6x6xi32>) -> tensor<6x6xi32> {1672B
%0 = linalg.conv_2d1673B
ins (%input, %filter: tensor<10x10xi32>, tensor<5x5xi32>)1674B
outs (%output: tensor<6x6xi32>) -> tensor<6x6xi32>1675B
return %0 : tensor<6x6xi32>1676A·B
}1677
1678new
func.func @B_742da725_conv2d_ss(%input: tensor<10x10xi32, #CSR>,1679B
%filter: tensor<5x5xi32, #CSR>,1680B
%output: tensor<6x6xi32>) -> tensor<6x6xi32> {1681B
%0 = linalg.conv_2d1682B
ins (%input, %filter: tensor<10x10xi32, #CSR>, tensor<5x5xi32, #CSR>)1683B
outs (%output: tensor<6x6xi32>) -> tensor<6x6xi32>1684B
return %0 : tensor<6x6xi32>1685A·B
}1686
1687new
func.func @B_742da725_conv2d_bs(%input: tensor<10x10xi32, #DCSR>,1688B
%filter: tensor<5x5xi32, #CSR>,1689B
%output: tensor<6x6xi32>) -> tensor<6x6xi32> {1690B
%0 = linalg.conv_2d1691B
ins (%input, %filter: tensor<10x10xi32, #DCSR>, tensor<5x5xi32, #CSR>)1692B
outs (%output: tensor<6x6xi32>) -> tensor<6x6xi32>1693B
return %0 : tensor<6x6xi32>1694A·B
}1695
1696new
func.func @B_742da725_main() {1697B
%c0 = arith.constant 0 : index1698B
%i0 = arith.constant 0 : i321699
1700B
// Dense filter and input to "stress" test sparsity.1701
1702B
%filter = arith.constant dense<[1703B
[ -1, -2, -3, -4, -5 ],1704B
[ -6, -7, -8, -9, -10 ],1705B
[ -11, -12, -13, -14, -15 ],1706B
[ -16, -17, -18, -19, -20 ],1707B
[ -21, -22, -23, -24, -25 ]1708B
]> : tensor<5x5xi32>1709
1710B
%input = arith.constant dense<[1711B
[ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9 ],1712B
[ 10, 11, 12, 13, 14, 15, 16, 17, 18, 19 ],1713B
[ 20, 21, 22, 23, 24, 25, 26, 27, 28, 29 ],1714B
[ 30, 31, 32, 33, 34, 35, 36, 37, 38, 39 ],1715B
[ 40, 41, 42, 43, 44, 45, 46, 47, 48, 49 ],1716B
[ 50, 51, 52, 53, 54, 55, 56, 57, 58, 59 ],1717B
[ 60, 61, 62, 63, 64, 65, 66, 67, 68, 69 ],1718B
[ 70, 71, 72, 73, 74, 75, 76, 77, 78, 79 ],1719B
[ 80, 81, 82, 83, 84, 85, 86, 87, 88, 89 ],1720B
[ 90, 91, 92, 93, 94, 95, 96, 97, 98, 99 ]1721B
]> : tensor<10x10xi32>1722
1723B
// Sparse filter and input to test true sparsity.1724
1725B
%sfilter = arith.constant dense<[1726B
[ 0, -1, 0, -2, 0 ],1727B
[ 0, 0, 0, 0, 0 ],1728B
[ 0, 0, 8, 0, 0 ],1729B
[ -3, 0, 0, -4, 0 ],1730B
[ 0, 0, -5, 0, -6 ]1731B
]> : tensor<5x5xi32>1732
1733B
%sinput = arith.constant dense<[1734B
[ 0, 1, 2, 3, 0, 0, 0, 0, 0, 0 ],1735B
[ 0, 4, 0, 0, 5, 0, 0, 0, 0, 0 ],1736B
[ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 ],1737B
[ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 ],1738B
[ 0, 0, 0, 0, 0, 0, 6, 0, 0, 7 ],1739B
[ 0, 0, 0, 0, 0, 0, 0, 8, 0, 0 ],1740B
[ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 ],1741B
[ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 ],1742B
[ 0, 9, 0, 0, 0, 0, 0, 0, 0, 0 ],1743B
[ 0, 0, 0, 0, 10, 0, 0, 0, 0, 0 ]1744B
]> : tensor<10x10xi32>1745
1746B
// Set up sparse tensors.1747
1748B
%input_CSR = sparse_tensor.convert %input : tensor<10x10xi32> to tensor<10x10xi32, #CSR>1749B
%input_DCSR = sparse_tensor.convert %input : tensor<10x10xi32> to tensor<10x10xi32, #DCSR>1750B
%filter_CSR = sparse_tensor.convert %filter : tensor<5x5xi32> to tensor<5x5xi32, #CSR>1751
1752B
%sinput_CSR = sparse_tensor.convert %sinput : tensor<10x10xi32> to tensor<10x10xi32, #CSR>1753B
%sinput_DCSR = sparse_tensor.convert %sinput : tensor<10x10xi32> to tensor<10x10xi32, #DCSR>1754B
%sfilter_CSR = sparse_tensor.convert %sfilter : tensor<5x5xi32> to tensor<5x5xi32, #CSR>1755
1756B
// Call the kernels with stress input.1757B
%output0 = arith.constant dense<0> : tensor<6x6xi32>1758new
%0 = call @B_742da725_conv2d(%input, %filter, %output0)1759B
: (tensor<10x10xi32>, tensor<5x5xi32>, tensor<6x6xi32>) -> tensor<6x6xi32>1760B
%output1 = arith.constant dense<0> : tensor<6x6xi32>1761new
%1 = call @B_742da725_conv2d_ss(%input_CSR, %filter_CSR, %output1)1762B
: (tensor<10x10xi32, #CSR>, tensor<5x5xi32, #CSR>, tensor<6x6xi32>) -> tensor<6x6xi32>1763B
%output2 = arith.constant dense<0> : tensor<6x6xi32>1764new
%2 = call @B_742da725_conv2d_bs(%input_DCSR, %filter_CSR, %output2)1765B
: (tensor<10x10xi32, #DCSR>, tensor<5x5xi32, #CSR>, tensor<6x6xi32>) -> tensor<6x6xi32>1766
1767B
// Call the kernels with sparse input.1768B
%output3 = arith.constant dense<0> : tensor<6x6xi32>1769new
%3 = call @B_742da725_conv2d(%sinput, %sfilter, %output3)1770B
: (tensor<10x10xi32>, tensor<5x5xi32>, tensor<6x6xi32>) -> tensor<6x6xi32>1771B
%output4 = arith.constant dense<0> : tensor<6x6xi32>1772new
%4 = call @B_742da725_conv2d_ss(%sinput_CSR, %sfilter_CSR, %output4)1773B
: (tensor<10x10xi32, #CSR>, tensor<5x5xi32, #CSR>, tensor<6x6xi32>) -> tensor<6x6xi32>1774B
%output5 = arith.constant dense<0> : tensor<6x6xi32>1775new
%5 = call @B_742da725_conv2d_bs(%sinput_DCSR, %sfilter_CSR, %output5)1776B
: (tensor<10x10xi32, #DCSR>, tensor<5x5xi32, #CSR>, tensor<6x6xi32>) -> tensor<6x6xi32>1777
1778B
// Verify the output.1779B
//1780B
//1781B
//1782B
//1783B
//1784B
//1785B
//1786B
%v0 = vector.transfer_read %0[%c0, %c0], %i0 : tensor<6x6xi32>, vector<6x6xi32>1787B
vector.print %v0 : vector<6x6xi32>1788B
%v1 = vector.transfer_read %1[%c0, %c0], %i0 : tensor<6x6xi32>, vector<6x6xi32>1789B
vector.print %v1 : vector<6x6xi32>1790B
%v2 = vector.transfer_read %2[%c0, %c0], %i0 : tensor<6x6xi32>, vector<6x6xi32>1791B
vector.print %v2 : vector<6x6xi32>1792B
%v3 = vector.transfer_read %3[%c0, %c0], %i0 : tensor<6x6xi32>, vector<6x6xi32>1793B
vector.print %v3 : vector<6x6xi32>1794B
%v4 = vector.transfer_read %4[%c0, %c0], %i0 : tensor<6x6xi32>, vector<6x6xi32>1795B
vector.print %v4 : vector<6x6xi32>1796B
%v5 = vector.transfer_read %5[%c0, %c0], %i0 : tensor<6x6xi32>, vector<6x6xi32>1797B
vector.print %v5 : vector<6x6xi32>1798
1799B
// Release resources.1800B
bufferization.dealloc_tensor %input_CSR : tensor<10x10xi32, #CSR>1801B
bufferization.dealloc_tensor %input_DCSR : tensor<10x10xi32, #DCSR>1802B
bufferization.dealloc_tensor %filter_CSR : tensor<5x5xi32, #CSR>1803B
bufferization.dealloc_tensor %sinput_CSR : tensor<10x10xi32, #CSR>1804B
bufferization.dealloc_tensor %sinput_DCSR : tensor<10x10xi32, #DCSR>1805B
bufferization.dealloc_tensor %sfilter_CSR : tensor<5x5xi32, #CSR>1806B
bufferization.dealloc_tensor %0 : tensor<6x6xi32>1807B
bufferization.dealloc_tensor %1 : tensor<6x6xi32>1808B
bufferization.dealloc_tensor %2 : tensor<6x6xi32>1809B
bufferization.dealloc_tensor %3 : tensor<6x6xi32>1810B
bufferization.dealloc_tensor %4 : tensor<6x6xi32>1811B
bufferization.dealloc_tensor %5 : tensor<6x6xi32>1812
1813B
return1814A·B
}1815A·B
}1816A·B
}1817
1818A
// -----1819
1820new
// ===== FFL Bridge + Bug Primitives =====1821B
module {1822
1823new
// P6: Index boundary arithmetic — index_cast at i64 max1824new
func.func @_ffl_p6_index_boundary() -> index {1825new
%large = arith.constant 9223372036854775807 : i64 // i64 MAX1826new
%idx = arith.index_cast %large : i64 to index1827new
%c1 = arith.constant 1 : index1828new
// Adding 1 to max index — undefined on 32-bit targets, wraps on 64-bit1829new
%r = arith.addi %idx, %c1 : index1830new
// Cast back and verify round-trip via i32 (lossy, stresses trunci)1831new
%i64 = arith.index_cast %r : index to i641832new
%i32 = arith.trunci %i64 : i64 to i321833new
%back = arith.index_cast %i32 : i32 to index1834new
return %back : index1835A·B
}1836A·B
}mlir-opt: /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/IR/Matchers.h:93: bool mlir::detail::constant_op_binder<AttrT>::match(mlir::Operation*) [with AttrT = mlir::Attribute]: Assertion `succeeded(result) && "expected ConstantLike op to be foldable"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-mlir-install/bin/mlir-opt --split-input-file --allow-unregistered-dialect --loop-invariant-code-motion --inline --sccp /home/fuzz/WorkSpace/fusion-fuzz/.fused/mlir/tmpdp4aibtr/27d27010.mlir
#0 0x0000640f4aeb2f42 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/lib/Support/Unix/Signals.inc:884:3
#1 0x0000640f4aeaf8bc llvm::sys::RunSignalHandlers() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/lib/Support/Signals.cpp:108:20
#2 0x0000640f4aeaff81 SignalHandler(int, siginfo_t*, void*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/lib/Support/Unix/Signals.inc:448:14
#3 0x0000759dd0861520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#4 0x0000759dd08b59fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
#5 0x0000759dd0861476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
#6 0x0000759dd08477f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
#7 0x0000759dd084771b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
#8 0x0000759dd0858e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#9 0x0000640f52598205 (/home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-mlir-install/bin/mlir-opt+0xa03e205)
#10 0x0000640f5259bc0c decltype(auto) llvm::cast<mlir::Attribute, mlir::OpFoldResult>(mlir::OpFoldResult&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:48:3
#11 0x0000640f5259bc0c mlir::detail::constant_op_binder<mlir::Attribute>::match(mlir::Operation*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/IR/Matchers.h:95:58
#12 0x0000640f5259bc0c bool mlir::matchPattern<mlir::detail::constant_op_binder<mlir::Attribute>>(mlir::Operation*, mlir::detail::constant_op_binder<mlir::Attribute> const&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/IR/Matchers.h:502:46
#13 0x0000640f5259bc0c operator() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/GreedyPatternRewriteDriver.cpp:862:23
#14 0x0000640f5259bc0c operator() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/GreedyPatternRewriteDriver.cpp:877:67
#15 0x0000640f5259bc0c mlir::WalkResult llvm::function_ref<mlir::WalkResult (mlir::Operation*)>::callback_fn<(anonymous namespace)::RegionPatternRewriteDriver::simplify(bool*) &&::'lambda1'(mlir::Operation*)>(long, mlir::Operation*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:52
#16 0x0000640f4af7e79d mlir::WalkResult mlir::detail::walk<mlir::ForwardIterator>(mlir::Operation*, llvm::function_ref<mlir::WalkResult (mlir::Operation*)>, mlir::WalkOrder) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/IR/Visitors.h:229:5
#17 0x0000640f5259dfc4 walk<(mlir::WalkOrder)0, mlir::ForwardIterator, (anonymous namespace)::RegionPatternRewriteDriver::simplify(bool*) &&::<lambda(mlir::Operation*)>&> /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/IR/Block.h:373:9
#18 0x0000640f5259dfc4 walk<(mlir::WalkOrder)0, mlir::ForwardIterator, (anonymous namespace)::RegionPatternRewriteDriver::simplify(bool*) &&::<lambda(mlir::Operation*)>&> /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/IR/Block.h:337:32
#19 0x0000640f5259dfc4 walk<(mlir::WalkOrder)0> /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/IR/Region.h:316:40
#20 0x0000640f5259dfc4 simplify /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/GreedyPatternRewriteDriver.cpp:876:39
#21 0x0000640f5259dfc4 mlir::applyPatternsGreedily(mlir::Region&, mlir::FrozenRewritePatternSet const&, mlir::GreedyRewriteConfig, bool*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/GreedyPatternRewriteDriver.cpp:956:55
#22 0x0000640f525031c2 mlir::applyPatternsGreedily(mlir::Operation*, mlir::FrozenRewritePatternSet const&, mlir::GreedyRewriteConfig, bool*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/Transforms/GreedyPatternRewriteDriver.h:239:40
#23 0x0000640f525031c2 (anonymous namespace)::Canonicalizer::runOnOperation() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Canonicalizer.cpp:88:30
#24 0x0000640f526357a6 operator() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:612:33
#25 0x0000640f526357a6 callback_fn<mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::<lambda()> > /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:52
#26 0x0000640f526357a6 llvm::function_ref<void ()>::operator()() const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#27 0x0000640f526357a6 void mlir::MLIRContext::executeAction<mlir::PassExecutionAction, mlir::Pass&>(llvm::function_ref<void ()>, llvm::ArrayRef<mlir::IRUnit>, mlir::Pass&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/IR/MLIRContext.h:294:15
#28 0x0000640f526357a6 mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:606:57
#29 0x0000640f52635a74 mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:688:5
#30 0x0000640f52636737 mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::'lambda1'(mlir::OpPassManager&, mlir::Operation*)::operator()(mlir::OpPassManager&, mlir::Operation*) const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:592:42
#31 0x0000640f5250f2c5 (anonymous namespace)::InlinerPass::runPipelineHelper(mlir::Pass&, mlir::OpPassManager&, mlir::Operation*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/InlinerPass.cpp:62:3
#32 0x0000640f4b650277 std::_Function_handler<llvm::LogicalResult (mlir::Pass&, mlir::OpPassManager&, mlir::Operation*), llvm::LogicalResult (*)(mlir::Pass&, mlir::OpPassManager&, mlir::Operation*)>::_M_invoke(std::_Any_data const&, mlir::Pass&, mlir::OpPassManager&, mlir::Operation*&&) /usr/include/c++/11/bits/std_function.h:292:7
#33 0x0000640f525a2657 mlir::Inliner::Impl::optimizeCallable(mlir::CallGraphNode*, llvm::StringMap<mlir::OpPassManager, llvm::MallocAllocator>&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/Inliner.cpp:577:1
#34 0x0000640f525a2891 mlir::Inliner::Impl::optimizeSCCAsync(llvm::MutableArrayRef<mlir::CallGraphNode*>, mlir::MLIRContext*)::'lambda'(mlir::CallGraphNode*)::operator()(mlir::CallGraphNode*) const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/Inliner.cpp:543:29
#35 0x0000640f525a3f82 failableParallelForEach<mlir::CallGraphNode**, mlir::Inliner::Impl::optimizeSCCAsync(llvm::MutableArrayRef<mlir::CallGraphNode*>, mlir::MLIRContext*)::<lambda(mlir::CallGraphNode*)> > /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/IR/Threading.h:46:7
#36 0x0000640f525a3f82 failableParallelForEach<llvm::MutableArrayRef<mlir::CallGraphNode*>&, mlir::Inliner::Impl::optimizeSCCAsync(llvm::MutableArrayRef<mlir::CallGraphNode*>, mlir::MLIRContext*)::<lambda(mlir::CallGraphNode*)> > /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/IR/Threading.h:92:33
#37 0x0000640f525a3f82 mlir::Inliner::Impl::optimizeSCCAsync(llvm::MutableArrayRef<mlir::CallGraphNode*>, mlir::MLIRContext*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/Inliner.cpp:541:33
#38 0x0000640f525aab38 optimizeSCC /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/Inliner.cpp:509:3
#39 0x0000640f525aab38 mlir::Inliner::Impl::inlineSCC((anonymous namespace)::InlinerInterfaceImpl&, (anonymous namespace)::CGUseList&, (anonymous namespace)::CallGraphSCC&, mlir::MLIRContext*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/Inliner.cpp:475:15
#40 0x0000640f525ab0ce runTransformOnCGSCCs /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/Inliner.cpp:294:5
#41 0x0000640f525ab0ce mlir::Inliner::doInlining() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/Inliner.cpp:760:46
#42 0x0000640f525125db (anonymous namespace)::InlinerPass::runOnOperation() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/InlinerPass.cpp:152:3
#43 0x0000640f526357a6 operator() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:612:33
#44 0x0000640f526357a6 callback_fn<mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::<lambda()> > /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:52
#45 0x0000640f526357a6 llvm::function_ref<void ()>::operator()() const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#46 0x0000640f526357a6 void mlir::MLIRContext::executeAction<mlir::PassExecutionAction, mlir::Pass&>(llvm::function_ref<void ()>, llvm::ArrayRef<mlir::IRUnit>, mlir::Pass&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/IR/MLIRContext.h:294:15
#47 0x0000640f526357a6 mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:606:57
#48 0x0000640f52635a74 mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:688:5
#49 0x0000640f52637a13 mlir::PassManager::runPasses(mlir::Operation*, mlir::AnalysisManager) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:1129:71
#50 0x0000640f52638fcb mlir::PassManager::run(mlir::Operation*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:1102:69
#51 0x0000640f4af6090d performActions(llvm::raw_ostream&, std::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:596:3
#52 0x0000640f4af6113c ~DiagnosticFilter /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:310:7
#53 0x0000640f4af6113c processBuffer(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef, mlir::MlirOptMainConfig const&, mlir::DialectRegistry&, mlir::SourceMgrDiagnosticVerifierHandler*, llvm::ThreadPoolInterface*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:687:3
#54 0x0000640f4af61351 std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>::~unique_ptr() /usr/include/c++/11/bits/unique_ptr.h:360:12
#55 0x0000640f4af61351 operator() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:784:25
#56 0x0000640f4af61351 llvm::LogicalResult llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::'lambda'(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef, llvm::raw_ostream&)>(long, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:52
#57 0x0000640f5299745a std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>::~unique_ptr() /usr/include/c++/11/bits/unique_ptr.h:360:12
#58 0x0000640f5299745a llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&) const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#59 0x0000640f5299745a mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::'lambda'(llvm::StringRef)::operator()(llvm::StringRef) const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Support/ToolUtilities.cpp:93:15
#60 0x0000640f52997a0b interleave<const llvm::StringRef*, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer>, mlir::ChunkBufferHandler, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::<lambda(llvm::StringRef)>, llvm::interleave<llvm::SmallVector<llvm::StringRef, 8>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer>, mlir::ChunkBufferHandler, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::<lambda(llvm::StringRef)>, llvm::raw_ostream>(const llvm::SmallVector<llvm::StringRef, 8>&, llvm::raw_ostream&, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer>, mlir::ChunkBufferHandler, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::<lambda(llvm::StringRef)>, const llvm::StringRef&)::<lambda()> > /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLExtras.h:2279:3
#61 0x0000640f52997a0b interleave<llvm::SmallVector<llvm::StringRef, 8>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer>, mlir::ChunkBufferHandler, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::<lambda(llvm::StringRef)>, llvm::raw_ostream> /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLExtras.h:2300:13
#62 0x0000640f52997a0b mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Support/ToolUtilities.cpp:97:19
#63 0x0000640f4af58763 std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>::~unique_ptr() /usr/include/c++/11/bits/unique_ptr.h:360:12
#64 0x0000640f4af58763 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) (.part.0) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:790:39
#65 0x0000640f4af618e8 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/Support/LogicalResult.h:62:42
#66 0x0000640f4af618e8 mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:835:13
#67 0x0000640f4af61b22 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::_M_data() const /usr/include/c++/11/bits/basic_string.h:195:28
#68 0x0000640f4af61b22 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::_M_is_local() const /usr/include/c++/11/bits/basic_string.h:230:23
#69 0x0000640f4af61b22 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::_M_dispose() /usr/include/c++/11/bits/basic_string.h:239:18
#70 0x0000640f4af61b22 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::~basic_string() /usr/include/c++/11/bits/basic_string.h:672:19
#71 0x0000640f4af61b22 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:852:1
#72 0x0000640f4adbe627 main /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/tools/mlir-opt/mlir-opt.cpp:347:1
#73 0x0000759dd0848d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#74 0x0000759dd0848e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#75 0x0000640f4ae96b65 _start (/home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-mlir-install/bin/mlir-opt+0x293cb65)
Aborted (core dumped)// RUN: mlir-translate --no-implicit-module --split-input-file --test-spirv-roundtrip %s | FileCheck %s
// RUN: %if spirv-tools %{ rm -rf %t %}
// RUN: %if spirv-tools %{ mkdir %t %}
// RUN: %if spirv-tools %{ mlir-translate --no-implicit-module --serialize-spirv --split-input-file --spirv-save-validation-files-with-prefix=%t/module %s %}
// RUN: %if spirv-tools %{ spirv-val %t %}
//===----------------------------------------------------------------------===//
// spirv.TOSA.ArgMax - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @argmax_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<3x28x17x17xi8>, UniformConstant>
spirv.GlobalVariable @argmax_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<3x28x17xi32>, UniformConstant>
spirv.ARM.GraphEntryPoint @argmax_int, @argmax_int_arg_0, @argmax_int_res_0
spirv.ARM.Graph @argmax_int(%arg0: !spirv.arm.tensor<3x28x17x17xi8>) -> (!spirv.arm.tensor<3x28x17xi32>) {
// CHECK: {{%.*}} = spirv.Tosa.ArgMax axis = 3, nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<3x28x17x17xi8> -> !spirv.arm.tensor<3x28x17xi32>
%2 = spirv.Tosa.ArgMax axis = 3, nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<3x28x17x17xi8> -> !spirv.arm.tensor<3x28x17xi32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<3x28x17xi32>
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<3x28x17xi32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.ArgMax - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @argmax_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<2x2x7x14xf32>, UniformConstant>
spirv.GlobalVariable @argmax_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<2x2x14xi32>, UniformConstant>
spirv.ARM.GraphEntryPoint @argmax_fp, @argmax_fp_arg_0, @argmax_fp_res_0
spirv.ARM.Graph @argmax_fp(%arg0: !spirv.arm.tensor<2x2x7x14xf32>) -> (!spirv.arm.tensor<2x2x14xi32>) {
// CHECK: {{%.*}} = spirv.Tosa.ArgMax axis = 2, nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<2x2x7x14xf32> -> !spirv.arm.tensor<2x2x14xi32>
%2 = spirv.Tosa.ArgMax axis = 2, nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<2x2x7x14xf32> -> !spirv.arm.tensor<2x2x14xi32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<2x2x14xi32>
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<2x2x14xi32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.AvgPool2D - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @avgpool2d_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x3x65537x1xi8>, UniformConstant>
spirv.GlobalVariable @avgpool2d_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x2x32768x1xi8>, UniformConstant>
spirv.ARM.GraphEntryPoint @avgpool2d_int, @avgpool2d_int_arg_0, @avgpool2d_int_res_0
spirv.ARM.Graph @avgpool2d_int(%arg0: !spirv.arm.tensor<1x3x65537x1xi8>) -> (!spirv.arm.tensor<1x2x32768x1xi8>) {
%4 = spirv.Constant dense<125> : !spirv.arm.tensor<1xi8>
%5 = spirv.Constant dense<-90> : !spirv.arm.tensor<1xi8>
// CHECK: {{%.*}} = spirv.Tosa.AvgPool2D kernel = [3, 3], stride = [1, 2], pad = [0, 1, 0, 0], acc_type = <INT32>, %arg0, {{%.*}}, {{%.*}} : !spirv.arm.tensor<1x3x65537x1xi8>, !spirv.arm.tensor<1xi8>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<1x2x32768x1xi8>
%6 = spirv.Tosa.AvgPool2D kernel = [3, 3], stride = [1, 2], pad = [0, 1, 0, 0], acc_type = <INT32>, %arg0, %4, %5 : !spirv.arm.tensor<1x3x65537x1xi8>, !spirv.arm.tensor<1xi8>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<1x2x32768x1xi8>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<1x2x32768x1xi8>
spirv.ARM.GraphOutputs %6 : !spirv.arm.tensor<1x2x32768x1xi8>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.AvgPool2D - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @avgpool2d_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x2x65533x2xf32>, UniformConstant>
spirv.GlobalVariable @avgpool2d_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x2x65532x2xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @avgpool2d_fp, @avgpool2d_fp_arg_0, @avgpool2d_fp_res_0
spirv.ARM.Graph @avgpool2d_fp(%arg0: !spirv.arm.tensor<1x2x65533x2xf32>) -> (!spirv.arm.tensor<1x2x65532x2xf32>) {
%4 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf32>
%5 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf32>
// CHECK: {{%.*}} = spirv.Tosa.AvgPool2D kernel = [2, 2], stride = [1, 1], pad = [1, 0, 0, 0], acc_type = <FP32>, %arg0, {{%.*}}, {{%.*}} : !spirv.arm.tensor<1x2x65533x2xf32>, !spirv.arm.tensor<1xf32>, !spirv.arm.tensor<1xf32> -> !spirv.arm.tensor<1x2x65532x2xf32>
%6 = spirv.Tosa.AvgPool2D kernel = [2, 2], stride = [1, 1], pad = [1, 0, 0, 0], acc_type = <FP32>, %arg0, %4, %5 : !spirv.arm.tensor<1x2x65533x2xf32>, !spirv.arm.tensor<1xf32>, !spirv.arm.tensor<1xf32> -> !spirv.arm.tensor<1x2x65532x2xf32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<1x2x65532x2xf32>
spirv.ARM.GraphOutputs %6 : !spirv.arm.tensor<1x2x65532x2xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Conv2D - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @conv2d_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x65535x3x1xi8>, UniformConstant>
spirv.GlobalVariable @conv2d_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<7x1x1x1xi8>, UniformConstant>
spirv.GlobalVariable @conv2d_int_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<1xi32>, UniformConstant>
spirv.GlobalVariable @conv2d_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x65536x2x7xi32>, UniformConstant>
spirv.ARM.GraphEntryPoint @conv2d_int, @conv2d_int_arg_0, @conv2d_int_arg_1, @conv2d_int_arg_2, @conv2d_int_res_0
spirv.ARM.Graph @conv2d_int(%arg0: !spirv.arm.tensor<1x65535x3x1xi8>, %arg1: !spirv.arm.tensor<7x1x1x1xi8>, %arg2: !spirv.arm.tensor<1xi32>) -> (!spirv.arm.tensor<1x65536x2x7xi32>) {
%5 = spirv.Constant dense<35> : !spirv.arm.tensor<1xi8>
%6 = spirv.Constant dense<57> : !spirv.arm.tensor<1xi8>
// CHECK: {{%.*}} = spirv.Tosa.Conv2D pad = [1, 0, 0, 0], stride = [1, 2], dilation = [7, 1], acc_type = <INT32>, local_bound = false, %arg0, %arg1, %arg2, {{%.*}}, {{%.*}} : !spirv.arm.tensor<1x65535x3x1xi8>, !spirv.arm.tensor<7x1x1x1xi8>, !spirv.arm.tensor<1xi32>, !spirv.arm.tensor<1xi8>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<1x65536x2x7xi32>
%7 = spirv.Tosa.Conv2D pad = [1, 0, 0, 0], stride = [1, 2], dilation = [7, 1], acc_type = <INT32>, local_bound = false, %arg0, %arg1, %arg2, %5, %6 : !spirv.arm.tensor<1x65535x3x1xi8>, !spirv.arm.tensor<7x1x1x1xi8>, !spirv.arm.tensor<1xi32>, !spirv.arm.tensor<1xi8>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<1x65536x2x7xi32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<1x65536x2x7xi32>
spirv.ARM.GraphOutputs %7 : !spirv.arm.tensor<1x65536x2x7xi32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Conv2D - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @conv2d_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x34x18x27xf16>, UniformConstant>
spirv.GlobalVariable @conv2d_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<11x1x1x27xf16>, UniformConstant>
spirv.GlobalVariable @conv2d_fp_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<11xf16>, UniformConstant>
spirv.GlobalVariable @conv2d_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x34x18x11xf16>, UniformConstant>
spirv.ARM.GraphEntryPoint @conv2d_fp, @conv2d_fp_arg_0, @conv2d_fp_arg_1, @conv2d_fp_arg_2, @conv2d_fp_res_0
spirv.ARM.Graph @conv2d_fp(%arg0: !spirv.arm.tensor<1x34x18x27xf16>, %arg1: !spirv.arm.tensor<11x1x1x27xf16>, %arg2: !spirv.arm.tensor<11xf16>) -> (!spirv.arm.tensor<1x34x18x11xf16>) {
%5 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf16>
%6 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf16>
// CHECK: {{%.*}} = spirv.Tosa.Conv2D pad = [0, 0, 0, 0], stride = [1, 1], dilation = [1, 1], acc_type = <FP16>, local_bound = true, %arg0, %arg1, %arg2, {{%.*}}, {{%.*}} : !spirv.arm.tensor<1x34x18x27xf16>, !spirv.arm.tensor<11x1x1x27xf16>, !spirv.arm.tensor<11xf16>, !spirv.arm.tensor<1xf16>, !spirv.arm.tensor<1xf16> -> !spirv.arm.tensor<1x34x18x11xf16>
%7 = spirv.Tosa.Conv2D pad = [0, 0, 0, 0], stride = [1, 1], dilation = [1, 1], acc_type = <FP16>, local_bound = true, %arg0, %arg1, %arg2, %5, %6 : !spirv.arm.tensor<1x34x18x27xf16>, !spirv.arm.tensor<11x1x1x27xf16>, !spirv.arm.tensor<11xf16>, !spirv.arm.tensor<1xf16>, !spirv.arm.tensor<1xf16> -> !spirv.arm.tensor<1x34x18x11xf16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<1x34x18x11xf16>
spirv.ARM.GraphOutputs %7 : !spirv.arm.tensor<1x34x18x11xf16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Conv3D - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @conv3d_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x9x21x14x1xi8>, UniformConstant>
spirv.GlobalVariable @conv3d_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<2x1x2x1x1xi8>, UniformConstant>
spirv.GlobalVariable @conv3d_int_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<1xi32>, UniformConstant>
spirv.GlobalVariable @conv3d_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x9x20x14x2xi32>, UniformConstant>
spirv.ARM.GraphEntryPoint @conv3d_int, @conv3d_int_arg_0, @conv3d_int_arg_1, @conv3d_int_arg_2, @conv3d_int_res_0
spirv.ARM.Graph @conv3d_int(%arg0: !spirv.arm.tensor<1x9x21x14x1xi8>, %arg1: !spirv.arm.tensor<2x1x2x1x1xi8>, %arg2: !spirv.arm.tensor<1xi32>) -> (!spirv.arm.tensor<1x9x20x14x2xi32>) {
%5 = spirv.Constant dense<123> : !spirv.arm.tensor<1xi8>
%6 = spirv.Constant dense<121> : !spirv.arm.tensor<1xi8>
// CHECK: {{%.*}} = spirv.Tosa.Conv3D pad = [0, 0, 0, 0, 0, 0], stride = [1, 1, 1], dilation = [1, 1, 1], acc_type = <INT32>, local_bound = false, %arg0, %arg1, %arg2, {{%.*}}, {{%.*}} : !spirv.arm.tensor<1x9x21x14x1xi8>, !spirv.arm.tensor<2x1x2x1x1xi8>, !spirv.arm.tensor<1xi32>, !spirv.arm.tensor<1xi8>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<1x9x20x14x2xi32>
%7 = spirv.Tosa.Conv3D pad = [0, 0, 0, 0, 0, 0], stride = [1, 1, 1], dilation = [1, 1, 1], acc_type = <INT32>, local_bound = false, %arg0, %arg1, %arg2, %5, %6 : !spirv.arm.tensor<1x9x21x14x1xi8>, !spirv.arm.tensor<2x1x2x1x1xi8>, !spirv.arm.tensor<1xi32>, !spirv.arm.tensor<1xi8>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<1x9x20x14x2xi32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<1x9x20x14x2xi32>
spirv.ARM.GraphOutputs %7 : !spirv.arm.tensor<1x9x20x14x2xi32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Conv3D - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @conv3d_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x2x65539x1x2xf32>, UniformConstant>
spirv.GlobalVariable @conv3d_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x1x1x1x2xf32>, UniformConstant>
spirv.GlobalVariable @conv3d_fp_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<1xf32>, UniformConstant>
spirv.GlobalVariable @conv3d_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x3x65540x2x1xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @conv3d_fp, @conv3d_fp_arg_0, @conv3d_fp_arg_1, @conv3d_fp_arg_2, @conv3d_fp_res_0
spirv.ARM.Graph @conv3d_fp(%arg0: !spirv.arm.tensor<1x2x65539x1x2xf32>, %arg1: !spirv.arm.tensor<1x1x1x1x2xf32>, %arg2: !spirv.arm.tensor<1xf32>) -> (!spirv.arm.tensor<1x3x65540x2x1xf32>) {
%5 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf32>
%6 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf32>
// CHECK: {{%.*}} = spirv.Tosa.Conv3D pad = [0, 1, 1, 0, 0, 1], stride = [1, 1, 1], dilation = [1, 1, 7], acc_type = <FP32>, local_bound = false, %arg0, %arg1, %arg2, {{%.*}}, {{%.*}} : !spirv.arm.tensor<1x2x65539x1x2xf32>, !spirv.arm.tensor<1x1x1x1x2xf32>, !spirv.arm.tensor<1xf32>, !spirv.arm.tensor<1xf32>, !spirv.arm.tensor<1xf32> -> !spirv.arm.tensor<1x3x65540x2x1xf32>
%7 = spirv.Tosa.Conv3D pad = [0, 1, 1, 0, 0, 1], stride = [1, 1, 1], dilation = [1, 1, 7], acc_type = <FP32>, local_bound = false, %arg0, %arg1, %arg2, %5, %6 : !spirv.arm.tensor<1x2x65539x1x2xf32>, !spirv.arm.tensor<1x1x1x1x2xf32>, !spirv.arm.tensor<1xf32>, !spirv.arm.tensor<1xf32>, !spirv.arm.tensor<1xf32> -> !spirv.arm.tensor<1x3x65540x2x1xf32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<1x3x65540x2x1xf32>
spirv.ARM.GraphOutputs %7 : !spirv.arm.tensor<1x3x65540x2x1xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.DepthwiseConv2D - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @depthwiseconv2d_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x4x65537x1xi8>, UniformConstant>
spirv.GlobalVariable @depthwiseconv2d_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x3x1x4xi8>, UniformConstant>
spirv.GlobalVariable @depthwiseconv2d_int_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<4xi32>, UniformConstant>
spirv.GlobalVariable @depthwiseconv2d_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x4x32762x4xi32>, UniformConstant>
spirv.ARM.GraphEntryPoint @depthwiseconv2d_int, @depthwiseconv2d_int_arg_0, @depthwiseconv2d_int_arg_1, @depthwiseconv2d_int_arg_2, @depthwiseconv2d_int_res_0
spirv.ARM.Graph @depthwiseconv2d_int(%arg0: !spirv.arm.tensor<1x4x65537x1xi8>, %arg1: !spirv.arm.tensor<1x3x1x4xi8>, %arg2: !spirv.arm.tensor<4xi32>) -> (!spirv.arm.tensor<1x4x32762x4xi32>) {
%5 = spirv.Constant dense<58> : !spirv.arm.tensor<1xi8>
%6 = spirv.Constant dense<-106> : !spirv.arm.tensor<1xi8>
// CHECK: {{%.*}} = spirv.Tosa.DepthwiseConv2D pad = [0, 0, 0, 0], stride = [1, 2], dilation = [7, 7], acc_type = <INT32>, local_bound = false, %arg0, %arg1, %arg2, {{%.*}}, {{%.*}} : !spirv.arm.tensor<1x4x65537x1xi8>, !spirv.arm.tensor<1x3x1x4xi8>, !spirv.arm.tensor<4xi32>, !spirv.arm.tensor<1xi8>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<1x4x32762x4xi32>
%7 = spirv.Tosa.DepthwiseConv2D pad = [0, 0, 0, 0], stride = [1, 2], dilation = [7, 7], acc_type = <INT32>, local_bound = false, %arg0, %arg1, %arg2, %5, %6 : !spirv.arm.tensor<1x4x65537x1xi8>, !spirv.arm.tensor<1x3x1x4xi8>, !spirv.arm.tensor<4xi32>, !spirv.arm.tensor<1xi8>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<1x4x32762x4xi32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<1x4x32762x4xi32>
spirv.ARM.GraphOutputs %7 : !spirv.arm.tensor<1x4x32762x4xi32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.DepthwiseConv2D - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @depthwiseconv2d_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x65540x1x3xf32>, UniformConstant>
spirv.GlobalVariable @depthwiseconv2d_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x1x3x1xf32>, UniformConstant>
spirv.GlobalVariable @depthwiseconv2d_fp_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<1xf32>, UniformConstant>
spirv.GlobalVariable @depthwiseconv2d_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x65541x2x3xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @depthwiseconv2d_fp, @depthwiseconv2d_fp_arg_0, @depthwiseconv2d_fp_arg_1, @depthwiseconv2d_fp_arg_2, @depthwiseconv2d_fp_res_0
spirv.ARM.Graph @depthwiseconv2d_fp(%arg0: !spirv.arm.tensor<1x65540x1x3xf32>, %arg1: !spirv.arm.tensor<1x1x3x1xf32>, %arg2: !spirv.arm.tensor<1xf32>) -> (!spirv.arm.tensor<1x65541x2x3xf32>) {
%5 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf32>
%6 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf32>
// CHECK: {{%.*}} = spirv.Tosa.DepthwiseConv2D pad = [0, 1, 1, 1], stride = [1, 2], dilation = [1, 7], acc_type = <FP32>, local_bound = true, %arg0, %arg1, %arg2, {{%.*}}, {{%.*}} : !spirv.arm.tensor<1x65540x1x3xf32>, !spirv.arm.tensor<1x1x3x1xf32>, !spirv.arm.tensor<1xf32>, !spirv.arm.tensor<1xf32>, !spirv.arm.tensor<1xf32> -> !spirv.arm.tensor<1x65541x2x3xf32>
%7 = spirv.Tosa.DepthwiseConv2D pad = [0, 1, 1, 1], stride = [1, 2], dilation = [1, 7], acc_type = <FP32>, local_bound = true, %arg0, %arg1, %arg2, %5, %6 : !spirv.arm.tensor<1x65540x1x3xf32>, !spirv.arm.tensor<1x1x3x1xf32>, !spirv.arm.tensor<1xf32>, !spirv.arm.tensor<1xf32>, !spirv.arm.tensor<1xf32> -> !spirv.arm.tensor<1x65541x2x3xf32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<1x65541x2x3xf32>
spirv.ARM.GraphOutputs %7 : !spirv.arm.tensor<1x65541x2x3xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.FFT2D - EXT-FFT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @fft2d_fft_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x32x32xf32>, UniformConstant>
spirv.GlobalVariable @fft2d_fft_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x32x32xf32>, UniformConstant>
spirv.GlobalVariable @fft2d_fft_res_0 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<1x32x32xf32>, UniformConstant>
spirv.GlobalVariable @fft2d_fft_res_1 bind(0, 3) : !spirv.ptr<!spirv.arm.tensor<1x32x32xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @fft2d_fft, @fft2d_fft_arg_0, @fft2d_fft_arg_1, @fft2d_fft_res_0, @fft2d_fft_res_1
spirv.ARM.Graph @fft2d_fft(%arg0: !spirv.arm.tensor<1x32x32xf32>, %arg1: !spirv.arm.tensor<1x32x32xf32>) -> (!spirv.arm.tensor<1x32x32xf32>, !spirv.arm.tensor<1x32x32xf32>) {
// CHECK: {{%.*}} = spirv.Tosa.FFT2D inverse = true, local_bound = false, %arg0, %arg1 : !spirv.arm.tensor<1x32x32xf32>, !spirv.arm.tensor<1x32x32xf32> -> !spirv.struct<(!spirv.arm.tensor<1x32x32xf32>, !spirv.arm.tensor<1x32x32xf32>)>
%out = spirv.Tosa.FFT2D inverse = true, local_bound = false, %arg0, %arg1 : !spirv.arm.tensor<1x32x32xf32>, !spirv.arm.tensor<1x32x32xf32> -> !spirv.struct<(!spirv.arm.tensor<1x32x32xf32>, !spirv.arm.tensor<1x32x32xf32>)>
// CHECK: {{%.*}} = spirv.CompositeExtract {{%.*}}[0 : i32] : !spirv.struct<(!spirv.arm.tensor<1x32x32xf32>, !spirv.arm.tensor<1x32x32xf32>)>
%out0 = spirv.CompositeExtract %out[0 : i32] : !spirv.struct<(!spirv.arm.tensor<1x32x32xf32>, !spirv.arm.tensor<1x32x32xf32>)>
// CHECK: {{%.*}} = spirv.CompositeExtract {{%.*}}[1 : i32] : !spirv.struct<(!spirv.arm.tensor<1x32x32xf32>, !spirv.arm.tensor<1x32x32xf32>)>
%out1 = spirv.CompositeExtract %out[1 : i32] : !spirv.struct<(!spirv.arm.tensor<1x32x32xf32>, !spirv.arm.tensor<1x32x32xf32>)>
// CHECK: spirv.ARM.GraphOutputs {{%.*}}, {{%.*}} : !spirv.arm.tensor<1x32x32xf32>, !spirv.arm.tensor<1x32x32xf32>
spirv.ARM.GraphOutputs %out0, %out1 : !spirv.arm.tensor<1x32x32xf32>, !spirv.arm.tensor<1x32x32xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.MatMul - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @matmul_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<8x2x3xi8>, UniformConstant>
spirv.GlobalVariable @matmul_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<8x3x8xi8>, UniformConstant>
spirv.GlobalVariable @matmul_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<8x2x8xi32>, UniformConstant>
spirv.ARM.GraphEntryPoint @matmul_int, @matmul_int_arg_0, @matmul_int_arg_1, @matmul_int_res_0
spirv.ARM.Graph @matmul_int(%arg0: !spirv.arm.tensor<8x2x3xi8>, %arg1: !spirv.arm.tensor<8x3x8xi8>) -> (!spirv.arm.tensor<8x2x8xi32>) {
%0 = spirv.Constant dense<0> : !spirv.arm.tensor<1xi8>
%1 = spirv.Constant dense<0> : !spirv.arm.tensor<1xi8>
// CHECK: {{%.*}} = spirv.Tosa.MatMul %arg0, %arg1, {{%.*}}, {{%.*}} : !spirv.arm.tensor<8x2x3xi8>, !spirv.arm.tensor<8x3x8xi8>, !spirv.arm.tensor<1xi8>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<8x2x8xi32>
%2 = spirv.Tosa.MatMul %arg0, %arg1, %0, %1 : !spirv.arm.tensor<8x2x3xi8>, !spirv.arm.tensor<8x3x8xi8>, !spirv.arm.tensor<1xi8>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<8x2x8xi32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<8x2x8xi32>
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<8x2x8xi32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.MatMul - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @matmul_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<15x39x50xf16>, UniformConstant>
spirv.GlobalVariable @matmul_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<15x50x24xf16>, UniformConstant>
spirv.GlobalVariable @matmul_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<15x39x24xf16>, UniformConstant>
spirv.ARM.GraphEntryPoint @matmul_fp, @matmul_fp_arg_0, @matmul_fp_arg_1, @matmul_fp_res_0
spirv.ARM.Graph @matmul_fp(%arg0: !spirv.arm.tensor<15x39x50xf16>, %arg1: !spirv.arm.tensor<15x50x24xf16>) -> (!spirv.arm.tensor<15x39x24xf16>) {
%0 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf16>
%1 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf16>
// CHECK: {{%.*}} = spirv.Tosa.MatMul %arg0, %arg1, {{%.*}}, {{%.*}} : !spirv.arm.tensor<15x39x50xf16>, !spirv.arm.tensor<15x50x24xf16>, !spirv.arm.tensor<1xf16>, !spirv.arm.tensor<1xf16> -> !spirv.arm.tensor<15x39x24xf16>
%2 = spirv.Tosa.MatMul %arg0, %arg1, %0, %1 : !spirv.arm.tensor<15x39x50xf16>, !spirv.arm.tensor<15x50x24xf16>, !spirv.arm.tensor<1xf16>, !spirv.arm.tensor<1xf16> -> !spirv.arm.tensor<15x39x24xf16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<15x39x24xf16>
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<15x39x24xf16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.MaxPool2D - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @maxpool2d_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x3x65537x1xi8>, UniformConstant>
spirv.GlobalVariable @maxpool2d_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x2x32769x1xi8>, UniformConstant>
spirv.ARM.GraphEntryPoint @maxpool2d_int, @maxpool2d_int_arg_0, @maxpool2d_int_res_0
spirv.ARM.Graph @maxpool2d_int(%arg0: !spirv.arm.tensor<1x3x65537x1xi8>) -> (!spirv.arm.tensor<1x2x32769x1xi8>) {
// CHECK: {{%.*}} = spirv.Tosa.MaxPool2D kernel = [3, 2], stride = [1, 2], pad = [1, 0, 0, 1], nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<1x3x65537x1xi8> -> !spirv.arm.tensor<1x2x32769x1xi8>
%4 = spirv.Tosa.MaxPool2D kernel = [3, 2], stride = [1, 2], pad = [1, 0, 0, 1], nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<1x3x65537x1xi8> -> !spirv.arm.tensor<1x2x32769x1xi8>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<1x2x32769x1xi8>
spirv.ARM.GraphOutputs %4 : !spirv.arm.tensor<1x2x32769x1xi8>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.MaxPool2D - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @maxpool2d_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x6x65536x1xf32>, UniformConstant>
spirv.GlobalVariable @maxpool2d_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x3x32769x1xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @maxpool2d_fp, @maxpool2d_fp_arg_0, @maxpool2d_fp_res_0
spirv.ARM.Graph @maxpool2d_fp(%arg0: !spirv.arm.tensor<1x6x65536x1xf32>) -> (!spirv.arm.tensor<1x3x32769x1xf32>) {
// CHECK: {{%.*}} = spirv.Tosa.MaxPool2D kernel = [3, 2], stride = [2, 2], pad = [1, 0, 1, 1], nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<1x6x65536x1xf32> -> !spirv.arm.tensor<1x3x32769x1xf32>
%4 = spirv.Tosa.MaxPool2D kernel = [3, 2], stride = [2, 2], pad = [1, 0, 1, 1], nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<1x6x65536x1xf32> -> !spirv.arm.tensor<1x3x32769x1xf32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<1x3x32769x1xf32>
spirv.ARM.GraphOutputs %4 : !spirv.arm.tensor<1x3x32769x1xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.RFFT2D - EXT-FFT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @rfft2d_fft_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x32x32xf32>, UniformConstant>
spirv.GlobalVariable @rfft2d_fft_res_0 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x32x17xf32>, UniformConstant>
spirv.GlobalVariable @rfft2d_fft_res_1 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<1x32x17xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @rfft2d_fft, @rfft2d_fft_arg_0, @rfft2d_fft_res_0, @rfft2d_fft_res_1
spirv.ARM.Graph @rfft2d_fft(%arg0: !spirv.arm.tensor<1x32x32xf32>) -> (!spirv.arm.tensor<1x32x17xf32>, !spirv.arm.tensor<1x32x17xf32>) {
// CHECK: {{%.*}} = spirv.Tosa.RFFT2D local_bound = false, %arg0 : !spirv.arm.tensor<1x32x32xf32> -> !spirv.struct<(!spirv.arm.tensor<1x32x17xf32>, !spirv.arm.tensor<1x32x17xf32>)>
%out = spirv.Tosa.RFFT2D local_bound = false, %arg0 : !spirv.arm.tensor<1x32x32xf32> -> !spirv.struct<(!spirv.arm.tensor<1x32x17xf32>, !spirv.arm.tensor<1x32x17xf32>)>
// CHECK: {{%.*}} = spirv.CompositeExtract {{%.*}}[0 : i32] : !spirv.struct<(!spirv.arm.tensor<1x32x17xf32>, !spirv.arm.tensor<1x32x17xf32>)>
%out0 = spirv.CompositeExtract %out[0 : i32] : !spirv.struct<(!spirv.arm.tensor<1x32x17xf32>, !spirv.arm.tensor<1x32x17xf32>)>
// CHECK: {{%.*}} = spirv.CompositeExtract {{%.*}}[1 : i32] : !spirv.struct<(!spirv.arm.tensor<1x32x17xf32>, !spirv.arm.tensor<1x32x17xf32>)>
%out1 = spirv.CompositeExtract %out[1 : i32] : !spirv.struct<(!spirv.arm.tensor<1x32x17xf32>, !spirv.arm.tensor<1x32x17xf32>)>
// CHECK: spirv.ARM.GraphOutputs {{%.*}}, {{%.*}} : !spirv.arm.tensor<1x32x17xf32>, !spirv.arm.tensor<1x32x17xf32>
spirv.ARM.GraphOutputs %out0, %out1 : !spirv.arm.tensor<1x32x17xf32>, !spirv.arm.tensor<1x32x17xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.TransposeConv2D - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @transposeconv2d_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x13x33x3xi16>, UniformConstant>
spirv.GlobalVariable @transposeconv2d_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<11x1x3x3xi8>, UniformConstant>
spirv.GlobalVariable @transposeconv2d_int_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<1xi64>, UniformConstant>
spirv.GlobalVariable @transposeconv2d_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x13x35x11xi64>, UniformConstant>
spirv.ARM.GraphEntryPoint @transposeconv2d_int, @transposeconv2d_int_arg_0, @transposeconv2d_int_arg_1, @transposeconv2d_int_arg_2, @transposeconv2d_int_res_0
spirv.ARM.Graph @transposeconv2d_int(%arg0: !spirv.arm.tensor<1x13x33x3xi16>, %arg1: !spirv.arm.tensor<11x1x3x3xi8>, %arg2: !spirv.arm.tensor<1xi64>) -> (!spirv.arm.tensor<1x13x35x11xi64>) {
%4 = spirv.Constant dense<0> : !spirv.arm.tensor<1xi16>
%5 = spirv.Constant dense<88> : !spirv.arm.tensor<1xi8>
// CHECK: {{%.*}} = spirv.Tosa.TransposeConv2D out_pad = [0, 0, 0, 0], stride = [1, 1], acc_type = <INT48>, local_bound = false, %arg0, %arg1, %arg2, {{%.*}}, {{%.*}} : !spirv.arm.tensor<1x13x33x3xi16>, !spirv.arm.tensor<11x1x3x3xi8>, !spirv.arm.tensor<1xi64>, !spirv.arm.tensor<1xi16>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<1x13x35x11xi64>
%6 = spirv.Tosa.TransposeConv2D out_pad = [0, 0, 0, 0], stride = [1, 1], acc_type = <INT48>, local_bound = false, %arg0, %arg1, %arg2, %4, %5 : !spirv.arm.tensor<1x13x33x3xi16>, !spirv.arm.tensor<11x1x3x3xi8>, !spirv.arm.tensor<1xi64>, !spirv.arm.tensor<1xi16>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<1x13x35x11xi64>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<1x13x35x11xi64>
spirv.ARM.GraphOutputs %6 : !spirv.arm.tensor<1x13x35x11xi64>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.TransposeConv2D - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @transposeconv2d_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<10x24x9x13xf16>, UniformConstant>
spirv.GlobalVariable @transposeconv2d_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<14x1x1x13xf16>, UniformConstant>
spirv.GlobalVariable @transposeconv2d_fp_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<14xf16>, UniformConstant>
spirv.GlobalVariable @transposeconv2d_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<10x25x65x14xf16>, UniformConstant>
spirv.ARM.GraphEntryPoint @transposeconv2d_fp, @transposeconv2d_fp_arg_0, @transposeconv2d_fp_arg_1, @transposeconv2d_fp_arg_2, @transposeconv2d_fp_res_0
spirv.ARM.Graph @transposeconv2d_fp(%arg0: !spirv.arm.tensor<10x24x9x13xf16>, %arg1: !spirv.arm.tensor<14x1x1x13xf16>, %arg2: !spirv.arm.tensor<14xf16>) -> (!spirv.arm.tensor<10x25x65x14xf16>) {
%4 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf16>
%5 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf16>
// CHECK: {{%.*}} = spirv.Tosa.TransposeConv2D out_pad = [0, 1, 0, 0], stride = [1, 8], acc_type = <FP16>, local_bound = true, %arg0, %arg1, %arg2, {{%.*}}, {{%.*}} : !spirv.arm.tensor<10x24x9x13xf16>, !spirv.arm.tensor<14x1x1x13xf16>, !spirv.arm.tensor<14xf16>, !spirv.arm.tensor<1xf16>, !spirv.arm.tensor<1xf16> -> !spirv.arm.tensor<10x25x65x14xf16>
%6 = spirv.Tosa.TransposeConv2D out_pad = [0, 1, 0, 0], stride = [1, 8], acc_type = <FP16>, local_bound = true, %arg0, %arg1, %arg2, %4, %5 : !spirv.arm.tensor<10x24x9x13xf16>, !spirv.arm.tensor<14x1x1x13xf16>, !spirv.arm.tensor<14xf16>, !spirv.arm.tensor<1xf16>, !spirv.arm.tensor<1xf16> -> !spirv.arm.tensor<10x25x65x14xf16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<10x25x65x14xf16>
spirv.ARM.GraphOutputs %6 : !spirv.arm.tensor<10x25x65x14xf16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Clamp - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @clamp_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<27x44x55xi8>, UniformConstant>
spirv.GlobalVariable @clamp_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<27x44x55xi8>, UniformConstant>
spirv.ARM.GraphEntryPoint @clamp_int, @clamp_int_arg_0, @clamp_int_res_0
spirv.ARM.Graph @clamp_int(%arg0: !spirv.arm.tensor<27x44x55xi8>) -> (!spirv.arm.tensor<27x44x55xi8>) {
// CHECK: {{%.*}} = spirv.Tosa.Clamp min_val = -102 : i8, max_val = -100 : i8, nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<27x44x55xi8> -> !spirv.arm.tensor<27x44x55xi8>
%3 = spirv.Tosa.Clamp min_val = -102 : i8, max_val = -100 : i8, nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<27x44x55xi8> -> !spirv.arm.tensor<27x44x55xi8>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<27x44x55xi8>
spirv.ARM.GraphOutputs %3 : !spirv.arm.tensor<27x44x55xi8>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Clamp - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @clamp_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<18x5x17x6xf32>, UniformConstant>
spirv.GlobalVariable @clamp_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<18x5x17x6xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @clamp_fp, @clamp_fp_arg_0, @clamp_fp_res_0
spirv.ARM.Graph @clamp_fp(%arg0: !spirv.arm.tensor<18x5x17x6xf32>) -> (!spirv.arm.tensor<18x5x17x6xf32>) {
// CHECK: {{%.*}} = spirv.Tosa.Clamp min_val = -1.19339396E+38 : f32, max_val = 2.38255944E+38 : f32, nan_mode = <Ignore>, %arg0 : !spirv.arm.tensor<18x5x17x6xf32> -> !spirv.arm.tensor<18x5x17x6xf32>
%3 = spirv.Tosa.Clamp min_val = -1.19339396E+38 : f32, max_val = 2.38255944E+38 : f32, nan_mode = <Ignore>, %arg0 : !spirv.arm.tensor<18x5x17x6xf32> -> !spirv.arm.tensor<18x5x17x6xf32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<18x5x17x6xf32>
spirv.ARM.GraphOutputs %3 : !spirv.arm.tensor<18x5x17x6xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Erf - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @erf_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<47x38x51xf32>, UniformConstant>
spirv.GlobalVariable @erf_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<47x38x51xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @erf_fp, @erf_fp_arg_0, @erf_fp_res_0
spirv.ARM.Graph @erf_fp(%arg0: !spirv.arm.tensor<47x38x51xf32>) -> (!spirv.arm.tensor<47x38x51xf32>) {
// CHECK: {{%.*}} = spirv.Tosa.Erf %arg0 : !spirv.arm.tensor<47x38x51xf32> -> !spirv.arm.tensor<47x38x51xf32>
%0 = spirv.Tosa.Erf %arg0 : !spirv.arm.tensor<47x38x51xf32> -> !spirv.arm.tensor<47x38x51xf32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<47x38x51xf32>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<47x38x51xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Sigmoid - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @sigmoid_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<28x43x45xf32>, UniformConstant>
spirv.GlobalVariable @sigmoid_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<28x43x45xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @sigmoid_fp, @sigmoid_fp_arg_0, @sigmoid_fp_res_0
spirv.ARM.Graph @sigmoid_fp(%arg0: !spirv.arm.tensor<28x43x45xf32>) -> (!spirv.arm.tensor<28x43x45xf32>) {
// CHECK: {{%.*}} = spirv.Tosa.Sigmoid %arg0 : !spirv.arm.tensor<28x43x45xf32> -> !spirv.arm.tensor<28x43x45xf32>
%0 = spirv.Tosa.Sigmoid %arg0 : !spirv.arm.tensor<28x43x45xf32> -> !spirv.arm.tensor<28x43x45xf32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<28x43x45xf32>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<28x43x45xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Tanh - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @tanh_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<46x50x36xf16>, UniformConstant>
spirv.GlobalVariable @tanh_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<46x50x36xf16>, UniformConstant>
spirv.ARM.GraphEntryPoint @tanh_fp, @tanh_fp_arg_0, @tanh_fp_res_0
spirv.ARM.Graph @tanh_fp(%arg0: !spirv.arm.tensor<46x50x36xf16>) -> (!spirv.arm.tensor<46x50x36xf16>) {
// CHECK: {{%.*}} = spirv.Tosa.Tanh %arg0 : !spirv.arm.tensor<46x50x36xf16> -> !spirv.arm.tensor<46x50x36xf16>
%0 = spirv.Tosa.Tanh %arg0 : !spirv.arm.tensor<46x50x36xf16> -> !spirv.arm.tensor<46x50x36xf16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<46x50x36xf16>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<46x50x36xf16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Add - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @add_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<4x7x3x10xi32>, UniformConstant>
spirv.GlobalVariable @add_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<4x7x3x1xi32>, UniformConstant>
spirv.GlobalVariable @add_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<4x7x3x10xi32>, UniformConstant>
spirv.ARM.GraphEntryPoint @add_int, @add_int_arg_0, @add_int_arg_1, @add_int_res_0
spirv.ARM.Graph @add_int(%arg0: !spirv.arm.tensor<4x7x3x10xi32>, %arg1: !spirv.arm.tensor<4x7x3x1xi32>) -> (!spirv.arm.tensor<4x7x3x10xi32>) {
// CHECK: {{%.*}} = spirv.Tosa.Add %arg0, %arg1 : !spirv.arm.tensor<4x7x3x10xi32>, !spirv.arm.tensor<4x7x3x1xi32> -> !spirv.arm.tensor<4x7x3x10xi32>
%0 = spirv.Tosa.Add %arg0, %arg1 : !spirv.arm.tensor<4x7x3x10xi32>, !spirv.arm.tensor<4x7x3x1xi32> -> !spirv.arm.tensor<4x7x3x10xi32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<4x7x3x10xi32>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<4x7x3x10xi32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Add - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @add_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<26x37x18xf16>, UniformConstant>
spirv.GlobalVariable @add_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x37x18xf16>, UniformConstant>
spirv.GlobalVariable @add_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<26x37x18xf16>, UniformConstant>
spirv.ARM.GraphEntryPoint @add_fp, @add_fp_arg_0, @add_fp_arg_1, @add_fp_res_0
spirv.ARM.Graph @add_fp(%arg0: !spirv.arm.tensor<26x37x18xf16>, %arg1: !spirv.arm.tensor<1x37x18xf16>) -> (!spirv.arm.tensor<26x37x18xf16>) {
// CHECK: {{%.*}} = spirv.Tosa.Add %arg0, %arg1 : !spirv.arm.tensor<26x37x18xf16>, !spirv.arm.tensor<1x37x18xf16> -> !spirv.arm.tensor<26x37x18xf16>
%0 = spirv.Tosa.Add %arg0, %arg1 : !spirv.arm.tensor<26x37x18xf16>, !spirv.arm.tensor<1x37x18xf16> -> !spirv.arm.tensor<26x37x18xf16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<26x37x18xf16>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<26x37x18xf16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.ArithmeticRightShift - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @arithmeticrightshift_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x47x22xi16>, UniformConstant>
spirv.GlobalVariable @arithmeticrightshift_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<49x47x22xi16>, UniformConstant>
spirv.GlobalVariable @arithmeticrightshift_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<49x47x22xi16>, UniformConstant>
spirv.ARM.GraphEntryPoint @arithmeticrightshift_int, @arithmeticrightshift_int_arg_0, @arithmeticrightshift_int_arg_1, @arithmeticrightshift_int_res_0
spirv.ARM.Graph @arithmeticrightshift_int(%arg0: !spirv.arm.tensor<1x47x22xi16>, %arg1: !spirv.arm.tensor<49x47x22xi16>) -> (!spirv.arm.tensor<49x47x22xi16>) {
// CHECK: {{%.*}} = spirv.Tosa.ArithmeticRightShift round = true, %arg0, %arg1 : !spirv.arm.tensor<1x47x22xi16>, !spirv.arm.tensor<49x47x22xi16> -> !spirv.arm.tensor<49x47x22xi16>
%1 = spirv.Tosa.ArithmeticRightShift round = true, %arg0, %arg1 : !spirv.arm.tensor<1x47x22xi16>, !spirv.arm.tensor<49x47x22xi16> -> !spirv.arm.tensor<49x47x22xi16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<49x47x22xi16>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<49x47x22xi16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.BitwiseAnd - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @bitwiseand_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<4x1x7x12xi16>, UniformConstant>
spirv.GlobalVariable @bitwiseand_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<4x13x7x12xi16>, UniformConstant>
spirv.GlobalVariable @bitwiseand_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<4x13x7x12xi16>, UniformConstant>
spirv.ARM.GraphEntryPoint @bitwiseand_int, @bitwiseand_int_arg_0, @bitwiseand_int_arg_1, @bitwiseand_int_res_0
spirv.ARM.Graph @bitwiseand_int(%arg0: !spirv.arm.tensor<4x1x7x12xi16>, %arg1: !spirv.arm.tensor<4x13x7x12xi16>) -> (!spirv.arm.tensor<4x13x7x12xi16>) {
// CHECK: {{%.*}} = spirv.Tosa.BitwiseAnd %arg0, %arg1 : !spirv.arm.tensor<4x1x7x12xi16>, !spirv.arm.tensor<4x13x7x12xi16> -> !spirv.arm.tensor<4x13x7x12xi16>
%0 = spirv.Tosa.BitwiseAnd %arg0, %arg1 : !spirv.arm.tensor<4x1x7x12xi16>, !spirv.arm.tensor<4x13x7x12xi16> -> !spirv.arm.tensor<4x13x7x12xi16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<4x13x7x12xi16>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<4x13x7x12xi16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.BitwiseOr - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @bitwiseor_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<11x30x23xi32>, UniformConstant>
spirv.GlobalVariable @bitwiseor_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x30x23xi32>, UniformConstant>
spirv.GlobalVariable @bitwiseor_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<11x30x23xi32>, UniformConstant>
spirv.ARM.GraphEntryPoint @bitwiseor_int, @bitwiseor_int_arg_0, @bitwiseor_int_arg_1, @bitwiseor_int_res_0
spirv.ARM.Graph @bitwiseor_int(%arg0: !spirv.arm.tensor<11x30x23xi32>, %arg1: !spirv.arm.tensor<1x30x23xi32>) -> (!spirv.arm.tensor<11x30x23xi32>) {
// CHECK: {{%.*}} = spirv.Tosa.BitwiseOr %arg0, %arg1 : !spirv.arm.tensor<11x30x23xi32>, !spirv.arm.tensor<1x30x23xi32> -> !spirv.arm.tensor<11x30x23xi32>
%0 = spirv.Tosa.BitwiseOr %arg0, %arg1 : !spirv.arm.tensor<11x30x23xi32>, !spirv.arm.tensor<1x30x23xi32> -> !spirv.arm.tensor<11x30x23xi32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<11x30x23xi32>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<11x30x23xi32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.BitwiseXor - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @bitwisexor_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<4x8x13x9xi16>, UniformConstant>
spirv.GlobalVariable @bitwisexor_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<4x8x1x9xi16>, UniformConstant>
spirv.GlobalVariable @bitwisexor_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<4x8x13x9xi16>, UniformConstant>
spirv.ARM.GraphEntryPoint @bitwisexor_int, @bitwisexor_int_arg_0, @bitwisexor_int_arg_1, @bitwisexor_int_res_0
spirv.ARM.Graph @bitwisexor_int(%arg0: !spirv.arm.tensor<4x8x13x9xi16>, %arg1: !spirv.arm.tensor<4x8x1x9xi16>) -> (!spirv.arm.tensor<4x8x13x9xi16>) {
// CHECK: {{%.*}} = spirv.Tosa.BitwiseXor %arg0, %arg1 : !spirv.arm.tensor<4x8x13x9xi16>, !spirv.arm.tensor<4x8x1x9xi16> -> !spirv.arm.tensor<4x8x13x9xi16>
%0 = spirv.Tosa.BitwiseXor %arg0, %arg1 : !spirv.arm.tensor<4x8x13x9xi16>, !spirv.arm.tensor<4x8x1x9xi16> -> !spirv.arm.tensor<4x8x13x9xi16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<4x8x13x9xi16>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<4x8x13x9xi16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.IntDiv - PRO-INT or PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @intdiv_any_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x65533x1xi32>, UniformConstant>
spirv.GlobalVariable @intdiv_any_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<2x65533x1xi32>, UniformConstant>
spirv.GlobalVariable @intdiv_any_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<2x65533x1xi32>, UniformConstant>
spirv.ARM.GraphEntryPoint @intdiv_any, @intdiv_any_arg_0, @intdiv_any_arg_1, @intdiv_any_res_0
spirv.ARM.Graph @intdiv_any(%arg0: !spirv.arm.tensor<1x65533x1xi32>, %arg1: !spirv.arm.tensor<2x65533x1xi32>) -> (!spirv.arm.tensor<2x65533x1xi32>) {
// CHECK: {{%.*}} = spirv.Tosa.IntDiv %arg0, %arg1 : !spirv.arm.tensor<1x65533x1xi32>, !spirv.arm.tensor<2x65533x1xi32> -> !spirv.arm.tensor<2x65533x1xi32>
%0 = spirv.Tosa.IntDiv %arg0, %arg1 : !spirv.arm.tensor<1x65533x1xi32>, !spirv.arm.tensor<2x65533x1xi32> -> !spirv.arm.tensor<2x65533x1xi32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<2x65533x1xi32>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<2x65533x1xi32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.LogicalAnd - PRO-INT or PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @logicaland_any_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<2x1x7x11xi1>, UniformConstant>
spirv.GlobalVariable @logicaland_any_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<2x4x7x11xi1>, UniformConstant>
spirv.GlobalVariable @logicaland_any_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<2x4x7x11xi1>, UniformConstant>
spirv.ARM.GraphEntryPoint @logicaland_any, @logicaland_any_arg_0, @logicaland_any_arg_1, @logicaland_any_res_0
spirv.ARM.Graph @logicaland_any(%arg0: !spirv.arm.tensor<2x1x7x11xi1>, %arg1: !spirv.arm.tensor<2x4x7x11xi1>) -> (!spirv.arm.tensor<2x4x7x11xi1>) {
// CHECK: {{%.*}} = spirv.Tosa.LogicalAnd %arg0, %arg1 : !spirv.arm.tensor<2x1x7x11xi1>, !spirv.arm.tensor<2x4x7x11xi1> -> !spirv.arm.tensor<2x4x7x11xi1>
%0 = spirv.Tosa.LogicalAnd %arg0, %arg1 : !spirv.arm.tensor<2x1x7x11xi1>, !spirv.arm.tensor<2x4x7x11xi1> -> !spirv.arm.tensor<2x4x7x11xi1>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<2x4x7x11xi1>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<2x4x7x11xi1>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.LogicalLeftShift - PRO-INT or PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @logicalleftshift_any_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<7x1x11x4xi8>, UniformConstant>
spirv.GlobalVariable @logicalleftshift_any_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<7x8x11x4xi8>, UniformConstant>
spirv.GlobalVariable @logicalleftshift_any_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<7x8x11x4xi8>, UniformConstant>
spirv.ARM.GraphEntryPoint @logicalleftshift_any, @logicalleftshift_any_arg_0, @logicalleftshift_any_arg_1, @logicalleftshift_any_res_0
spirv.ARM.Graph @logicalleftshift_any(%arg0: !spirv.arm.tensor<7x1x11x4xi8>, %arg1: !spirv.arm.tensor<7x8x11x4xi8>) -> (!spirv.arm.tensor<7x8x11x4xi8>) {
// CHECK: {{%.*}} = spirv.Tosa.LogicalLeftShift %arg0, %arg1 : !spirv.arm.tensor<7x1x11x4xi8>, !spirv.arm.tensor<7x8x11x4xi8> -> !spirv.arm.tensor<7x8x11x4xi8>
%0 = spirv.Tosa.LogicalLeftShift %arg0, %arg1 : !spirv.arm.tensor<7x1x11x4xi8>, !spirv.arm.tensor<7x8x11x4xi8> -> !spirv.arm.tensor<7x8x11x4xi8>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<7x8x11x4xi8>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<7x8x11x4xi8>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.LogicalRightShift - PRO-INT or PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @logicalrightshift_any_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<6x13x1x19xi8>, UniformConstant>
spirv.GlobalVariable @logicalrightshift_any_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<6x13x6x19xi8>, UniformConstant>
spirv.GlobalVariable @logicalrightshift_any_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<6x13x6x19xi8>, UniformConstant>
spirv.ARM.GraphEntryPoint @logicalrightshift_any, @logicalrightshift_any_arg_0, @logicalrightshift_any_arg_1, @logicalrightshift_any_res_0
spirv.ARM.Graph @logicalrightshift_any(%arg0: !spirv.arm.tensor<6x13x1x19xi8>, %arg1: !spirv.arm.tensor<6x13x6x19xi8>) -> (!spirv.arm.tensor<6x13x6x19xi8>) {
// CHECK: {{%.*}} = spirv.Tosa.LogicalRightShift %arg0, %arg1 : !spirv.arm.tensor<6x13x1x19xi8>, !spirv.arm.tensor<6x13x6x19xi8> -> !spirv.arm.tensor<6x13x6x19xi8>
%0 = spirv.Tosa.LogicalRightShift %arg0, %arg1 : !spirv.arm.tensor<6x13x1x19xi8>, !spirv.arm.tensor<6x13x6x19xi8> -> !spirv.arm.tensor<6x13x6x19xi8>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<6x13x6x19xi8>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<6x13x6x19xi8>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.LogicalOr - PRO-INT or PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @logicalor_any_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<3x6x12x5xi1>, UniformConstant>
spirv.GlobalVariable @logicalor_any_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<3x6x1x5xi1>, UniformConstant>
spirv.GlobalVariable @logicalor_any_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<3x6x12x5xi1>, UniformConstant>
spirv.ARM.GraphEntryPoint @logicalor_any, @logicalor_any_arg_0, @logicalor_any_arg_1, @logicalor_any_res_0
spirv.ARM.Graph @logicalor_any(%arg0: !spirv.arm.tensor<3x6x12x5xi1>, %arg1: !spirv.arm.tensor<3x6x1x5xi1>) -> (!spirv.arm.tensor<3x6x12x5xi1>) {
// CHECK: {{%.*}} = spirv.Tosa.LogicalOr %arg0, %arg1 : !spirv.arm.tensor<3x6x12x5xi1>, !spirv.arm.tensor<3x6x1x5xi1> -> !spirv.arm.tensor<3x6x12x5xi1>
%0 = spirv.Tosa.LogicalOr %arg0, %arg1 : !spirv.arm.tensor<3x6x12x5xi1>, !spirv.arm.tensor<3x6x1x5xi1> -> !spirv.arm.tensor<3x6x12x5xi1>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<3x6x12x5xi1>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<3x6x12x5xi1>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.LogicalXor - PRO-INT or PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @logicalxor_any_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<11x4x9x12xi1>, UniformConstant>
spirv.GlobalVariable @logicalxor_any_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<11x4x9x1xi1>, UniformConstant>
spirv.GlobalVariable @logicalxor_any_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<11x4x9x12xi1>, UniformConstant>
spirv.ARM.GraphEntryPoint @logicalxor_any, @logicalxor_any_arg_0, @logicalxor_any_arg_1, @logicalxor_any_res_0
spirv.ARM.Graph @logicalxor_any(%arg0: !spirv.arm.tensor<11x4x9x12xi1>, %arg1: !spirv.arm.tensor<11x4x9x1xi1>) -> (!spirv.arm.tensor<11x4x9x12xi1>) {
// CHECK: {{%.*}} = spirv.Tosa.LogicalXor %arg0, %arg1 : !spirv.arm.tensor<11x4x9x12xi1>, !spirv.arm.tensor<11x4x9x1xi1> -> !spirv.arm.tensor<11x4x9x12xi1>
%0 = spirv.Tosa.LogicalXor %arg0, %arg1 : !spirv.arm.tensor<11x4x9x12xi1>, !spirv.arm.tensor<11x4x9x1xi1> -> !spirv.arm.tensor<11x4x9x12xi1>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<11x4x9x12xi1>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<11x4x9x12xi1>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Maximum - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @maximum_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x2x65533x1xi32>, UniformConstant>
spirv.GlobalVariable @maximum_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x2x65533x2xi32>, UniformConstant>
spirv.GlobalVariable @maximum_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x2x65533x2xi32>, UniformConstant>
spirv.ARM.GraphEntryPoint @maximum_int, @maximum_int_arg_0, @maximum_int_arg_1, @maximum_int_res_0
spirv.ARM.Graph @maximum_int(%arg0: !spirv.arm.tensor<1x2x65533x1xi32>, %arg1: !spirv.arm.tensor<1x2x65533x2xi32>) -> (!spirv.arm.tensor<1x2x65533x2xi32>) {
// CHECK: {{%.*}} = spirv.Tosa.Maximum nan_mode = <Propagate>, %arg0, %arg1 : !spirv.arm.tensor<1x2x65533x1xi32>, !spirv.arm.tensor<1x2x65533x2xi32> -> !spirv.arm.tensor<1x2x65533x2xi32>
%1 = spirv.Tosa.Maximum nan_mode = <Propagate>, %arg0, %arg1 : !spirv.arm.tensor<1x2x65533x1xi32>, !spirv.arm.tensor<1x2x65533x2xi32> -> !spirv.arm.tensor<1x2x65533x2xi32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<1x2x65533x2xi32>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<1x2x65533x2xi32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Maximum - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @maximum_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x12x14x7xf16>, UniformConstant>
spirv.GlobalVariable @maximum_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<11x12x14x7xf16>, UniformConstant>
spirv.GlobalVariable @maximum_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<11x12x14x7xf16>, UniformConstant>
spirv.ARM.GraphEntryPoint @maximum_fp, @maximum_fp_arg_0, @maximum_fp_arg_1, @maximum_fp_res_0
spirv.ARM.Graph @maximum_fp(%arg0: !spirv.arm.tensor<1x12x14x7xf16>, %arg1: !spirv.arm.tensor<11x12x14x7xf16>) -> (!spirv.arm.tensor<11x12x14x7xf16>) {
// CHECK: {{%.*}} = spirv.Tosa.Maximum nan_mode = <Ignore>, %arg0, %arg1 : !spirv.arm.tensor<1x12x14x7xf16>, !spirv.arm.tensor<11x12x14x7xf16> -> !spirv.arm.tensor<11x12x14x7xf16>
%1 = spirv.Tosa.Maximum nan_mode = <Ignore>, %arg0, %arg1 : !spirv.arm.tensor<1x12x14x7xf16>, !spirv.arm.tensor<11x12x14x7xf16> -> !spirv.arm.tensor<11x12x14x7xf16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<11x12x14x7xf16>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<11x12x14x7xf16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Minimum - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @minimum_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<15x2x10x11xi32>, UniformConstant>
spirv.GlobalVariable @minimum_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<15x1x10x11xi32>, UniformConstant>
spirv.GlobalVariable @minimum_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<15x2x10x11xi32>, UniformConstant>
spirv.ARM.GraphEntryPoint @minimum_int, @minimum_int_arg_0, @minimum_int_arg_1, @minimum_int_res_0
spirv.ARM.Graph @minimum_int(%arg0: !spirv.arm.tensor<15x2x10x11xi32>, %arg1: !spirv.arm.tensor<15x1x10x11xi32>) -> (!spirv.arm.tensor<15x2x10x11xi32>) {
// CHECK: {{%.*}} = spirv.Tosa.Minimum nan_mode = <Propagate>, %arg0, %arg1 : !spirv.arm.tensor<15x2x10x11xi32>, !spirv.arm.tensor<15x1x10x11xi32> -> !spirv.arm.tensor<15x2x10x11xi32>
%1 = spirv.Tosa.Minimum nan_mode = <Propagate>, %arg0, %arg1 : !spirv.arm.tensor<15x2x10x11xi32>, !spirv.arm.tensor<15x1x10x11xi32> -> !spirv.arm.tensor<15x2x10x11xi32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<15x2x10x11xi32>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<15x2x10x11xi32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Minimum - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @minimum_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x65531x2x1xf32>, UniformConstant>
spirv.GlobalVariable @minimum_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x1x2x1xf32>, UniformConstant>
spirv.GlobalVariable @minimum_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x65531x2x1xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @minimum_fp, @minimum_fp_arg_0, @minimum_fp_arg_1, @minimum_fp_res_0
spirv.ARM.Graph @minimum_fp(%arg0: !spirv.arm.tensor<1x65531x2x1xf32>, %arg1: !spirv.arm.tensor<1x1x2x1xf32>) -> (!spirv.arm.tensor<1x65531x2x1xf32>) {
// CHECK: {{%.*}} = spirv.Tosa.Minimum nan_mode = <Propagate>, %arg0, %arg1 : !spirv.arm.tensor<1x65531x2x1xf32>, !spirv.arm.tensor<1x1x2x1xf32> -> !spirv.arm.tensor<1x65531x2x1xf32>
%1 = spirv.Tosa.Minimum nan_mode = <Propagate>, %arg0, %arg1 : !spirv.arm.tensor<1x65531x2x1xf32>, !spirv.arm.tensor<1x1x2x1xf32> -> !spirv.arm.tensor<1x65531x2x1xf32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<1x65531x2x1xf32>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<1x65531x2x1xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Mul - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @mul_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<34x21x39xi32>, UniformConstant>
spirv.GlobalVariable @mul_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<34x21x1xi32>, UniformConstant>
spirv.GlobalVariable @mul_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<34x21x39xi32>, UniformConstant>
spirv.ARM.GraphEntryPoint @mul_int, @mul_int_arg_0, @mul_int_arg_1, @mul_int_res_0
spirv.ARM.Graph @mul_int(%arg0: !spirv.arm.tensor<34x21x39xi32>, %arg1: !spirv.arm.tensor<34x21x1xi32>) -> (!spirv.arm.tensor<34x21x39xi32>) {
%0 = spirv.Constant dense<31> : !spirv.arm.tensor<1xi8>
// CHECK: {{%.*}} = spirv.Tosa.Mul %arg0, %arg1, {{%.*}} : !spirv.arm.tensor<34x21x39xi32>, !spirv.arm.tensor<34x21x1xi32>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<34x21x39xi32>
%1 = spirv.Tosa.Mul %arg0, %arg1, %0 : !spirv.arm.tensor<34x21x39xi32>, !spirv.arm.tensor<34x21x1xi32>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<34x21x39xi32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<34x21x39xi32>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<34x21x39xi32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Mul - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @mul_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<57x1x55xf16>, UniformConstant>
spirv.GlobalVariable @mul_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<57x37x55xf16>, UniformConstant>
spirv.GlobalVariable @mul_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<57x37x55xf16>, UniformConstant>
spirv.ARM.GraphEntryPoint @mul_fp, @mul_fp_arg_0, @mul_fp_arg_1, @mul_fp_res_0
spirv.ARM.Graph @mul_fp(%arg0: !spirv.arm.tensor<57x1x55xf16>, %arg1: !spirv.arm.tensor<57x37x55xf16>) -> (!spirv.arm.tensor<57x37x55xf16>) {
%0 = spirv.Constant dense<0> : !spirv.arm.tensor<1xi8>
// CHECK: {{%.*}} = spirv.Tosa.Mul %arg0, %arg1, {{%.*}} : !spirv.arm.tensor<57x1x55xf16>, !spirv.arm.tensor<57x37x55xf16>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<57x37x55xf16>
%1 = spirv.Tosa.Mul %arg0, %arg1, %0 : !spirv.arm.tensor<57x1x55xf16>, !spirv.arm.tensor<57x37x55xf16>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<57x37x55xf16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<57x37x55xf16>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<57x37x55xf16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Pow - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @pow_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x52x53xf16>, UniformConstant>
spirv.GlobalVariable @pow_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<44x52x53xf16>, UniformConstant>
spirv.GlobalVariable @pow_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<44x52x53xf16>, UniformConstant>
spirv.ARM.GraphEntryPoint @pow_fp, @pow_fp_arg_0, @pow_fp_arg_1, @pow_fp_res_0
spirv.ARM.Graph @pow_fp(%arg0: !spirv.arm.tensor<1x52x53xf16>, %arg1: !spirv.arm.tensor<44x52x53xf16>) -> (!spirv.arm.tensor<44x52x53xf16>) {
// CHECK: {{%.*}} = spirv.Tosa.Pow %arg0, %arg1 : !spirv.arm.tensor<1x52x53xf16>, !spirv.arm.tensor<44x52x53xf16> -> !spirv.arm.tensor<44x52x53xf16>
%0 = spirv.Tosa.Pow %arg0, %arg1 : !spirv.arm.tensor<1x52x53xf16>, !spirv.arm.tensor<44x52x53xf16> -> !spirv.arm.tensor<44x52x53xf16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<44x52x53xf16>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<44x52x53xf16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Sub - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @sub_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<6x10x6x6xi32>, UniformConstant>
spirv.GlobalVariable @sub_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x10x6x6xi32>, UniformConstant>
spirv.GlobalVariable @sub_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<6x10x6x6xi32>, UniformConstant>
spirv.ARM.GraphEntryPoint @sub_int, @sub_int_arg_0, @sub_int_arg_1, @sub_int_res_0
spirv.ARM.Graph @sub_int(%arg0: !spirv.arm.tensor<6x10x6x6xi32>, %arg1: !spirv.arm.tensor<1x10x6x6xi32>) -> (!spirv.arm.tensor<6x10x6x6xi32>) {
// CHECK: {{%.*}} = spirv.Tosa.Sub %arg0, %arg1 : !spirv.arm.tensor<6x10x6x6xi32>, !spirv.arm.tensor<1x10x6x6xi32> -> !spirv.arm.tensor<6x10x6x6xi32>
%0 = spirv.Tosa.Sub %arg0, %arg1 : !spirv.arm.tensor<6x10x6x6xi32>, !spirv.arm.tensor<1x10x6x6xi32> -> !spirv.arm.tensor<6x10x6x6xi32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<6x10x6x6xi32>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<6x10x6x6xi32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Sub - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @sub_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x10x13x12xf16>, UniformConstant>
spirv.GlobalVariable @sub_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<6x10x13x12xf16>, UniformConstant>
spirv.GlobalVariable @sub_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<6x10x13x12xf16>, UniformConstant>
spirv.ARM.GraphEntryPoint @sub_fp, @sub_fp_arg_0, @sub_fp_arg_1, @sub_fp_res_0
spirv.ARM.Graph @sub_fp(%arg0: !spirv.arm.tensor<1x10x13x12xf16>, %arg1: !spirv.arm.tensor<6x10x13x12xf16>) -> (!spirv.arm.tensor<6x10x13x12xf16>) {
// CHECK: {{%.*}} = spirv.Tosa.Sub %arg0, %arg1 : !spirv.arm.tensor<1x10x13x12xf16>, !spirv.arm.tensor<6x10x13x12xf16> -> !spirv.arm.tensor<6x10x13x12xf16>
%0 = spirv.Tosa.Sub %arg0, %arg1 : !spirv.arm.tensor<1x10x13x12xf16>, !spirv.arm.tensor<6x10x13x12xf16> -> !spirv.arm.tensor<6x10x13x12xf16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<6x10x13x12xf16>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<6x10x13x12xf16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Table - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @table_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<3x2x15x7xi8>, UniformConstant>
spirv.GlobalVariable @table_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<3x2x15x7xi8>, UniformConstant>
spirv.ARM.GraphEntryPoint @table_int, @table_int_arg_0, @table_int_res_0
spirv.ARM.Graph @table_int(%arg0: !spirv.arm.tensor<3x2x15x7xi8>) -> (!spirv.arm.tensor<3x2x15x7xi8>) {
%0 = spirv.ARM.GraphConstant {graph_constant_id = 0 : i32} : !spirv.arm.tensor<256xi8>
// CHECK: {{%.*}} = spirv.Tosa.Table %arg0, {{%.*}} : !spirv.arm.tensor<3x2x15x7xi8>, !spirv.arm.tensor<256xi8> -> !spirv.arm.tensor<3x2x15x7xi8>
%1 = spirv.Tosa.Table %arg0, %0 : !spirv.arm.tensor<3x2x15x7xi8>, !spirv.arm.tensor<256xi8> -> !spirv.arm.tensor<3x2x15x7xi8>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<3x2x15x7xi8>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<3x2x15x7xi8>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Abs - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @abs_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<5x1x4x4xi32>, UniformConstant>
spirv.GlobalVariable @abs_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<5x1x4x4xi32>, UniformConstant>
spirv.ARM.GraphEntryPoint @abs_int, @abs_int_arg_0, @abs_int_res_0
spirv.ARM.Graph @abs_int(%arg0: !spirv.arm.tensor<5x1x4x4xi32>) -> (!spirv.arm.tensor<5x1x4x4xi32>) {
// CHECK: {{%.*}} = spirv.Tosa.Abs %arg0 : !spirv.arm.tensor<5x1x4x4xi32> -> !spirv.arm.tensor<5x1x4x4xi32>
%0 = spirv.Tosa.Abs %arg0 : !spirv.arm.tensor<5x1x4x4xi32> -> !spirv.arm.tensor<5x1x4x4xi32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<5x1x4x4xi32>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<5x1x4x4xi32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Abs - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @abs_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<3x6x14x8xf16>, UniformConstant>
spirv.GlobalVariable @abs_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<3x6x14x8xf16>, UniformConstant>
spirv.ARM.GraphEntryPoint @abs_fp, @abs_fp_arg_0, @abs_fp_res_0
spirv.ARM.Graph @abs_fp(%arg0: !spirv.arm.tensor<3x6x14x8xf16>) -> (!spirv.arm.tensor<3x6x14x8xf16>) {
// CHECK: {{%.*}} = spirv.Tosa.Abs %arg0 : !spirv.arm.tensor<3x6x14x8xf16> -> !spirv.arm.tensor<3x6x14x8xf16>
%0 = spirv.Tosa.Abs %arg0 : !spirv.arm.tensor<3x6x14x8xf16> -> !spirv.arm.tensor<3x6x14x8xf16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<3x6x14x8xf16>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<3x6x14x8xf16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.BitwiseNot - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @bitwisenot_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<12x56x50xi32>, UniformConstant>
spirv.GlobalVariable @bitwisenot_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<12x56x50xi32>, UniformConstant>
spirv.ARM.GraphEntryPoint @bitwisenot_int, @bitwisenot_int_arg_0, @bitwisenot_int_res_0
spirv.ARM.Graph @bitwisenot_int(%arg0: !spirv.arm.tensor<12x56x50xi32>) -> (!spirv.arm.tensor<12x56x50xi32>) {
// CHECK: {{%.*}} = spirv.Tosa.BitwiseNot %arg0 : !spirv.arm.tensor<12x56x50xi32> -> !spirv.arm.tensor<12x56x50xi32>
%0 = spirv.Tosa.BitwiseNot %arg0 : !spirv.arm.tensor<12x56x50xi32> -> !spirv.arm.tensor<12x56x50xi32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<12x56x50xi32>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<12x56x50xi32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Ceil - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @ceil_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<46x55x53xf16>, UniformConstant>
spirv.GlobalVariable @ceil_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<46x55x53xf16>, UniformConstant>
spirv.ARM.GraphEntryPoint @ceil_fp, @ceil_fp_arg_0, @ceil_fp_res_0
spirv.ARM.Graph @ceil_fp(%arg0: !spirv.arm.tensor<46x55x53xf16>) -> (!spirv.arm.tensor<46x55x53xf16>) {
// CHECK: {{%.*}} = spirv.Tosa.Ceil %arg0 : !spirv.arm.tensor<46x55x53xf16> -> !spirv.arm.tensor<46x55x53xf16>
%0 = spirv.Tosa.Ceil %arg0 : !spirv.arm.tensor<46x55x53xf16> -> !spirv.arm.tensor<46x55x53xf16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<46x55x53xf16>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<46x55x53xf16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Clz - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @clz_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<14x10x7x5xi32>, UniformConstant>
spirv.GlobalVariable @clz_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<14x10x7x5xi32>, UniformConstant>
spirv.ARM.GraphEntryPoint @clz_int, @clz_int_arg_0, @clz_int_res_0
spirv.ARM.Graph @clz_int(%arg0: !spirv.arm.tensor<14x10x7x5xi32>) -> (!spirv.arm.tensor<14x10x7x5xi32>) {
// CHECK: {{%.*}} = spirv.Tosa.Clz %arg0 : !spirv.arm.tensor<14x10x7x5xi32> -> !spirv.arm.tensor<14x10x7x5xi32>
%0 = spirv.Tosa.Clz %arg0 : !spirv.arm.tensor<14x10x7x5xi32> -> !spirv.arm.tensor<14x10x7x5xi32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<14x10x7x5xi32>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<14x10x7x5xi32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Cos - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @cos_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<44x49x51xf32>, UniformConstant>
spirv.GlobalVariable @cos_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<44x49x51xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @cos_fp, @cos_fp_arg_0, @cos_fp_res_0
spirv.ARM.Graph @cos_fp(%arg0: !spirv.arm.tensor<44x49x51xf32>) -> (!spirv.arm.tensor<44x49x51xf32>) {
// CHECK: {{%.*}} = spirv.Tosa.Cos %arg0 : !spirv.arm.tensor<44x49x51xf32> -> !spirv.arm.tensor<44x49x51xf32>
%0 = spirv.Tosa.Cos %arg0 : !spirv.arm.tensor<44x49x51xf32> -> !spirv.arm.tensor<44x49x51xf32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<44x49x51xf32>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<44x49x51xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Exp - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @exp_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<37x53x47xf32>, UniformConstant>
spirv.GlobalVariable @exp_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<37x53x47xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @exp_fp, @exp_fp_arg_0, @exp_fp_res_0
spirv.ARM.Graph @exp_fp(%arg0: !spirv.arm.tensor<37x53x47xf32>) -> (!spirv.arm.tensor<37x53x47xf32>) {
// CHECK: {{%.*}} = spirv.Tosa.Exp %arg0 : !spirv.arm.tensor<37x53x47xf32> -> !spirv.arm.tensor<37x53x47xf32>
%0 = spirv.Tosa.Exp %arg0 : !spirv.arm.tensor<37x53x47xf32> -> !spirv.arm.tensor<37x53x47xf32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<37x53x47xf32>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<37x53x47xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Floor - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @floor_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<40x52x42xf32>, UniformConstant>
spirv.GlobalVariable @floor_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<40x52x42xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @floor_fp, @floor_fp_arg_0, @floor_fp_res_0
spirv.ARM.Graph @floor_fp(%arg0: !spirv.arm.tensor<40x52x42xf32>) -> (!spirv.arm.tensor<40x52x42xf32>) {
// CHECK: {{%.*}} = spirv.Tosa.Floor %arg0 : !spirv.arm.tensor<40x52x42xf32> -> !spirv.arm.tensor<40x52x42xf32>
%0 = spirv.Tosa.Floor %arg0 : !spirv.arm.tensor<40x52x42xf32> -> !spirv.arm.tensor<40x52x42xf32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<40x52x42xf32>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<40x52x42xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Log - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @log_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<45x43x36xf16>, UniformConstant>
spirv.GlobalVariable @log_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<45x43x36xf16>, UniformConstant>
spirv.ARM.GraphEntryPoint @log_fp, @log_fp_arg_0, @log_fp_res_0
spirv.ARM.Graph @log_fp(%arg0: !spirv.arm.tensor<45x43x36xf16>) -> (!spirv.arm.tensor<45x43x36xf16>) {
// CHECK: {{%.*}} = spirv.Tosa.Log %arg0 : !spirv.arm.tensor<45x43x36xf16> -> !spirv.arm.tensor<45x43x36xf16>
%0 = spirv.Tosa.Log %arg0 : !spirv.arm.tensor<45x43x36xf16> -> !spirv.arm.tensor<45x43x36xf16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<45x43x36xf16>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<45x43x36xf16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.LogicalNot - PRO-INT or PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @logicalnot_any_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<54x26x10xi1>, UniformConstant>
spirv.GlobalVariable @logicalnot_any_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<54x26x10xi1>, UniformConstant>
spirv.ARM.GraphEntryPoint @logicalnot_any, @logicalnot_any_arg_0, @logicalnot_any_res_0
spirv.ARM.Graph @logicalnot_any(%arg0: !spirv.arm.tensor<54x26x10xi1>) -> (!spirv.arm.tensor<54x26x10xi1>) {
// CHECK: {{%.*}} = spirv.Tosa.LogicalNot %arg0 : !spirv.arm.tensor<54x26x10xi1> -> !spirv.arm.tensor<54x26x10xi1>
%0 = spirv.Tosa.LogicalNot %arg0 : !spirv.arm.tensor<54x26x10xi1> -> !spirv.arm.tensor<54x26x10xi1>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<54x26x10xi1>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<54x26x10xi1>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Negate - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @negate_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<3x1x65540x1xi8>, UniformConstant>
spirv.GlobalVariable @negate_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<3x1x65540x1xi8>, UniformConstant>
spirv.ARM.GraphEntryPoint @negate_int, @negate_int_arg_0, @negate_int_res_0
spirv.ARM.Graph @negate_int(%arg0: !spirv.arm.tensor<3x1x65540x1xi8>) -> (!spirv.arm.tensor<3x1x65540x1xi8>) {
%0 = spirv.Constant dense<111> : !spirv.arm.tensor<1xi8>
%1 = spirv.Constant dense<-32> : !spirv.arm.tensor<1xi8>
// CHECK: {{%.*}} = spirv.Tosa.Negate %arg0, {{%.*}}, {{%.*}} : !spirv.arm.tensor<3x1x65540x1xi8>, !spirv.arm.tensor<1xi8>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<3x1x65540x1xi8>
%2 = spirv.Tosa.Negate %arg0, %0, %1 : !spirv.arm.tensor<3x1x65540x1xi8>, !spirv.arm.tensor<1xi8>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<3x1x65540x1xi8>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<3x1x65540x1xi8>
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<3x1x65540x1xi8>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Negate - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @negate_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<2x7x15x13xf16>, UniformConstant>
spirv.GlobalVariable @negate_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<2x7x15x13xf16>, UniformConstant>
spirv.ARM.GraphEntryPoint @negate_fp, @negate_fp_arg_0, @negate_fp_res_0
spirv.ARM.Graph @negate_fp(%arg0: !spirv.arm.tensor<2x7x15x13xf16>) -> (!spirv.arm.tensor<2x7x15x13xf16>) {
%0 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf16>
%1 = spirv.Constant dense<0.000000e+00> : !spirv.arm.tensor<1xf16>
// CHECK: {{%.*}} = spirv.Tosa.Negate %arg0, {{%.*}}, {{%.*}} : !spirv.arm.tensor<2x7x15x13xf16>, !spirv.arm.tensor<1xf16>, !spirv.arm.tensor<1xf16> -> !spirv.arm.tensor<2x7x15x13xf16>
%2 = spirv.Tosa.Negate %arg0, %0, %1 : !spirv.arm.tensor<2x7x15x13xf16>, !spirv.arm.tensor<1xf16>, !spirv.arm.tensor<1xf16> -> !spirv.arm.tensor<2x7x15x13xf16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<2x7x15x13xf16>
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<2x7x15x13xf16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Reciprocal - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @reciprocal_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<38x47x44xf32>, UniformConstant>
spirv.GlobalVariable @reciprocal_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<38x47x44xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @reciprocal_fp, @reciprocal_fp_arg_0, @reciprocal_fp_res_0
spirv.ARM.Graph @reciprocal_fp(%arg0: !spirv.arm.tensor<38x47x44xf32>) -> (!spirv.arm.tensor<38x47x44xf32>) {
// CHECK: {{%.*}} = spirv.Tosa.Reciprocal %arg0 : !spirv.arm.tensor<38x47x44xf32> -> !spirv.arm.tensor<38x47x44xf32>
%0 = spirv.Tosa.Reciprocal %arg0 : !spirv.arm.tensor<38x47x44xf32> -> !spirv.arm.tensor<38x47x44xf32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<38x47x44xf32>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<38x47x44xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Rsqrt - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @rsqrt_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<40x57x56xf32>, UniformConstant>
spirv.GlobalVariable @rsqrt_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<40x57x56xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @rsqrt_fp, @rsqrt_fp_arg_0, @rsqrt_fp_res_0
spirv.ARM.Graph @rsqrt_fp(%arg0: !spirv.arm.tensor<40x57x56xf32>) -> (!spirv.arm.tensor<40x57x56xf32>) {
// CHECK: {{%.*}} = spirv.Tosa.Rsqrt %arg0 : !spirv.arm.tensor<40x57x56xf32> -> !spirv.arm.tensor<40x57x56xf32>
%0 = spirv.Tosa.Rsqrt %arg0 : !spirv.arm.tensor<40x57x56xf32> -> !spirv.arm.tensor<40x57x56xf32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<40x57x56xf32>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<40x57x56xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Sin - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @sin_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<49x38x58xf16>, UniformConstant>
spirv.GlobalVariable @sin_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<49x38x58xf16>, UniformConstant>
spirv.ARM.GraphEntryPoint @sin_fp, @sin_fp_arg_0, @sin_fp_res_0
spirv.ARM.Graph @sin_fp(%arg0: !spirv.arm.tensor<49x38x58xf16>) -> (!spirv.arm.tensor<49x38x58xf16>) {
// CHECK: {{%.*}} = spirv.Tosa.Sin %arg0 : !spirv.arm.tensor<49x38x58xf16> -> !spirv.arm.tensor<49x38x58xf16>
%0 = spirv.Tosa.Sin %arg0 : !spirv.arm.tensor<49x38x58xf16> -> !spirv.arm.tensor<49x38x58xf16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<49x38x58xf16>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<49x38x58xf16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Select - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @select_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<4x1x4x5xi1>, UniformConstant>
spirv.GlobalVariable @select_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<4x6x4x5xi8>, UniformConstant>
spirv.GlobalVariable @select_int_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<4x6x4x5xi8>, UniformConstant>
spirv.GlobalVariable @select_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<4x6x4x5xi8>, UniformConstant>
spirv.ARM.GraphEntryPoint @select_int, @select_int_arg_0, @select_int_arg_1, @select_int_arg_2, @select_int_res_0
spirv.ARM.Graph @select_int(%arg0: !spirv.arm.tensor<4x1x4x5xi1>, %arg1: !spirv.arm.tensor<4x6x4x5xi8>, %arg2: !spirv.arm.tensor<4x6x4x5xi8>) -> (!spirv.arm.tensor<4x6x4x5xi8>) {
// CHECK: {{%.*}} = spirv.Tosa.Select %arg0, %arg1, %arg2 : !spirv.arm.tensor<4x1x4x5xi1>, !spirv.arm.tensor<4x6x4x5xi8>, !spirv.arm.tensor<4x6x4x5xi8> -> !spirv.arm.tensor<4x6x4x5xi8>
%0 = spirv.Tosa.Select %arg0, %arg1, %arg2 : !spirv.arm.tensor<4x1x4x5xi1>, !spirv.arm.tensor<4x6x4x5xi8>, !spirv.arm.tensor<4x6x4x5xi8> -> !spirv.arm.tensor<4x6x4x5xi8>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<4x6x4x5xi8>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<4x6x4x5xi8>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Select - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @select_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<9x2x15x8xi1>, UniformConstant>
spirv.GlobalVariable @select_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<9x2x15x8xf16>, UniformConstant>
spirv.GlobalVariable @select_fp_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<9x1x15x8xf16>, UniformConstant>
spirv.GlobalVariable @select_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<9x2x15x8xf16>, UniformConstant>
spirv.ARM.GraphEntryPoint @select_fp, @select_fp_arg_0, @select_fp_arg_1, @select_fp_arg_2, @select_fp_res_0
spirv.ARM.Graph @select_fp(%arg0: !spirv.arm.tensor<9x2x15x8xi1>, %arg1: !spirv.arm.tensor<9x2x15x8xf16>, %arg2: !spirv.arm.tensor<9x1x15x8xf16>) -> (!spirv.arm.tensor<9x2x15x8xf16>) {
// CHECK: {{%.*}} = spirv.Tosa.Select %arg0, %arg1, %arg2 : !spirv.arm.tensor<9x2x15x8xi1>, !spirv.arm.tensor<9x2x15x8xf16>, !spirv.arm.tensor<9x1x15x8xf16> -> !spirv.arm.tensor<9x2x15x8xf16>
%0 = spirv.Tosa.Select %arg0, %arg1, %arg2 : !spirv.arm.tensor<9x2x15x8xi1>, !spirv.arm.tensor<9x2x15x8xf16>, !spirv.arm.tensor<9x1x15x8xf16> -> !spirv.arm.tensor<9x2x15x8xf16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<9x2x15x8xf16>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<9x2x15x8xf16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Equal - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @equal_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<51x28x59xi32>, UniformConstant>
spirv.GlobalVariable @equal_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<51x1x59xi32>, UniformConstant>
spirv.GlobalVariable @equal_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<51x28x59xi1>, UniformConstant>
spirv.ARM.GraphEntryPoint @equal_int, @equal_int_arg_0, @equal_int_arg_1, @equal_int_res_0
spirv.ARM.Graph @equal_int(%arg0: !spirv.arm.tensor<51x28x59xi32>, %arg1: !spirv.arm.tensor<51x1x59xi32>) -> (!spirv.arm.tensor<51x28x59xi1>) {
// CHECK: {{%.*}} = spirv.Tosa.Equal %arg0, %arg1 : !spirv.arm.tensor<51x28x59xi32>, !spirv.arm.tensor<51x1x59xi32> -> !spirv.arm.tensor<51x28x59xi1>
%0 = spirv.Tosa.Equal %arg0, %arg1 : !spirv.arm.tensor<51x28x59xi32>, !spirv.arm.tensor<51x1x59xi32> -> !spirv.arm.tensor<51x28x59xi1>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<51x28x59xi1>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<51x28x59xi1>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Equal - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @equal_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<16x11x5x3xf32>, UniformConstant>
spirv.GlobalVariable @equal_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<16x1x5x3xf32>, UniformConstant>
spirv.GlobalVariable @equal_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<16x11x5x3xi1>, UniformConstant>
spirv.ARM.GraphEntryPoint @equal_fp, @equal_fp_arg_0, @equal_fp_arg_1, @equal_fp_res_0
spirv.ARM.Graph @equal_fp(%arg0: !spirv.arm.tensor<16x11x5x3xf32>, %arg1: !spirv.arm.tensor<16x1x5x3xf32>) -> (!spirv.arm.tensor<16x11x5x3xi1>) {
// CHECK: {{%.*}} = spirv.Tosa.Equal %arg0, %arg1 : !spirv.arm.tensor<16x11x5x3xf32>, !spirv.arm.tensor<16x1x5x3xf32> -> !spirv.arm.tensor<16x11x5x3xi1>
%0 = spirv.Tosa.Equal %arg0, %arg1 : !spirv.arm.tensor<16x11x5x3xf32>, !spirv.arm.tensor<16x1x5x3xf32> -> !spirv.arm.tensor<16x11x5x3xi1>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<16x11x5x3xi1>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<16x11x5x3xi1>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Greater - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @greater_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<11x10x10x2xi32>, UniformConstant>
spirv.GlobalVariable @greater_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<11x10x10x1xi32>, UniformConstant>
spirv.GlobalVariable @greater_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<11x10x10x2xi1>, UniformConstant>
spirv.ARM.GraphEntryPoint @greater_int, @greater_int_arg_0, @greater_int_arg_1, @greater_int_res_0
spirv.ARM.Graph @greater_int(%arg0: !spirv.arm.tensor<11x10x10x2xi32>, %arg1: !spirv.arm.tensor<11x10x10x1xi32>) -> (!spirv.arm.tensor<11x10x10x2xi1>) {
// CHECK: {{%.*}} = spirv.Tosa.Greater %arg0, %arg1 : !spirv.arm.tensor<11x10x10x2xi32>, !spirv.arm.tensor<11x10x10x1xi32> -> !spirv.arm.tensor<11x10x10x2xi1>
%0 = spirv.Tosa.Greater %arg0, %arg1 : !spirv.arm.tensor<11x10x10x2xi32>, !spirv.arm.tensor<11x10x10x1xi32> -> !spirv.arm.tensor<11x10x10x2xi1>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<11x10x10x2xi1>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<11x10x10x2xi1>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Greater - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @greater_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<6x3x12x4xf16>, UniformConstant>
spirv.GlobalVariable @greater_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<6x3x1x4xf16>, UniformConstant>
spirv.GlobalVariable @greater_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<6x3x12x4xi1>, UniformConstant>
spirv.ARM.GraphEntryPoint @greater_fp, @greater_fp_arg_0, @greater_fp_arg_1, @greater_fp_res_0
spirv.ARM.Graph @greater_fp(%arg0: !spirv.arm.tensor<6x3x12x4xf16>, %arg1: !spirv.arm.tensor<6x3x1x4xf16>) -> (!spirv.arm.tensor<6x3x12x4xi1>) {
// CHECK: {{%.*}} = spirv.Tosa.Greater %arg0, %arg1 : !spirv.arm.tensor<6x3x12x4xf16>, !spirv.arm.tensor<6x3x1x4xf16> -> !spirv.arm.tensor<6x3x12x4xi1>
%0 = spirv.Tosa.Greater %arg0, %arg1 : !spirv.arm.tensor<6x3x12x4xf16>, !spirv.arm.tensor<6x3x1x4xf16> -> !spirv.arm.tensor<6x3x12x4xi1>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<6x3x12x4xi1>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<6x3x12x4xi1>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.GreaterEqual - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @greaterequal_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<10x17x7x1xi32>, UniformConstant>
spirv.GlobalVariable @greaterequal_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<10x17x7x16xi32>, UniformConstant>
spirv.GlobalVariable @greaterequal_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<10x17x7x16xi1>, UniformConstant>
spirv.ARM.GraphEntryPoint @greaterequal_int, @greaterequal_int_arg_0, @greaterequal_int_arg_1, @greaterequal_int_res_0
spirv.ARM.Graph @greaterequal_int(%arg0: !spirv.arm.tensor<10x17x7x1xi32>, %arg1: !spirv.arm.tensor<10x17x7x16xi32>) -> (!spirv.arm.tensor<10x17x7x16xi1>) {
// CHECK: {{%.*}} = spirv.Tosa.GreaterEqual %arg0, %arg1 : !spirv.arm.tensor<10x17x7x1xi32>, !spirv.arm.tensor<10x17x7x16xi32> -> !spirv.arm.tensor<10x17x7x16xi1>
%0 = spirv.Tosa.GreaterEqual %arg0, %arg1 : !spirv.arm.tensor<10x17x7x1xi32>, !spirv.arm.tensor<10x17x7x16xi32> -> !spirv.arm.tensor<10x17x7x16xi1>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<10x17x7x16xi1>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<10x17x7x16xi1>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.GreaterEqual - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @greaterequal_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<3x17x6x3xf32>, UniformConstant>
spirv.GlobalVariable @greaterequal_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<1x17x6x3xf32>, UniformConstant>
spirv.GlobalVariable @greaterequal_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<3x17x6x3xi1>, UniformConstant>
spirv.ARM.GraphEntryPoint @greaterequal_fp, @greaterequal_fp_arg_0, @greaterequal_fp_arg_1, @greaterequal_fp_res_0
spirv.ARM.Graph @greaterequal_fp(%arg0: !spirv.arm.tensor<3x17x6x3xf32>, %arg1: !spirv.arm.tensor<1x17x6x3xf32>) -> (!spirv.arm.tensor<3x17x6x3xi1>) {
// CHECK: {{%.*}} = spirv.Tosa.GreaterEqual %arg0, %arg1 : !spirv.arm.tensor<3x17x6x3xf32>, !spirv.arm.tensor<1x17x6x3xf32> -> !spirv.arm.tensor<3x17x6x3xi1>
%0 = spirv.Tosa.GreaterEqual %arg0, %arg1 : !spirv.arm.tensor<3x17x6x3xf32>, !spirv.arm.tensor<1x17x6x3xf32> -> !spirv.arm.tensor<3x17x6x3xi1>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<3x17x6x3xi1>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<3x17x6x3xi1>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.ReduceAll - PRO-INT or PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @reduceall_any_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<18x22x23x12xi1>, UniformConstant>
spirv.GlobalVariable @reduceall_any_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<18x22x1x12xi1>, UniformConstant>
spirv.ARM.GraphEntryPoint @reduceall_any, @reduceall_any_arg_0, @reduceall_any_res_0
spirv.ARM.Graph @reduceall_any(%arg0: !spirv.arm.tensor<18x22x23x12xi1>) -> (!spirv.arm.tensor<18x22x1x12xi1>) {
// CHECK: {{%.*}} = spirv.Tosa.ReduceAll axis = 2, %arg0 : !spirv.arm.tensor<18x22x23x12xi1> -> !spirv.arm.tensor<18x22x1x12xi1>
%1 = spirv.Tosa.ReduceAll axis = 2, %arg0 : !spirv.arm.tensor<18x22x23x12xi1> -> !spirv.arm.tensor<18x22x1x12xi1>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<18x22x1x12xi1>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<18x22x1x12xi1>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.ReduceAny - PRO-INT or PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @reduceany_any_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<25x13x30x8xi1>, UniformConstant>
spirv.GlobalVariable @reduceany_any_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<25x13x1x8xi1>, UniformConstant>
spirv.ARM.GraphEntryPoint @reduceany_any, @reduceany_any_arg_0, @reduceany_any_res_0
spirv.ARM.Graph @reduceany_any(%arg0: !spirv.arm.tensor<25x13x30x8xi1>) -> (!spirv.arm.tensor<25x13x1x8xi1>) {
// CHECK: {{%.*}} = spirv.Tosa.ReduceAny axis = 2, %arg0 : !spirv.arm.tensor<25x13x30x8xi1> -> !spirv.arm.tensor<25x13x1x8xi1>
%1 = spirv.Tosa.ReduceAny axis = 2, %arg0 : !spirv.arm.tensor<25x13x30x8xi1> -> !spirv.arm.tensor<25x13x1x8xi1>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<25x13x1x8xi1>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<25x13x1x8xi1>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.ReduceMax - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @reducemax_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<8x30x12x3xi8>, UniformConstant>
spirv.GlobalVariable @reducemax_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<8x30x1x3xi8>, UniformConstant>
spirv.ARM.GraphEntryPoint @reducemax_int, @reducemax_int_arg_0, @reducemax_int_res_0
spirv.ARM.Graph @reducemax_int(%arg0: !spirv.arm.tensor<8x30x12x3xi8>) -> (!spirv.arm.tensor<8x30x1x3xi8>) {
// CHECK: {{%.*}} = spirv.Tosa.ReduceMax axis = 2, nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<8x30x12x3xi8> -> !spirv.arm.tensor<8x30x1x3xi8>
%2 = spirv.Tosa.ReduceMax axis = 2, nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<8x30x12x3xi8> -> !spirv.arm.tensor<8x30x1x3xi8>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<8x30x1x3xi8>
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<8x30x1x3xi8>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.ReduceMax - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @reducemax_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<16x20x10xf16>, UniformConstant>
spirv.GlobalVariable @reducemax_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<16x20x1xf16>, UniformConstant>
spirv.ARM.GraphEntryPoint @reducemax_fp, @reducemax_fp_arg_0, @reducemax_fp_res_0
spirv.ARM.Graph @reducemax_fp(%arg0: !spirv.arm.tensor<16x20x10xf16>) -> (!spirv.arm.tensor<16x20x1xf16>) {
// CHECK: {{%.*}} = spirv.Tosa.ReduceMax axis = 2, nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<16x20x10xf16> -> !spirv.arm.tensor<16x20x1xf16>
%2 = spirv.Tosa.ReduceMax axis = 2, nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<16x20x10xf16> -> !spirv.arm.tensor<16x20x1xf16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<16x20x1xf16>
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<16x20x1xf16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.ReduceMin - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @reducemin_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<2x5x5x1xi8>, UniformConstant>
spirv.GlobalVariable @reducemin_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<2x5x1x1xi8>, UniformConstant>
spirv.ARM.GraphEntryPoint @reducemin_int, @reducemin_int_arg_0, @reducemin_int_res_0
spirv.ARM.Graph @reducemin_int(%arg0: !spirv.arm.tensor<2x5x5x1xi8>) -> (!spirv.arm.tensor<2x5x1x1xi8>) {
// CHECK: {{%.*}} = spirv.Tosa.ReduceMin axis = 2, nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<2x5x5x1xi8> -> !spirv.arm.tensor<2x5x1x1xi8>
%2 = spirv.Tosa.ReduceMin axis = 2, nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<2x5x5x1xi8> -> !spirv.arm.tensor<2x5x1x1xi8>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<2x5x1x1xi8>
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<2x5x1x1xi8>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.ReduceMin - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @reducemin_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<27x10x25x9xf16>, UniformConstant>
spirv.GlobalVariable @reducemin_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<27x10x1x9xf16>, UniformConstant>
spirv.ARM.GraphEntryPoint @reducemin_fp, @reducemin_fp_arg_0, @reducemin_fp_res_0
spirv.ARM.Graph @reducemin_fp(%arg0: !spirv.arm.tensor<27x10x25x9xf16>) -> (!spirv.arm.tensor<27x10x1x9xf16>) {
// CHECK: {{%.*}} = spirv.Tosa.ReduceMin axis = 2, nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<27x10x25x9xf16> -> !spirv.arm.tensor<27x10x1x9xf16>
%2 = spirv.Tosa.ReduceMin axis = 2, nan_mode = <Propagate>, %arg0 : !spirv.arm.tensor<27x10x25x9xf16> -> !spirv.arm.tensor<27x10x1x9xf16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<27x10x1x9xf16>
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<27x10x1x9xf16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.ReduceProduct - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @reduceproduct_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<2x16x25xf16>, UniformConstant>
spirv.GlobalVariable @reduceproduct_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<2x16x1xf16>, UniformConstant>
spirv.ARM.GraphEntryPoint @reduceproduct_fp, @reduceproduct_fp_arg_0, @reduceproduct_fp_res_0
spirv.ARM.Graph @reduceproduct_fp(%arg0: !spirv.arm.tensor<2x16x25xf16>) -> (!spirv.arm.tensor<2x16x1xf16>) {
// CHECK: {{%.*}} = spirv.Tosa.ReduceProduct axis = 2, %arg0 : !spirv.arm.tensor<2x16x25xf16> -> !spirv.arm.tensor<2x16x1xf16>
%1 = spirv.Tosa.ReduceProduct axis = 2, %arg0 : !spirv.arm.tensor<2x16x25xf16> -> !spirv.arm.tensor<2x16x1xf16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<2x16x1xf16>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<2x16x1xf16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.ReduceSum - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @reducesum_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<20x24x22xi32>, UniformConstant>
spirv.GlobalVariable @reducesum_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<20x1x22xi32>, UniformConstant>
spirv.ARM.GraphEntryPoint @reducesum_int, @reducesum_int_arg_0, @reducesum_int_res_0
spirv.ARM.Graph @reducesum_int(%arg0: !spirv.arm.tensor<20x24x22xi32>) -> (!spirv.arm.tensor<20x1x22xi32>) {
// CHECK: {{%.*}} = spirv.Tosa.ReduceSum axis = 1, %arg0 : !spirv.arm.tensor<20x24x22xi32> -> !spirv.arm.tensor<20x1x22xi32>
%1 = spirv.Tosa.ReduceSum axis = 1, %arg0 : !spirv.arm.tensor<20x24x22xi32> -> !spirv.arm.tensor<20x1x22xi32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<20x1x22xi32>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<20x1x22xi32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.ReduceSum - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @reducesum_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<32x32x33xf32>, UniformConstant>
spirv.GlobalVariable @reducesum_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<32x1x33xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @reducesum_fp, @reducesum_fp_arg_0, @reducesum_fp_res_0
spirv.ARM.Graph @reducesum_fp(%arg0: !spirv.arm.tensor<32x32x33xf32>) -> (!spirv.arm.tensor<32x1x33xf32>) {
// CHECK: {{%.*}} = spirv.Tosa.ReduceSum axis = 1, %arg0 : !spirv.arm.tensor<32x32x33xf32> -> !spirv.arm.tensor<32x1x33xf32>
%1 = spirv.Tosa.ReduceSum axis = 1, %arg0 : !spirv.arm.tensor<32x32x33xf32> -> !spirv.arm.tensor<32x1x33xf32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<32x1x33xf32>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<32x1x33xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Concat - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @concat_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<12x13x3x14xi8>, UniformConstant>
spirv.GlobalVariable @concat_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<12x13x3x14xi8>, UniformConstant>
spirv.GlobalVariable @concat_int_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<12x13x3x14xi8>, UniformConstant>
spirv.GlobalVariable @concat_int_arg_3 bind(0, 3) : !spirv.ptr<!spirv.arm.tensor<12x13x3x14xi8>, UniformConstant>
spirv.GlobalVariable @concat_int_res_0 bind(0, 4) : !spirv.ptr<!spirv.arm.tensor<12x13x12x14xi8>, UniformConstant>
spirv.ARM.GraphEntryPoint @concat_int, @concat_int_arg_0, @concat_int_arg_1, @concat_int_arg_2, @concat_int_arg_3, @concat_int_res_0
spirv.ARM.Graph @concat_int(%arg0: !spirv.arm.tensor<12x13x3x14xi8>, %arg1: !spirv.arm.tensor<12x13x3x14xi8>, %arg2: !spirv.arm.tensor<12x13x3x14xi8>, %arg3: !spirv.arm.tensor<12x13x3x14xi8>) -> (!spirv.arm.tensor<12x13x12x14xi8>) {
// CHECK: {{%.*}} = spirv.Tosa.Concat axis = 2, %arg0, %arg1, %arg2, %arg3 : !spirv.arm.tensor<12x13x3x14xi8>, !spirv.arm.tensor<12x13x3x14xi8>, !spirv.arm.tensor<12x13x3x14xi8>, !spirv.arm.tensor<12x13x3x14xi8> -> !spirv.arm.tensor<12x13x12x14xi8>
%1 = spirv.Tosa.Concat axis = 2, %arg0, %arg1, %arg2, %arg3 : !spirv.arm.tensor<12x13x3x14xi8>, !spirv.arm.tensor<12x13x3x14xi8>, !spirv.arm.tensor<12x13x3x14xi8>, !spirv.arm.tensor<12x13x3x14xi8> -> !spirv.arm.tensor<12x13x12x14xi8>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<12x13x12x14xi8>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<12x13x12x14xi8>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Concat - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @concat_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<40x31x19xf32>, UniformConstant>
spirv.GlobalVariable @concat_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<40x15x19xf32>, UniformConstant>
spirv.GlobalVariable @concat_fp_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<40x16x19xf32>, UniformConstant>
spirv.GlobalVariable @concat_fp_res_0 bind(0, 3) : !spirv.ptr<!spirv.arm.tensor<40x62x19xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @concat_fp, @concat_fp_arg_0, @concat_fp_arg_1, @concat_fp_arg_2, @concat_fp_res_0
spirv.ARM.Graph @concat_fp(%arg0: !spirv.arm.tensor<40x31x19xf32>, %arg1: !spirv.arm.tensor<40x15x19xf32>, %arg2: !spirv.arm.tensor<40x16x19xf32>) -> (!spirv.arm.tensor<40x62x19xf32>) {
// CHECK: {{%.*}} = spirv.Tosa.Concat axis = 1, %arg0, %arg1, %arg2 : !spirv.arm.tensor<40x31x19xf32>, !spirv.arm.tensor<40x15x19xf32>, !spirv.arm.tensor<40x16x19xf32> -> !spirv.arm.tensor<40x62x19xf32>
%1 = spirv.Tosa.Concat axis = 1, %arg0, %arg1, %arg2 : !spirv.arm.tensor<40x31x19xf32>, !spirv.arm.tensor<40x15x19xf32>, !spirv.arm.tensor<40x16x19xf32> -> !spirv.arm.tensor<40x62x19xf32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<40x62x19xf32>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<40x62x19xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Pad - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @pad_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<4x7xi8>, UniformConstant>
spirv.GlobalVariable @pad_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<21x19xi8>, UniformConstant>
spirv.ARM.GraphEntryPoint @pad_int, @pad_int_arg_0, @pad_int_res_0
spirv.ARM.Graph @pad_int(%arg0: !spirv.arm.tensor<4x7xi8>) -> (!spirv.arm.tensor<21x19xi8>) {
%0 = spirv.Constant dense<[10, 7, 6, 6]> : !spirv.arm.tensor<4xi32>
%1 = spirv.Constant dense<-76> : !spirv.arm.tensor<1xi8>
// CHECK: {{%.*}} = spirv.Tosa.Pad %arg0, {{%.*}}, {{%.*}} : !spirv.arm.tensor<4x7xi8>, !spirv.arm.tensor<4xi32>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<21x19xi8>
%2 = spirv.Tosa.Pad %arg0, %0, %1 : !spirv.arm.tensor<4x7xi8>, !spirv.arm.tensor<4xi32>, !spirv.arm.tensor<1xi8> -> !spirv.arm.tensor<21x19xi8>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<21x19xi8>
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<21x19xi8>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Pad - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @pad_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<2x9x2x3xf32>, UniformConstant>
spirv.GlobalVariable @pad_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<4x9x4x4xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @pad_fp, @pad_fp_arg_0, @pad_fp_res_0
spirv.ARM.Graph @pad_fp(%arg0: !spirv.arm.tensor<2x9x2x3xf32>) -> (!spirv.arm.tensor<4x9x4x4xf32>) {
%0 = spirv.Constant dense<[1, 1, 0, 0, 1, 1, 0, 1]> : !spirv.arm.tensor<8xi32>
%1 = spirv.Constant dense<1.21630913E+38> : !spirv.arm.tensor<1xf32>
// CHECK: {{%.*}} = spirv.Tosa.Pad %arg0, {{%.*}}, {{%.*}} : !spirv.arm.tensor<2x9x2x3xf32>, !spirv.arm.tensor<8xi32>, !spirv.arm.tensor<1xf32> -> !spirv.arm.tensor<4x9x4x4xf32>
%2 = spirv.Tosa.Pad %arg0, %0, %1 : !spirv.arm.tensor<2x9x2x3xf32>, !spirv.arm.tensor<8xi32>, !spirv.arm.tensor<1xf32> -> !spirv.arm.tensor<4x9x4x4xf32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<4x9x4x4xf32>
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<4x9x4x4xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Reshape - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @reshape_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<25x6x29x35xi16>, UniformConstant>
spirv.GlobalVariable @reshape_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<125x6x7x29xi16>, UniformConstant>
spirv.ARM.GraphEntryPoint @reshape_int, @reshape_int_arg_0, @reshape_int_res_0
spirv.ARM.Graph @reshape_int(%arg0: !spirv.arm.tensor<25x6x29x35xi16>) -> (!spirv.arm.tensor<125x6x7x29xi16>) {
%0 = spirv.Constant dense<[125, 6, 7, 29]> : !spirv.arm.tensor<4xi32>
// CHECK: {{%.*}} = spirv.Tosa.Reshape %arg0, {{%.*}} : !spirv.arm.tensor<25x6x29x35xi16>, !spirv.arm.tensor<4xi32> -> !spirv.arm.tensor<125x6x7x29xi16>
%1 = spirv.Tosa.Reshape %arg0, %0 : !spirv.arm.tensor<25x6x29x35xi16>, !spirv.arm.tensor<4xi32> -> !spirv.arm.tensor<125x6x7x29xi16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<125x6x7x29xi16>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<125x6x7x29xi16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Reshape - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @reshape_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x2x7x2xf32>, UniformConstant>
spirv.GlobalVariable @reshape_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<2x1x14xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @reshape_fp, @reshape_fp_arg_0, @reshape_fp_res_0
spirv.ARM.Graph @reshape_fp(%arg0: !spirv.arm.tensor<1x2x7x2xf32>) -> (!spirv.arm.tensor<2x1x14xf32>) {
%0 = spirv.Constant dense<[2, 1, 14]> : !spirv.arm.tensor<3xi32>
// CHECK: {{%.*}} = spirv.Tosa.Reshape %arg0, {{%.*}} : !spirv.arm.tensor<1x2x7x2xf32>, !spirv.arm.tensor<3xi32> -> !spirv.arm.tensor<2x1x14xf32>
%1 = spirv.Tosa.Reshape %arg0, %0 : !spirv.arm.tensor<1x2x7x2xf32>, !spirv.arm.tensor<3xi32> -> !spirv.arm.tensor<2x1x14xf32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<2x1x14xf32>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<2x1x14xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Reverse - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @reverse_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<20x5x28x31xi32>, UniformConstant>
spirv.GlobalVariable @reverse_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<20x5x28x31xi32>, UniformConstant>
spirv.ARM.GraphEntryPoint @reverse_int, @reverse_int_arg_0, @reverse_int_res_0
spirv.ARM.Graph @reverse_int(%arg0: !spirv.arm.tensor<20x5x28x31xi32>) -> (!spirv.arm.tensor<20x5x28x31xi32>) {
// CHECK: {{%.*}} = spirv.Tosa.Reverse axis = 2, %arg0 : !spirv.arm.tensor<20x5x28x31xi32> -> !spirv.arm.tensor<20x5x28x31xi32>
%1 = spirv.Tosa.Reverse axis = 2, %arg0 : !spirv.arm.tensor<20x5x28x31xi32> -> !spirv.arm.tensor<20x5x28x31xi32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<20x5x28x31xi32>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<20x5x28x31xi32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Reverse - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @reverse_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<21x34x47xf32>, UniformConstant>
spirv.GlobalVariable @reverse_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<21x34x47xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @reverse_fp, @reverse_fp_arg_0, @reverse_fp_res_0
spirv.ARM.Graph @reverse_fp(%arg0: !spirv.arm.tensor<21x34x47xf32>) -> (!spirv.arm.tensor<21x34x47xf32>) {
// CHECK: {{%.*}} = spirv.Tosa.Reverse axis = 1, %arg0 : !spirv.arm.tensor<21x34x47xf32> -> !spirv.arm.tensor<21x34x47xf32>
%1 = spirv.Tosa.Reverse axis = 1, %arg0 : !spirv.arm.tensor<21x34x47xf32> -> !spirv.arm.tensor<21x34x47xf32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<21x34x47xf32>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<21x34x47xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Slice - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @slice_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<32x19x41xi8>, UniformConstant>
spirv.GlobalVariable @slice_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<21x5x2xi8>, UniformConstant>
spirv.ARM.GraphEntryPoint @slice_int, @slice_int_arg_0, @slice_int_res_0
spirv.ARM.Graph @slice_int(%arg0: !spirv.arm.tensor<32x19x41xi8>) -> (!spirv.arm.tensor<21x5x2xi8>) {
%0 = spirv.Constant dense<[8, 11, 39]> : !spirv.arm.tensor<3xi32>
%1 = spirv.Constant dense<[21, 5, 2]> : !spirv.arm.tensor<3xi32>
// CHECK: {{%.*}} = spirv.Tosa.Slice %arg0, {{%.*}}, {{%.*}} : !spirv.arm.tensor<32x19x41xi8>, !spirv.arm.tensor<3xi32>, !spirv.arm.tensor<3xi32> -> !spirv.arm.tensor<21x5x2xi8>
%2 = spirv.Tosa.Slice %arg0, %0, %1 : !spirv.arm.tensor<32x19x41xi8>, !spirv.arm.tensor<3xi32>, !spirv.arm.tensor<3xi32> -> !spirv.arm.tensor<21x5x2xi8>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<21x5x2xi8>
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<21x5x2xi8>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Slice - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @slice_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<30x45x29xf32>, UniformConstant>
spirv.GlobalVariable @slice_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<5x12x11xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @slice_fp, @slice_fp_arg_0, @slice_fp_res_0
spirv.ARM.Graph @slice_fp(%arg0: !spirv.arm.tensor<30x45x29xf32>) -> (!spirv.arm.tensor<5x12x11xf32>) {
%0 = spirv.Constant dense<[21, 20, 10]> : !spirv.arm.tensor<3xi32>
%1 = spirv.Constant dense<[5, 12, 11]> : !spirv.arm.tensor<3xi32>
// CHECK: {{%.*}} = spirv.Tosa.Slice %arg0, {{%.*}}, {{%.*}} : !spirv.arm.tensor<30x45x29xf32>, !spirv.arm.tensor<3xi32>, !spirv.arm.tensor<3xi32> -> !spirv.arm.tensor<5x12x11xf32>
%2 = spirv.Tosa.Slice %arg0, %0, %1 : !spirv.arm.tensor<30x45x29xf32>, !spirv.arm.tensor<3xi32>, !spirv.arm.tensor<3xi32> -> !spirv.arm.tensor<5x12x11xf32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<5x12x11xf32>
spirv.ARM.GraphOutputs %2 : !spirv.arm.tensor<5x12x11xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Tile - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @tile_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<10x28x21xi16>, UniformConstant>
spirv.GlobalVariable @tile_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<10x28x63xi16>, UniformConstant>
spirv.ARM.GraphEntryPoint @tile_int, @tile_int_arg_0, @tile_int_res_0
spirv.ARM.Graph @tile_int(%arg0: !spirv.arm.tensor<10x28x21xi16>) -> (!spirv.arm.tensor<10x28x63xi16>) {
%0 = spirv.Constant dense<[1, 1, 3]> : !spirv.arm.tensor<3xi32>
// CHECK: {{%.*}} = spirv.Tosa.Tile %arg0, {{%.*}} : !spirv.arm.tensor<10x28x21xi16>, !spirv.arm.tensor<3xi32> -> !spirv.arm.tensor<10x28x63xi16>
%1 = spirv.Tosa.Tile %arg0, %0 : !spirv.arm.tensor<10x28x21xi16>, !spirv.arm.tensor<3xi32> -> !spirv.arm.tensor<10x28x63xi16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<10x28x63xi16>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<10x28x63xi16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Tile - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @tile_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<31x19x5xf16>, UniformConstant>
spirv.GlobalVariable @tile_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<62x57x10xf16>, UniformConstant>
spirv.ARM.GraphEntryPoint @tile_fp, @tile_fp_arg_0, @tile_fp_res_0
spirv.ARM.Graph @tile_fp(%arg0: !spirv.arm.tensor<31x19x5xf16>) -> (!spirv.arm.tensor<62x57x10xf16>) {
%0 = spirv.Constant dense<[2, 3, 2]> : !spirv.arm.tensor<3xi32>
// CHECK: {{%.*}} = spirv.Tosa.Tile %arg0, {{%.*}} : !spirv.arm.tensor<31x19x5xf16>, !spirv.arm.tensor<3xi32> -> !spirv.arm.tensor<62x57x10xf16>
%1 = spirv.Tosa.Tile %arg0, %0 : !spirv.arm.tensor<31x19x5xf16>, !spirv.arm.tensor<3xi32> -> !spirv.arm.tensor<62x57x10xf16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<62x57x10xf16>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<62x57x10xf16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Transpose - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @transpose_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<14x28x1x61xi16>, UniformConstant>
spirv.GlobalVariable @transpose_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x14x28x61xi16>, UniformConstant>
spirv.ARM.GraphEntryPoint @transpose_int, @transpose_int_arg_0, @transpose_int_res_0
spirv.ARM.Graph @transpose_int(%arg0: !spirv.arm.tensor<14x28x1x61xi16>) -> (!spirv.arm.tensor<1x14x28x61xi16>) {
// CHECK: {{%.*}} = spirv.Tosa.Transpose perms = [2, 0, 1, 3], %arg0 : !spirv.arm.tensor<14x28x1x61xi16> -> !spirv.arm.tensor<1x14x28x61xi16>
%1 = spirv.Tosa.Transpose perms = [2, 0, 1, 3], %arg0 : !spirv.arm.tensor<14x28x1x61xi16> -> !spirv.arm.tensor<1x14x28x61xi16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<1x14x28x61xi16>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<1x14x28x61xi16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Transpose - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @transpose_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<42x22x49xi1>, UniformConstant>
spirv.GlobalVariable @transpose_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<49x42x22xi1>, UniformConstant>
spirv.ARM.GraphEntryPoint @transpose_fp, @transpose_fp_arg_0, @transpose_fp_res_0
spirv.ARM.Graph @transpose_fp(%arg0: !spirv.arm.tensor<42x22x49xi1>) -> (!spirv.arm.tensor<49x42x22xi1>) {
// CHECK: {{%.*}} = spirv.Tosa.Transpose perms = [2, 0, 1], %arg0 : !spirv.arm.tensor<42x22x49xi1> -> !spirv.arm.tensor<49x42x22xi1>
%1 = spirv.Tosa.Transpose perms = [2, 0, 1], %arg0 : !spirv.arm.tensor<42x22x49xi1> -> !spirv.arm.tensor<49x42x22xi1>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<49x42x22xi1>
spirv.ARM.GraphOutputs %1 : !spirv.arm.tensor<49x42x22xi1>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Gather - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @gather_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<31x11x45xi32>, UniformConstant>
spirv.GlobalVariable @gather_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<31x15xi32>, UniformConstant>
spirv.GlobalVariable @gather_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<31x15x45xi32>, UniformConstant>
spirv.ARM.GraphEntryPoint @gather_int, @gather_int_arg_0, @gather_int_arg_1, @gather_int_res_0
spirv.ARM.Graph @gather_int(%arg0: !spirv.arm.tensor<31x11x45xi32>, %arg1: !spirv.arm.tensor<31x15xi32>) -> (!spirv.arm.tensor<31x15x45xi32>) {
// CHECK: {{%.*}} = spirv.Tosa.Gather %arg0, %arg1 : !spirv.arm.tensor<31x11x45xi32>, !spirv.arm.tensor<31x15xi32> -> !spirv.arm.tensor<31x15x45xi32>
%0 = spirv.Tosa.Gather %arg0, %arg1 : !spirv.arm.tensor<31x11x45xi32>, !spirv.arm.tensor<31x15xi32> -> !spirv.arm.tensor<31x15x45xi32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<31x15x45xi32>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<31x15x45xi32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Gather - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @gather_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<59x61x19xf32>, UniformConstant>
spirv.GlobalVariable @gather_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<59x65xi32>, UniformConstant>
spirv.GlobalVariable @gather_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<59x65x19xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @gather_fp, @gather_fp_arg_0, @gather_fp_arg_1, @gather_fp_res_0
spirv.ARM.Graph @gather_fp(%arg0: !spirv.arm.tensor<59x61x19xf32>, %arg1: !spirv.arm.tensor<59x65xi32>) -> (!spirv.arm.tensor<59x65x19xf32>) {
// CHECK: {{%.*}} = spirv.Tosa.Gather %arg0, %arg1 : !spirv.arm.tensor<59x61x19xf32>, !spirv.arm.tensor<59x65xi32> -> !spirv.arm.tensor<59x65x19xf32>
%0 = spirv.Tosa.Gather %arg0, %arg1 : !spirv.arm.tensor<59x61x19xf32>, !spirv.arm.tensor<59x65xi32> -> !spirv.arm.tensor<59x65x19xf32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<59x65x19xf32>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<59x65x19xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Scatter - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @scatter_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<34x28x54xi32>, UniformConstant>
spirv.GlobalVariable @scatter_int_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<34x18xi32>, UniformConstant>
spirv.GlobalVariable @scatter_int_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<34x18x54xi32>, UniformConstant>
spirv.GlobalVariable @scatter_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<34x28x54xi32>, UniformConstant>
spirv.ARM.GraphEntryPoint @scatter_int, @scatter_int_arg_0, @scatter_int_arg_1, @scatter_int_arg_2, @scatter_int_res_0
spirv.ARM.Graph @scatter_int(%arg0: !spirv.arm.tensor<34x28x54xi32>, %arg1: !spirv.arm.tensor<34x18xi32>, %arg2: !spirv.arm.tensor<34x18x54xi32>) -> (!spirv.arm.tensor<34x28x54xi32>) {
// CHECK: {{%.*}} = spirv.Tosa.Scatter %arg0, %arg1, %arg2 : !spirv.arm.tensor<34x28x54xi32>, !spirv.arm.tensor<34x18xi32>, !spirv.arm.tensor<34x18x54xi32> -> !spirv.arm.tensor<34x28x54xi32>
%0 = spirv.Tosa.Scatter %arg0, %arg1, %arg2 : !spirv.arm.tensor<34x28x54xi32>, !spirv.arm.tensor<34x18xi32>, !spirv.arm.tensor<34x18x54xi32> -> !spirv.arm.tensor<34x28x54xi32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<34x28x54xi32>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<34x28x54xi32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Scatter - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @scatter_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<18x34x25xf16>, UniformConstant>
spirv.GlobalVariable @scatter_fp_arg_1 bind(0, 1) : !spirv.ptr<!spirv.arm.tensor<18x20xi32>, UniformConstant>
spirv.GlobalVariable @scatter_fp_arg_2 bind(0, 2) : !spirv.ptr<!spirv.arm.tensor<18x20x25xf16>, UniformConstant>
spirv.GlobalVariable @scatter_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<18x34x25xf16>, UniformConstant>
spirv.ARM.GraphEntryPoint @scatter_fp, @scatter_fp_arg_0, @scatter_fp_arg_1, @scatter_fp_arg_2, @scatter_fp_res_0
spirv.ARM.Graph @scatter_fp(%arg0: !spirv.arm.tensor<18x34x25xf16>, %arg1: !spirv.arm.tensor<18x20xi32>, %arg2: !spirv.arm.tensor<18x20x25xf16>) -> (!spirv.arm.tensor<18x34x25xf16>) {
// CHECK: {{%.*}} = spirv.Tosa.Scatter %arg0, %arg1, %arg2 : !spirv.arm.tensor<18x34x25xf16>, !spirv.arm.tensor<18x20xi32>, !spirv.arm.tensor<18x20x25xf16> -> !spirv.arm.tensor<18x34x25xf16>
%0 = spirv.Tosa.Scatter %arg0, %arg1, %arg2 : !spirv.arm.tensor<18x34x25xf16>, !spirv.arm.tensor<18x20xi32>, !spirv.arm.tensor<18x20x25xf16> -> !spirv.arm.tensor<18x34x25xf16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<18x34x25xf16>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<18x34x25xf16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Resize - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @resize_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x1x31x55xi8>, UniformConstant>
spirv.GlobalVariable @resize_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x1x278x55xi8>, UniformConstant>
spirv.ARM.GraphEntryPoint @resize_int, @resize_int_arg_0, @resize_int_res_0
spirv.ARM.Graph @resize_int(%arg0: !spirv.arm.tensor<1x1x31x55xi8>) -> (!spirv.arm.tensor<1x1x278x55xi8>) {
%1 = spirv.Constant dense<[16, 1, 9, 1]> : !spirv.arm.tensor<4xi32>
%2 = spirv.Constant dense<0> : !spirv.arm.tensor<2xi32>
%3 = spirv.Constant dense<[0, 7]> : !spirv.arm.tensor<2xi32>
// CHECK: {{%.*}} = spirv.Tosa.Resize mode = <NearestNeighbor>, %arg0, {{%.*}}, {{%.*}}, {{%.*}} : !spirv.arm.tensor<1x1x31x55xi8>, !spirv.arm.tensor<4xi32>, !spirv.arm.tensor<2xi32>, !spirv.arm.tensor<2xi32> -> !spirv.arm.tensor<1x1x278x55xi8>
%4 = spirv.Tosa.Resize mode = <NearestNeighbor>, %arg0, %1, %2, %3 : !spirv.arm.tensor<1x1x31x55xi8>, !spirv.arm.tensor<4xi32>, !spirv.arm.tensor<2xi32>, !spirv.arm.tensor<2xi32> -> !spirv.arm.tensor<1x1x278x55xi8>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<1x1x278x55xi8>
spirv.ARM.GraphOutputs %4 : !spirv.arm.tensor<1x1x278x55xi8>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Resize - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @resize_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x48x33x63xf32>, UniformConstant>
spirv.GlobalVariable @resize_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x753x297x63xf32>, UniformConstant>
spirv.ARM.GraphEntryPoint @resize_fp, @resize_fp_arg_0, @resize_fp_res_0
spirv.ARM.Graph @resize_fp(%arg0: !spirv.arm.tensor<1x48x33x63xf32>) -> (!spirv.arm.tensor<1x753x297x63xf32>) {
%1 = spirv.Constant dense<[16, 1, 9, 1]> : !spirv.arm.tensor<4xi32>
%2 = spirv.Constant dense<0> : !spirv.arm.tensor<2xi32>
%3 = spirv.Constant dense<[0, 8]> : !spirv.arm.tensor<2xi32>
// CHECK: {{%.*}} = spirv.Tosa.Resize mode = <Bilinear>, %arg0, {{%.*}}, {{%.*}}, {{%.*}} : !spirv.arm.tensor<1x48x33x63xf32>, !spirv.arm.tensor<4xi32>, !spirv.arm.tensor<2xi32>, !spirv.arm.tensor<2xi32> -> !spirv.arm.tensor<1x753x297x63xf32>
%4 = spirv.Tosa.Resize mode = <Bilinear>, %arg0, %1, %2, %3 : !spirv.arm.tensor<1x48x33x63xf32>, !spirv.arm.tensor<4xi32>, !spirv.arm.tensor<2xi32>, !spirv.arm.tensor<2xi32> -> !spirv.arm.tensor<1x753x297x63xf32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<1x753x297x63xf32>
spirv.ARM.GraphOutputs %4 : !spirv.arm.tensor<1x753x297x63xf32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Cast - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @cast_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<1x65538x1x2xi8>, UniformConstant>
spirv.GlobalVariable @cast_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<1x65538x1x2xi32>, UniformConstant>
spirv.ARM.GraphEntryPoint @cast_int, @cast_int_arg_0, @cast_int_res_0
spirv.ARM.Graph @cast_int(%arg0: !spirv.arm.tensor<1x65538x1x2xi8>) -> (!spirv.arm.tensor<1x65538x1x2xi32>) {
// CHECK: {{%.*}} = spirv.Tosa.Cast %arg0 : !spirv.arm.tensor<1x65538x1x2xi8> -> !spirv.arm.tensor<1x65538x1x2xi32>
%0 = spirv.Tosa.Cast %arg0 : !spirv.arm.tensor<1x65538x1x2xi8> -> !spirv.arm.tensor<1x65538x1x2xi32>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<1x65538x1x2xi32>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<1x65538x1x2xi32>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Cast - PRO-FP
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @cast_fp_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<11x5x14x4xf32>, UniformConstant>
spirv.GlobalVariable @cast_fp_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<11x5x14x4xf16>, UniformConstant>
spirv.ARM.GraphEntryPoint @cast_fp, @cast_fp_arg_0, @cast_fp_res_0
spirv.ARM.Graph @cast_fp(%arg0: !spirv.arm.tensor<11x5x14x4xf32>) -> (!spirv.arm.tensor<11x5x14x4xf16>) {
// CHECK: {{%.*}} = spirv.Tosa.Cast %arg0 : !spirv.arm.tensor<11x5x14x4xf32> -> !spirv.arm.tensor<11x5x14x4xf16>
%0 = spirv.Tosa.Cast %arg0 : !spirv.arm.tensor<11x5x14x4xf32> -> !spirv.arm.tensor<11x5x14x4xf16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<11x5x14x4xf16>
spirv.ARM.GraphOutputs %0 : !spirv.arm.tensor<11x5x14x4xf16>
}
}
// -----
//===----------------------------------------------------------------------===//
// spirv.TOSA.Rescale - PRO-INT
//===----------------------------------------------------------------------===//
// CHECK: spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]>
spirv.module Logical Vulkan requires #spirv.vce<v1.3, [VulkanMemoryModel, Shader, Int8, Int16, Int64, Float16, TensorsARM, GraphARM], [SPV_ARM_tensors, SPV_ARM_graph, SPV_KHR_vulkan_memory_model]> {
spirv.GlobalVariable @rescale_int_arg_0 bind(0, 0) : !spirv.ptr<!spirv.arm.tensor<17x29x19xi16>, UniformConstant>
spirv.GlobalVariable @rescale_int_res_0 bind(1, 0) : !spirv.ptr<!spirv.arm.tensor<17x29x19xi16>, UniformConstant>
spirv.ARM.GraphEntryPoint @rescale_int, @rescale_int_arg_0, @rescale_int_res_0
spirv.ARM.Graph @rescale_int(%arg0: !spirv.arm.tensor<17x29x19xi16>) -> (!spirv.arm.tensor<17x29x19xi16>) {
%5 = spirv.Constant dense<1866149760> : !spirv.arm.tensor<1xi32>
%6 = spirv.Constant dense<31> : !spirv.arm.tensor<1xi8>
%7 = spirv.Constant dense<0> : !spirv.arm.tensor<1xi16>
%8 = spirv.Constant dense<0> : !spirv.arm.tensor<1xi16>
// CHECK: {{%.*}} = spirv.Tosa.Rescale scale32 = true, rounding_mode = <DoubleRound>, per_channel = false, input_unsigned = false, output_unsigned = true, %arg0, {{%.*}}, {{%.*}}, {{%.*}}, {{%.*}} : !spirv.arm.tensor<17x29x19xi16>, !spirv.arm.tensor<1xi32>, !spirv.arm.tensor<1xi8>, !spirv.arm.tensor<1xi16>, !spirv.arm.tensor<1xi16> -> !spirv.arm.tensor<17x29x19xi16>
%9 = spirv.Tosa.Rescale scale32 = true, rounding_mode = <DoubleRound>, per_channel = false, input_unsigned = false, output_unsigned = true, %arg0, %5, %6, %7, %8 : !spirv.arm.tensor<17x29x19xi16>, !spirv.arm.tensor<1xi32>, !spirv.arm.tensor<1xi8>, !spirv.arm.tensor<1xi16>, !spirv.arm.tensor<1xi16> -> !spirv.arm.tensor<17x29x19xi16>
// CHECK: spirv.ARM.GraphOutputs {{%.*}} : !spirv.arm.tensor<17x29x19xi16>
spirv.ARM.GraphOutputs %9 : !spirv.arm.tensor<17x29x19xi16>
}
}//--------------------------------------------------------------------------------------------------
// WHEN CREATING A NEW TEST, PLEASE JUST COPY & PASTE WITHOUT EDITS.
//
// Set-up that's shared across all tests in this directory. In principle, this
// config could be moved to lit.local.cfg. However, there are downstream users that
// do not use these LIT config files. Hence why this is kept inline.
//
// DEFINE: %{sparsifier_opts} = enable-runtime-library=true
// DEFINE: %{sparsifier_opts_sve} = enable-arm-sve=true %{sparsifier_opts}
// DEFINE: %{compile} = mlir-opt %s --sparsifier="%{sparsifier_opts}"
// DEFINE: %{compile_sve} = mlir-opt %s --sparsifier="%{sparsifier_opts_sve}"
// DEFINE: %{run_libs} = -shared-libs=%mlir_c_runner_utils,%mlir_runner_utils
// DEFINE: %{run_libs_sve} = -shared-libs=%native_mlir_runner_utils,%native_mlir_c_runner_utils
// DEFINE: %{run_opts} = -e main -entry-point-result=void
// DEFINE: %{run} = mlir-runner %{run_opts} %{run_libs}
// DEFINE: %{run_sve} = %mcr_aarch64_cmd --march=aarch64 --mattr="+sve" %{run_opts} %{run_libs_sve}
//
// DEFINE: %{env} =
//--------------------------------------------------------------------------------------------------
// RUN: %{compile} | %{run} | FileCheck %s
//
// Do the same run, but now with direct IR generation.
// REDEFINE: %{sparsifier_opts} = enable-runtime-library=false
// RUN: %{compile} | %{run} | FileCheck %s
//
// Do the same run, but now with direct IR generation and vectorization.
// REDEFINE: %{sparsifier_opts} = enable-runtime-library=false vl=2 reassociate-fp-reductions=true enable-index-optimizations=true
//
// Do the same run, but now with direct IR generation and VLA vectorization.
// RUN: %if mlir_arm_sve_tests %{ %{compile_sve} | %{run_sve} | FileCheck %s %}
#CSR = #sparse_tensor.encoding<{
map = (d0, d1) -> (d0 : dense,
d1 : compressed)
}>
#DCSR = #sparse_tensor.encoding<{
map = (d0, d1) -> (d0 : compressed,
d1 : compressed)
}>
// An example of a 2D convolution with sparse data and filter.
module {
func.func @conv2d(%input: tensor<10x10xi32>,
%filter: tensor<5x5xi32>,
%output: tensor<6x6xi32>) -> tensor<6x6xi32> {
%0 = linalg.conv_2d
ins (%input, %filter: tensor<10x10xi32>, tensor<5x5xi32>)
outs (%output: tensor<6x6xi32>) -> tensor<6x6xi32>
return %0 : tensor<6x6xi32>
}
func.func @conv2d_ss(%input: tensor<10x10xi32, #CSR>,
%filter: tensor<5x5xi32, #CSR>,
%output: tensor<6x6xi32>) -> tensor<6x6xi32> {
%0 = linalg.conv_2d
ins (%input, %filter: tensor<10x10xi32, #CSR>, tensor<5x5xi32, #CSR>)
outs (%output: tensor<6x6xi32>) -> tensor<6x6xi32>
return %0 : tensor<6x6xi32>
}
func.func @conv2d_bs(%input: tensor<10x10xi32, #DCSR>,
%filter: tensor<5x5xi32, #CSR>,
%output: tensor<6x6xi32>) -> tensor<6x6xi32> {
%0 = linalg.conv_2d
ins (%input, %filter: tensor<10x10xi32, #DCSR>, tensor<5x5xi32, #CSR>)
outs (%output: tensor<6x6xi32>) -> tensor<6x6xi32>
return %0 : tensor<6x6xi32>
}
func.func @main() {
%c0 = arith.constant 0 : index
%i0 = arith.constant 0 : i32
// Dense filter and input to "stress" test sparsity.
%filter = arith.constant dense<[
[ -1, -2, -3, -4, -5 ],
[ -6, -7, -8, -9, -10 ],
[ -11, -12, -13, -14, -15 ],
[ -16, -17, -18, -19, -20 ],
[ -21, -22, -23, -24, -25 ]
]> : tensor<5x5xi32>
%input = arith.constant dense<[
[ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9 ],
[ 10, 11, 12, 13, 14, 15, 16, 17, 18, 19 ],
[ 20, 21, 22, 23, 24, 25, 26, 27, 28, 29 ],
[ 30, 31, 32, 33, 34, 35, 36, 37, 38, 39 ],
[ 40, 41, 42, 43, 44, 45, 46, 47, 48, 49 ],
[ 50, 51, 52, 53, 54, 55, 56, 57, 58, 59 ],
[ 60, 61, 62, 63, 64, 65, 66, 67, 68, 69 ],
[ 70, 71, 72, 73, 74, 75, 76, 77, 78, 79 ],
[ 80, 81, 82, 83, 84, 85, 86, 87, 88, 89 ],
[ 90, 91, 92, 93, 94, 95, 96, 97, 98, 99 ]
]> : tensor<10x10xi32>
// Sparse filter and input to test true sparsity.
%sfilter = arith.constant dense<[
[ 0, -1, 0, -2, 0 ],
[ 0, 0, 0, 0, 0 ],
[ 0, 0, 8, 0, 0 ],
[ -3, 0, 0, -4, 0 ],
[ 0, 0, -5, 0, -6 ]
]> : tensor<5x5xi32>
%sinput = arith.constant dense<[
[ 0, 1, 2, 3, 0, 0, 0, 0, 0, 0 ],
[ 0, 4, 0, 0, 5, 0, 0, 0, 0, 0 ],
[ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 ],
[ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 ],
[ 0, 0, 0, 0, 0, 0, 6, 0, 0, 7 ],
[ 0, 0, 0, 0, 0, 0, 0, 8, 0, 0 ],
[ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 ],
[ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 ],
[ 0, 9, 0, 0, 0, 0, 0, 0, 0, 0 ],
[ 0, 0, 0, 0, 10, 0, 0, 0, 0, 0 ]
]> : tensor<10x10xi32>
// Set up sparse tensors.
%input_CSR = sparse_tensor.convert %input : tensor<10x10xi32> to tensor<10x10xi32, #CSR>
%input_DCSR = sparse_tensor.convert %input : tensor<10x10xi32> to tensor<10x10xi32, #DCSR>
%filter_CSR = sparse_tensor.convert %filter : tensor<5x5xi32> to tensor<5x5xi32, #CSR>
%sinput_CSR = sparse_tensor.convert %sinput : tensor<10x10xi32> to tensor<10x10xi32, #CSR>
%sinput_DCSR = sparse_tensor.convert %sinput : tensor<10x10xi32> to tensor<10x10xi32, #DCSR>
%sfilter_CSR = sparse_tensor.convert %sfilter : tensor<5x5xi32> to tensor<5x5xi32, #CSR>
// Call the kernels with stress input.
%output0 = arith.constant dense<0> : tensor<6x6xi32>
%0 = call @conv2d(%input, %filter, %output0)
: (tensor<10x10xi32>, tensor<5x5xi32>, tensor<6x6xi32>) -> tensor<6x6xi32>
%output1 = arith.constant dense<0> : tensor<6x6xi32>
%1 = call @conv2d_ss(%input_CSR, %filter_CSR, %output1)
: (tensor<10x10xi32, #CSR>, tensor<5x5xi32, #CSR>, tensor<6x6xi32>) -> tensor<6x6xi32>
%output2 = arith.constant dense<0> : tensor<6x6xi32>
%2 = call @conv2d_bs(%input_DCSR, %filter_CSR, %output2)
: (tensor<10x10xi32, #DCSR>, tensor<5x5xi32, #CSR>, tensor<6x6xi32>) -> tensor<6x6xi32>
// Call the kernels with sparse input.
%output3 = arith.constant dense<0> : tensor<6x6xi32>
%3 = call @conv2d(%sinput, %sfilter, %output3)
: (tensor<10x10xi32>, tensor<5x5xi32>, tensor<6x6xi32>) -> tensor<6x6xi32>
%output4 = arith.constant dense<0> : tensor<6x6xi32>
%4 = call @conv2d_ss(%sinput_CSR, %sfilter_CSR, %output4)
: (tensor<10x10xi32, #CSR>, tensor<5x5xi32, #CSR>, tensor<6x6xi32>) -> tensor<6x6xi32>
%output5 = arith.constant dense<0> : tensor<6x6xi32>
%5 = call @conv2d_bs(%sinput_DCSR, %sfilter_CSR, %output5)
: (tensor<10x10xi32, #DCSR>, tensor<5x5xi32, #CSR>, tensor<6x6xi32>) -> tensor<6x6xi32>
// Verify the output.
//
// CHECK: ( ( -9700, -10025, -10350, -10675, -11000, -11325 ),
// CHECK-SAME: ( -12950, -13275, -13600, -13925, -14250, -14575 ),
// CHECK-SAME: ( -16200, -16525, -16850, -17175, -17500, -17825 ),
// CHECK-SAME: ( -19450, -19775, -20100, -20425, -20750, -21075 ),
// CHECK-SAME: ( -22700, -23025, -23350, -23675, -24000, -24325 ),
// CHECK-SAME: ( -25950, -26275, -26600, -26925, -27250, -27575 ) )
//
// CHECK: ( ( -9700, -10025, -10350, -10675, -11000, -11325 ),
// CHECK-SAME: ( -12950, -13275, -13600, -13925, -14250, -14575 ),
// CHECK-SAME: ( -16200, -16525, -16850, -17175, -17500, -17825 ),
// CHECK-SAME: ( -19450, -19775, -20100, -20425, -20750, -21075 ),
// CHECK-SAME: ( -22700, -23025, -23350, -23675, -24000, -24325 ),
// CHECK-SAME: ( -25950, -26275, -26600, -26925, -27250, -27575 ) )
//
// CHECK: ( ( -9700, -10025, -10350, -10675, -11000, -11325 ),
// CHECK-SAME: ( -12950, -13275, -13600, -13925, -14250, -14575 ),
// CHECK-SAME: ( -16200, -16525, -16850, -17175, -17500, -17825 ),
// CHECK-SAME: ( -19450, -19775, -20100, -20425, -20750, -21075 ),
// CHECK-SAME: ( -22700, -23025, -23350, -23675, -24000, -24325 ),
// CHECK-SAME: ( -25950, -26275, -26600, -26925, -27250, -27575 ) )
//
// CHECK: ( ( -7, -2, -39, 0, -30, -42 ),
// CHECK-SAME: ( -4, -10, 0, -77, 0, -40 ),
// CHECK-SAME: ( 0, 0, 0, 0, 16, 0 ),
// CHECK-SAME: ( 0, 0, 0, 0, 0, 64 ),
// CHECK-SAME: ( 0, 0, 0, -12, 0, -6 ),
// CHECK-SAME: ( -60, -27, -50, 0, -16, 0 ) )
//
// CHECK: ( ( -7, -2, -39, 0, -30, -42 ),
// CHECK-SAME: ( -4, -10, 0, -77, 0, -40 ),
// CHECK-SAME: ( 0, 0, 0, 0, 16, 0 ),
// CHECK-SAME: ( 0, 0, 0, 0, 0, 64 ),
// CHECK-SAME: ( 0, 0, 0, -12, 0, -6 ),
// CHECK-SAME: ( -60, -27, -50, 0, -16, 0 ) )
//
// CHECK: ( ( -7, -2, -39, 0, -30, -42 ),
// CHECK-SAME: ( -4, -10, 0, -77, 0, -40 ),
// CHECK-SAME: ( 0, 0, 0, 0, 16, 0 ),
// CHECK-SAME: ( 0, 0, 0, 0, 0, 64 ),
// CHECK-SAME: ( 0, 0, 0, -12, 0, -6 ),
// CHECK-SAME: ( -60, -27, -50, 0, -16, 0 ) )
//
%v0 = vector.transfer_read %0[%c0, %c0], %i0 : tensor<6x6xi32>, vector<6x6xi32>
vector.print %v0 : vector<6x6xi32>
%v1 = vector.transfer_read %1[%c0, %c0], %i0 : tensor<6x6xi32>, vector<6x6xi32>
vector.print %v1 : vector<6x6xi32>
%v2 = vector.transfer_read %2[%c0, %c0], %i0 : tensor<6x6xi32>, vector<6x6xi32>
vector.print %v2 : vector<6x6xi32>
%v3 = vector.transfer_read %3[%c0, %c0], %i0 : tensor<6x6xi32>, vector<6x6xi32>
vector.print %v3 : vector<6x6xi32>
%v4 = vector.transfer_read %4[%c0, %c0], %i0 : tensor<6x6xi32>, vector<6x6xi32>
vector.print %v4 : vector<6x6xi32>
%v5 = vector.transfer_read %5[%c0, %c0], %i0 : tensor<6x6xi32>, vector<6x6xi32>
vector.print %v5 : vector<6x6xi32>
// Release resources.
bufferization.dealloc_tensor %input_CSR : tensor<10x10xi32, #CSR>
bufferization.dealloc_tensor %input_DCSR : tensor<10x10xi32, #DCSR>
bufferization.dealloc_tensor %filter_CSR : tensor<5x5xi32, #CSR>
bufferization.dealloc_tensor %sinput_CSR : tensor<10x10xi32, #CSR>
bufferization.dealloc_tensor %sinput_DCSR : tensor<10x10xi32, #DCSR>
bufferization.dealloc_tensor %sfilter_CSR : tensor<5x5xi32, #CSR>
bufferization.dealloc_tensor %0 : tensor<6x6xi32>
bufferization.dealloc_tensor %1 : tensor<6x6xi32>
bufferization.dealloc_tensor %2 : tensor<6x6xi32>
bufferization.dealloc_tensor %3 : tensor<6x6xi32>
bufferization.dealloc_tensor %4 : tensor<6x6xi32>
bufferization.dealloc_tensor %5 : tensor<6x6xi32>
return
}
}
#197960
Assertion:symbolUses && "expected uses to be valid"
llvm
CRASH 134
2026-05-15
Aparent_aBparent_bA·Bbothnewnovel / fused
1A·B
module {2new
func.func @f() {3new
"a.b"() ({}) : () -> ()4A·B
}5A·B
}Aparent_aBparent_bA·Bbothnewnovel / fused
1new
// FUSED MLIR (FFL) A: aa1bdd52 B: 9a7077152
3new
// ===== Section A =====4A·B
module {5new
// (seed A not plausible MLIR — omitted)6A·B
}7
8B
// -----9
10new
// ===== Section B =====11A·B
module {12B
// Note: Listener notifications appear after the pattern application because13B
// the conversion driver sends all notifications at the end of the conversion14B
// in bulk.15new
func.func @B_9a707715_verifyDirectPattern() -> i32 {16B
%result = "test.illegal_op_a"() : () -> (i32)17B
return %result : i3218A·B
}19
20
21B
// Note: func.return is modified a second time when running in no-rollback22B
// mode.23
24new
func.func @B_9a707715_verifyLargerBenefit() -> i32 {25B
%result = "test.illegal_op_c"() : () -> (i32)26B
return %result : i3227A·B
}28
29
30B
// Note: No block insertion because this function is external and no block31B
// signature conversion is performed.32
33B
func.func private @remap_input_1_to_0(i16)34
35
36new
func.func @B_9a707715_remap_input_1_to_1(%arg0: i64) {37B
"test.invalid"(%arg0) : (i64) -> ()38A·B
}39
40new
func.func @B_9a707715_remap_call_1_to_1(%arg0: i64) {41new
call @B_9a707715_remap_input_1_to_1(%arg0) : (i64) -> ()42B
return43A·B
}44
45
46B
// Block signature conversion: new block is inserted.47
48B
// Contents of the old block are moved to the new block.49
50B
// The old block is erased.51
52B
// The function op gets a new type attribute.53
54B
// "test.return" is replaced.55
56new
func.func @B_9a707715_remap_input_1_to_N(%arg0: f32) -> f32 {57B
"test.return"(%arg0) : (f32) -> ()58A·B
}59
60
61new
func.func @B_9a707715_remap_input_1_to_N_remaining_use(%arg0: f32) {62B
"work"(%arg0) : (f32) -> ()63A·B
}64
65new
func.func @B_9a707715_remap_materialize_1_to_1(%arg0: i42) {66B
"work"(%arg0) : (i42) -> ()67B
"test.return"() : () -> ()68A·B
}69
70
71new
func.func @B_9a707715_remap_input_to_self(%arg0: index) {72B
"work"(%arg0) : (index) -> ()73A·B
}74
75new
func.func @B_9a707715_remap_multi(%arg0: i64, %unused: i16, %arg1: i64) -> (i64, i64) {76B
"test.invalid"(%arg0, %arg1) : (i64, i64) -> ()77A·B
}78
79
80new
func.func @B_9a707715_no_remap_nested() {81B
"foo.region"() ({82B
^bb0(%i0: f64, %unused: i16, %i1: f64):83B
"test.invalid"(%i0, %i1) : (f64, f64) -> ()84B
}) : () -> ()85B
return86A·B
}87
88
89new
func.func @B_9a707715_remap_drop_region() {90B
"test.drop_region_op"() ({91B
^bb1(%i0: i64, %unused: i16, %i1: i64, %2: f32):92B
"test.invalid"(%i0, %i1, %2) : (i64, i64, f32) -> ()93B
}) : () -> ()94B
return95A·B
}96
97
98new
func.func @B_9a707715_dropped_input_in_use(%arg: i16, %arg2: i64) {99B
"work"(%arg) : (i16) -> ()100A·B
}101
102
103new
func.func @B_9a707715_up_to_date_replacement(%arg: i8) -> i8 {104B
%repl_1 = "test.rewrite"(%arg) : (i8) -> i8105B
%repl_2 = "test.rewrite"(%repl_1) : (i8) -> i8106B
return %repl_2 : i8107A·B
}108
109
110new
func.func @B_9a707715_remove_foldable_op(%arg0 : i32) -> (i32) {111B
%0 = "test.op_with_region_fold"(%arg0) ({112B
"foo.op_with_region_terminator"() : () -> ()113B
}) : (i32) -> (i32)114B
return %0 : i32115A·B
}116
117
118new
func.func @B_9a707715_create_block() {119B
// Check that we created a block with arguments.120B
"test.create_block"() : () -> ()121
122B
return123A·B
}124
125
126
127new
func.func @B_9a707715_bounded_recursion() {128B
test.recursive_rewrite 3129B
return130A·B
}131
132
133B
builtin.module {134
135new
func.func @B_9a707715_fail_to_convert_illegal_op() -> i32 {136B
%result = "test.illegal_op_f"() : () -> (i32)137B
return %result : i32138A·B
}139
140A·B
}141
142
143new
func.func @B_9a707715_replace_block_arg_1_to_n() {144B
"test.legal_op"() ({145B
^bb0(%arg0: i32, %arg1: i16):146B
"test.value_replace"(%arg0, %arg1) : (i32, i16) -> ()147B
"test.return"(%arg0) : (i32) -> ()148B
}) : () -> ()149B
"test.return"() : () -> ()150A·B
}151
152
153new
func.func @B_9a707715_replace_op_result_1_to_n() -> i32 {154B
%0 = "test.legal_op"() : () -> i32155B
%1 = "test.legal_op"() : () -> i16156
157B
"test.value_replace"(%0, %1) : (i32, i16) -> ()158B
"test.return"(%0) : (i32) -> ()159A·B
}160
161
162B
// Check that a conversion pattern on `test.blackhole` can mark the producer163B
// for deletion.164new
func.func @B_9a707715_blackhole() {165B
%input = "test.blackhole_producer"() : () -> (i32)166B
"test.blackhole"(%input) : (i32) -> ()167B
return168A·B
}169
170
171A·B
module {172B
func.func private @callee() -> (f32, i24)173
174new
func.func @B_9a707715_caller() {175B
// f32 is converted to (f16, f16).176B
// i24 is converted to ().177B
%0:2 = func.call @callee() : () -> (f32, i24)178
179B
"test.some_user"(%0#0, %0#1) : (f32, i24) -> ()180B
"test.return"() : () -> ()181A·B
}182A·B
}183
184
185new
func.func @B_9a707715_use_of_replaced_bbarg(%arg0: i64) {186B
%0 = "test.op_with_region_fold"(%arg0) ({187B
"foo.op_with_region_terminator"() : () -> ()188B
}) : (i64) -> (i64)189B
"test.invalid"(%0) : (i64) -> ()190A·B
}191
192
193new
func.func @B_9a707715_fold_legalization() -> i32 {194B
%1 = "test.op_in_place_self_fold"() : () -> (i32)195B
"test.return"(%1) : (i32) -> ()196A·B
}197
198
199new
func.func @B_9a707715_convert_detached_signature() {200B
"test.detached_signature_conversion"() ({201B
^bb0(%arg0: i64):202B
"test.return"() : () -> ()203B
}) : () -> ()204B
"test.return"() : () -> ()205A·B
}206
207
208
209new
func.func @B_9a707715_circular_mapping() {210B
// Regression test that used to crash due to circular211B
// unrealized_conversion_cast ops. 212B
%0 = "test.erase_op"() ({213B
"test.dummy_op_lvl_1"() ({214B
"test.dummy_op_lvl_2"() : () -> ()215B
}) : () -> ()216B
}): () -> (i64)217B
"test.drop_operands_and_replace_with_valid"(%0) : (i64) -> ()218A·B
}219
220
221new
func.func @B_9a707715_test_duplicate_block_arg() {222B
test.convert_block_args duplicate {223B
^bb0(%arg0: i64):224B
"test.repetitive_1_to_n_consumer"(%arg0) : (i64) -> ()225B
} : () -> ()226B
"test.return"() : () -> ()227A·B
}228
229
230new
func.func @B_9a707715_test_remap_block_arg() {231B
%0 = "test.legal_op"() : () -> (i32)232B
test.convert_block_args %0 replace_with_operand {233B
^bb0(%arg0: i32):234B
"test.repetitive_1_to_n_consumer"(%arg0) : (i32) -> ()235B
} : (i32) -> ()236B
"test.return"() : () -> ()237A·B
}238
239
240
241B
// Note: There is a bug in the rollback-based conversion driver: it emits a242B
// "test.cast" : (f16, f16, f16, f16) -> f16, when it should be emitting243B
// three consecutive casts of (f16, f16) -> f16.244new
func.func @B_9a707715_test_multiple_1_to_n_replacement() {245B
%0 = "test.multiple_1_to_n_replacement"() : () -> (f16)246B
"test.invalid"(%0) : (f16) -> ()247A·B
}248
249
250new
func.func @B_9a707715_test_lookup_without_converter() {251B
%0 = "test.replace_with_valid_producer"() {type = i16} : () -> (i64)252B
"test.replace_with_valid_consumer"(%0) {with_converter} : (i64) -> ()253B
// Make sure that the second "replace_with_valid_consumer" lowering does not254B
// lookup the materialization that was created for the above op.255B
"test.replace_with_valid_consumer"(%0) : (i64) -> ()256B
return257A·B
}258
259
260new
func.func @B_9a707715_test_skip_1to1_pattern(%arg0: f32) {261B
"test.type_consumer"(%arg0) : (f32) -> ()262B
return263A·B
}264
265
266B
// Demonstrate that the pattern generally works, but only for 1:1 type267B
// conversions.268
269new
func.func @B_9a707715_test_working_1to1_pattern(%arg0: f16) {270B
"test.type_consumer"(%arg0) : (f16) -> ()271B
"test.return"() : () -> ()272A·B
}273
274
275B
// The region of "test.post_order_legalization" is converted before the op.276
277
278B
// Note: The survival of a not-explicitly-invalid operation does *not* cause279B
// a conversion failure in when applying a partial conversion.280new
func.func @B_9a707715_test_preorder_legalization() {281B
"test.post_order_legalization"() ({282B
^bb0(%arg0: i64):283B
"test.remaining_consumer"(%arg0) : (i64) -> ()284B
"test.legal_op"() ({285B
"test.invalid"(%arg0) : (i64) -> ()286B
}) : () -> ()287B
"test.invalid"(%arg0) : (i64) -> ()288B
}) : () -> ()289B
return290A·B
}291A·B
}292
293B
// -----294
295new
// ===== FFL Bridge + Bug Primitives =====296A·B
module {297
298new
// P9: Multi-result function & call — multi-value SSA lowering299new
func.func @_ffl_p9_divmod(%a : i32, %b : i32) -> (i32, i32) {300new
%q = arith.divsi %a, %b : i32301new
%r = arith.remsi %a, %b : i32302new
return %q, %r : i32, i32303A·B
}304
305new
func.func @_ffl_p9_call() -> i32 {306new
%num = arith.constant 1000000007 : i32307new
%den = arith.constant 998244353 : i32308new
%q, %r = func.call @_ffl_p9_divmod(%num, %den) : (i32, i32) -> (i32, i32)309new
%res = arith.addi %q, %r : i32310new
return %res : i32311A·B
}312A·B
}mlir-opt: /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/Inliner.cpp:42: void walkReferencedSymbolNodes(mlir::Operation*, mlir::CallGraph&, mlir::SymbolTableCollection&, mlir::DenseMap<mlir::Attribute, mlir::CallGraphNode*>&, mlir::function_ref<void(mlir::CallGraphNode*, mlir::Operation*)>): Assertion `symbolUses && "expected uses to be valid"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-mlir-install/bin/mlir-opt --split-input-file --allow-unregistered-dialect --inline --loop-invariant-code-motion --cse --canonicalize --symbol-dce --sccp --verify-each /home/fuzz/WorkSpace/fusion-fuzz/.fused/mlir/tmpgqobe1w3/e62d92b2.mlir
#0 0x00006092e3549f42 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/lib/Support/Unix/Signals.inc:884:3
#1 0x00006092e35468bc llvm::sys::RunSignalHandlers() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/lib/Support/Signals.cpp:108:20
#2 0x00006092e3546f81 SignalHandler(int, siginfo_t*, void*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/lib/Support/Unix/Signals.inc:448:14
#3 0x000078b2603e2520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#4 0x000078b2604369fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
#5 0x000078b2603e2476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
#6 0x000078b2603c87f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
#7 0x000078b2603c871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
#8 0x000078b2603d9e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#9 0x00006092eac3da98 walkReferencedSymbolNodes(mlir::Operation*, mlir::CallGraph&, mlir::SymbolTableCollection&, llvm::DenseMap<mlir::Attribute, mlir::CallGraphNode*, llvm::DenseMapInfo<mlir::Attribute, void>, llvm::detail::DenseMapPair<mlir::Attribute, mlir::CallGraphNode*>>&, llvm::function_ref<void (mlir::CallGraphNode*, mlir::Operation*)>) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/Inliner.cpp:62:1
#10 0x00006092eac3e1cd llvm::DenseMap<mlir::Attribute, mlir::CallGraphNode*, llvm::DenseMapInfo<mlir::Attribute, void>, llvm::detail::DenseMapPair<mlir::Attribute, mlir::CallGraphNode*>>::deallocateBuckets() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/DenseMap.h:822:50
#11 0x00006092eac3e1cd llvm::DenseMap<mlir::Attribute, mlir::CallGraphNode*, llvm::DenseMapInfo<mlir::Attribute, void>, llvm::detail::DenseMapPair<mlir::Attribute, mlir::CallGraphNode*>>::~DenseMap() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/DenseMap.h:784:22
#12 0x00006092eac3e1cd (anonymous namespace)::CGUseList::recomputeUses(mlir::CallGraphNode*, mlir::CallGraph&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/Inliner.cpp:233:1
#13 0x00006092eac41f84 CGUseList /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/Inliner.cpp:159:30
#14 0x00006092eac41f84 mlir::Inliner::doInlining() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/Utils/Inliner.cpp:759:40
#15 0x00006092eaba95db (anonymous namespace)::InlinerPass::runOnOperation() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Transforms/InlinerPass.cpp:152:3
#16 0x00006092eaccc7a6 operator() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:612:33
#17 0x00006092eaccc7a6 callback_fn<mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::<lambda()> > /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:52
#18 0x00006092eaccc7a6 llvm::function_ref<void ()>::operator()() const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#19 0x00006092eaccc7a6 void mlir::MLIRContext::executeAction<mlir::PassExecutionAction, mlir::Pass&>(llvm::function_ref<void ()>, llvm::ArrayRef<mlir::IRUnit>, mlir::Pass&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/include/mlir/IR/MLIRContext.h:294:15
#20 0x00006092eaccc7a6 mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:606:57
#21 0x00006092eaccca74 mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:688:5
#22 0x00006092eaccea13 mlir::PassManager::runPasses(mlir::Operation*, mlir::AnalysisManager) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:1129:71
#23 0x00006092eaccffcb mlir::PassManager::run(mlir::Operation*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Pass/Pass.cpp:1102:69
#24 0x00006092e35f790d performActions(llvm::raw_ostream&, std::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:596:3
#25 0x00006092e35f813c ~DiagnosticFilter /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:310:7
#26 0x00006092e35f813c processBuffer(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef, mlir::MlirOptMainConfig const&, mlir::DialectRegistry&, mlir::SourceMgrDiagnosticVerifierHandler*, llvm::ThreadPoolInterface*) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:687:3
#27 0x00006092e35f8351 std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>::~unique_ptr() /usr/include/c++/11/bits/unique_ptr.h:360:12
#28 0x00006092e35f8351 operator() /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:784:25
#29 0x00006092e35f8351 llvm::LogicalResult llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::'lambda'(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef, llvm::raw_ostream&)>(long, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:52
#30 0x00006092eb02e45a std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>::~unique_ptr() /usr/include/c++/11/bits/unique_ptr.h:360:12
#31 0x00006092eb02e45a llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&) const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#32 0x00006092eb02e45a mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::'lambda'(llvm::StringRef)::operator()(llvm::StringRef) const /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Support/ToolUtilities.cpp:93:15
#33 0x00006092eb02ea3d interleave<const llvm::StringRef*, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer>, mlir::ChunkBufferHandler, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::<lambda(llvm::StringRef)>, llvm::interleave<llvm::SmallVector<llvm::StringRef, 8>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer>, mlir::ChunkBufferHandler, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::<lambda(llvm::StringRef)>, llvm::raw_ostream>(const llvm::SmallVector<llvm::StringRef, 8>&, llvm::raw_ostream&, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer>, mlir::ChunkBufferHandler, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::<lambda(llvm::StringRef)>, const llvm::StringRef&)::<lambda()> > /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLExtras.h:2280:16
#34 0x00006092eb02ea3d interleave<llvm::SmallVector<llvm::StringRef, 8>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer>, mlir::ChunkBufferHandler, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::<lambda(llvm::StringRef)>, llvm::raw_ostream> /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/ADT/STLExtras.h:2300:13
#35 0x00006092eb02ea3d mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Support/ToolUtilities.cpp:97:19
#36 0x00006092e35ef763 std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>::~unique_ptr() /usr/include/c++/11/bits/unique_ptr.h:360:12
#37 0x00006092e35ef763 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) (.part.0) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:790:39
#38 0x00006092e35f88e8 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/llvm/include/llvm/Support/LogicalResult.h:62:42
#39 0x00006092e35f88e8 mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:835:13
#40 0x00006092e35f8b22 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::_M_data() const /usr/include/c++/11/bits/basic_string.h:195:28
#41 0x00006092e35f8b22 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::_M_is_local() const /usr/include/c++/11/bits/basic_string.h:230:23
#42 0x00006092e35f8b22 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::_M_dispose() /usr/include/c++/11/bits/basic_string.h:239:18
#43 0x00006092e35f8b22 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::~basic_string() /usr/include/c++/11/bits/basic_string.h:672:19
#44 0x00006092e35f8b22 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:852:1
#45 0x00006092e3455627 main /home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-project/mlir/tools/mlir-opt/mlir-opt.cpp:347:1
#46 0x000078b2603c9d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#47 0x000078b2603c9e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#48 0x00006092e352db65 _start (/home/fuzz/WorkSpace/fusion-fuzz/projects/mlir/llvm-mlir-install/bin/mlir-opt+0x293cb65)
Aborted (core dumped)
module {
}
// -----module {
func @main() {
%html = "<!DOCTYPE HTML><html><body><div></div></body></html>" : !llvm.string
%dom = "createDom"() : !llvm.ptr
"loadHtml"(%dom, %html) : ()
%divs = "getDivs"(%dom) : !llvm.ptr
%count = "getCount"(%divs) : i32
%zero = constant 0 : i32
%one = constant 1 : i32
%index = "createIndex"() : !llvm.ptr
"forLoop"(%zero, %count, %one, %index) : () {
%div = "getDiv"(%divs, %index) : !llvm.ptr
%fragment = "createDocumentFragment"() : !llvm.ptr
"appendXml"(%fragment, "<p>Hi!</p>") : ()
"replaceWith"(%div, %fragment) : ()
}
"saveHtml"(%dom) : !llvm.string
"cleanup"(%dom) : ()
}
}// RUN: mlir-opt -allow-unregistered-dialect -split-input-file -test-legalize-patterns="allow-pattern-rollback=1" -verify-diagnostics %s | FileCheck %s
// RUN: mlir-opt -allow-unregistered-dialect -split-input-file -test-legalize-patterns="allow-pattern-rollback=1" -verify-diagnostics -profile-actions-to=- %s | FileCheck %s --check-prefix=CHECK-PROFILER
// RUN: mlir-opt -allow-unregistered-dialect -split-input-file -test-legalize-patterns="allow-pattern-rollback=0" -verify-diagnostics %s | FileCheck %s
// CHECK-PROFILER: "name": "pass-execution", "cat": "PERF", "ph": "B"
// CHECK-PROFILER: "name": "apply-conversion", "cat": "PERF", "ph": "B"
// CHECK-PROFILER: "name": "apply-pattern", "cat": "PERF", "ph": "B"
// CHECK-PROFILER: "name": "apply-pattern", "cat": "PERF", "ph": "E"
// CHECK-PROFILER: "name": "apply-conversion", "cat": "PERF", "ph": "E"
// CHECK-PROFILER: "name": "pass-execution", "cat": "PERF", "ph": "E"
// Note: Listener notifications appear after the pattern application because
// the conversion driver sends all notifications at the end of the conversion
// in bulk.
// CHECK: notifyOperationInserted: test.legal_op_a, was unlinked
// CHECK-NEXT: notifyOperationReplaced: test.illegal_op_a
// CHECK-NEXT: notifyOperationModified: func.return
// CHECK-NEXT: notifyOperationErased: test.illegal_op_a
// CHECK-LABEL: verifyDirectPattern
func.func @verifyDirectPattern() -> i32 {
// CHECK-NEXT: "test.legal_op_a"() <{status = "Success"}
%result = "test.illegal_op_a"() : () -> (i32)
// expected-remark@+1 {{op 'func.return' is not legalizable}}
return %result : i32
}
// -----
// CHECK: notifyOperationInserted: test.illegal_op_e, was unlinked
// CHECK-NEXT: notifyOperationReplaced: test.illegal_op_c
// CHECK-NEXT: notifyOperationModified: func.return
// CHECK-NEXT: notifyOperationErased: test.illegal_op_c
// CHECK-NEXT: notifyOperationInserted: test.legal_op_a, was unlinked
// CHECK-NEXT: notifyOperationReplaced: test.illegal_op_e
// Note: func.return is modified a second time when running in no-rollback
// mode.
// CHECK: notifyOperationErased: test.illegal_op_e
// CHECK-LABEL: verifyLargerBenefit
func.func @verifyLargerBenefit() -> i32 {
// CHECK-NEXT: "test.legal_op_a"() <{status = "Success"}
%result = "test.illegal_op_c"() : () -> (i32)
// expected-remark@+1 {{op 'func.return' is not legalizable}}
return %result : i32
}
// -----
// CHECK: notifyOperationModified: func.func
// Note: No block insertion because this function is external and no block
// signature conversion is performed.
// CHECK-LABEL: func private @remap_input_1_to_0()
func.func private @remap_input_1_to_0(i16)
// -----
// CHECK-LABEL: func @remap_input_1_to_1(%arg0: f64)
func.func @remap_input_1_to_1(%arg0: i64) {
// CHECK-NEXT: "test.valid"{{.*}} : (f64)
"test.invalid"(%arg0) : (i64) -> ()
}
// CHECK: func @remap_call_1_to_1(%arg0: f64)
func.func @remap_call_1_to_1(%arg0: i64) {
// CHECK-NEXT: call @remap_input_1_to_1(%arg0) : (f64) -> ()
call @remap_input_1_to_1(%arg0) : (i64) -> ()
// expected-remark@+1 {{op 'func.return' is not legalizable}}
return
}
// -----
// Block signature conversion: new block is inserted.
// CHECK: notifyBlockInserted into func.func: was unlinked
// Contents of the old block are moved to the new block.
// CHECK-NEXT: notifyOperationInserted: test.return
// The old block is erased.
// CHECK-NEXT: notifyBlockErased
// The function op gets a new type attribute.
// CHECK-NEXT: notifyOperationModified: func.func
// "test.return" is replaced.
// CHECK-NEXT: notifyOperationInserted: test.return, was unlinked
// CHECK-NEXT: notifyOperationReplaced: test.return
// CHECK-NEXT: notifyOperationErased: test.return
// CHECK-LABEL: func @remap_input_1_to_N({{.*}}f16, {{.*}}f16)
func.func @remap_input_1_to_N(%arg0: f32) -> f32 {
// CHECK-NEXT: "test.return"{{.*}} : (f16, f16) -> ()
"test.return"(%arg0) : (f32) -> ()
}
// -----
// CHECK-LABEL: func @remap_input_1_to_N_remaining_use(%arg0: f16, %arg1: f16)
func.func @remap_input_1_to_N_remaining_use(%arg0: f32) {
// CHECK-NEXT: [[CAST:%.*]] = "test.cast"(%arg0, %arg1) : (f16, f16) -> f32
// CHECK-NEXT: "work"([[CAST]]) : (f32) -> ()
// expected-remark@+1 {{op 'work' is not legalizable}}
"work"(%arg0) : (f32) -> ()
}
// CHECK-LABEL: func @remap_materialize_1_to_1(%{{.*}}: i43)
func.func @remap_materialize_1_to_1(%arg0: i42) {
// CHECK: %[[V:.*]] = "test.cast"(%arg0) : (i43) -> i42
// CHECK-NEXT: "work"(%[[V]])
// expected-remark@+1 {{op 'work' is not legalizable}}
"work"(%arg0) : (i42) -> ()
"test.return"() : () -> ()
}
// -----
// CHECK-LABEL: func @remap_input_to_self
func.func @remap_input_to_self(%arg0: index) {
// CHECK-NOT: test.cast
// CHECK: "work"
// expected-remark@+1 {{op 'work' is not legalizable}}
"work"(%arg0) : (index) -> ()
}
// CHECK-LABEL: func @remap_multi(%arg0: f64, %arg1: f64) -> (f64, f64)
func.func @remap_multi(%arg0: i64, %unused: i16, %arg1: i64) -> (i64, i64) {
// CHECK-NEXT: "test.valid"{{.*}} : (f64, f64)
"test.invalid"(%arg0, %arg1) : (i64, i64) -> ()
}
// -----
// CHECK-LABEL: func @no_remap_nested
func.func @no_remap_nested() {
// CHECK-NEXT: "foo.region"
// expected-remark@+1 {{op 'foo.region' is not legalizable}}
"foo.region"() ({
// CHECK-NEXT: ^bb0(%{{.*}}: f64, %{{.*}}: i16, %{{.*}}: f64):
^bb0(%i0: f64, %unused: i16, %i1: f64):
// CHECK-NEXT: "test.valid"{{.*}} : (f64, f64)
"test.invalid"(%i0, %i1) : (f64, f64) -> ()
}) : () -> ()
// expected-remark@+1 {{op 'func.return' is not legalizable}}
return
}
// -----
// CHECK-LABEL: func @remap_drop_region
func.func @remap_drop_region() {
// CHECK-NEXT: return
// CHECK-NEXT: }
"test.drop_region_op"() ({
^bb1(%i0: i64, %unused: i16, %i1: i64, %2: f32):
"test.invalid"(%i0, %i1, %2) : (i64, i64, f32) -> ()
}) : () -> ()
// expected-remark@+1 {{op 'func.return' is not legalizable}}
return
}
// -----
// CHECK-LABEL: func @dropped_input_in_use
func.func @dropped_input_in_use(%arg: i16, %arg2: i64) {
// CHECK-NEXT: %[[cast:.*]] = "test.cast"() : () -> i16
// CHECK-NEXT: "work"(%[[cast]]) : (i16)
// expected-remark@+1 {{op 'work' is not legalizable}}
"work"(%arg) : (i16) -> ()
}
// -----
// CHECK-LABEL: func @up_to_date_replacement
func.func @up_to_date_replacement(%arg: i8) -> i8 {
// CHECK-NEXT: return
%repl_1 = "test.rewrite"(%arg) : (i8) -> i8
%repl_2 = "test.rewrite"(%repl_1) : (i8) -> i8
// expected-remark@+1 {{op 'func.return' is not legalizable}}
return %repl_2 : i8
}
// -----
// CHECK-LABEL: func @remove_foldable_op
// CHECK-SAME: (%[[ARG_0:[a-z0-9]*]]: i32)
func.func @remove_foldable_op(%arg0 : i32) -> (i32) {
// CHECK-NEXT: return %[[ARG_0]]
%0 = "test.op_with_region_fold"(%arg0) ({
"foo.op_with_region_terminator"() : () -> ()
}) : (i32) -> (i32)
// expected-remark@+1 {{op 'func.return' is not legalizable}}
return %0 : i32
}
// -----
// CHECK-LABEL: @create_block
func.func @create_block() {
// Check that we created a block with arguments.
// CHECK-NOT: test.create_block
// CHECK: ^{{.*}}(%{{.*}}: i32, %{{.*}}: i32):
"test.create_block"() : () -> ()
// expected-remark@+1 {{op 'func.return' is not legalizable}}
return
}
// -----
// CHECK: notifyOperationModified: test.recursive_rewrite
// CHECK-NEXT: notifyOperationModified: test.recursive_rewrite
// CHECK-NEXT: notifyOperationModified: test.recursive_rewrite
// CHECK-LABEL: @bounded_recursion
func.func @bounded_recursion() {
// CHECK: test.recursive_rewrite 0
test.recursive_rewrite 3
// expected-remark@+1 {{op 'func.return' is not legalizable}}
return
}
// -----
// expected-remark@+1 {{applyPartialConversion failed}}
builtin.module {
func.func @fail_to_convert_illegal_op() -> i32 {
// expected-error@+1 {{failed to legalize operation 'test.illegal_op_f' that was explicitly marked illegal: %0 = "test.illegal_op_f"() : () -> i32}}
%result = "test.illegal_op_f"() : () -> (i32)
return %result : i32
}
}
// -----
// CHECK-LABEL: @replace_block_arg_1_to_n
func.func @replace_block_arg_1_to_n() {
// CHECK: "test.legal_op"
"test.legal_op"() ({
^bb0(%arg0: i32, %arg1: i16):
// CHECK-NEXT: ^bb0(%[[ARG0:.*]]: i32, %[[ARG1:.*]]: i16):
// CHECK-NEXT: %[[cast:.*]] = "test.cast"(%[[ARG1]], %[[ARG1]]) : (i16, i16) -> i32
// CHECK-NEXT: "test.value_replace"(%[[cast]], %[[ARG1]]) {is_legal} : (i32, i16) -> ()
// CHECK-NEXT: "test.return"(%[[cast]]) : (i32)
"test.value_replace"(%arg0, %arg1) : (i32, i16) -> ()
"test.return"(%arg0) : (i32) -> ()
}) : () -> ()
"test.return"() : () -> ()
}
// -----
// CHECK-LABEL: @replace_op_result_1_to_n
func.func @replace_op_result_1_to_n() -> i32 {
// CHECK: %[[orig:.*]] = "test.legal_op"() : () -> i32
// CHECK: %[[repl:.*]] = "test.legal_op"() : () -> i16
%0 = "test.legal_op"() : () -> i32
%1 = "test.legal_op"() : () -> i16
// CHECK-NEXT: %[[cast:.*]] = "test.cast"(%[[repl]], %[[repl]]) : (i16, i16) -> i32
// CHECK-NEXT: "test.value_replace"(%[[cast]], %[[repl]]) {is_legal} : (i32, i16) -> ()
// CHECK-NEXT: "test.return"(%[[cast]]) : (i32)
"test.value_replace"(%0, %1) : (i32, i16) -> ()
"test.return"(%0) : (i32) -> ()
}
// -----
// Check that a conversion pattern on `test.blackhole` can mark the producer
// for deletion.
// CHECK-LABEL: @blackhole
func.func @blackhole() {
%input = "test.blackhole_producer"() : () -> (i32)
"test.blackhole"(%input) : (i32) -> ()
// expected-remark@+1 {{op 'func.return' is not legalizable}}
return
}
// -----
module {
// CHECK-LABEL: func.func private @callee() -> (f16, f16)
func.func private @callee() -> (f32, i24)
// CHECK: func.func @caller()
func.func @caller() {
// f32 is converted to (f16, f16).
// i24 is converted to ().
// CHECK: %[[call:.*]]:2 = call @callee() : () -> (f16, f16)
%0:2 = func.call @callee() : () -> (f32, i24)
// CHECK-DAG: %[[cast1:.*]] = "test.cast"() : () -> i24
// CHECK-DAG: %[[cast0:.*]] = "test.cast"(%[[call]]#0, %[[call]]#1) : (f16, f16) -> f32
// CHECK: "test.some_user"(%[[cast0]], %[[cast1]]) : (f32, i24) -> ()
// expected-remark @below{{'test.some_user' is not legalizable}}
"test.some_user"(%0#0, %0#1) : (f32, i24) -> ()
"test.return"() : () -> ()
}
}
// -----
// CHECK: func.func @use_of_replaced_bbarg(
// CHECK-SAME: %[[arg0:.*]]: f64)
// CHECK: "test.valid"(%[[arg0]])
func.func @use_of_replaced_bbarg(%arg0: i64) {
%0 = "test.op_with_region_fold"(%arg0) ({
"foo.op_with_region_terminator"() : () -> ()
}) : (i64) -> (i64)
"test.invalid"(%0) : (i64) -> ()
}
// -----
// CHECK-LABEL: @fold_legalization
func.func @fold_legalization() -> i32 {
// CHECK: op_in_place_self_fold
// CHECK-SAME: folded
%1 = "test.op_in_place_self_fold"() : () -> (i32)
"test.return"(%1) : (i32) -> ()
}
// -----
// CHECK-LABEL: func @convert_detached_signature()
// CHECK: "test.legal_op"() ({
// CHECK: ^bb0(%arg0: f64):
// CHECK: "test.return"() : () -> ()
// CHECK: }) : () -> ()
func.func @convert_detached_signature() {
"test.detached_signature_conversion"() ({
^bb0(%arg0: i64):
"test.return"() : () -> ()
}) : () -> ()
"test.return"() : () -> ()
}
// -----
// CHECK: notifyOperationReplaced: test.erase_op
// CHECK: notifyOperationErased: test.dummy_op_lvl_2
// CHECK: notifyBlockErased
// CHECK: notifyOperationErased: test.dummy_op_lvl_1
// CHECK: notifyBlockErased
// CHECK: notifyOperationErased: test.erase_op
// CHECK: notifyOperationInserted: test.valid, was unlinked
// CHECK: notifyOperationReplaced: test.drop_operands_and_replace_with_valid
// CHECK: notifyOperationErased: test.drop_operands_and_replace_with_valid
// CHECK-LABEL: func @circular_mapping()
// CHECK-NEXT: "test.valid"() : () -> ()
func.func @circular_mapping() {
// Regression test that used to crash due to circular
// unrealized_conversion_cast ops.
%0 = "test.erase_op"() ({
"test.dummy_op_lvl_1"() ({
"test.dummy_op_lvl_2"() : () -> ()
}) : () -> ()
}): () -> (i64)
"test.drop_operands_and_replace_with_valid"(%0) : (i64) -> ()
}
// -----
// CHECK-LABEL: func @test_duplicate_block_arg()
// CHECK: test.convert_block_args is_legal duplicate {
// CHECK: ^{{.*}}(%[[arg0:.*]]: i64, %[[arg1:.*]]: i64):
// CHECK: "test.valid"(%[[arg0]], %[[arg1]])
// CHECK: }
func.func @test_duplicate_block_arg() {
test.convert_block_args duplicate {
^bb0(%arg0: i64):
"test.repetitive_1_to_n_consumer"(%arg0) : (i64) -> ()
} : () -> ()
"test.return"() : () -> ()
}
// -----
// CHECK-LABEL: func @test_remap_block_arg()
// CHECK: %[[repl:.*]] = "test.legal_op"() : () -> i32
// CHECK: test.convert_block_args %[[repl]] is_legal replace_with_operand {
// CHECK-NEXT: "test.valid"(%[[repl]], %[[repl]])
// CHECK: }
func.func @test_remap_block_arg() {
%0 = "test.legal_op"() : () -> (i32)
test.convert_block_args %0 replace_with_operand {
^bb0(%arg0: i32):
"test.repetitive_1_to_n_consumer"(%arg0) : (i32) -> ()
} : (i32) -> ()
"test.return"() : () -> ()
}
// -----
// CHECK: notifyOperationInserted: test.step_1
// CHECK: notifyOperationReplaced: test.multiple_1_to_n_replacement
// CHECK: notifyOperationErased: test.multiple_1_to_n_replacement
// CHECK: notifyOperationInserted: test.legal_op
// CHECK: notifyOperationReplaced: test.step_1
// CHECK: notifyOperationErased: test.step_1
// CHECK-LABEL: func @test_multiple_1_to_n_replacement()
// CHECK: %[[legal_op:.*]]:4 = "test.legal_op"() : () -> (f16, f16, f16, f16)
// Note: There is a bug in the rollback-based conversion driver: it emits a
// "test.cast" : (f16, f16, f16, f16) -> f16, when it should be emitting
// three consecutive casts of (f16, f16) -> f16.
// CHECK: "test.valid"(%{{.*}}) : (f16) -> ()
func.func @test_multiple_1_to_n_replacement() {
%0 = "test.multiple_1_to_n_replacement"() : () -> (f16)
"test.invalid"(%0) : (f16) -> ()
}
// -----
// CHECK-LABEL: func @test_lookup_without_converter
// CHECK: %[[producer:.*]] = "test.valid_producer"() : () -> i16
// CHECK: %[[cast:.*]] = "test.cast"(%[[producer]]) : (i16) -> f64
// CHECK: "test.valid_consumer"(%[[cast]]) : (f64) -> ()
// CHECK: "test.valid_consumer"(%[[producer]]) : (i16) -> ()
func.func @test_lookup_without_converter() {
%0 = "test.replace_with_valid_producer"() {type = i16} : () -> (i64)
"test.replace_with_valid_consumer"(%0) {with_converter} : (i64) -> ()
// Make sure that the second "replace_with_valid_consumer" lowering does not
// lookup the materialization that was created for the above op.
"test.replace_with_valid_consumer"(%0) : (i64) -> ()
// expected-remark@+1 {{op 'func.return' is not legalizable}}
return
}
// -----
// expected-remark@-1 {{applyPartialConversion failed}}
func.func @test_skip_1to1_pattern(%arg0: f32) {
// expected-error@+1 {{failed to legalize operation 'test.type_consumer' that was explicitly marked illegal}}
"test.type_consumer"(%arg0) : (f32) -> ()
return
}
// -----
// Demonstrate that the pattern generally works, but only for 1:1 type
// conversions.
// CHECK-LABEL: @test_working_1to1_pattern(
func.func @test_working_1to1_pattern(%arg0: f16) {
// CHECK-NEXT: "test.return"() : () -> ()
"test.type_consumer"(%arg0) : (f16) -> ()
"test.return"() : () -> ()
}
// -----
// The region of "test.post_order_legalization" is converted before the op.
// CHECK: notifyBlockInserted into test.post_order_legalization: was unlinked
// CHECK: notifyOperationInserted: test.remaining_consumer
// CHECK: notifyOperationInserted: test.legal_op
// CHECK: notifyOperationInserted: test.invalid
// CHECK: notifyBlockErased
// CHECK: notifyOperationInserted: test.valid, was unlinked
// CHECK: notifyOperationReplaced: test.invalid
// CHECK: notifyOperationErased: test.invalid
// CHECK: notifyOperationInserted: test.valid, was unlinked
// CHECK: notifyOperationReplaced: test.invalid
// CHECK: notifyOperationErased: test.invalid
// CHECK: notifyOperationModified: test.post_order_legalization
// CHECK-LABEL: func @test_preorder_legalization
// CHECK: "test.post_order_legalization"() ({
// CHECK: ^{{.*}}(%[[arg0:.*]]: f64):
// Note: The survival of a not-explicitly-invalid operation does *not* cause
// a conversion failure in when applying a partial conversion.
// CHECK: %[[cast:.*]] = "test.cast"(%[[arg0]]) : (f64) -> i64
// CHECK: "test.remaining_consumer"(%[[cast]]) : (i64) -> ()
// CHECK: "test.valid"(%[[arg0]]) : (f64) -> ()
// CHECK: }) {is_legal} : () -> ()
func.func @test_preorder_legalization() {
"test.post_order_legalization"() ({
^bb0(%arg0: i64):
// expected-remark @+1 {{'test.remaining_consumer' is not legalizable}}
"test.remaining_consumer"(%arg0) : (i64) -> ()
"test.legal_op"() ({
"test.invalid"(%arg0) : (i64) -> ()
}) : () -> ()
"test.invalid"(%arg0) : (i64) -> ()
}) : () -> ()
// expected-remark @+1 {{'func.return' is not legalizable}}
return
}
#89154
Assertion failed: (std::find(conformsTo.begin(), conformsTo.end(), symbol.getProtocol()) != conformsTo.end()), function getTypeForSymbolRange at InterfaceType.cpp:365.
swift
CRASH 139
2026-05-15
Aparent_aBparent_bA·Bbothnewnovel / fused
1A
public protocol P1 {2A
associatedtype DP13A
associatedtype DP114A·B
}5
6A
public protocol P2 {7new
associatedtype DP2: P18A·B
}9
10new
public struct H<T> {}11
12new
public struct MyStruct3: P1 {13A
public typealias DP1 = Int14A
public typealias DP11 = H<Int>15A·B
}16
17new
public struct MyStruct4: P2 {18A
public typealias DP2 = MyStruct319A·B
}20
21new
@_specialize(where T == MyStruct4)22new
public func foo<T: P2>(_ t: T) where T.DP2.DP11 == H<T.DP2.DP1> {}23
24new
struct MyStruct3 {}Aparent_aBparent_bA·Bbothnewnovel / fused
1new
// --- Seed A ---2A
// RUN: %target-typecheck-verify-swift3A
// RUN: %target-swift-ide-test -print-ast-typechecked -source-filename=%s -disable-objc-attr-requires-foundation-module -define-availability 'SwiftStdlib 5.1:macOS 10.15, iOS 13.0, watchOS 6.0, tvOS 13.0' | %FileCheck %s4
5A
struct S<T> {}6
7A
public protocol P {8A·B
}9A
extension Int: P {10A·B
}11
12A
public protocol ProtocolWithDep {13A
associatedtype Element14A
func getElement() -> Element15A·B
}16
17A
public class C1 {18A·B
}19
20A
class Base {}21A
class Sub : Base {}22A
class NonSub {}23
24A
// Specialize freestanding functions with the correct number of concrete types.25A
// ----------------------------------------------------------------------------26
27A
// CHECK: @_specialize(exported: false, kind: full, where T == Int)28A
@_specialize(where T == Int)29A
// CHECK: @_specialize(exported: false, kind: full, where T == S<Int>)30A
@_specialize(where T == S<Int>)31A
@_specialize(where T == Int, U == Int) // expected-error{{cannot find type 'U' in scope}},32A
@_specialize(where T == T1) // expected-error{{cannot find type 'T1' in scope}}33A
@specialized(where T == T1) // expected-error{{cannot find type 'T1' in scope}}34A
public func oneGenericParam<T>(_ t: T) -> T {35A
return t36A·B
}37
38A
// CHECK: @_specialize(exported: false, kind: full, where T == Int, U == Int)39A
@_specialize(where T == Int, U == Int)40A
@_specialize(where T == Int) // expected-error{{too few generic parameters are specified in '_specialize' attribute (got 1, but expected 2)}} expected-note{{missing constraint for 'U' in '_specialize' attribute}}41A
public func twoGenericParams<T, U>(_ t: T, u: U) -> (T, U) {42A
return (t, u)43A·B
}44
45A
@_specialize(where T == Int) // expected-error{{trailing 'where' clause in '_specialize' attribute of non-generic function 'nonGenericParam(x:)'}}46A
func nonGenericParam(x: Int) {}47
48A
// Specialize contextual types.49A
// ----------------------------50
51A
class G<T> {52A
// CHECK: @_specialize(exported: false, kind: full, where T == Int)53A
@_specialize(where T == Int)54A
@_specialize(where T == T) // expected-error{{too few generic parameters are specified in '_specialize' attribute (got 0, but expected 1)}}55A
// expected-note@-1 {{missing constraint for 'T' in '_specialize' attribute}}56A
@_specialize(where T == S<T>)57A
// expected-error@-1 {{cannot build rewrite system for generic signature; concrete type nesting limit exceeded}}58A
// expected-note@-2 {{failed rewrite rule is τ_0_0.[concrete: S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<τ_0_0>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>] => τ_0_0}}59A
@_specialize(where T == Int, U == Int) // expected-error{{cannot find type 'U' in scope}}60
61A
func noGenericParams() {}62
63A
@specialized(where T == Int)64A
@specialized(where T == T) // expected-error{{too few generic parameters are specified in 'specialized' attribute (got 0, but expected 1)}}65A
// expected-note@-1 {{missing constraint for 'T' in 'specialized' attribute}}66A
func noGenericParamsPublic() {}67
68A
// CHECK: @_specialize(exported: false, kind: full, where T == Int, U == Float)69A
@_specialize(where T == Int, U == Float)70A
// CHECK: @_specialize(exported: false, kind: full, where T == Int, U == S<Int>)71A
@_specialize(where T == Int, U == S<Int>)72A
@_specialize(where T == Int) // expected-error{{too few generic parameters are specified in '_specialize' attribute (got 1, but expected 2)}} expected-note {{missing constraint for 'U' in '_specialize' attribute}}73A
func oneGenericParam<U>(_ t: T, u: U) -> (U, T) {74A
return (u, t)75A·B
}76A
@specialized(where T == Int) // expected-error{{too few generic parameters are specified in 'specialized' attribute (got 1, but expected 2)}} expected-note {{missing constraint for 'U' in 'specialized' attribute}}77A
func oneGenericParamPublic<U>(_ t: T, u: U) -> (U, T) {78A
return (u, t)79A
}}80
81A
// Specialize with requirements.82A
// -----------------------------83
84A
protocol Thing {}85
86A
struct AThing : Thing {}87
88A
// CHECK: @_specialize(exported: false, kind: full, where T == AThing)89A
@_specialize(where T == AThing)90A
@_specialize(where T == Int) // expected-error{{no type for 'T' can satisfy both 'T == Int' and 'T : Thing'}}91
92A
func oneRequirement<T : Thing>(_ t: T) {}93
94A
protocol HasElt {95A
associatedtype Element96A·B
}97A
struct IntElement : HasElt {98A
typealias Element = Int99A·B
}100A
struct FloatElement : HasElt {101A
typealias Element = Float102A·B
}103A
@_specialize(where T == FloatElement)104A
@_specialize(where T == IntElement) // expected-error{{generic signature requires types 'IntElement.Element' (aka 'Int') and 'Float' to be the same}}105A
func sameTypeRequirement<T : HasElt>(_ t: T) where T.Element == Float {}106
107A
@specialized(where T == FloatElement)108A
@specialized(where T == IntElement) // expected-error{{generic signature requires types 'IntElement.Element' (aka 'Int') and 'Float' to be the same}}109A
func sameTypeRequirementPublic<T : HasElt>(_ t: T) where T.Element == Float {}110
111A
@_specialize(where T == Sub)112A
@_specialize(where T == NonSub) // expected-error{{no type for 'T' can satisfy both 'T : NonSub' and 'T : Base'}}113A
@specialized(where T == Sub)114A
@specialized(where T == NonSub) // expected-error{{no type for 'T' can satisfy both 'T : NonSub' and 'T : Base'}}115A
func superTypeRequirement<T : Base>(_ t: T) {}116
117A
@_specialize(where X:_Trivial(8), Y == Int) // expected-error{{trailing 'where' clause in '_specialize' attribute of non-generic function 'requirementOnNonGenericFunction(x:y:)'}}118A
public func requirementOnNonGenericFunction(x: Int, y: Int) {119A·B
}120
121A
@_specialize(where Y == Int) // expected-error{{too few generic parameters are specified in '_specialize' attribute (got 1, but expected 2)}} expected-note{{missing constraint for 'X' in '_specialize' attribute}}122A
@specialized(where Y == Int) // expected-error{{too few generic parameters are specified in 'specialized' attribute (got 1, but expected 2)}} expected-note{{missing constraint for 'X' in 'specialized' attribute}}123A
public func missingRequirement<X:P, Y>(x: X, y: Y) {124A·B
}125
126A
@_specialize(where) // expected-error{{expected type}}127A
@_specialize() // expected-error{{expected a parameter label or a where clause in '_specialize' attribute}} expected-error{{expected declaration}}128A
@specialized() // expected-error{{expected a where clause in 'specialized' attribute}} expected-error{{expected declaration}}129A
public func funcWithEmptySpecializeAttr<X: P, Y>(x: X, y: Y) {130A·B
}131
132
133A
@_specialize(where X:_Trivial(8), Y:_Trivial(32), Z == Int) // expected-error{{cannot find type 'Z' in scope}}134A
@_specialize(where X:_Trivial(8), Y:_Trivial(32, 4))135A
@_specialize(where X == Int) // expected-error{{too few generic parameters are specified in '_specialize' attribute (got 1, but expected 2)}} expected-note{{missing constraint for 'Y' in '_specialize' attribute}}136A
@_specialize(where Y:_Trivial(32)) // expected-error {{too few generic parameters are specified in '_specialize' attribute (got 1, but expected 2)}} expected-note{{missing constraint for 'X' in '_specialize' attribute}}137A
@_specialize(where Y: P) // expected-error{{only same-type and layout requirements are supported by '_specialize' attribute}}138A
@_specialize(where Y: MyClass) // expected-error{{cannot find type 'MyClass' in scope}} expected-error{{too few generic parameters are specified in '_specialize' attribute (got 0, but expected 2)}} expected-note{{missing constraint for 'X' in '_specialize' attribute}} expected-note{{missing constraint for 'Y' in '_specialize' attribute}}139A
@_specialize(where X:_Trivial(8), Y == Int)140A
@_specialize(where X == Int, Y == Int)141A
@_specialize(where X == Int, X == Int) // expected-error{{too few generic parameters are specified in '_specialize' attribute (got 1, but expected 2)}} expected-note{{missing constraint for 'Y' in '_specialize' attribute}}142A
@_specialize(where Y:_Trivial(32), X == Float)143A
@_specialize(where X1 == Int, Y1 == Int) // expected-error{{cannot find type 'X1' in scope}} expected-error{{cannot find type 'Y1' in scope}} expected-error{{too few generic parameters are specified in '_specialize' attribute (got 0, but expected 2)}} expected-note{{missing constraint for 'X' in '_specialize' attribute}} expected-note{{missing constraint for 'Y' in '_specialize' attribute}}144A
public func funcWithTwoGenericParameters<X, Y>(x: X, y: Y) {145A·B
}146
147A
@_specialize(where X == Int, Y == Int)148A
@_specialize(exported: true, where X == Int, Y == Int)149A
@_specialize(exported: false, where X == Int, Y == Int)150A
@_specialize(exported: false where X == Int, Y == Int) // expected-error{{missing ',' in '_specialize' attribute}}151A
@_specialize(exported: yes, where X == Int, Y == Int) // expected-error{{expected a boolean true or false value in '_specialize' attribute}}152A
@_specialize(exported: , where X == Int, Y == Int) // expected-error{{expected a boolean true or false value in '_specialize' attribute}}153
154A
@_specialize(kind: partial, where X == Int, Y == Int)155A
@_specialize(kind: partial, where X == Int)156A
@_specialize(kind: full, where X == Int, Y == Int)157A
@_specialize(kind: any, where X == Int, Y == Int) // expected-error{{expected 'partial' or 'full' as values of the 'kind' parameter in '_specialize' attribute}}158A
@_specialize(kind: false, where X == Int, Y == Int) // expected-error{{expected 'partial' or 'full' as values of the 'kind' parameter in '_specialize' attribute}}159A
@_specialize(kind: partial where X == Int, Y == Int) // expected-error{{missing ',' in '_specialize' attribute}}160A
@_specialize(kind: partial, where X == Int, Y == Int)161A
@_specialize(kind: , where X == Int, Y == Int)162
163A
@_specialize(exported: true, kind: partial, where X == Int, Y == Int)164A
@_specialize(exported: true, exported: true, where X == Int, Y == Int) // expected-error{{parameter 'exported' was already defined in '_specialize' attribute}}165A
@_specialize(kind: partial, exported: true, where X == Int, Y == Int)166A
@_specialize(kind: partial, kind: partial, where X == Int, Y == Int) // expected-error{{parameter 'kind' was already defined in '_specialize' attribute}}167
168A
@_specialize(where X == Int, Y == Int, exported: true, kind: partial) // expected-error{{expected type}} expected-error{{cannot find type 'exported' in scope}} expected-error{{cannot find type 'kind' in scope}} expected-error{{cannot find type 'partial' in scope}}169A
public func anotherFuncWithTwoGenericParameters<X: P, Y>(x: X, y: Y) {170A·B
}171
172A
@_specialize(where T: P) // expected-error{{only same-type and layout requirements are supported by '_specialize' attribute}}173A
@specialized(where T: P) // expected-error{{only same-type are supported by 'specialized' attribute}}174A
@_specialize(where T: Int) // expected-error{{type 'T' constrained to non-protocol, non-class type 'Int'}} expected-note {{use 'T == Int' to require 'T' to be 'Int'}}175A
// expected-error@-1 {{too few generic parameters are specified in '_specialize' attribute (got 0, but expected 1)}}176A
// expected-note@-2 {{missing constraint for 'T' in '_specialize' attribute}}177
178A
@_specialize(where T: S1) // expected-error{{type 'T' constrained to non-protocol, non-class type 'S1'}} expected-note {{use 'T == S1' to require 'T' to be 'S1'}}179A
// expected-error@-1 {{too few generic parameters are specified in '_specialize' attribute (got 0, but expected 1)}}180A
// expected-note@-2 {{missing constraint for 'T' in '_specialize' attribute}}181A
@_specialize(where T: C1) // expected-error{{only same-type and layout requirements are supported by '_specialize' attribute}}182A
@_specialize(where Int: P) // expected-error{{too few generic parameters are specified in '_specialize' attribute (got 0, but expected 1)}} expected-note{{missing constraint for 'T' in '_specialize' attribute}}183A
@specialized(where T: Int) // expected-error{{type 'T' constrained to non-protocol, non-class type 'Int'}} expected-note {{use 'T == Int' to require 'T' to be 'Int'}}184A
// expected-error@-1 {{too few generic parameters are specified in 'specialized' attribute (got 0, but expected 1)}}185A
// expected-note@-2 {{missing constraint for 'T' in 'specialized' attribute}}186A
func funcWithForbiddenSpecializeRequirement<T>(_ t: T) {187A·B
}188
189A
@_specialize(where T: _Trivial(32), T: _Trivial(64), T: _Trivial, T: _RefCountedObject)190A
// expected-error@-1{{no type for 'T' can satisfy both 'T : _RefCountedObject' and 'T : _Trivial(64)'}}191A
// expected-error@-2{{no type for 'T' can satisfy both 'T : _Trivial(64)' and 'T : _Trivial(32)'}}192A
@_specialize(where T: _Trivial, T: _Trivial(64))193A
@_specialize(where T: _RefCountedObject, T: _NativeRefCountedObject)194A
@_specialize(where Array<T> == Int) // expected-error{{generic signature requires types 'Array<T>' and 'Int' to be the same}}195A
// expected-error@-1 {{too few generic parameters are specified in '_specialize' attribute (got 0, but expected 1)}}196A
// expected-note@-2 {{missing constraint for 'T' in '_specialize' attribute}}197A
@_specialize(where T.Element == Int) // expected-error{{only requirements on generic parameters are supported by '_specialize' attribute}}198A
public func funcWithComplexSpecializeRequirements<T: ProtocolWithDep>(t: T) -> Int {199A
return 55555200A·B
}201
202A
public protocol Proto: class {203A·B
}204
205A
@_specialize(where T: _RefCountedObject)206A
// expected-error@-1 {{too few generic parameters are specified in '_specialize' attribute (got 0, but expected 1)}}207A
// expected-note@-2 {{missing constraint for 'T' in '_specialize' attribute}}208A
@_specialize(where T: _Trivial)209A
// expected-error@-1{{no type for 'T' can satisfy both 'T : _NativeClass' and 'T : _Trivial'}}210A
// expected-error@-2 {{too few generic parameters are specified in '_specialize' attribute (got 0, but expected 1)}}211A
// expected-note@-3 {{missing constraint for 'T' in '_specialize' attribute}}212A
@_specialize(where T: _Trivial(64))213A
// expected-error@-1{{no type for 'T' can satisfy both 'T : _NativeClass' and 'T : _Trivial(64)'}}214A
// expected-error@-2 {{too few generic parameters are specified in '_specialize' attribute (got 0, but expected 1)}}215A
// expected-note@-3 {{missing constraint for 'T' in '_specialize' attribute}}216A
public func funcWithABaseClassRequirement<T>(t: T) -> Int where T: C1 {217A
return 44444218A·B
}219
220A
public struct S1 {221A·B
}222
223A
@_specialize(exported: false, where T == Int64)224A
public func simpleGeneric<T>(t: T) -> T {225A
return t226A·B
}227
228
229A
@_specialize(exported: true, where S: _Trivial(64))230A
// Check that any bitsize size is OK, not only powers of 8.231A
@_specialize(where S: _Trivial(60))232A
@_specialize(exported: true, where S: _RefCountedObject)233A
@inline(never)234A
public func copyValue<S>(_ t: S, s: inout S) -> Int64 where S: P{235A
return 1236A·B
}237
238A
@_specialize(exported: true, where S: _Trivial)239A
@_specialize(exported: true, where S: _Trivial(64))240A
@_specialize(exported: true, where S: _Trivial(32))241A
@_specialize(exported: true, where S: _RefCountedObject)242A
@_specialize(exported: true, where S: _NativeRefCountedObject)243A
@_specialize(exported: true, where S: _Class)244A
@_specialize(exported: true, where S: _NativeClass)245A
@inline(never)246A
public func copyValueAndReturn<S>(_ t: S, s: inout S) -> S where S: P{247A
return s248A·B
}249
250A
struct OuterStruct<S> {251A
struct MyStruct<T> {252A
@_specialize(where T == Int, U == Float) // expected-error{{too few generic parameters are specified in '_specialize' attribute (got 2, but expected 3)}} expected-note{{missing constraint for 'S' in '_specialize' attribute}}253A
@specialized(where T == Int, U == Float) // expected-error{{too few generic parameters are specified in 'specialized' attribute (got 2, but expected 3)}} expected-note{{missing constraint for 'S' in 'specialized' attribute}}254A
public func foo<U>(u : U) {255A·B
}256
257A
@_specialize(where T == Int, U == Float, S == Int)258A
@specialized(where T == Int, U == Float, S == Int)259A
public func bar<U>(u : U) {260A·B
}261A·B
}262A·B
}263
264A
// Check _TrivialAtMostN constraints.265A
@_specialize(exported: true, where S: _TrivialAtMost(64))266A
@inline(never)267A
public func copy2<S>(_ t: S, s: inout S) -> S where S: P{268A
return s269A·B
}270
271A
// Check missing alignment.272A
@_specialize(where S: _Trivial(64, )) // expected-error{{expected non-negative alignment to be specified in layout constraint}}273A
// Check non-numeric size.274A
@_specialize(where S: _Trivial(Int)) // expected-error{{expected non-negative size to be specified in layout constraint}}275A
// Check non-numeric alignment.276A
@_specialize(where S: _Trivial(64, X)) // expected-error{{expected non-negative alignment to be specified in layout constraint}}277A
@inline(never)278A
public func copy3<S>(_ s: S) -> S {279A
return s280A·B
}281
282A
public func funcWithWhereClause<T>(t: T) where T:P, T: _Trivial(64) { // expected-error{{layout constraints are only allowed inside '_specialize' attributes}}283A·B
}284
285A
// rdar://problem/29333056286A
public protocol P1 {287A
associatedtype DP1288A
associatedtype DP11289A·B
}290
291A
public protocol P2 {292A
associatedtype DP2 : P1293A·B
}294
295A
public struct H<T> {296A·B
}297
298A
public struct MyStruct3 : P1 {299A
public typealias DP1 = Int300A
public typealias DP11 = H<Int>301A·B
}302
303A
public struct MyStruct4 : P2 {304A
public typealias DP2 = MyStruct3305A·B
}306
307A
@_specialize(where T==MyStruct4)308A
public func foo<T: P2>(_ t: T) where T.DP2.DP11 == H<T.DP2.DP1> {309A·B
}310
311A
public func targetFun<T>(_ t: T) {}312
313A
@_specialize(exported: true, target: targetFun(_:), where T == Int)314A
public func specifyTargetFunc<T>(_ t: T) {315A·B
}316
317A
public struct Container {318A
public func targetFun<T>(_ t: T) {}319A·B
}320
321A
extension Container {322A
@_specialize(exported: true, target: targetFun(_:), where T == Int)323A
public func specifyTargetFunc<T>(_ t: T) { }324
325A
@_specialize(exported: true, target: targetFun2(_:), where T == Int) // expected-error{{target function 'targetFun2' could not be found}}326A
public func specifyTargetFunc2<T>(_ t: T) { }327A·B
}328
329A
// Make sure we don't complain that 'E' is not explicitly specialized here.330A
// E becomes concrete via the combination of 'S == Set<String>' and331A
// 'E == S.Element'.332A
@_specialize(where S == Set<String>)333A
@specialized(where S == Set<String>)334A
public func takesSequenceAndElement<S, E>(_: S, _: E)335A
where S : Sequence, E == S.Element {}336
337A
// CHECK: @_specialize(exported: true, kind: full, availability: macOS 11, iOS 13, *; where T == Int)338A
// CHECK: public func testAvailability<T>(_ t: T)339A
@_specialize(exported: true, availability: macOS 11, iOS 13, *; where T == Int)340A
public func testAvailability<T>(_ t: T) {}341
342A
// CHECK: @_specialize(exported: true, kind: full, availability: macOS, introduced: 11; where T == Int)343A
// CHECK: public func testAvailability2<T>(_ t: T)344A
@_specialize(exported: true, availability: macOS 11, *; where T == Int)345A
public func testAvailability2<T>(_ t: T) {}346
347A
// CHECK: @_specialize(exported: true, kind: full, availability: macOS, introduced: 11; where T == Int)348A
// CHECK: public func testAvailability3<T>(_ t: T)349A
@_specialize(exported: true, availability: macOS, introduced: 11; where T == Int)350A
public func testAvailability3<T>(_ t: T) {}351
352A
// CHECK: @_specialize(exported: true, kind: full, availability: macOS 10.15, iOS 13.0, watchOS 6.0, tvOS 13.0, *; where T == Int)353A
// CHECK: public func testAvailability4<T>(_ t: T)354A
@_specialize(exported: true, availability: SwiftStdlib 5.1, *; where T == Int)355A
public func testAvailability4<T>(_ t: T) {}356
357A
public struct ExpectedElement {358A
@inline(never)359A
public func hello() {}360A·B
}361
362A
public struct ConformerElement {}363
364A
public struct Conformer : ProtocolWithDep {365A
public typealias Element = ConformerElement366A
public func getElement() -> ConformerElement { return ConformerElement() }367A·B
}368
369A
@inline(never)370A
@_specialize(where T == Conformer) // expected-error{{generic signature requires types 'Conformer.Element' (aka 'ConformerElement') and 'ExpectedElement' to be the same}}371A
public func foo<T : ProtocolWithDep>(_ t: T) where T.Element == ExpectedElement {372A
t.getElement().hello()373A·B
}374
375A
@_specialize(where T == Conformer) // expected-error{{generic signature requires types 'Conformer.Element' (aka 'ConformerElement') and 'ExpectedElement' to be the same}}376A
@specialized(where T == Conformer) // expected-error{{generic signature requires types 'Conformer.Element' (aka 'ConformerElement') and 'ExpectedElement' to be the same}}377A
public func bar<T : ProtocolWithDep>(_ t: T) where T.Element == ExpectedElement {378A
foo(t)379A·B
}380
381A
// CHECK: @specialized(where T == Int)382A
@specialized(where T == Int)383A
// CHECK: @specialized(where T == S<Int>)384A
@specialized(where T == S<Int>)385A
public func oneGenericParam2Good<T>(_ t: T) -> T {386A
return t387A·B
}388
389A
@specialized(where T == Int, U == Int) // expected-error{{cannot find type 'U' in scope}},390A
@specialized(where T == T1) // expected-error{{cannot find type 'T1' in scope}},391A
@specialized(where T : _Trivial) // expected-error{{layout constraints are only allowed inside '_specialize' attributes}} expected-error{{empty 'where' clause in 'specialized' attribute}}392A
public func oneGenericParam2<T>(_ t: T) -> T {393A
return t394A·B
}395
396A
// CHECK: @specialized(where T == Int, U == Int)397A
@specialized(where T == Int, U == Int)398A
@specialized(where T == Int) // expected-error{{too few generic parameters are specified in 'specialized' attribute (got 1, but expected 2)}} expected-note{{missing constraint for 'U' in 'specialized' attribute}}399A
public func twoGenericParams2<T, U>(_ t: T, u: U) -> (T, U) {400A
return (t, u)401A·B
}402
403A
@specialized(where T == Int) // expected-error{{trailing 'where' clause in 'specialized' attribute of non-generic function 'nonGenericParam2(x:)'}}404A
func nonGenericParam2(x: Int) {}405
406A
@_specialize(where T == Int)407A
@_specialize(where T == Int)408A
func genericParamDuplicate<T>(t: T) {}409
410A
struct GG<T: P> {}411
412A
// expected-error@+1 {{type 'String' does not conform to protocol 'P'}}413A
@_specialize(where T == GG<String>)414A
func genericArgInvalidSpecialize<T>(t: T) {}415
416new
// --- Seed B ---417B
// REQUIRES: swift_swift_parser418
419B
// RUN: %empty-directory(%t)420B
// RUN: %target-swift-frontend %s -swift-version 5 -module-name main -disable-availability-checking -typecheck -plugin-path %swift-plugin-dir -dump-macro-expansions > %t/expansions-dump.txt 2>&1421B
// RUN: %FileCheck %s < %t/expansions-dump.txt422
423B
@DebugDescription424B
struct MyStruct1: CustomStringConvertible {425B
var description: String { "thirty" }426A·B
}427B
// CHECK: static let _lldb_summary: (428B
// CHECK: {{UInt8(, UInt8)*}}429B
// CHECK: ) =430B
// CHECK: (431B
// CHECK: /* version */ 1,432B
// CHECK: /* record size */ 24,433B
// CHECK: /* "main.MyStruct1" */ 15, 109, 97, 105, 110, 46, 77, 121, 83, 116, 114, 117, 99, 116, 49, 0,434B
// CHECK: /* "thirty" */ 7, 116, 104, 105, 114, 116, 121, 0435B
// CHECK: )436
437B
@DebugDescription438B
struct MyStruct2: CustomDebugStringConvertible {439B
var description: String { "thirty" }440B
var debugDescription: String { "eleven" }441A·B
}442B
// CHECK: static let _lldb_summary: (443B
// CHECK: {{UInt8(, UInt8)*}}444B
// CHECK: ) =445B
// CHECK: (446B
// CHECK: /* version */ 1,447B
// CHECK: /* record size */ 24,448B
// CHECK: /* "main.MyStruct2" */ 15, 109, 97, 105, 110, 46, 77, 121, 83, 116, 114, 117, 99, 116, 50, 0,449B
// CHECK: /* "eleven" */ 7, 101, 108, 101, 118, 101, 110, 0450B
// CHECK: )451
452B
@DebugDescription453B
struct MyStruct3: CustomDebugStringConvertible {454B
var description: String { "thirty" }455B
var debugDescription: String { "eleven" }456B
var lldbDescription: String { "two" }457A·B
}458B
// CHECK: static let _lldb_summary: (459B
// CHECK: {{UInt8(, UInt8)*}}460B
// CHECK: ) =461B
// CHECK: (462B
// CHECK: /* version */ 1,463B
// CHECK: /* record size */ 21,464B
// CHECK: /* "main.MyStruct3" */ 15, 109, 97, 105, 110, 46, 77, 121, 83, 116, 114, 117, 99, 116, 51, 0,465B
// CHECK: /* "two" */ 4, 116, 119, 111, 0466new
var _ffl_sentinel: Int = 0467new
// --- Bug Primitive ---468
469new
// P9: @resultBuilder control-flow desugaring stress470new
@resultBuilder471new
struct _FflHTML {472new
static func buildBlock(_ parts: String...) -> String { parts.joined() }473new
static func buildOptional(_ part: String?) -> String { part ?? "" }474new
static func buildEither(first: String) -> String { "<first>\(first)</first>" }475new
static func buildEither(second: String) -> String { "<second>\(second)</second>" }476new
static func buildArray(_ parts: [String]) -> String { parts.joined(separator: "\n") }477A·B
}478new
func _ffl_p9_render(_ flag: Bool, items: [String]) -> String {479new
@_FflHTML var body: String {480new
"<root>"481new
if flag {482new
"<active/>"483new
} else {484new
"<inactive/>"485A·B
}486new
for item in items {487new
"<item>\(item)</item>"488A·B
}489new
if items.isEmpty {490new
"<empty/>"491A·B
}492new
"</root>"493A·B
}494new
return body495A·B
}496new
do {497new
let _ffl_desc = String(describing: _ffl_sentinel)498new
let _ffl_items = _ffl_desc.split(separator: " ").map(String.init)499new
_ = _ffl_p9_render(_ffl_items.isEmpty, items: _ffl_items)500A·B
}[... 670 lines / 60,220 bytes of output truncated before crash signature ...]
rsi 0x000055f62415b1a8 18 71 7a e4 c7 7f 00 00 19 71 7a e4 c7 7f 00 00 ·qzäÇ····qzäÇ···
rdi 0x0000000000000000 0
rbp 0x000055f624132060 68 68 58 fa f5 55 00 00 00 00 00 00 00 00 00 00 hhXúõU··········
rsp 0x000055f624131e50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ················
r8 0x000055f5fc4561bc 66 e5 bf f6 72 e5 bf f6 60 e7 bf f6 16 e0 bf f6 få¿örå¿ö`ç¿ö·à¿ö
r9 0x0000000000000000 0
r10 0x0000000000000031 49
r11 0x0000000000000202 514
r12 0x0000000000000000 0
r13 0x000055f5fa88d8dc 66 61 6c 73 65 00 6f 66 66 00 72 65 71 75 65 73 false·off·reques
r14 0x0000000000000000 0
r15 0x000055f62415b1a8 18 71 7a e4 c7 7f 00 00 19 71 7a e4 c7 7f 00 00 ·qzäÇ····qzäÇ···
rip 0x000055f5f30554df 48 8b 46 48 48 89 c3 48 83 e3 fc 31 ff a8 02 48 H·FHH·ÃH·ãü1ÿ¨·H
rflags 0x0000000000010206 PF
cs 0x0033 fs 0x0000 gs 0x0000
Images (29 omitted):
0x000055f5f0843000–0x000055f5fa525408 7962bc5b87f37dc987a2f3d77afdf00ca4b96717 swift-frontend /usr/bin/swift-frontend
Backtrace took 0.45s
Segmentation fault (core dumped)// RUN: %target-typecheck-verify-swift
// RUN: %target-swift-ide-test -print-ast-typechecked -source-filename=%s -disable-objc-attr-requires-foundation-module -define-availability 'SwiftStdlib 5.1:macOS 10.15, iOS 13.0, watchOS 6.0, tvOS 13.0' | %FileCheck %s
struct S<T> {}
public protocol P {
}
extension Int: P {
}
public protocol ProtocolWithDep {
associatedtype Element
func getElement() -> Element
}
public class C1 {
}
class Base {}
class Sub : Base {}
class NonSub {}
// Specialize freestanding functions with the correct number of concrete types.
// ----------------------------------------------------------------------------
// CHECK: @_specialize(exported: false, kind: full, where T == Int)
@_specialize(where T == Int)
// CHECK: @_specialize(exported: false, kind: full, where T == S<Int>)
@_specialize(where T == S<Int>)
@_specialize(where T == Int, U == Int) // expected-error{{cannot find type 'U' in scope}},
@_specialize(where T == T1) // expected-error{{cannot find type 'T1' in scope}}
@specialized(where T == T1) // expected-error{{cannot find type 'T1' in scope}}
public func oneGenericParam<T>(_ t: T) -> T {
return t
}
// CHECK: @_specialize(exported: false, kind: full, where T == Int, U == Int)
@_specialize(where T == Int, U == Int)
@_specialize(where T == Int) // expected-error{{too few generic parameters are specified in '_specialize' attribute (got 1, but expected 2)}} expected-note{{missing constraint for 'U' in '_specialize' attribute}}
public func twoGenericParams<T, U>(_ t: T, u: U) -> (T, U) {
return (t, u)
}
@_specialize(where T == Int) // expected-error{{trailing 'where' clause in '_specialize' attribute of non-generic function 'nonGenericParam(x:)'}}
func nonGenericParam(x: Int) {}
// Specialize contextual types.
// ----------------------------
class G<T> {
// CHECK: @_specialize(exported: false, kind: full, where T == Int)
@_specialize(where T == Int)
@_specialize(where T == T) // expected-error{{too few generic parameters are specified in '_specialize' attribute (got 0, but expected 1)}}
// expected-note@-1 {{missing constraint for 'T' in '_specialize' attribute}}
@_specialize(where T == S<T>)
// expected-error@-1 {{cannot build rewrite system for generic signature; concrete type nesting limit exceeded}}
// expected-note@-2 {{failed rewrite rule is τ_0_0.[concrete: S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<S<τ_0_0>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>] => τ_0_0}}
@_specialize(where T == Int, U == Int) // expected-error{{cannot find type 'U' in scope}}
func noGenericParams() {}
@specialized(where T == Int)
@specialized(where T == T) // expected-error{{too few generic parameters are specified in 'specialized' attribute (got 0, but expected 1)}}
// expected-note@-1 {{missing constraint for 'T' in 'specialized' attribute}}
func noGenericParamsPublic() {}
// CHECK: @_specialize(exported: false, kind: full, where T == Int, U == Float)
@_specialize(where T == Int, U == Float)
// CHECK: @_specialize(exported: false, kind: full, where T == Int, U == S<Int>)
@_specialize(where T == Int, U == S<Int>)
@_specialize(where T == Int) // expected-error{{too few generic parameters are specified in '_specialize' attribute (got 1, but expected 2)}} expected-note {{missing constraint for 'U' in '_specialize' attribute}}
func oneGenericParam<U>(_ t: T, u: U) -> (U, T) {
return (u, t)
}
@specialized(where T == Int) // expected-error{{too few generic parameters are specified in 'specialized' attribute (got 1, but expected 2)}} expected-note {{missing constraint for 'U' in 'specialized' attribute}}
func oneGenericParamPublic<U>(_ t: T, u: U) -> (U, T) {
return (u, t)
}}
// Specialize with requirements.
// -----------------------------
protocol Thing {}
struct AThing : Thing {}
// CHECK: @_specialize(exported: false, kind: full, where T == AThing)
@_specialize(where T == AThing)
@_specialize(where T == Int) // expected-error{{no type for 'T' can satisfy both 'T == Int' and 'T : Thing'}}
func oneRequirement<T : Thing>(_ t: T) {}
protocol HasElt {
associatedtype Element
}
struct IntElement : HasElt {
typealias Element = Int
}
struct FloatElement : HasElt {
typealias Element = Float
}
@_specialize(where T == FloatElement)
@_specialize(where T == IntElement) // expected-error{{generic signature requires types 'IntElement.Element' (aka 'Int') and 'Float' to be the same}}
func sameTypeRequirement<T : HasElt>(_ t: T) where T.Element == Float {}
@specialized(where T == FloatElement)
@specialized(where T == IntElement) // expected-error{{generic signature requires types 'IntElement.Element' (aka 'Int') and 'Float' to be the same}}
func sameTypeRequirementPublic<T : HasElt>(_ t: T) where T.Element == Float {}
@_specialize(where T == Sub)
@_specialize(where T == NonSub) // expected-error{{no type for 'T' can satisfy both 'T : NonSub' and 'T : Base'}}
@specialized(where T == Sub)
@specialized(where T == NonSub) // expected-error{{no type for 'T' can satisfy both 'T : NonSub' and 'T : Base'}}
func superTypeRequirement<T : Base>(_ t: T) {}
@_specialize(where X:_Trivial(8), Y == Int) // expected-error{{trailing 'where' clause in '_specialize' attribute of non-generic function 'requirementOnNonGenericFunction(x:y:)'}}
public func requirementOnNonGenericFunction(x: Int, y: Int) {
}
@_specialize(where Y == Int) // expected-error{{too few generic parameters are specified in '_specialize' attribute (got 1, but expected 2)}} expected-note{{missing constraint for 'X' in '_specialize' attribute}}
@specialized(where Y == Int) // expected-error{{too few generic parameters are specified in 'specialized' attribute (got 1, but expected 2)}} expected-note{{missing constraint for 'X' in 'specialized' attribute}}
public func missingRequirement<X:P, Y>(x: X, y: Y) {
}
@_specialize(where) // expected-error{{expected type}}
@_specialize() // expected-error{{expected a parameter label or a where clause in '_specialize' attribute}} expected-error{{expected declaration}}
@specialized() // expected-error{{expected a where clause in 'specialized' attribute}} expected-error{{expected declaration}}
public func funcWithEmptySpecializeAttr<X: P, Y>(x: X, y: Y) {
}
@_specialize(where X:_Trivial(8), Y:_Trivial(32), Z == Int) // expected-error{{cannot find type 'Z' in scope}}
@_specialize(where X:_Trivial(8), Y:_Trivial(32, 4))
@_specialize(where X == Int) // expected-error{{too few generic parameters are specified in '_specialize' attribute (got 1, but expected 2)}} expected-note{{missing constraint for 'Y' in '_specialize' attribute}}
@_specialize(where Y:_Trivial(32)) // expected-error {{too few generic parameters are specified in '_specialize' attribute (got 1, but expected 2)}} expected-note{{missing constraint for 'X' in '_specialize' attribute}}
@_specialize(where Y: P) // expected-error{{only same-type and layout requirements are supported by '_specialize' attribute}}
@_specialize(where Y: MyClass) // expected-error{{cannot find type 'MyClass' in scope}} expected-error{{too few generic parameters are specified in '_specialize' attribute (got 0, but expected 2)}} expected-note{{missing constraint for 'X' in '_specialize' attribute}} expected-note{{missing constraint for 'Y' in '_specialize' attribute}}
@_specialize(where X:_Trivial(8), Y == Int)
@_specialize(where X == Int, Y == Int)
@_specialize(where X == Int, X == Int) // expected-error{{too few generic parameters are specified in '_specialize' attribute (got 1, but expected 2)}} expected-note{{missing constraint for 'Y' in '_specialize' attribute}}
@_specialize(where Y:_Trivial(32), X == Float)
@_specialize(where X1 == Int, Y1 == Int) // expected-error{{cannot find type 'X1' in scope}} expected-error{{cannot find type 'Y1' in scope}} expected-error{{too few generic parameters are specified in '_specialize' attribute (got 0, but expected 2)}} expected-note{{missing constraint for 'X' in '_specialize' attribute}} expected-note{{missing constraint for 'Y' in '_specialize' attribute}}
public func funcWithTwoGenericParameters<X, Y>(x: X, y: Y) {
}
@_specialize(where X == Int, Y == Int)
@_specialize(exported: true, where X == Int, Y == Int)
@_specialize(exported: false, where X == Int, Y == Int)
@_specialize(exported: false where X == Int, Y == Int) // expected-error{{missing ',' in '_specialize' attribute}}
@_specialize(exported: yes, where X == Int, Y == Int) // expected-error{{expected a boolean true or false value in '_specialize' attribute}}
@_specialize(exported: , where X == Int, Y == Int) // expected-error{{expected a boolean true or false value in '_specialize' attribute}}
@_specialize(kind: partial, where X == Int, Y == Int)
@_specialize(kind: partial, where X == Int)
@_specialize(kind: full, where X == Int, Y == Int)
@_specialize(kind: any, where X == Int, Y == Int) // expected-error{{expected 'partial' or 'full' as values of the 'kind' parameter in '_specialize' attribute}}
@_specialize(kind: false, where X == Int, Y == Int) // expected-error{{expected 'partial' or 'full' as values of the 'kind' parameter in '_specialize' attribute}}
@_specialize(kind: partial where X == Int, Y == Int) // expected-error{{missing ',' in '_specialize' attribute}}
@_specialize(kind: partial, where X == Int, Y == Int)
@_specialize(kind: , where X == Int, Y == Int)
@_specialize(exported: true, kind: partial, where X == Int, Y == Int)
@_specialize(exported: true, exported: true, where X == Int, Y == Int) // expected-error{{parameter 'exported' was already defined in '_specialize' attribute}}
@_specialize(kind: partial, exported: true, where X == Int, Y == Int)
@_specialize(kind: partial, kind: partial, where X == Int, Y == Int) // expected-error{{parameter 'kind' was already defined in '_specialize' attribute}}
@_specialize(where X == Int, Y == Int, exported: true, kind: partial) // expected-error{{expected type}} expected-error{{cannot find type 'exported' in scope}} expected-error{{cannot find type 'kind' in scope}} expected-error{{cannot find type 'partial' in scope}}
public func anotherFuncWithTwoGenericParameters<X: P, Y>(x: X, y: Y) {
}
@_specialize(where T: P) // expected-error{{only same-type and layout requirements are supported by '_specialize' attribute}}
@specialized(where T: P) // expected-error{{only same-type are supported by 'specialized' attribute}}
@_specialize(where T: Int) // expected-error{{type 'T' constrained to non-protocol, non-class type 'Int'}} expected-note {{use 'T == Int' to require 'T' to be 'Int'}}
// expected-error@-1 {{too few generic parameters are specified in '_specialize' attribute (got 0, but expected 1)}}
// expected-note@-2 {{missing constraint for 'T' in '_specialize' attribute}}
@_specialize(where T: S1) // expected-error{{type 'T' constrained to non-protocol, non-class type 'S1'}} expected-note {{use 'T == S1' to require 'T' to be 'S1'}}
// expected-error@-1 {{too few generic parameters are specified in '_specialize' attribute (got 0, but expected 1)}}
// expected-note@-2 {{missing constraint for 'T' in '_specialize' attribute}}
@_specialize(where T: C1) // expected-error{{only same-type and layout requirements are supported by '_specialize' attribute}}
@_specialize(where Int: P) // expected-error{{too few generic parameters are specified in '_specialize' attribute (got 0, but expected 1)}} expected-note{{missing constraint for 'T' in '_specialize' attribute}}
@specialized(where T: Int) // expected-error{{type 'T' constrained to non-protocol, non-class type 'Int'}} expected-note {{use 'T == Int' to require 'T' to be 'Int'}}
// expected-error@-1 {{too few generic parameters are specified in 'specialized' attribute (got 0, but expected 1)}}
// expected-note@-2 {{missing constraint for 'T' in 'specialized' attribute}}
func funcWithForbiddenSpecializeRequirement<T>(_ t: T) {
}
@_specialize(where T: _Trivial(32), T: _Trivial(64), T: _Trivial, T: _RefCountedObject)
// expected-error@-1{{no type for 'T' can satisfy both 'T : _RefCountedObject' and 'T : _Trivial(64)'}}
// expected-error@-2{{no type for 'T' can satisfy both 'T : _Trivial(64)' and 'T : _Trivial(32)'}}
@_specialize(where T: _Trivial, T: _Trivial(64))
@_specialize(where T: _RefCountedObject, T: _NativeRefCountedObject)
@_specialize(where Array<T> == Int) // expected-error{{generic signature requires types 'Array<T>' and 'Int' to be the same}}
// expected-error@-1 {{too few generic parameters are specified in '_specialize' attribute (got 0, but expected 1)}}
// expected-note@-2 {{missing constraint for 'T' in '_specialize' attribute}}
@_specialize(where T.Element == Int) // expected-error{{only requirements on generic parameters are supported by '_specialize' attribute}}
public func funcWithComplexSpecializeRequirements<T: ProtocolWithDep>(t: T) -> Int {
return 55555
}
public protocol Proto: class {
}
@_specialize(where T: _RefCountedObject)
// expected-error@-1 {{too few generic parameters are specified in '_specialize' attribute (got 0, but expected 1)}}
// expected-note@-2 {{missing constraint for 'T' in '_specialize' attribute}}
@_specialize(where T: _Trivial)
// expected-error@-1{{no type for 'T' can satisfy both 'T : _NativeClass' and 'T : _Trivial'}}
// expected-error@-2 {{too few generic parameters are specified in '_specialize' attribute (got 0, but expected 1)}}
// expected-note@-3 {{missing constraint for 'T' in '_specialize' attribute}}
@_specialize(where T: _Trivial(64))
// expected-error@-1{{no type for 'T' can satisfy both 'T : _NativeClass' and 'T : _Trivial(64)'}}
// expected-error@-2 {{too few generic parameters are specified in '_specialize' attribute (got 0, but expected 1)}}
// expected-note@-3 {{missing constraint for 'T' in '_specialize' attribute}}
public func funcWithABaseClassRequirement<T>(t: T) -> Int where T: C1 {
return 44444
}
public struct S1 {
}
@_specialize(exported: false, where T == Int64)
public func simpleGeneric<T>(t: T) -> T {
return t
}
@_specialize(exported: true, where S: _Trivial(64))
// Check that any bitsize size is OK, not only powers of 8.
@_specialize(where S: _Trivial(60))
@_specialize(exported: true, where S: _RefCountedObject)
@inline(never)
public func copyValue<S>(_ t: S, s: inout S) -> Int64 where S: P{
return 1
}
@_specialize(exported: true, where S: _Trivial)
@_specialize(exported: true, where S: _Trivial(64))
@_specialize(exported: true, where S: _Trivial(32))
@_specialize(exported: true, where S: _RefCountedObject)
@_specialize(exported: true, where S: _NativeRefCountedObject)
@_specialize(exported: true, where S: _Class)
@_specialize(exported: true, where S: _NativeClass)
@inline(never)
public func copyValueAndReturn<S>(_ t: S, s: inout S) -> S where S: P{
return s
}
struct OuterStruct<S> {
struct MyStruct<T> {
@_specialize(where T == Int, U == Float) // expected-error{{too few generic parameters are specified in '_specialize' attribute (got 2, but expected 3)}} expected-note{{missing constraint for 'S' in '_specialize' attribute}}
@specialized(where T == Int, U == Float) // expected-error{{too few generic parameters are specified in 'specialized' attribute (got 2, but expected 3)}} expected-note{{missing constraint for 'S' in 'specialized' attribute}}
public func foo<U>(u : U) {
}
@_specialize(where T == Int, U == Float, S == Int)
@specialized(where T == Int, U == Float, S == Int)
public func bar<U>(u : U) {
}
}
}
// Check _TrivialAtMostN constraints.
@_specialize(exported: true, where S: _TrivialAtMost(64))
@inline(never)
public func copy2<S>(_ t: S, s: inout S) -> S where S: P{
return s
}
// Check missing alignment.
@_specialize(where S: _Trivial(64, )) // expected-error{{expected non-negative alignment to be specified in layout constraint}}
// Check non-numeric size.
@_specialize(where S: _Trivial(Int)) // expected-error{{expected non-negative size to be specified in layout constraint}}
// Check non-numeric alignment.
@_specialize(where S: _Trivial(64, X)) // expected-error{{expected non-negative alignment to be specified in layout constraint}}
@inline(never)
public func copy3<S>(_ s: S) -> S {
return s
}
public func funcWithWhereClause<T>(t: T) where T:P, T: _Trivial(64) { // expected-error{{layout constraints are only allowed inside '_specialize' attributes}}
}
// rdar://problem/29333056
public protocol P1 {
associatedtype DP1
associatedtype DP11
}
public protocol P2 {
associatedtype DP2 : P1
}
public struct H<T> {
}
public struct MyStruct3 : P1 {
public typealias DP1 = Int
public typealias DP11 = H<Int>
}
public struct MyStruct4 : P2 {
public typealias DP2 = MyStruct3
}
@_specialize(where T==MyStruct4)
public func foo<T: P2>(_ t: T) where T.DP2.DP11 == H<T.DP2.DP1> {
}
public func targetFun<T>(_ t: T) {}
@_specialize(exported: true, target: targetFun(_:), where T == Int)
public func specifyTargetFunc<T>(_ t: T) {
}
public struct Container {
public func targetFun<T>(_ t: T) {}
}
extension Container {
@_specialize(exported: true, target: targetFun(_:), where T == Int)
public func specifyTargetFunc<T>(_ t: T) { }
@_specialize(exported: true, target: targetFun2(_:), where T == Int) // expected-error{{target function 'targetFun2' could not be found}}
public func specifyTargetFunc2<T>(_ t: T) { }
}
// Make sure we don't complain that 'E' is not explicitly specialized here.
// E becomes concrete via the combination of 'S == Set<String>' and
// 'E == S.Element'.
@_specialize(where S == Set<String>)
@specialized(where S == Set<String>)
public func takesSequenceAndElement<S, E>(_: S, _: E)
where S : Sequence, E == S.Element {}
// CHECK: @_specialize(exported: true, kind: full, availability: macOS 11, iOS 13, *; where T == Int)
// CHECK: public func testAvailability<T>(_ t: T)
@_specialize(exported: true, availability: macOS 11, iOS 13, *; where T == Int)
public func testAvailability<T>(_ t: T) {}
// CHECK: @_specialize(exported: true, kind: full, availability: macOS, introduced: 11; where T == Int)
// CHECK: public func testAvailability2<T>(_ t: T)
@_specialize(exported: true, availability: macOS 11, *; where T == Int)
public func testAvailability2<T>(_ t: T) {}
// CHECK: @_specialize(exported: true, kind: full, availability: macOS, introduced: 11; where T == Int)
// CHECK: public func testAvailability3<T>(_ t: T)
@_specialize(exported: true, availability: macOS, introduced: 11; where T == Int)
public func testAvailability3<T>(_ t: T) {}
// CHECK: @_specialize(exported: true, kind: full, availability: macOS 10.15, iOS 13.0, watchOS 6.0, tvOS 13.0, *; where T == Int)
// CHECK: public func testAvailability4<T>(_ t: T)
@_specialize(exported: true, availability: SwiftStdlib 5.1, *; where T == Int)
public func testAvailability4<T>(_ t: T) {}
public struct ExpectedElement {
@inline(never)
public func hello() {}
}
public struct ConformerElement {}
public struct Conformer : ProtocolWithDep {
public typealias Element = ConformerElement
public func getElement() -> ConformerElement { return ConformerElement() }
}
@inline(never)
@_specialize(where T == Conformer) // expected-error{{generic signature requires types 'Conformer.Element' (aka 'ConformerElement') and 'ExpectedElement' to be the same}}
public func foo<T : ProtocolWithDep>(_ t: T) where T.Element == ExpectedElement {
t.getElement().hello()
}
@_specialize(where T == Conformer) // expected-error{{generic signature requires types 'Conformer.Element' (aka 'ConformerElement') and 'ExpectedElement' to be the same}}
@specialized(where T == Conformer) // expected-error{{generic signature requires types 'Conformer.Element' (aka 'ConformerElement') and 'ExpectedElement' to be the same}}
public func bar<T : ProtocolWithDep>(_ t: T) where T.Element == ExpectedElement {
foo(t)
}
// CHECK: @specialized(where T == Int)
@specialized(where T == Int)
// CHECK: @specialized(where T == S<Int>)
@specialized(where T == S<Int>)
public func oneGenericParam2Good<T>(_ t: T) -> T {
return t
}
@specialized(where T == Int, U == Int) // expected-error{{cannot find type 'U' in scope}},
@specialized(where T == T1) // expected-error{{cannot find type 'T1' in scope}},
@specialized(where T : _Trivial) // expected-error{{layout constraints are only allowed inside '_specialize' attributes}} expected-error{{empty 'where' clause in 'specialized' attribute}}
public func oneGenericParam2<T>(_ t: T) -> T {
return t
}
// CHECK: @specialized(where T == Int, U == Int)
@specialized(where T == Int, U == Int)
@specialized(where T == Int) // expected-error{{too few generic parameters are specified in 'specialized' attribute (got 1, but expected 2)}} expected-note{{missing constraint for 'U' in 'specialized' attribute}}
public func twoGenericParams2<T, U>(_ t: T, u: U) -> (T, U) {
return (t, u)
}
@specialized(where T == Int) // expected-error{{trailing 'where' clause in 'specialized' attribute of non-generic function 'nonGenericParam2(x:)'}}
func nonGenericParam2(x: Int) {}
@_specialize(where T == Int)
@_specialize(where T == Int)
func genericParamDuplicate<T>(t: T) {}
struct GG<T: P> {}
// expected-error@+1 {{type 'String' does not conform to protocol 'P'}}
@_specialize(where T == GG<String>)
func genericArgInvalidSpecialize<T>(t: T) {}// REQUIRES: swift_swift_parser
// RUN: %empty-directory(%t)
// RUN: %target-swift-frontend %s -swift-version 5 -module-name main -disable-availability-checking -typecheck -plugin-path %swift-plugin-dir -dump-macro-expansions > %t/expansions-dump.txt 2>&1
// RUN: %FileCheck %s < %t/expansions-dump.txt
@DebugDescription
struct MyStruct1: CustomStringConvertible {
var description: String { "thirty" }
}
// CHECK: static let _lldb_summary: (
// CHECK: {{UInt8(, UInt8)*}}
// CHECK: ) =
// CHECK: (
// CHECK: /* version */ 1,
// CHECK: /* record size */ 24,
// CHECK: /* "main.MyStruct1" */ 15, 109, 97, 105, 110, 46, 77, 121, 83, 116, 114, 117, 99, 116, 49, 0,
// CHECK: /* "thirty" */ 7, 116, 104, 105, 114, 116, 121, 0
// CHECK: )
@DebugDescription
struct MyStruct2: CustomDebugStringConvertible {
var description: String { "thirty" }
var debugDescription: String { "eleven" }
}
// CHECK: static let _lldb_summary: (
// CHECK: {{UInt8(, UInt8)*}}
// CHECK: ) =
// CHECK: (
// CHECK: /* version */ 1,
// CHECK: /* record size */ 24,
// CHECK: /* "main.MyStruct2" */ 15, 109, 97, 105, 110, 46, 77, 121, 83, 116, 114, 117, 99, 116, 50, 0,
// CHECK: /* "eleven" */ 7, 101, 108, 101, 118, 101, 110, 0
// CHECK: )
@DebugDescription
struct MyStruct3: CustomDebugStringConvertible {
var description: String { "thirty" }
var debugDescription: String { "eleven" }
var lldbDescription: String { "two" }
}
// CHECK: static let _lldb_summary: (
// CHECK: {{UInt8(, UInt8)*}}
// CHECK: ) =
// CHECK: (
// CHECK: /* version */ 1,
// CHECK: /* record size */ 21,
// CHECK: /* "main.MyStruct3" */ 15, 109, 97, 105, 110, 46, 77, 121, 83, 116, 114, 117, 99, 116, 51, 0,
// CHECK: /* "two" */ 4, 116, 119, 111, 0
#89152
Assertion failed: (std::find(Bindings.begin(), Bindings.end(), binding) == Bindings.end()), function addBinding at CSBindings.cpp:1681.
swift
CRASH 134
2026-05-15
Aparent_aBparent_bA·Bbothnewnovel / fused
1new
func outer() {2new
protocol Foo {}3B
extension Int: Foo {}4
5new
func foo(_: Int) -> some Foo { return 1738 }6new
func foo(_: String) -> some Foo { return 679 }7new
func foo<T: Foo>(_ x: T) -> some Foo { return x }8
9new
var globalVarTuple: (some Foo, some Foo) = (123, foo(123))10B
}Aparent_aBparent_bA·Bbothnewnovel / fused
1new
// --- Seed A ---2A·B
// RUN: %empty-directory(%t)3A
// RUN: split-file %s %t4
5A
// RUN: not %target-swift-frontend-verify -typecheck %t/test.swift 2>&1 | %update-verify-tests6A
// RUN: %target-swift-frontend-verify -typecheck %t/test.swift7A
// RUN: %diff %t/test.swift %t/test.swift.expected8
9A
//--- test.swift10A
func foo() {11
12A
//--- test.swift.expected13A
// expected-note@+1{{to match this opening '{'}}14A
func foo() {15
16A
// expected-error@+1{{expected '}' at end of brace statement}}17
18new
// --- Seed B ---19A·B
// RUN: %empty-directory(%t)20B
// RUN: %target-swift-emit-module-interface(%t/OpaqueResultTypes.swiftinterface) %s -module-name OpaqueResultTypes21B
// RUN: %target-swift-typecheck-module-from-interface(%t/OpaqueResultTypes.swiftinterface) -module-name OpaqueResultTypes22B
// RUN: %FileCheck %s < %t/OpaqueResultTypes.swiftinterface23B
// RUN: %target-swift-frontend -I %t -typecheck -verify -verify-ignore-unrelated %S/Inputs/opaque-result-types-client.swift24
25B
public protocol Foo {}26B
extension Int: Foo {}27
28B
// CHECK-LABEL: public func foo(_: Swift::Int) -> some OpaqueResultTypes::Foo29B
@available(SwiftStdlib 5.1, *)30B
public func foo(_: Int) -> some Foo {31B
return 173832B
}33
34B
// CHECK-LABEL: @inlinable public func foo(_: Swift::String) -> some OpaqueResultTypes::Foo {35B
@available(SwiftStdlib 5.1, *)36B
@inlinable public func foo(_: String) -> some Foo {37B
return 67938B
}39
40B
// CHECK-LABEL: public func foo<T>(_ x: T) -> some OpaqueResultTypes::Foo where T : OpaqueResultTypes::Foo41B
@available(SwiftStdlib 5.1, *)42B
public func foo<T: Foo>(_ x: T) -> some Foo {43B
return x44B
}45
46B
// CHECK-LABEL: public var globalComputedVar: some OpaqueResultTypes::Foo {47B
// CHECK-NEXT: get48B
// CHECK-NEXT: }49B
@available(SwiftStdlib 5.1, *)50B
public var globalComputedVar: some Foo { 123 }51
52B
// CHECK-LABEL: public var globalVar: some OpaqueResultTypes::Foo{{$}}53B
@available(SwiftStdlib 5.1, *)54B
public var globalVar: some Foo = 12355
56B
// CHECK-LABEL: public var globalVarTuple: (some OpaqueResultTypes::Foo, some OpaqueResultTypes::Foo){{$}}57B
@available(SwiftStdlib 5.1, *)58B
public var globalVarTuple: (some Foo, some Foo) = (123, foo(123))59
60B
public protocol AssocTypeInference {61B
associatedtype Assoc: Foo62B
associatedtype AssocProperty: Foo63B
associatedtype AssocSubscript: Foo64
65B
func foo(_: Int) -> Assoc66
67B
var prop: AssocProperty { get }68B
subscript() -> AssocSubscript { get }69B
}70
71B
@available(SwiftStdlib 5.1, *)72B
public struct Bar<T>: AssocTypeInference {73B
public init() {}74
75B
// CHECK-LABEL: public func foo(_: Swift::Int) -> some OpaqueResultTypes::Foo76B
@available(SwiftStdlib 5.1, *)77B
public func foo(_: Int) -> some Foo {78B
return 2072179B
}80
81B
@available(SwiftStdlib 5.1, *)82B
public func foo(_: String) -> some Foo {83B
return 21984B
}85
86B
// CHECK-LABEL: public func foo<U>(_ x: U) -> some OpaqueResultTypes::Foo where U : OpaqueResultTypes::Foo87B
@available(SwiftStdlib 5.1, *)88B
public func foo<U: Foo>(_ x: U) -> some Foo {89B
return x90B
}91
92B
@available(SwiftStdlib 5.1, *)93B
public struct Bas: AssocTypeInference {94B
public init() {}95
96B
// CHECK-LABEL: public func foo(_: Swift::Int) -> some OpaqueResultTypes::Foo97B
@available(SwiftStdlib 5.1, *)98B
public func foo(_: Int) -> some Foo {99B
return 20721100B
}101
102B
@available(SwiftStdlib 5.1, *)103B
public func foo(_: String) -> some Foo {104B
return 219105B
}106
107B
// CHECK-LABEL: public func foo<U>(_ x: U) -> some OpaqueResultTypes::Foo where U : OpaqueResultTypes::Foo108B
@available(SwiftStdlib 5.1, *)109B
public func foo<U: Foo>(_ x: U) -> some Foo {110B
return x111B
}112
113B
@available(SwiftStdlib 5.1, *)114B
public var prop: some Foo {115B
return 123116B
}117B
@available(SwiftStdlib 5.1, *)118B
public subscript() -> some Foo {119B
return 123120B
}121
122B
// CHECK-LABEL: public typealias Assoc = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<T>123B
// CHECK-LABEL: public typealias AssocProperty = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<T>124B
// CHECK-LABEL: public typealias AssocSubscript = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<T>125B
}126
127B
@available(SwiftStdlib 5.1, *)128B
public struct Bass<U: Foo>: AssocTypeInference {129B
public init() {}130
131B
// CHECK-LABEL: public func foo(_: Swift::Int) -> some OpaqueResultTypes::Foo132B
@available(SwiftStdlib 5.1, *)133B
public func foo(_: Int) -> some Foo {134B
return 20721135B
}136
137B
@available(SwiftStdlib 5.1, *)138B
public func foo(_: String) -> some Foo {139B
return 219140B
}141
142B
// CHECK-LABEL: public func foo(_ x: U) -> some OpaqueResultTypes::Foo143B
@available(SwiftStdlib 5.1, *)144B
public func foo(_ x: U) -> some Foo {145B
return x146B
}147
148B
// CHECK-LABEL: public func foo<V>(_ x: V) -> some OpaqueResultTypes::Foo where V : OpaqueResultTypes::Foo149B
@available(SwiftStdlib 5.1, *)150B
public func foo<V: Foo>(_ x: V) -> some Foo {151B
return x152B
}153B
@available(SwiftStdlib 5.1, *)154B
public var prop: some Foo {155B
return 123156B
}157B
@available(SwiftStdlib 5.1, *)158B
public subscript() -> some Foo {159B
return 123160B
}161
162B
// CHECK-LABEL: public typealias Assoc = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<T, U>163B
// CHECK-LABEL: public typealias AssocProperty = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<T, U>164B
// CHECK-LABEL: public typealias AssocSubscript = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<T, U>165B
}166
167B
@available(SwiftStdlib 5.1, *)168B
public var prop: some Foo {169B
return 123170B
}171B
@available(SwiftStdlib 5.1, *)172B
public subscript() -> some Foo {173B
return 123174B
}175
176B
// CHECK-LABEL: public typealias Assoc = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<T>177B
// CHECK-LABEL: public typealias AssocProperty = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<T>178B
// CHECK-LABEL: public typealias AssocSubscript = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<T>179B
}180
181B
@available(SwiftStdlib 5.1, *)182B
public struct Zim: AssocTypeInference {183B
public init() {}184
185B
@available(SwiftStdlib 5.1, *)186B
public func foo(_: Int) -> some Foo {187B
return 20721188B
}189
190B
@available(SwiftStdlib 5.1, *)191B
public func foo(_: String) -> some Foo {192B
return 219193B
}194
195B
// CHECK-LABEL: public func foo<U>(_ x: U) -> some OpaqueResultTypes::Foo where U : OpaqueResultTypes::Foo196B
@available(SwiftStdlib 5.1, *)197B
public func foo<U: Foo>(_ x: U) -> some Foo {198B
return x199B
}200
201B
@available(SwiftStdlib 5.1, *)202B
public struct Zang: AssocTypeInference {203B
public init() {}204
205B
@available(SwiftStdlib 5.1, *)206B
public func foo(_: Int) -> some Foo {207B
return 20721208B
}209
210B
@available(SwiftStdlib 5.1, *)211B
public func foo(_: String) -> some Foo {212B
return 219213B
}214
215B
// CHECK-LABEL: public func foo<U>(_ x: U) -> some OpaqueResultTypes::Foo where U : OpaqueResultTypes::Foo216B
@available(SwiftStdlib 5.1, *)217B
public func foo<U: Foo>(_ x: U) -> some Foo {218B
return x219B
}220
221B
@available(SwiftStdlib 5.1, *)222B
public var prop: some Foo {223B
return 123224B
}225B
@available(SwiftStdlib 5.1, *)226B
public subscript() -> some Foo {227B
return 123228B
}229B
}230
231B
@available(SwiftStdlib 5.1, *)232B
public struct Zung<U: Foo>: AssocTypeInference {233B
public init() {}234
235B
// CHECK-LABEL: public func foo(_: Swift::Int) -> some OpaqueResultTypes::Foo236B
@available(SwiftStdlib 5.1, *)237B
public func foo(_: Int) -> some Foo {238B
return 20721239B
}240
241B
@available(SwiftStdlib 5.1, *)242B
public func foo(_: String) -> some Foo {243B
return 219244B
}245
246B
@available(SwiftStdlib 5.1, *)247B
public func foo(_ x: U) -> some Foo {248B
return x249B
}250
251B
// CHECK-LABEL: public func foo<V>(_ x: V) -> some OpaqueResultTypes::Foo where V : OpaqueResultTypes::Foo252B
@available(SwiftStdlib 5.1, *)253B
public func foo<V: Foo>(_ x: V) -> some Foo {254B
return x255B
}256
257B
@available(SwiftStdlib 5.1, *)258B
public var prop: some Foo {259B
return 123260B
}261B
@available(SwiftStdlib 5.1, *)262B
public subscript() -> some Foo {263B
return 123264B
}265
266B
// CHECK-LABEL: public typealias Assoc = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<U>267B
// CHECK-LABEL: public typealias AssocProperty = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<U>268B
// CHECK-LABEL: public typealias AssocSubscript = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<U>269B
}270
271B
@available(SwiftStdlib 5.1, *)272B
public var prop: some Foo {273B
return 123274B
}275B
@available(SwiftStdlib 5.1, *)276B
public subscript() -> some Foo {277B
return 123278B
}279B
}280new
var _ffl_sentinel: Int = 0281new
// --- Bug Primitive ---282
283new
// P5: Dynamic casting chain stress284new
protocol _FflCastable: AnyObject {}285new
class _FflBase: _FflCastable {286new
var v: Int = 0287B
}288new
class _FflDerived: _FflBase {289new
var extra: String = ""290B
}291new
func _ffl_p5_cast(_ obj: AnyObject) -> String {292new
if let d = obj as? _FflDerived { return "derived:\(d.extra)" }293new
if let b = obj as? _FflBase { return "base:\(b.v)" }294new
if let s = obj as? CustomStringConvertible { return s.description }295new
return "unknown:\(type(of: obj))"296B
}297new
do {298new
let _ffl_seed = String(describing: _ffl_sentinel).count299new
let _ffl_obj: AnyObject = _ffl_seed % 2 == 0300new
? _FflDerived() as AnyObject301new
: _FflBase() as AnyObject302new
_ = _ffl_p5_cast(_ffl_obj)303new
// Force-cast through Any — stresses value-witness metadata path304new
let _ffl_any: Any = _ffl_sentinel305new
_ = _ffl_any as? Int306new
_ = _ffl_any as? String307new
_ = _ffl_any as? Bool308new
_ = type(of: _ffl_any)309B
}[... 1,138 lines / 52,636 bytes of output truncated before crash signature ...]
rsi 0x000000000013cdb5 1297845
rdi 0x000000000013cdb5 1297845
rbp 0x000000000013cdb5 1297845
rsp 0x00005604f6977328 3b a8 af e3 04 56 00 00 b0 75 97 f6 04 56 00 00 ;¨¯ã·V··°u·ö·V··
r8 0x00005604f69775b0 06 00 00 00 00 00 00 00 fa ff ff ff 00 00 00 00 ········úÿÿÿ····
r9 0x00005604f69775b0 06 00 00 00 00 00 00 00 fa ff ff ff 00 00 00 00 ········úÿÿÿ····
r10 0x00005604f69775b0 06 00 00 00 00 00 00 00 fa ff ff ff 00 00 00 00 ········úÿÿÿ····
r11 0x0000000000000246 582
r12 0x0000000000000006 6
r13 0x000000000000000a 10
r14 0x0000000000000000 0
r15 0x00005604f69773c8 ff ff ff 7f fe ff ff ff 00 00 00 00 00 00 00 00 ÿÿÿ·þÿÿÿ········
rip 0x00007fea9292828d 48 3d 01 f0 ff ff 73 01 c3 48 8b 0d 5b bb 0d 00 H=·ðÿÿs·ÃH··[»··
rflags 0x0000000000000246 ZF PF
cs 0x0033 fs 0x0000 gs 0x0000
Images (29 omitted):
0x00007fea92801000–0x00007fea929b0d39 8e9fd827446c24067541ac5390e6f527fb5947bb libc.so.6 /usr/lib/x86_64-linux-gnu/libc.so.6
Backtrace took 0.00s
Aborted (core dumped)// RUN: %empty-directory(%t)
// RUN: split-file %s %t
// RUN: not %target-swift-frontend-verify -typecheck %t/test.swift 2>&1 | %update-verify-tests
// RUN: %target-swift-frontend-verify -typecheck %t/test.swift
// RUN: %diff %t/test.swift %t/test.swift.expected
//--- test.swift
func foo() {
//--- test.swift.expected
// expected-note@+1{{to match this opening '{'}}
func foo() {
// expected-error@+1{{expected '}' at end of brace statement}}// RUN: %empty-directory(%t)
// RUN: %target-swift-emit-module-interface(%t/OpaqueResultTypes.swiftinterface) %s -module-name OpaqueResultTypes
// RUN: %target-swift-typecheck-module-from-interface(%t/OpaqueResultTypes.swiftinterface) -module-name OpaqueResultTypes
// RUN: %FileCheck %s < %t/OpaqueResultTypes.swiftinterface
// RUN: %target-swift-frontend -I %t -typecheck -verify -verify-ignore-unrelated %S/Inputs/opaque-result-types-client.swift
public protocol Foo {}
extension Int: Foo {}
// CHECK-LABEL: public func foo(_: Swift::Int) -> some OpaqueResultTypes::Foo
@available(SwiftStdlib 5.1, *)
public func foo(_: Int) -> some Foo {
return 1738
}
// CHECK-LABEL: @inlinable public func foo(_: Swift::String) -> some OpaqueResultTypes::Foo {
@available(SwiftStdlib 5.1, *)
@inlinable public func foo(_: String) -> some Foo {
return 679
}
// CHECK-LABEL: public func foo<T>(_ x: T) -> some OpaqueResultTypes::Foo where T : OpaqueResultTypes::Foo
@available(SwiftStdlib 5.1, *)
public func foo<T: Foo>(_ x: T) -> some Foo {
return x
}
// CHECK-LABEL: public var globalComputedVar: some OpaqueResultTypes::Foo {
// CHECK-NEXT: get
// CHECK-NEXT: }
@available(SwiftStdlib 5.1, *)
public var globalComputedVar: some Foo { 123 }
// CHECK-LABEL: public var globalVar: some OpaqueResultTypes::Foo{{$}}
@available(SwiftStdlib 5.1, *)
public var globalVar: some Foo = 123
// CHECK-LABEL: public var globalVarTuple: (some OpaqueResultTypes::Foo, some OpaqueResultTypes::Foo){{$}}
@available(SwiftStdlib 5.1, *)
public var globalVarTuple: (some Foo, some Foo) = (123, foo(123))
public protocol AssocTypeInference {
associatedtype Assoc: Foo
associatedtype AssocProperty: Foo
associatedtype AssocSubscript: Foo
func foo(_: Int) -> Assoc
var prop: AssocProperty { get }
subscript() -> AssocSubscript { get }
}
@available(SwiftStdlib 5.1, *)
public struct Bar<T>: AssocTypeInference {
public init() {}
// CHECK-LABEL: public func foo(_: Swift::Int) -> some OpaqueResultTypes::Foo
@available(SwiftStdlib 5.1, *)
public func foo(_: Int) -> some Foo {
return 20721
}
@available(SwiftStdlib 5.1, *)
public func foo(_: String) -> some Foo {
return 219
}
// CHECK-LABEL: public func foo<U>(_ x: U) -> some OpaqueResultTypes::Foo where U : OpaqueResultTypes::Foo
@available(SwiftStdlib 5.1, *)
public func foo<U: Foo>(_ x: U) -> some Foo {
return x
}
@available(SwiftStdlib 5.1, *)
public struct Bas: AssocTypeInference {
public init() {}
// CHECK-LABEL: public func foo(_: Swift::Int) -> some OpaqueResultTypes::Foo
@available(SwiftStdlib 5.1, *)
public func foo(_: Int) -> some Foo {
return 20721
}
@available(SwiftStdlib 5.1, *)
public func foo(_: String) -> some Foo {
return 219
}
// CHECK-LABEL: public func foo<U>(_ x: U) -> some OpaqueResultTypes::Foo where U : OpaqueResultTypes::Foo
@available(SwiftStdlib 5.1, *)
public func foo<U: Foo>(_ x: U) -> some Foo {
return x
}
@available(SwiftStdlib 5.1, *)
public var prop: some Foo {
return 123
}
@available(SwiftStdlib 5.1, *)
public subscript() -> some Foo {
return 123
}
// CHECK-LABEL: public typealias Assoc = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<T>
// CHECK-LABEL: public typealias AssocProperty = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<T>
// CHECK-LABEL: public typealias AssocSubscript = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<T>
}
@available(SwiftStdlib 5.1, *)
public struct Bass<U: Foo>: AssocTypeInference {
public init() {}
// CHECK-LABEL: public func foo(_: Swift::Int) -> some OpaqueResultTypes::Foo
@available(SwiftStdlib 5.1, *)
public func foo(_: Int) -> some Foo {
return 20721
}
@available(SwiftStdlib 5.1, *)
public func foo(_: String) -> some Foo {
return 219
}
// CHECK-LABEL: public func foo(_ x: U) -> some OpaqueResultTypes::Foo
@available(SwiftStdlib 5.1, *)
public func foo(_ x: U) -> some Foo {
return x
}
// CHECK-LABEL: public func foo<V>(_ x: V) -> some OpaqueResultTypes::Foo where V : OpaqueResultTypes::Foo
@available(SwiftStdlib 5.1, *)
public func foo<V: Foo>(_ x: V) -> some Foo {
return x
}
@available(SwiftStdlib 5.1, *)
public var prop: some Foo {
return 123
}
@available(SwiftStdlib 5.1, *)
public subscript() -> some Foo {
return 123
}
// CHECK-LABEL: public typealias Assoc = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<T, U>
// CHECK-LABEL: public typealias AssocProperty = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<T, U>
// CHECK-LABEL: public typealias AssocSubscript = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<T, U>
}
@available(SwiftStdlib 5.1, *)
public var prop: some Foo {
return 123
}
@available(SwiftStdlib 5.1, *)
public subscript() -> some Foo {
return 123
}
// CHECK-LABEL: public typealias Assoc = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<T>
// CHECK-LABEL: public typealias AssocProperty = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<T>
// CHECK-LABEL: public typealias AssocSubscript = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<T>
}
@available(SwiftStdlib 5.1, *)
public struct Zim: AssocTypeInference {
public init() {}
@available(SwiftStdlib 5.1, *)
public func foo(_: Int) -> some Foo {
return 20721
}
@available(SwiftStdlib 5.1, *)
public func foo(_: String) -> some Foo {
return 219
}
// CHECK-LABEL: public func foo<U>(_ x: U) -> some OpaqueResultTypes::Foo where U : OpaqueResultTypes::Foo
@available(SwiftStdlib 5.1, *)
public func foo<U: Foo>(_ x: U) -> some Foo {
return x
}
@available(SwiftStdlib 5.1, *)
public struct Zang: AssocTypeInference {
public init() {}
@available(SwiftStdlib 5.1, *)
public func foo(_: Int) -> some Foo {
return 20721
}
@available(SwiftStdlib 5.1, *)
public func foo(_: String) -> some Foo {
return 219
}
// CHECK-LABEL: public func foo<U>(_ x: U) -> some OpaqueResultTypes::Foo where U : OpaqueResultTypes::Foo
@available(SwiftStdlib 5.1, *)
public func foo<U: Foo>(_ x: U) -> some Foo {
return x
}
@available(SwiftStdlib 5.1, *)
public var prop: some Foo {
return 123
}
@available(SwiftStdlib 5.1, *)
public subscript() -> some Foo {
return 123
}
}
@available(SwiftStdlib 5.1, *)
public struct Zung<U: Foo>: AssocTypeInference {
public init() {}
// CHECK-LABEL: public func foo(_: Swift::Int) -> some OpaqueResultTypes::Foo
@available(SwiftStdlib 5.1, *)
public func foo(_: Int) -> some Foo {
return 20721
}
@available(SwiftStdlib 5.1, *)
public func foo(_: String) -> some Foo {
return 219
}
@available(SwiftStdlib 5.1, *)
public func foo(_ x: U) -> some Foo {
return x
}
// CHECK-LABEL: public func foo<V>(_ x: V) -> some OpaqueResultTypes::Foo where V : OpaqueResultTypes::Foo
@available(SwiftStdlib 5.1, *)
public func foo<V: Foo>(_ x: V) -> some Foo {
return x
}
@available(SwiftStdlib 5.1, *)
public var prop: some Foo {
return 123
}
@available(SwiftStdlib 5.1, *)
public subscript() -> some Foo {
return 123
}
// CHECK-LABEL: public typealias Assoc = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<U>
// CHECK-LABEL: public typealias AssocProperty = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<U>
// CHECK-LABEL: public typealias AssocSubscript = @_opaqueReturnTypeOf("{{.*}}", 0) {{.*}}<U>
}
@available(SwiftStdlib 5.1, *)
public var prop: some Foo {
return 123
}
@available(SwiftStdlib 5.1, *)
public subscript() -> some Foo {
return 123
}
}
#89151
Assertion failed: (isConcrete()), function getConcrete at ProtocolConformanceRef.h:127.
swift
CRASH 134
2026-05-15
Aparent_aBparent_bA·Bbothnewnovel / fused
1A
protocol DefaultInit {2A
init()3A·B
}4
5A
@attached(extension, conformances: DefaultInit)6A
@attached(member, conformances: DefaultInit, names: named(init()), named(f()))7A
macro DefaultInit() = #externalMacro(module: "MacroDefinition", type: "RequiredDefaultInitMacro")8
9A
@DefaultInit10A
class C { }11
12A
@DefaultInit13A
class D: C { }Aparent_aBparent_bA·Bbothnewnovel / fused
1new
// --- Seed A ---2A
// REQUIRES: swift_swift_parser3
4A
// RUN: %empty-directory(%t)5A
// RUN: %host-build-swift -swift-version 5 -emit-library -o %t/%target-library-name(MacroDefinition) -module-name=MacroDefinition %S/Inputs/syntax_macro_definitions.swift -g -no-toolchain-stdlib-rpath6
7A
// RUN: %target-typecheck-verify-swift -swift-version 5 -load-plugin-library %t/%target-library-name(MacroDefinition) -module-name MacroUser -DTEST_DIAGNOSTICS -swift-version 5 -I %t8A
protocol DefaultInit {9A
init()10A·B
}11
12A
@attached(extension, conformances: DefaultInit)13A
@attached(member, conformances: DefaultInit, names: named(init()), named(f()))14A
macro DefaultInit() = #externalMacro(module: "MacroDefinition", type: "RequiredDefaultInitMacro")15
16A
@DefaultInit17A
class C { }18
19A
@DefaultInit20A
class D: C { }21
22A
@DefaultInit23A
struct E { }24
25new
// --- Seed B ---26B
// RUN: %target-typecheck-verify-swift -swift-version 427
28B
func bet() where A : B {} // expected-error {{'where' clause cannot be applied to a non-generic top-level declaration}}29
30B
typealias gimel = Int where A : B // expected-error {{'where' clause cannot be applied to a non-generic top-level declaration}}31
32B
class dalet where A : B {} // expected-error {{'where' clause cannot be applied to a non-generic top-level declaration}}33
34B
struct Where {35B
func bet() where A == B {} // expected-error {{'where' clause on non-generic member declaration requires a generic context}}36B
typealias gimel = Int where A : B // expected-error {{'where' clause on non-generic member declaration requires a generic context}}37B
class dalet where A : B {} // expected-error {{'where' clause on non-generic member declaration requires a generic context}}38A·B
}39
40B
// Make sure Self: ... is correctly diagnosed in classes41
42B
class SelfInGenericClass<T> {43B
// expected-error@+1 {{type 'Self' in conformance requirement does not refer to a generic parameter or associated type}}44B
func foo() where Self: Equatable { }45B
// expected-error@+1 {{generic signature requires types 'Self' and 'Bool' to be the same}}46B
func bar() where Self == Bool { }47A·B
}48
49B
protocol Whereable {50B
associatedtype Assoc51B
associatedtype Bssoc52
53B
// expected-error@+1 {{instance method requirement 'requirement1()' cannot add constraint 'Self.Assoc: Sequence' on 'Self'}}54B
func requirement1() where Assoc: Sequence55B
// expected-error@+1 {{instance method requirement 'requirement2()' cannot add constraint 'Self.Bssoc == Never' on 'Self'}}56B
func requirement2() where Bssoc == Never57A·B
}58
59B
extension Whereable {60B
// expected-note@+1 {{where 'Self' = 'T1'}}61B
static func staticExtensionFunc(arg: Self.Element) -> Self.Element62B
where Self: Sequence {63B
return arg64A·B
}65
66B
// expected-note@+1 {{where 'Self.Assoc' = 'T1.Assoc', 'Self.Bssoc' = 'T1.Bssoc'}}67B
func extensionFunc() where Assoc == Bssoc { }68
69
70B
// expected-note@+1 {{where 'Self.Assoc' = 'T1.Assoc'}}71B
subscript() -> Assoc where Assoc: Whereable {72B
fatalError()73A·B
}74A·B
}75
76B
func testProtocolExtensions<T1, T2, T3, T4>(t1: T1, t2: T2, t3: T3, t4: T4)77B
where T1: Whereable,78B
T2: Whereable & Sequence,79B
T3: Whereable, T3.Assoc == T3.Bssoc,80B
T4: Whereable, T4.Assoc: Whereable {81B
_ = T1.staticExtensionFunc // expected-error {{static method 'staticExtensionFunc(arg:)' requires that 'T1' conform to 'Sequence'}}82B
_ = T2.staticExtensionFunc83
84B
t1.extensionFunc() // expected-error {{instance method 'extensionFunc()' requires the types 'T1.Assoc' and 'T1.Bssoc' be equivalent}}85B
t3.extensionFunc()86
87B
_ = t1[] // expected-error {{subscript 'subscript()' requires that 'T1.Assoc' conform to 'Whereable'}}88B
_ = t4[]89A·B
}90
91B
class Class<T> {92B
// expected-note@+1 {{where 'T' = 'T}} // expected-note@+1 {{where 'T.Assoc' = 'T.Assoc'}}93B
static func staticFunc() where T: Whereable, T.Assoc == Int { }94
95B
// expected-note@+1 {{candidate requires that the types 'T' and 'Bool' be equivalent}}96B
func func1() where T == Bool { }97B
// FIXME: The rhs type at the end of the error message is not persistent across compilations.98B
// expected-note@+1 {{candidate requires that the types 'T' and 'Int' be equivalent (requirement specified as 'T' == }}99B
func func1() where T == Int { }100
101B
func func2() where T == Int { } // expected-note {{where 'T' = 'T'}}102
103B
subscript() -> T.Element where T: Sequence { // expected-note {{where 'T' = 'T'}}104B
fatalError()105A·B
}106A·B
}107
108B
extension Class {109B
static func staticExtensionFunc() where T: Class<Int> { } // expected-note {{where 'T' = 'T'}}110
111B
subscript(arg: T.Element) -> T.Element where T == Array<Int> {112B
fatalError()113A·B
}114A·B
}115
116B
extension Class where T: Equatable {117B
func extensionFunc() where T: Comparable { } // expected-note {{where 'T' = 'T'}}118
119B
// expected-error@+1 {{no type for 'T' can satisfy both 'T == Class<Int>' and 'T : Equatable'}}120B
func badRequirement1() where T == Class<Int> { }121A·B
}122
123B
extension Class where T == Bool {124B
// expected-error@+1 {{no type for 'T' can satisfy both 'T == Int' and 'T == Bool'}}125B
func badRequirement2() where T == Int { }126A·B
}127
128B
func testMemberDeclarations<T, U: Comparable>(arg1: Class<T>, arg2: Class<U>) {129B
// expected-error@+2 {{static method 'staticFunc()' requires the types 'T.Assoc' and 'Int' be equivalent}}130B
// expected-error@+1 {{static method 'staticFunc()' requires that 'T' conform to 'Whereable'}}131B
Class<T>.staticFunc()132B
Class<T>.staticExtensionFunc() // expected-error {{static method 'staticExtensionFunc()' requires that 'T' inherit from 'Class<Int>'}}133B
Class<Class<Int>>.staticExtensionFunc()134
135B
arg1.func1() // expected-error {{no exact matches in call to instance method 'func1'}}136B
arg1.func2() // expected-error {{instance method 'func2()' requires the types 'T' and 'Int' be equivalent}}137B
arg1.extensionFunc() // expected-error {{instance method 'extensionFunc()' requires that 'T' conform to 'Comparable'}}138B
arg2.extensionFunc()139B
Class<Int>().func1()140B
Class<Int>().func2()141
142B
arg1[] // expected-error {{subscript 'subscript()' requires that 'T' conform to 'Sequence'}}143B
_ = Class<Array<Int>>()[Int.zero]144A·B
}145
146B
// Test nested types and requirements.147
148B
struct Container<T> {149B
typealias NestedAlias = Bool where T == Int150B
// expected-note@-1 {{'NestedAlias' previously declared here}}151B
typealias NestedAlias = Bool where T == Bool152B
// expected-error@-1 {{invalid redeclaration of 'NestedAlias}}153B
typealias NestedAlias2 = T.Magnitude where T: FixedWidthInteger154
155B
typealias NestedAlias3 = T.Element where T: Sequence156
157B
class NestedClass where T: Equatable {}158A·B
}159
160B
extension Container where T: Sequence {161B
struct NestedStruct {}162
163B
struct NestedStruct2 where T.Element: Comparable {164B
enum NestedEnum where T.Element == Double {} // expected-note {{requirement specified as 'T.Element' == 'Double' [with T = String]}}165A·B
}166
167B
struct NestedStruct3<U: Whereable> {}168A·B
}169
170B
extension Container.NestedStruct3 {171B
func foo(arg: U) where U.Assoc == T {}172A·B
}173
174B
_ = Container<String>.NestedAlias2.self // expected-error {{type 'String' does not conform to protocol 'FixedWidthInteger'}}175B
_ = Container<Container<Bool>>.NestedClass.self // expected-error {{type 'Container<Bool>' does not conform to protocol 'Equatable'}}176B
_ = Container<Void>.NestedStruct.self // expected-error {{type 'Void' does not conform to protocol 'Sequence'}}177B
_ = Container<Array<Void>>.NestedStruct2.self // expected-error {{type 'Void' does not conform to protocol 'Comparable'}}178B
_ = Container<String>.NestedStruct2.NestedEnum.self // expected-error {{'Container<T>.NestedStruct2.NestedEnum' requires the types 'String.Element' (aka 'Character') and 'Double' be equivalent}}179B
_ = Container<Int>.NestedAlias2.self180B
_ = Container<Bool>.NestedClass.self181B
_ = Container<String>.NestedStruct.self182B
_ = Container<Array<UInt8>>.NestedStruct2.self183B
_ = Container<Array<Double>>.NestedStruct2.NestedEnum.self184
185B
// Make sure the substitution here actually succeeds instead of producing an ErrorType186B
func sameType<T>(_: T.Type, _: T.Type) {}187B
sameType(Container<Array<Int>>.NestedAlias3.self, Int.self)188B
sameType(Container<Array<Bool>>.NestedAlias3.self, Int.self)189B
// expected-error@-1 {{cannot convert value of type 'Int.Type' to expected argument type 'Container<Array<Bool>>.NestedAlias3.Type' (aka 'Bool.Type')}}190
191B
sameType(Container<Array<Int>>.NestedAlias3.self, Bool.self)192B
// expected-error@-1 {{cannot convert value of type 'Bool.Type' to expected argument type 'Container<Array<Int>>.NestedAlias3.Type' (aka 'Int.Type')}}193new
var _ffl_sentinel: Int = 0194new
// --- Bug Primitive ---195
196new
// P3: Opaque result type (some) reverse-inference stress197new
protocol _FflProducer {198new
associatedtype Output199new
func produce() -> Output200A·B
}201new
struct _FflIntProducer: _FflProducer {202new
let seed: Int203new
func produce() -> Int { seed &* 6364136223846793005 &+ 1442695040888963407 }204A·B
}205new
struct _FflStrProducer: _FflProducer {206new
let seed: String207new
func produce() -> String { seed + seed }208A·B
}209new
@inlinable210new
func _ffl_p3_make(_ flag: Bool) -> some _FflProducer {211new
if flag { return _FflIntProducer(seed: 42) as! any _FflProducer as! _FflIntProducer }212new
return _FflIntProducer(seed: 0)213A·B
}214new
do {215new
let _ffl_flag = String(describing: _ffl_sentinel).isEmpty216new
let _ffl_prod = _ffl_p3_make(_ffl_flag)217new
_ = _ffl_prod.produce()218A·B
}/home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmp624fpi98/d52f65f9.swift:16:7: warning: external macro implementation type 'MacroDefinition.RequiredDefaultInitMacro' could not be found for macro 'DefaultInit()'; plugin for module 'MacroDefinition' not found
14 | @attached(extension, conformances: DefaultInit)
15 | @attached(member, conformances: DefaultInit, names: named(init()), named(f()))
16 | macro DefaultInit() = #externalMacro(module: "MacroDefinition", type: "RequiredDefaultInitMacro")
| `- warning: external macro implementation type 'MacroDefinition.RequiredDefaultInitMacro' could not be found for macro 'DefaultInit()'; plugin for module 'MacroDefinition' not found
17 |
18 | @DefaultInit
/home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmp624fpi98/d52f65f9.swift:19:7: error: external macro implementation type 'MacroDefinition.RequiredDefaultInitMacro' could not be found for macro 'DefaultInit()'; plugin for module 'MacroDefinition' not found
14 | @attached(extension, conformances: DefaultInit)
15 | @attached(member, conformances: DefaultInit, names: named(init()), named(f()))
16 | macro DefaultInit() = #externalMacro(module: "MacroDefinition", type: "RequiredDefaultInitMacro")
| `- note: 'DefaultInit()' declared here
17 |
18 | @DefaultInit
19 | class C { }
| `- error: external macro implementation type 'MacroDefinition.RequiredDefaultInitMacro' could not be found for macro 'DefaultInit()'; plugin for module 'MacroDefinition' not found
20 |
21 | @DefaultInit
Assertion failed: (isConcrete()), function getConcrete at ProtocolConformanceRef.h:127.
(to display assertion configuration options: -Xllvm -assert-help)
Please submit a bug report (https://swift.org/contributing/#reporting-bugs) and include the crash backtrace.
Stack dump:
0. Program arguments: /usr/bin/swift-frontend -emit-ir -O -sil-verify-all -enable-experimental-feature NonescapableTypes -strict-concurrency=complete /home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmp624fpi98/d52f65f9.swift
1. Swift version 6.5-dev (LLVM 7c86461e21cca7e, Swift 6da4da7153e8252)
2. Compiling with effective version 5.10
3. While evaluating request TypeCheckPrimaryFileRequest(source_file "/home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmp624fpi98/d52f65f9.swift")
4. While type-checking 'D' (at /home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmp624fpi98/d52f65f9.swift:22:1)
5. While evaluating request StoredPropertiesRequest(d52f65f9.(file).D@/home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmp624fpi98/d52f65f9.swift:22:7)
6. While evaluating request ExpandSynthesizedMemberMacroRequest(d52f65f9.(file).D@/home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmp624fpi98/d52f65f9.swift:22:7)
7. Assertion failed: (isConcrete()), function getConcrete at ProtocolConformanceRef.h:127.
| (to display assertion configuration options: -Xllvm -assert-help)
#0 0x0000597934172a58 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/usr/bin/swift-frontend+0x8bc7a58)
#1 0x0000597934170275 llvm::sys::RunSignalHandlers() (/usr/bin/swift-frontend+0x8bc5275)
#2 0x0000597934173811 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x0000785c8d00b330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#4 0x0000785c8d064b2c pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x9eb2c)
#5 0x0000785c8d00b27e raise (/lib/x86_64-linux-gnu/libc.so.6+0x4527e)
#6 0x0000785c8cfee8ff abort (/lib/x86_64-linux-gnu/libc.so.6+0x288ff)
#7 0x000059792e294e72 (/usr/bin/swift-frontend+0x2ce9e72)
#8 0x000059792e294e24 (/usr/bin/swift-frontend+0x2ce9e24)
#9 0x000059792e1a99ae swift::ConformanceLookupTable::getConformance(swift::NominalTypeDecl*, swift::ConformanceLookupTable::ConformanceEntry*) (/usr/bin/swift-frontend+0x2bfe9ae)
#10 0x000059792e1a9e7e swift::ConformanceLookupTable::lookupConformance(swift::NominalTypeDecl*, swift::ProtocolDecl*, llvm::SmallVectorImpl<swift::ProtocolConformance*>&) (/usr/bin/swift-frontend+0x2bfee7e)
#11 0x000059792d7c1838 getIntroducedConformances(swift::NominalTypeDecl*, swift::MacroRole, swift::MacroDecl*, llvm::SmallVectorImpl<swift::ProtocolDecl*>*) TypeCheckMacros.cpp:0:0
#12 0x000059792d7c15ac swift::expandMembers(swift::CustomAttr*, swift::MacroDecl*, swift::Decl*) (/usr/bin/swift-frontend+0x22165ac)
#13 0x000059792d7d088b void llvm::function_ref<void (swift::CustomAttr*, swift::MacroDecl*)>::callback_fn<swift::ExpandSynthesizedMemberMacroRequest::evaluate(swift::Evaluator&, swift::Decl*) const::$_17>(long, swift::CustomAttr*, swift::MacroDecl*) TypeCheckMacros.cpp:0:0
#14 0x000059792de2c319 swift::Decl::forEachAttachedMacro(swift::MacroRole, llvm::function_ref<void (swift::CustomAttr*, swift::MacroDecl*)>) const (/usr/bin/swift-frontend+0x2881319)
#15 0x000059792d7be0a6 swift::ExpandSynthesizedMemberMacroRequest::evaluate(swift::Evaluator&, swift::Decl*) const (/usr/bin/swift-frontend+0x22130a6)
#16 0x000059792d73f92a swift::ExpandSynthesizedMemberMacroRequest::OutputType swift::Evaluator::getResultUncached<swift::ExpandSynthesizedMemberMacroRequest, swift::ExpandSynthesizedMemberMacroRequest::OutputType swift::evaluateOrDefault<swift::ExpandSynthesizedMemberMacroRequest>(swift::Evaluator&, swift::ExpandSynthesizedMemberMacroRequest, swift::ExpandSynthesizedMemberMacroRequest::OutputType)::'lambda'()>(swift::ExpandSynthesizedMemberMacroRequest const&, swift::ExpandSynthesizedMemberMacroRequest::OutputType swift::evaluateOrDefault<swift::ExpandSynthesizedMemberMacroRequest>(swift::Evaluator&, swift::ExpandSynthesizedMemberMacroRequest, swift::ExpandSynthesizedMemberMacroRequest::OutputType)::'lambda'()) crtstuff.c:0:0
#17 0x000059792d73f6f8 swift::ExpandSynthesizedMemberMacroRequest::OutputType swift::Evaluator::getResultCached<swift::ExpandSynthesizedMemberMacroRequest, swift::ExpandSynthesizedMemberMacroRequest::OutputType swift::evaluateOrDefault<swift::ExpandSynthesizedMemberMacroRequest>(swift::Evaluator&, swift::ExpandSynthesizedMemberMacroRequest, swift::ExpandSynthesizedMemberMacroRequest::OutputType)::'lambda'(), (void*)0>(swift::ExpandSynthesizedMemberMacroRequest const&, swift::ExpandSynthesizedMemberMacroRequest::OutputType swift::evaluateOrDefault<swift::ExpandSynthesizedMemberMacroRequest>(swift::Evaluator&, swift::ExpandSynthesizedMemberMacroRequest, swift::ExpandSynthesizedMemberMacroRequest::OutputType)::'lambda'()) crtstuff.c:0:0
#18 0x000059792d838463 computeLoweredProperties(swift::NominalTypeDecl*, swift::IterableDeclContext*, (anonymous namespace)::LoweredPropertiesReason) TypeCheckStorage.cpp:0:0
#19 0x000059792d837862 swift::StoredPropertiesRequest::evaluate(swift::Evaluator&, swift::NominalTypeDecl*) const (/usr/bin/swift-frontend+0x228c862)
#20 0x000059792de94f2e swift::StoredPropertiesRequest::OutputType swift::Evaluator::getResultUncached<swift::StoredPropertiesRequest, swift::StoredPropertiesRequest::OutputType swift::evaluateOrDefault<swift::StoredPropertiesRequest>(swift::Evaluator&, swift::StoredPropertiesRequest, swift::StoredPropertiesRequest::OutputType)::'lambda'()>(swift::StoredPropertiesRequest const&, swift::StoredPropertiesRequest::OutputType swift::evaluateOrDefault<swift::StoredPropertiesRequest>(swift::Evaluator&, swift::StoredPropertiesRequest, swift::StoredPropertiesRequest::OutputType)::'lambda'()) crtstuff.c:0:0
#21 0x000059792de94cf8 swift::StoredPropertiesRequest::OutputType swift::Evaluator::getResultCached<swift::StoredPropertiesRequest, swift::StoredPropertiesRequest::OutputType swift::evaluateOrDefault<swift::StoredPropertiesRequest>(swift::Evaluator&, swift::StoredPropertiesRequest, swift::StoredPropertiesRequest::OutputType)::'lambda'(), (void*)0>(swift::StoredPropertiesRequest const&, swift::StoredPropertiesRequest::OutputType swift::evaluateOrDefault<swift::StoredPropertiesRequest>(swift::Evaluator&, swift::StoredPropertiesRequest, swift::StoredPropertiesRequest::OutputType)::'lambda'()) crtstuff.c:0:0
#22 0x000059792de4191f swift::NominalTypeDecl::getStoredProperties() const (/usr/bin/swift-frontend+0x289691f)
#23 0x000059792d7757ec (anonymous namespace)::DeclChecker::visitClassDecl(swift::ClassDecl*) TypeCheckDeclPrimary.cpp:0:0
#24 0x000059792d76fce2 (anonymous namespace)::DeclChecker::visit(swift::Decl*) TypeCheckDeclPrimary.cpp:0:0
#25 0x000059792d76fb74 swift::TypeChecker::typeCheckDecl(swift::Decl*) (/usr/bin/swift-frontend+0x21c4b74)
#26 0x000059792d8a84a5 swift::TypeCheckPrimaryFileRequest::evaluate(swift::Evaluator&, swift::SourceFile*) const (/usr/bin/swift-frontend+0x22fd4a5)
#27 0x000059792d8ace6b swift::TypeCheckPrimaryFileRequest::OutputType swift::Evaluator::getResultUncached<swift::TypeCheckPrimaryFileRequest, swift::TypeCheckPrimaryFileRequest::OutputType swift::evaluateOrDefault<swift::TypeCheckPrimaryFileRequest>(swift::Evaluator&, swift::TypeCheckPrimaryFileRequest, swift::TypeCheckPrimaryFileRequest::OutputType)::'lambda'()>(swift::TypeCheckPrimaryFileRequest const&, swift::TypeCheckPrimaryFileRequest::OutputType swift::evaluateOrDefault<swift::TypeCheckPrimaryFileRequest>(swift::Evaluator&, swift::TypeCheckPrimaryFileRequest, swift::TypeCheckPrimaryFileRequest::OutputType)::'lambda'()) crtstuff.c:0:0
#28 0x000059792d8a83d8 swift::performTypeChecking(swift::SourceFile&) (/usr/bin/swift-frontend+0x22fd3d8)
#29 0x000059792c373499 bool llvm::function_ref<bool (swift::SourceFile&)>::callback_fn<swift::CompilerInstance::performSema()::$_10>(long, swift::SourceFile&) Frontend.cpp:0:0
#30 0x000059792c36790e swift::CompilerInstance::forEachFileToTypeCheck(llvm::function_ref<bool (swift::SourceFile&)>) (/usr/bin/swift-frontend+0xdbc90e)
#31 0x000059792c36768b swift::CompilerInstance::performSema() (/usr/bin/swift-frontend+0xdbc68b)
#32 0x000059792bfd1f32 withSemanticAnalysis(swift::CompilerInstance&, swift::FrontendObserver*, llvm::function_ref<bool (swift::CompilerInstance&)>, bool) FrontendTool.cpp:0:0
#33 0x000059792bfbf9a5 performCompile(swift::CompilerInstance&, int&, swift::FrontendObserver*, llvm::ArrayRef<char const*>) FrontendTool.cpp:0:0
#34 0x000059792bfbc62e swift::performFrontend(llvm::ArrayRef<char const*>, char const*, void*, swift::FrontendObserver*) (/usr/bin/swift-frontend+0xa1162e)
#35 0x000059792bce0d21 swift::mainEntry(int, char const**) (/usr/bin/swift-frontend+0x735d21)
#36 0x0000785c8cff01ca (/lib/x86_64-linux-gnu/libc.so.6+0x2a1ca)
#37 0x0000785c8cff028b __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28b)
#38 0x000059792bcdfc15 _start (/usr/bin/swift-frontend+0x734c15)
*** Signal 6: Backtracing from 0x785c8d0ed28d... done ***
*** Program crashed: Aborted at 0x0000785c8d0ed28d ***
Platform: x86_64 Linux (Ubuntu 24.04.4 LTS)
Thread 0 "swift-frontend" crashed:
0 0x0000785c8d0ed28d <unknown> in libc.so.6
Registers:
rax 0x0000000000000000 0
rdx 0x0000000000000006 6
rcx 0x0000785c8d0ed28d 48 3d 01 f0 ff ff 73 01 c3 48 8b 0d 5b bb 0d 00 H=·ðÿÿs·ÃH··[»··
rbx 0x0000000000000006 6
rsi 0x0000000000145eff 1335039
rdi 0x0000000000145eff 1335039
rbp 0x0000000000145eff 1335039
rsp 0x00005979779831a8 3b 38 17 34 79 59 00 00 30 34 98 77 79 59 00 00 ;8·4yY··04·wyY··
r8 0x0000597977983430 06 00 00 00 00 00 00 00 fa ff ff ff 00 00 00 00 ········úÿÿÿ····
r9 0x0000597977983430 06 00 00 00 00 00 00 00 fa ff ff ff 00 00 00 00 ········úÿÿÿ····
r10 0x0000597977983430 06 00 00 00 00 00 00 00 fa ff ff ff 00 00 00 00 ········úÿÿÿ····
r11 0x0000000000000246 582
r12 0x0000000000000006 6
r13 0x000000000000000b 11
r14 0x0000000000000000 0
r15 0x0000597977983248 ff ff ff 7f fe ff ff ff 00 00 00 00 00 00 00 00 ÿÿÿ·þÿÿÿ········
rip 0x0000785c8d0ed28d 48 3d 01 f0 ff ff 73 01 c3 48 8b 0d 5b bb 0d 00 H=·ðÿÿs·ÃH··[»··
rflags 0x0000000000000246 ZF PF
cs 0x0033 fs 0x0000 gs 0x0000
Images (29 omitted):
0x0000785c8cfc6000–0x0000785c8d175d39 8e9fd827446c24067541ac5390e6f527fb5947bb libc.so.6 /usr/lib/x86_64-linux-gnu/libc.so.6
Backtrace took 0.00s
Aborted (core dumped)// REQUIRES: swift_swift_parser
// RUN: %empty-directory(%t)
// RUN: %host-build-swift -swift-version 5 -emit-library -o %t/%target-library-name(MacroDefinition) -module-name=MacroDefinition %S/Inputs/syntax_macro_definitions.swift -g -no-toolchain-stdlib-rpath
// RUN: %target-typecheck-verify-swift -swift-version 5 -load-plugin-library %t/%target-library-name(MacroDefinition) -module-name MacroUser -DTEST_DIAGNOSTICS -swift-version 5 -I %t
protocol DefaultInit {
init()
}
@attached(extension, conformances: DefaultInit)
@attached(member, conformances: DefaultInit, names: named(init()), named(f()))
macro DefaultInit() = #externalMacro(module: "MacroDefinition", type: "RequiredDefaultInitMacro")
@DefaultInit
class C { }
@DefaultInit
class D: C { }
@DefaultInit
struct E { }// RUN: %target-typecheck-verify-swift -swift-version 4
func bet() where A : B {} // expected-error {{'where' clause cannot be applied to a non-generic top-level declaration}}
typealias gimel = Int where A : B // expected-error {{'where' clause cannot be applied to a non-generic top-level declaration}}
class dalet where A : B {} // expected-error {{'where' clause cannot be applied to a non-generic top-level declaration}}
struct Where {
func bet() where A == B {} // expected-error {{'where' clause on non-generic member declaration requires a generic context}}
typealias gimel = Int where A : B // expected-error {{'where' clause on non-generic member declaration requires a generic context}}
class dalet where A : B {} // expected-error {{'where' clause on non-generic member declaration requires a generic context}}
}
// Make sure Self: ... is correctly diagnosed in classes
class SelfInGenericClass<T> {
// expected-error@+1 {{type 'Self' in conformance requirement does not refer to a generic parameter or associated type}}
func foo() where Self: Equatable { }
// expected-error@+1 {{generic signature requires types 'Self' and 'Bool' to be the same}}
func bar() where Self == Bool { }
}
protocol Whereable {
associatedtype Assoc
associatedtype Bssoc
// expected-error@+1 {{instance method requirement 'requirement1()' cannot add constraint 'Self.Assoc: Sequence' on 'Self'}}
func requirement1() where Assoc: Sequence
// expected-error@+1 {{instance method requirement 'requirement2()' cannot add constraint 'Self.Bssoc == Never' on 'Self'}}
func requirement2() where Bssoc == Never
}
extension Whereable {
// expected-note@+1 {{where 'Self' = 'T1'}}
static func staticExtensionFunc(arg: Self.Element) -> Self.Element
where Self: Sequence {
return arg
}
// expected-note@+1 {{where 'Self.Assoc' = 'T1.Assoc', 'Self.Bssoc' = 'T1.Bssoc'}}
func extensionFunc() where Assoc == Bssoc { }
// expected-note@+1 {{where 'Self.Assoc' = 'T1.Assoc'}}
subscript() -> Assoc where Assoc: Whereable {
fatalError()
}
}
func testProtocolExtensions<T1, T2, T3, T4>(t1: T1, t2: T2, t3: T3, t4: T4)
where T1: Whereable,
T2: Whereable & Sequence,
T3: Whereable, T3.Assoc == T3.Bssoc,
T4: Whereable, T4.Assoc: Whereable {
_ = T1.staticExtensionFunc // expected-error {{static method 'staticExtensionFunc(arg:)' requires that 'T1' conform to 'Sequence'}}
_ = T2.staticExtensionFunc
t1.extensionFunc() // expected-error {{instance method 'extensionFunc()' requires the types 'T1.Assoc' and 'T1.Bssoc' be equivalent}}
t3.extensionFunc()
_ = t1[] // expected-error {{subscript 'subscript()' requires that 'T1.Assoc' conform to 'Whereable'}}
_ = t4[]
}
class Class<T> {
// expected-note@+1 {{where 'T' = 'T}} // expected-note@+1 {{where 'T.Assoc' = 'T.Assoc'}}
static func staticFunc() where T: Whereable, T.Assoc == Int { }
// expected-note@+1 {{candidate requires that the types 'T' and 'Bool' be equivalent}}
func func1() where T == Bool { }
// FIXME: The rhs type at the end of the error message is not persistent across compilations.
// expected-note@+1 {{candidate requires that the types 'T' and 'Int' be equivalent (requirement specified as 'T' == }}
func func1() where T == Int { }
func func2() where T == Int { } // expected-note {{where 'T' = 'T'}}
subscript() -> T.Element where T: Sequence { // expected-note {{where 'T' = 'T'}}
fatalError()
}
}
extension Class {
static func staticExtensionFunc() where T: Class<Int> { } // expected-note {{where 'T' = 'T'}}
subscript(arg: T.Element) -> T.Element where T == Array<Int> {
fatalError()
}
}
extension Class where T: Equatable {
func extensionFunc() where T: Comparable { } // expected-note {{where 'T' = 'T'}}
// expected-error@+1 {{no type for 'T' can satisfy both 'T == Class<Int>' and 'T : Equatable'}}
func badRequirement1() where T == Class<Int> { }
}
extension Class where T == Bool {
// expected-error@+1 {{no type for 'T' can satisfy both 'T == Int' and 'T == Bool'}}
func badRequirement2() where T == Int { }
}
func testMemberDeclarations<T, U: Comparable>(arg1: Class<T>, arg2: Class<U>) {
// expected-error@+2 {{static method 'staticFunc()' requires the types 'T.Assoc' and 'Int' be equivalent}}
// expected-error@+1 {{static method 'staticFunc()' requires that 'T' conform to 'Whereable'}}
Class<T>.staticFunc()
Class<T>.staticExtensionFunc() // expected-error {{static method 'staticExtensionFunc()' requires that 'T' inherit from 'Class<Int>'}}
Class<Class<Int>>.staticExtensionFunc()
arg1.func1() // expected-error {{no exact matches in call to instance method 'func1'}}
arg1.func2() // expected-error {{instance method 'func2()' requires the types 'T' and 'Int' be equivalent}}
arg1.extensionFunc() // expected-error {{instance method 'extensionFunc()' requires that 'T' conform to 'Comparable'}}
arg2.extensionFunc()
Class<Int>().func1()
Class<Int>().func2()
arg1[] // expected-error {{subscript 'subscript()' requires that 'T' conform to 'Sequence'}}
_ = Class<Array<Int>>()[Int.zero]
}
// Test nested types and requirements.
struct Container<T> {
typealias NestedAlias = Bool where T == Int
// expected-note@-1 {{'NestedAlias' previously declared here}}
typealias NestedAlias = Bool where T == Bool
// expected-error@-1 {{invalid redeclaration of 'NestedAlias}}
typealias NestedAlias2 = T.Magnitude where T: FixedWidthInteger
typealias NestedAlias3 = T.Element where T: Sequence
class NestedClass where T: Equatable {}
}
extension Container where T: Sequence {
struct NestedStruct {}
struct NestedStruct2 where T.Element: Comparable {
enum NestedEnum where T.Element == Double {} // expected-note {{requirement specified as 'T.Element' == 'Double' [with T = String]}}
}
struct NestedStruct3<U: Whereable> {}
}
extension Container.NestedStruct3 {
func foo(arg: U) where U.Assoc == T {}
}
_ = Container<String>.NestedAlias2.self // expected-error {{type 'String' does not conform to protocol 'FixedWidthInteger'}}
_ = Container<Container<Bool>>.NestedClass.self // expected-error {{type 'Container<Bool>' does not conform to protocol 'Equatable'}}
_ = Container<Void>.NestedStruct.self // expected-error {{type 'Void' does not conform to protocol 'Sequence'}}
_ = Container<Array<Void>>.NestedStruct2.self // expected-error {{type 'Void' does not conform to protocol 'Comparable'}}
_ = Container<String>.NestedStruct2.NestedEnum.self // expected-error {{'Container<T>.NestedStruct2.NestedEnum' requires the types 'String.Element' (aka 'Character') and 'Double' be equivalent}}
_ = Container<Int>.NestedAlias2.self
_ = Container<Bool>.NestedClass.self
_ = Container<String>.NestedStruct.self
_ = Container<Array<UInt8>>.NestedStruct2.self
_ = Container<Array<Double>>.NestedStruct2.NestedEnum.self
// Make sure the substitution here actually succeeds instead of producing an ErrorType
func sameType<T>(_: T.Type, _: T.Type) {}
sameType(Container<Array<Int>>.NestedAlias3.self, Int.self)
sameType(Container<Array<Bool>>.NestedAlias3.self, Int.self)
// expected-error@-1 {{cannot convert value of type 'Int.Type' to expected argument type 'Container<Array<Bool>>.NestedAlias3.Type' (aka 'Bool.Type')}}
sameType(Container<Array<Int>>.NestedAlias3.self, Bool.self)
// expected-error@-1 {{cannot convert value of type 'Bool.Type' to expected argument type 'Container<Array<Int>>.NestedAlias3.Type' (aka 'Int.Type')}}
#89073
Assertion failed: (Context.SourceMgr.hasIDEInspectionTargetBuffer() || Context.LangOpts.IsForSourceKit || Context.TypeCheckerOpts.EnableLazyTypecheck || inSecondaryScriptFile() && "Querying VarDecl's type before type-checking parent stmt"), function evaluate at TypeCheckDecl.cpp:2766.
swift
CRASH 134
2026-05-15
Aparent_aBparent_bA·Bbothnewnovel / fused
1new
var fusion_0e59 = c2
3new
let a: Int? = fusion_0e594B
guard let b = a else {5new
fatalError()6A·B
}7
8new
func foo() {}9
10B
let c = bAparent_aBparent_bA·Bbothnewnovel / fused
1new
// --- Seed A ---2A
func myPrintR(_ dict: [String: Any]) {3A
let sortedDict = dict.sorted(by: { $0.key < $1.key })4A
for (key, value) in sortedDict {5A
print("\(key): \(value)")6A·B
}7A·B
}8
9A
func f1() {10A
let c = 111A
print("Extracted:")12A
myPrintR(["": c])13A
myPrintR(["c": c])14A·B
}15
16A
func f2() {17A
let a = 118A
let c = 119A
print("Extracted:")20A
myPrintR(["a": c])21A
myPrintR(["c": c, "a": a])22A·B
}23
24A
func f3() {25A
let a = 126A
let c = 127A
print("Extracted:")28A
myPrintR(["a": c])29A
myPrintR(["c": c, "prefix_a": a])30A·B
}31
32A
func f4() {33A
let c = 134A
print("Extracted:")35A
myPrintR(["": c])36A
myPrintR(["c": c])37A·B
}38
39A
func f5() {40A
let c = 141A
print("Extracted:")42A
myPrintR(["111": c])43A
myPrintR(["c": c])44A·B
}45
46A
f1()47A
f2()48A
f3()49A
f4()50A
f5()51
52new
// --- Fusion Bridge ---53new
var fusion_0e59 = c54
55new
// --- Seed B ---56B
// RUN: %target-typecheck-verify-swift57
58new
let a: Int? = fusion_0e5959B
guard let b = a else {60A·B
}61
62B
func foo() {} // to interrupt the TopLevelCodeDecl63
64B
let c = b65new
// --- Bug Primitive ---66
67new
// P4: Closure capture / @escaping / ownership stress68new
func _ffl_p4_apply<T>(_ f: () -> T) -> T { f() }69new
func _ffl_p4_escape<T>(_ f: @escaping () -> T) -> () -> T { f }70new
do {71new
var _ffl_cap = fusion_0e5972new
// noescape: bridge captured by reference on the stack73new
let _ffl_local = _ffl_p4_apply { _ffl_cap }74new
// @escaping: bridge promoted to heap box75new
let _ffl_esc = _ffl_p4_escape { _ffl_cap }76new
// nested closure capturing both outer and inner captures77new
let _ffl_nest: () -> String = {78new
let inner = _ffl_esc()79new
return "\(inner) \(_ffl_local)"80A·B
}81new
_ = _ffl_nest()82new
// mutation after escape — probes copy-on-write / exclusive-access83new
_ffl_cap = fusion_0e5984new
_ = _ffl_esc()85A·B
}Assertion failed: (Context.SourceMgr.hasIDEInspectionTargetBuffer() || Context.LangOpts.IsForSourceKit || Context.TypeCheckerOpts.EnableLazyTypecheck || inSecondaryScriptFile() && "Querying VarDecl's type before type-checking parent stmt"), function evaluate at TypeCheckDecl.cpp:2766.
(to display assertion configuration options: -Xllvm -assert-help)
Please submit a bug report (https://swift.org/contributing/#reporting-bugs) and include the crash backtrace.
Stack dump:
0. Program arguments: /usr/bin/swift-frontend -emit-sil -wmo -sil-verify-all /home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpk5la4wyv/f1b72f43.swift
1. Swift version 6.4-dev (LLVM d2079213f1d4451, Swift 82b7720768ba875)
2. Compiling with effective version 5.10
3. While evaluating request TypeCheckPrimaryFileRequest(source_file "/home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpk5la4wyv/f1b72f43.swift")
4. While type-checking statement at [/home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpk5la4wyv/f1b72f43.swift:55:1 - line:55:19] RangeText="var fusion_0e59 = "
5. While type-checking declaration 0x56f908c08b60 (at /home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpk5la4wyv/f1b72f43.swift:55:1)
6. While evaluating request PatternBindingEntryRequest((unknown decl)@/home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpk5la4wyv/f1b72f43.swift:55:1, 0)
7. While type-checking expression at [/home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpk5la4wyv/f1b72f43.swift:55:19 - line:55:19] RangeText=""
8. While type-checking-target starting at /home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpk5la4wyv/f1b72f43.swift:55:19
9. While evaluating request InterfaceTypeRequest(f1b72f43.(file).c@/home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpk5la4wyv/f1b72f43.swift:66:5)
10. While evaluating request NamingPatternRequest(f1b72f43.(file).c@/home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpk5la4wyv/f1b72f43.swift:66:5)
11. While evaluating request PatternBindingEntryRequest((unknown decl)@/home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpk5la4wyv/f1b72f43.swift:66:1, 0)
12. While type-checking expression at [/home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpk5la4wyv/f1b72f43.swift:66:9 - line:66:9] RangeText=""
13. While type-checking-target starting at /home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpk5la4wyv/f1b72f43.swift:66:9
14. While evaluating request InterfaceTypeRequest(f1b72f43.(file).top-level code.b@/home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpk5la4wyv/f1b72f43.swift:61:11)
15. While evaluating request NamingPatternRequest(f1b72f43.(file).top-level code.b@/home/fuzz/WorkSpace/fusion-fuzz/.fused/swift/tmpk5la4wyv/f1b72f43.swift:61:11)
16. Assertion failed: (Context.SourceMgr.hasIDEInspectionTargetBuffer() || Context.LangOpts.IsForSourceKit || Context.TypeCheckerOpts.EnableLazyTypecheck || inSecondaryScriptFile() && "Querying VarDecl's type before type-checking parent stmt"), function evaluate at TypeCheckDecl.cpp:2766.
| (to display assertion configuration options: -Xllvm -assert-help)
#0 0x000056f901797c98 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/usr/bin/swift-frontend+0x8bb8c98)
#1 0x000056f9017954b5 llvm::sys::RunSignalHandlers() (/usr/bin/swift-frontend+0x8bb64b5)
#2 0x000056f901798a51 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007192c7a05330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#4 0x00007192c7a5eb2c pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x9eb2c)
#5 0x00007192c7a0527e raise (/lib/x86_64-linux-gnu/libc.so.6+0x4527e)
#6 0x00007192c79e88ff abort (/lib/x86_64-linux-gnu/libc.so.6+0x288ff)
#7 0x000056f8fb8ba392 (/usr/bin/swift-frontend+0x2cdb392)
#8 0x000056f8fb8ba344 (/usr/bin/swift-frontend+0x2cdb344)
#9 0x000056f8fad6110f swift::NamingPatternRequest::evaluate(swift::Evaluator&, swift::VarDecl*) const (/usr/bin/swift-frontend+0x218210f)
#10 0x000056f8fb50d13f swift::NamingPatternRequest::OutputType swift::Evaluator::getResultUncached<swift::NamingPatternRequest, swift::NamingPatternRequest::OutputType swift::evaluateOrDefault<swift::NamingPatternRequest>(swift::Evaluator&, swift::NamingPatternRequest, swift::NamingPatternRequest::OutputType)::'lambda'()>(swift::NamingPatternRequest const&, swift::NamingPatternRequest::OutputType swift::evaluateOrDefault<swift::NamingPatternRequest>(swift::Evaluator&, swift::NamingPatternRequest, swift::NamingPatternRequest::OutputType)::'lambda'()) crtstuff.c:0:0
#11 0x000056f8fb473009 swift::VarDecl::getNamingPattern() const (/usr/bin/swift-frontend+0x2894009)
#12 0x000056f8fad5f4ef swift::InterfaceTypeRequest::evaluate(swift::Evaluator&, swift::ValueDecl*) const (/usr/bin/swift-frontend+0x21804ef)
#13 0x000056f8fb453c05 swift::ValueDecl::getInterfaceType() const (/usr/bin/swift-frontend+0x2874c05)
#14 0x000056f8fb472931 swift::VarDecl::getTypeInContext() const (/usr/bin/swift-frontend+0x2893931)
#15 0x000056f8fab233c2 (anonymous namespace)::ConstraintWalker::walkToExprPost(swift::Expr*) CSGen.cpp:0:0
#16 0x000056f8fb3c88a6 (anonymous namespace)::Traversal::doIt(swift::Expr*) ASTWalker.cpp:0:0
#17 0x000056f8fb3c87b3 swift::Expr::walk(swift::ASTWalker&) (/usr/bin/swift-frontend+0x27e97b3)
#18 0x000056f8fab1755e swift::constraints::ConstraintSystem::generateConstraints(swift::Expr*, swift::DeclContext*) (/usr/bin/swift-frontend+0x1f3855e)
#19 0x000056f8fab1602b swift::constraints::ConstraintSystem::generateConstraints(swift::constraints::SyntacticElementTarget&, swift::FreeTypeVariableBinding) (/usr/bin/swift-frontend+0x1f3702b)
#20 0x000056f8fab8a980 swift::constraints::ConstraintSystem::solveImpl(swift::constraints::SyntacticElementTarget&, swift::FreeTypeVariableBinding) (/usr/bin/swift-frontend+0x1fab980)
#21 0x000056f8fab8a296 swift::constraints::ConstraintSystem::solve(swift::constraints::SyntacticElementTarget&, swift::FreeTypeVariableBinding) (/usr/bin/swift-frontend+0x1fab296)
#22 0x000056f8fad4ad65 swift::TypeChecker::typeCheckTarget(swift::constraints::SyntacticElementTarget&, swift::optionset::OptionSet<swift::TypeCheckExprFlags, unsigned int>, swift::DiagnosticTransaction*) (/usr/bin/swift-frontend+0x216bd65)
#23 0x000056f8fad4abe1 swift::TypeChecker::typeCheckExpression(swift::constraints::SyntacticElementTarget&, swift::optionset::OptionSet<swift::TypeCheckExprFlags, unsigned int>, swift::DiagnosticTransaction*) (/usr/bin/swift-frontend+0x216bbe1)
#24 0x000056f8fad4cad5 swift::TypeChecker::typeCheckBinding(swift::Pattern*&, swift::Expr*&, swift::DeclContext*, swift::Type, swift::PatternBindingDecl*, unsigned int, swift::optionset::OptionSet<swift::TypeCheckExprFlags, unsigned int>) (/usr/bin/swift-frontend+0x216dad5)
#25 0x000056f8fad4cdca swift::TypeChecker::typeCheckPatternBinding(swift::PatternBindingDecl*, unsigned int, swift::Type, swift::optionset::OptionSet<swift::TypeCheckExprFlags, unsigned int>) (/usr/bin/swift-frontend+0x216ddca)
#26 0x000056f8fae629d2 swift::PatternBindingEntryRequest::evaluate(swift::Evaluator&, swift::PatternBindingDecl*, unsigned int) const (/usr/bin/swift-frontend+0x22839d2)
#27 0x000056f8fb49f020 swift::PatternBindingEntryRequest::OutputType swift::Evaluator::getResultUncached<swift::PatternBindingEntryRequest, swift::PatternBindingEntryRequest::OutputType swift::evaluateOrDefault<swift::PatternBindingEntryRequest>(swift::Evaluator&, swift::PatternBindingEntryRequest, swift::PatternBindingEntryRequest::OutputType)::'lambda'()>(swift::PatternBindingEntryRequest const&, swift::PatternBindingEntryRequest::OutputType swift::evaluateOrDefault<swift::PatternBindingEntryRequest>(swift::Evaluator&, swift::PatternBindingEntryRequest, swift::PatternBindingEntryRequest::OutputType)::'lambda'()) crtstuff.c:0:0
#28 0x000056f8fb45c4c0 swift::PatternBindingDecl::getCheckedPatternBindingEntry(unsigned int) const (/usr/bin/swift-frontend+0x287d4c0)
#29 0x000056f8fad60dea swift::NamingPatternRequest::evaluate(swift::Evaluator&, swift::VarDecl*) const (/usr/bin/swift-frontend+0x2181dea)
#30 0x000056f8fb50d13f swift::NamingPatternRequest::OutputType swift::Evaluator::getResultUncached<swift::NamingPatternRequest, swift::NamingPatternRequest::OutputType swift::evaluateOrDefault<swift::NamingPatternRequest>(swift::Evaluator&, swift::NamingPatternRequest, swift::NamingPatternRequest::OutputType)::'lambda'()>(swift::NamingPatternRequest const&, swift::NamingPatternRequest::OutputType swift::evaluateOrDefault<swift::NamingPatternRequest>(swift::Evaluator&, swift::NamingPatternRequest, swift::NamingPatternRequest::OutputType)::'lambda'()) crtstuff.c:0:0
#31 0x000056f8fb473009 swift::VarDecl::getNamingPattern() const (/usr/bin/swift-frontend+0x2894009)
#32 0x000056f8fad5f4ef swift::InterfaceTypeRequest::evaluate(swift::Evaluator&, swift::ValueDecl*) const (/usr/bin/swift-frontend+0x21804ef)
#33 0x000056f8fb453c05 swift::ValueDecl::getInterfaceType() const (/usr/bin/swift-frontend+0x2874c05)
#34 0x000056f8fb472931 swift::VarDecl::getTypeInContext() const (/usr/bin/swift-frontend+0x2893931)
#35 0x000056f8fab233c2 (anonymous namespace)::ConstraintWalker::walkToExprPost(swift::Expr*) CSGen.cpp:0:0
#36 0x000056f8fb3c88a6 (anonymous namespace)::Traversal::doIt(swift::Expr*) ASTWalker.cpp:0:0
#37 0x000056f8fb3c87b3 swift::Expr::walk(swift::ASTWalker&) (/usr/bin/swift-frontend+0x27e97b3)
#38 0x000056f8fab1755e swift::constraints::ConstraintSystem::generateConstraints(swift::Expr*, swift::DeclContext*) (/usr/bin/swift-frontend+0x1f3855e)
#39 0x000056f8fab1602b swift::constraints::ConstraintSystem::generateConstraints(swift::constraints::SyntacticElementTarget&, swift::FreeTypeVariableBinding) (/usr/bin/swift-frontend+0x1f3702b)
#40 0x000056f8fab8a980 swift::constraints::ConstraintSystem::solveImpl(swift::constraints::SyntacticElementTarget&, swift::FreeTypeVariableBinding) (/usr/bin/swift-frontend+0x1fab980)
#41 0x000056f8fab8a296 swift::constraints::ConstraintSystem::solve(swift::constraints::SyntacticElementTarget&, swift::FreeTypeVariableBinding) (/usr/bin/swift-frontend+0x1fab296)
#42 0x000056f8fad4ad65 swift::TypeChecker::typeCheckTarget(swift::constraints::SyntacticElementTarget&, swift::optionset::OptionSet<swift::TypeCheckExprFlags, unsigned int>, swift::DiagnosticTransaction*) (/usr/bin/swift-frontend+0x216bd65)
#43 0x000056f8fad4abe1 swift::TypeChecker::typeCheckExpression(swift::constraints::SyntacticElementTarget&, swift::optionset::OptionSet<swift::TypeCheckExprFlags, unsigned int>, swift::DiagnosticTransaction*) (/usr/bin/swift-frontend+0x216bbe1)
#44 0x000056f8fad4cad5 swift::TypeChecker::typeCheckBinding(swift::Pattern*&, swift::Expr*&, swift::DeclContext*, swift::Type, swift::PatternBindingDecl*, unsigned int, swift::optionset::OptionSet<swift::TypeCheckExprFlags, unsigned int>) (/usr/bin/swift-frontend+0x216dad5)
#45 0x000056f8fad4cdca swift::TypeChecker::typeCheckPatternBinding(swift::PatternBindingDecl*, unsigned int, swift::Type, swift::optionset::OptionSet<swift::TypeCheckExprFlags, unsigned int>) (/usr/bin/swift-frontend+0x216ddca)
#46 0x000056f8fae629d2 swift::PatternBindingEntryRequest::evaluate(swift::Evaluator&, swift::PatternBindingDecl*, unsigned int) const (/usr/bin/swift-frontend+0x22839d2)
#47 0x000056f8fb49f020 swift::PatternBindingEntryRequest::OutputType swift::Evaluator::getResultUncached<swift::PatternBindingEntryRequest, swift::PatternBindingEntryRequest::OutputType swift::evaluateOrDefault<swift::PatternBindingEntryRequest>(swift::Evaluator&, swift::PatternBindingEntryRequest, swift::PatternBindingEntryRequest::OutputType)::'lambda'()>(swift::PatternBindingEntryRequest const&, swift::PatternBindingEntryRequest::OutputType swift::evaluateOrDefault<swift::PatternBindingEntryRequest>(swift::Evaluator&, swift::PatternBindingEntryRequest, swift::PatternBindingEntryRequest::OutputType)::'lambda'()) crtstuff.c:0:0
#48 0x000056f8fb45c4c0 swift::PatternBindingDecl::getCheckedPatternBindingEntry(unsigned int) const (/usr/bin/swift-frontend+0x287d4c0)
#49 0x000056f8fad97fd7 (anonymous namespace)::DeclChecker::visit(swift::Decl*) TypeCheckDeclPrimary.cpp:0:0
#50 0x000056f8fad97cc4 swift::TypeChecker::typeCheckDecl(swift::Decl*) (/usr/bin/swift-frontend+0x21b8cc4)
#51 0x000056f8fae56a6c swift::ASTVisitor<(anonymous namespace)::StmtChecker, void, swift::Stmt*, void, void, void, void>::visit(swift::Stmt*) TypeCheckStmt.cpp:0:0
#52 0x000056f8fae592bc bool (anonymous namespace)::StmtChecker::typeCheckStmt<swift::BraceStmt>(swift::BraceStmt*&) TypeCheckStmt.cpp:0:0
#53 0x000056f8fae51c36 swift::TypeChecker::typeCheckTopLevelCodeDecl(swift::TopLevelCodeDecl*) (/usr/bin/swift-frontend+0x2272c36)
#54 0x000056f8faed05ba swift::TypeCheckPrimaryFileRequest::evaluate(swift::Evaluator&, swift::SourceFile*) const (/usr/bin/swift-frontend+0x22f15ba)
#55 0x000056f8faed4f5b swift::TypeCheckPrimaryFileRequest::OutputType swift::Evaluator::getResultUncached<swift::TypeCheckPrimaryFileRequest, swift::TypeCheckPrimaryFileRequest::OutputType swift::evaluateOrDefault<swift::TypeCheckPrimaryFileRequest>(swift::Evaluator&, swift::TypeCheckPrimaryFileRequest, swift::TypeCheckPrimaryFileRequest::OutputType)::'lambda'()>(swift::TypeCheckPrimaryFileRequest const&, swift::TypeCheckPrimaryFileRequest::OutputType swift::evaluateOrDefault<swift::TypeCheckPrimaryFileRequest>(swift::Evaluator&, swift::TypeCheckPrimaryFileRequest, swift::TypeCheckPrimaryFileRequest::OutputType)::'lambda'()) crtstuff.c:0:0
#56 0x000056f8faed04c8 swift::performTypeChecking(swift::SourceFile&) (/usr/bin/swift-frontend+0x22f14c8)
#57 0x000056f8f99a4c39 bool llvm::function_ref<bool (swift::SourceFile&)>::callback_fn<swift::CompilerInstance::performSema()::$_10>(long, swift::SourceFile&) Frontend.cpp:0:0
#58 0x000056f8f999a96e swift::CompilerInstance::forEachFileToTypeCheck(llvm::function_ref<bool (swift::SourceFile&)>) (/usr/bin/swift-frontend+0xdbb96e)
#59 0x000056f8f999a6eb swift::CompilerInstance::performSema() (/usr/bin/swift-frontend+0xdbb6eb)
#60 0x000056f8f96050e2 withSemanticAnalysis(swift::CompilerInstance&, swift::FrontendObserver*, llvm::function_ref<bool (swift::CompilerInstance&)>, bool) FrontendTool.cpp:0:0
#61 0x000056f8f95f2b95 performCompile(swift::CompilerInstance&, int&, swift::FrontendObserver*, llvm::ArrayRef<char const*>) FrontendTool.cpp:0:0
#62 0x000056f8f95ef81e swift::performFrontend(llvm::ArrayRef<char const*>, char const*, void*, swift::FrontendObserver*) (/usr/bin/swift-frontend+0xa1081e)
#63 0x000056f8f9314681 swift::mainEntry(int, char const**) (/usr/bin/swift-frontend+0x735681)
#64 0x00007192c79ea1ca (/lib/x86_64-linux-gnu/libc.so.6+0x2a1ca)
#65 0x00007192c79ea28b __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28b)
#66 0x000056f8f9313575 _start (/usr/bin/swift-frontend+0x734575)
*** Signal 6: Backtracing from 0x7192c7ae728d... done ***
*** Program crashed: Aborted at 0x00007192c7ae728d ***
Platform: x86_64 Linux (Ubuntu 24.04.4 LTS)
Thread 0 "swift-frontend" crashed:
0 0x00007192c7ae728d <unknown> in libc.so.6
Registers:
rax 0x0000000000000000 0
rdx 0x0000000000000006 6
rcx 0x00007192c7ae728d 48 3d 01 f0 ff ff 73 01 c3 48 8b 0d 5b bb 0d 00 H=·ðÿÿs·ÃH··[»··
rbx 0x0000000000000006 6
rsi 0x000000000017499e 1526174
rdi 0x000000000017499e 1526174
rbp 0x000000000017499e 1526174
rsp 0x000056f9088af328 7b 8a 79 01 f9 56 00 00 b0 f5 8a 08 f9 56 00 00 {·y·ùV··°õ··ùV··
r8 0x000056f9088af5b0 06 00 00 00 00 00 00 00 fa ff ff ff 00 00 00 00 ········úÿÿÿ····
r9 0x000056f9088af5b0 06 00 00 00 00 00 00 00 fa ff ff ff 00 00 00 00 ········úÿÿÿ····
r10 0x000056f9088af5b0 06 00 00 00 00 00 00 00 fa ff ff ff 00 00 00 00 ········úÿÿÿ····
r11 0x0000000000000246 582
r12 0x0000000000000006 6
r13 0x0000000000000008 8
r14 0x0000000000000000 0
r15 0x000056f9088af3c8 ff ff ff 7f fe ff ff ff 00 00 00 00 00 00 00 00 ÿÿÿ·þÿÿÿ········
rip 0x00007192c7ae728d 48 3d 01 f0 ff ff 73 01 c3 48 8b 0d 5b bb 0d 00 H=·ðÿÿs·ÃH··[»··
rflags 0x0000000000000246 ZF PF
cs 0x0033 fs 0x0000 gs 0x0000
Images (29 omitted):
0x00007192c79c0000–0x00007192c7b6fd39 8e9fd827446c24067541ac5390e6f527fb5947bb libc.so.6 /usr/lib/x86_64-linux-gnu/libc.so.6
Backtrace took 0.00s
Aborted (core dumped)func myPrintR(_ dict: [String: Any]) {
let sortedDict = dict.sorted(by: { $0.key < $1.key })
for (key, value) in sortedDict {
print("\(key): \(value)")
}
}
func f1() {
let c = 1
print("Extracted:")
myPrintR(["": c])
myPrintR(["c": c])
}
func f2() {
let a = 1
let c = 1
print("Extracted:")
myPrintR(["a": c])
myPrintR(["c": c, "a": a])
}
func f3() {
let a = 1
let c = 1
print("Extracted:")
myPrintR(["a": c])
myPrintR(["c": c, "prefix_a": a])
}
func f4() {
let c = 1
print("Extracted:")
myPrintR(["": c])
myPrintR(["c": c])
}
func f5() {
let c = 1
print("Extracted:")
myPrintR(["111": c])
myPrintR(["c": c])
}
f1()
f2()
f3()
f4()
f5()// RUN: %target-typecheck-verify-swift
let a: Int? = 1
guard let b = a else {
}
func foo() {} // to interrupt the TopLevelCodeDecl
let c = b
#22004
Assertion:info & (1 << type)
php
CRASH 134
2026-05-11
Aparent_aBparent_bA·Bbothnewnovel / fused
1A·B
<?php2new
try {3A
function doRandom($iter) {4A
for ($i = 0; $i < $iter; $i++) {5A
$lines = [];6A
for ($j = 0; $j < $nLines; $j++) {7A
$lines[] = $line;8A·B
}9A
foreach ($lines as $i => $line) {10A·B
}11A·B
}12A·B
}13A
$iter = 10000;14A
doRandom($iter);15new
} catch (\Throwable $_ffl_e) {}Aparent_aBparent_bA·Bbothnewnovel / fused
1A·B
<?php2new
try {3A
function printable($s) {4A
$result = '';5A
for ($i = 0; $i < strlen($s); $i++) {6A
$ch = $s[$i];7A
if (ord($ch) <= 32 || ord($ch) >= 128) {8A
$result .= '(' . ord($ch) . ')';9A
} else {10A
$result .= $ch;11A·B
}12A·B
}13A
return $result;14A·B
}15A
function randStr() {16A
$sz = rand(0, 20);17A
$buf = '';18A
for ($i = 0; $i < $sz; $i++) {19A
$what = rand(0, 19);20A
switch ($what) {21A
case 0: $buf .= "\r"; break;22A
case 1: $buf .= "\n"; break;23A
case 2: $buf .= "\t"; break;24A
case 3: $buf .= "\f"; break;25A
case 4: $buf .= ' '; break;26A
case 5: $buf .= ','; break;27A
case 6: $buf .= '"'; break;28A
case 7: $buf .= "'"; break;29A
case 8: $buf .= "\\"; break;30A
default: $buf .= chr(rand(0, 299)); break;31A·B
}32A·B
}33A
return $buf;34A·B
}35A
function doRandom($iter) {36A
for ($i = 0; $i < $iter; $i++) {37A
$nLines = rand(1, 4);38A
$nCol = rand(1, 3);39A
$lines = [];40A
for ($j = 0; $j < $nLines; $j++) {41A
$line = [];42A
for ($k = 0; $k < $nCol; $k++) {43A
$line[] = randStr();44A·B
}45A
$lines[] = $line;46A·B
}47A
$result = '';48A
foreach ($lines as $line) {49A
$result .= implode(',', array_map(function($v) {50A
return '"' . str_replace('"', '""', $v) . '"';51A
}, $line)) . "\n";52A·B
}53A
$parseResult = explode("\n", trim($result));54A
foreach ($lines as $i => $line) {55A
$parsedLine = explode(',', $parseResult[$i]);56A
for ($j = 0; $j < count($line); $j++) {57A
if ($line[$j] !== trim($parsedLine[$j], '"')) {58A
break;59A·B
}60A·B
}61A·B
}62A·B
}63A·B
}64A
$iter = 10000;65A
doRandom($iter);66B
function foo() {67B
$a = array(1,2,3);68B
$b=&$a;69B
$b=1;70B
$a = new stdClass;71B
$a->a=1;72B
$a->b=2;73B
$b=&$a;74A·B
}75B
foo();76B
echo "ok\n";77new
var_dump(get_defined_vars());78new
} catch (\Throwable $_ffl_e) {}php: ext/opcache/jit/zend_jit_trace.c:361: uint32_t zend_jit_trace_type_to_info_ex(uint8_t, uint32_t): Assertion `info & (1 << type)' failed.
Aborted (core dumped)
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30
Deprecated: chr(): Providing a value not in-between 0 and 255 is deprecated, this is because a byte value must be in the [0, 255] interval. The value used will be constrained using % 256 in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/3534aec2.php on line 30<?php
function printable($s) {
$result = '';
for ($i = 0; $i < strlen($s); $i++) {
$ch = $s[$i];
if (ord($ch) <= 32 || ord($ch) >= 128) {
$result .= '(' . ord($ch) . ')';
} else {
$result .= $ch;
}
}
return $result;
}
function randStr() {
$sz = rand(0, 20);
$buf = '';
for ($i = 0; $i < $sz; $i++) {
$what = rand(0, 19);
switch ($what) {
case 0: $buf .= "\r"; break;
case 1: $buf .= "\n"; break;
case 2: $buf .= "\t"; break;
case 3: $buf .= "\f"; break;
case 4: $buf .= ' '; break;
case 5: $buf .= ','; break;
case 6: $buf .= '"'; break;
case 7: $buf .= "'"; break;
case 8: $buf .= "\\"; break;
default: $buf .= chr(rand(0, 299)); break;
}
}
return $buf;
}
function doRandom($iter) {
for ($i = 0; $i < $iter; $i++) {
$nLines = rand(1, 4);
$nCol = rand(1, 3);
$lines = [];
for ($j = 0; $j < $nLines; $j++) {
$line = [];
for ($k = 0; $k < $nCol; $k++) {
$line[] = randStr();
}
$lines[] = $line;
}
$result = '';
foreach ($lines as $line) {
$result .= implode(',', array_map(function($v) {
return '"' . str_replace('"', '""', $v) . '"';
}, $line)) . "\n";
}
$parseResult = explode("\n", trim($result));
foreach ($lines as $i => $line) {
$parsedLine = explode(',', $parseResult[$i]);
for ($j = 0; $j < count($line); $j++) {
if ($line[$j] !== trim($parsedLine[$j], '"')) {
break;
}
}
}
}
}
$iter = 10000;
doRandom($iter);
?><?php
function foo() {
$a = array(1,2,3);
$b=&$a;
$b=1;
$a = new stdClass;
$a->a=1;
$a->b=2;
$b=&$a;
}
foo();
echo "ok\n";
?>
#21994
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/gd/libgd/gd_png.c:556:54 in
php
CRASH 1
2026-05-10
Aparent_aBparent_bA·Bbothnewnovel / fused
1A·B
<?php2new
try {3A
$exp = imagecreate(100, 100);4new
imageresolution($exp, 71, 0x80000000);5A
imagepng($exp, $filename);6new
} catch (\Throwable $_ffl_e) {}Aparent_aBparent_bA·Bbothnewnovel / fused
1A·B
<?php2new
try {3A
$filename = __DIR__ . DIRECTORY_SEPARATOR . 'imageresolution_png.png';4A
$exp = imagecreate(100, 100);5A
imagecolorallocate($exp, 255, 0, 0);6A
imageresolution($exp, 71);7A
imagepng($exp, $filename);8A
$act = imagecreatefrompng($filename);9A
var_dump(imageresolution($act));10new
imageresolution($exp, 71, 0x80000000);11A
imagepng($exp, $filename);12A
$act = imagecreatefrompng($filename);13A
var_dump(imageresolution($act));14B
class MappedFile {15B
const DEFAULT_CAPACITY = 1 << 40;16B
private $chunkSize;17B
private $overlapSize;18B
private $stores = [];19B
private $closed = false;20B
private $capacity;21B
public function __construct($chunkSize, $overlapSize, $capacity) {22B
$this->chunkSize = $this->mapAlign($chunkSize);23B
$this->overlapSize = $this->mapAlign($overlapSize);24B
$this->capacity = $capacity;25B
}26B
public static function create($chunkSize, $overlapSize) {27B
return new self($chunkSize, $overlapSize, self::DEFAULT_CAPACITY);28B
}29B
private function mapAlign($size) {30B
return $size; // Simulating alignment31B
}32B
public function acquireByteStore($position) {33B
if ($this->closed) {34B
throw new Exception("Closed");35B
}36B
$chunk = (int)($position / $this->chunkSize);37B
while (count($this->stores) <= $chunk) {38B
$this->stores[] = null;39B
}40B
if (isset($this->stores[$chunk])) {41B
return $this->stores[$chunk]; // Return existing store if available42B
}43B
$this->stores[$chunk] = $this->createByteStore($chunk);44B
return $this->stores[$chunk];45B
}46B
private function createByteStore($chunk) {47B
return new MappedBytesStore($chunk * $this->chunkSize, $this->chunkSize + $this->overlapSize);48B
}49B
public function close() {50B
$this->closed = true;51B
foreach ($this->stores as $store) {52B
if ($store !== null) {53B
$store->release();54B
}55B
}56B
}57B
}58B
class MappedBytesStore {59B
private $address;60B
private $size;61B
public function __construct($address, $size) {62B
$this->address = $address;63B
$this->size = $size;64B
}65B
public function release() {66B
// Simulate releasing resources67B
}68B
}69B
function main() {70B
$mappedFile = MappedFile::create(1024, 256);71B
$mappedBytesStore = $mappedFile->acquireByteStore(0);72B
$mappedFile->close();73B
}74B
main();75new
var_dump(get_defined_vars());76new
} catch (\Throwable $_ffl_e) {}/home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/gd/libgd/gd_png.c:556:54: runtime error: 8.45466e+10 is outside the range of representable values of type 'unsigned int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/gd/libgd/gd_png.c:556:54 in
array(2) {
[0]=>
int(71)
[1]=>
int(71)
}<?php
$filename = __DIR__ . DIRECTORY_SEPARATOR . 'imageresolution_png.png';
$exp = imagecreate(100, 100);
imagecolorallocate($exp, 255, 0, 0);
imageresolution($exp, 71);
imagepng($exp, $filename);
$act = imagecreatefrompng($filename);
var_dump(imageresolution($act));
imageresolution($exp, 71, 299);
imagepng($exp, $filename);
$act = imagecreatefrompng($filename);
var_dump(imageresolution($act));
?><?php
class MappedFile {
const DEFAULT_CAPACITY = 1 << 40;
private $chunkSize;
private $overlapSize;
private $stores = [];
private $closed = false;
private $capacity;
public function __construct($chunkSize, $overlapSize, $capacity) {
$this->chunkSize = $this->mapAlign($chunkSize);
$this->overlapSize = $this->mapAlign($overlapSize);
$this->capacity = $capacity;
}
public static function create($chunkSize, $overlapSize) {
return new self($chunkSize, $overlapSize, self::DEFAULT_CAPACITY);
}
private function mapAlign($size) {
return $size; // Simulating alignment
}
public function acquireByteStore($position) {
if ($this->closed) {
throw new Exception("Closed");
}
$chunk = (int)($position / $this->chunkSize);
while (count($this->stores) <= $chunk) {
$this->stores[] = null;
}
if (isset($this->stores[$chunk])) {
return $this->stores[$chunk]; // Return existing store if available
}
$this->stores[$chunk] = $this->createByteStore($chunk);
return $this->stores[$chunk];
}
private function createByteStore($chunk) {
return new MappedBytesStore($chunk * $this->chunkSize, $this->chunkSize + $this->overlapSize);
}
public function close() {
$this->closed = true;
foreach ($this->stores as $store) {
if ($store !== null) {
$store->release();
}
}
}
}
class MappedBytesStore {
private $address;
private $size;
public function __construct($address, $size) {
$this->address = $address;
$this->size = $size;
}
public function release() {
// Simulate releasing resources
}
}
function main() {
$mappedFile = MappedFile::create(1024, 256);
$mappedBytesStore = $mappedFile->acquireByteStore(0);
$mappedFile->close();
}
main();
#21952
SUMMARY: AddressSanitizer: heap-use-after-free /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/dom/php_dom.c:322:18 in php_dom_object_get_data
php
CRASH 1
2026-05-05
Aparent_aBparent_bA·Bbothnewnovel / fused
1A·B
<?php2new
try {3A
$doc = new DOMDocument;4A
$doc->loadXML(<<<'XML'5A
<!DOCTYPE books [6A
<!NOTATION myNotation SYSTEM "test.dtd">7A
]>8A
<container/>9A
XML);10A
$notation = $doc->doctype->notations[0];11A
$doc->removeChild($doc->doctype);12new
var_dump(get_defined_vars());13new
} catch (\Throwable $_ffl_e) {}Aparent_aBparent_bA·Bbothnewnovel / fused
1A·B
<?php2new
try {3A
$doc = new DOMDocument;4A
$doc->loadXML(<<<'XML'5A
<?xml version="1.0"?>6A
<!DOCTYPE books [7A
<!NOTATION myNotation SYSTEM "test.dtd">8A
]>9A
<container/>10A
XML);11A
$notation = $doc->doctype->notations[0];12A
var_dump($notation->nodeName, $notation->publicId, $notation->systemId);13A
$doc->removeChild($doc->doctype);14A
var_dump($notation->nodeName, $notation->publicId, $notation->systemId);15A
unset($doc);16A
var_dump($notation->nodeName, $notation->publicId, $notation->systemId);17new
$fusion = $doc;18B
$date = DateTime::createFromFormat(DateTime::COOKIE, "Mon, 21-Jan-2041 15:24:52 GMT");19new
print_r($fusion);20new
var_dump(get_defined_vars());21new
try { spl_object_id($notation); } catch (Exception $e) {};22new
try { spl_object_id($doc); } catch (Exception $e) {};23new
try { spl_object_id($date); } catch (Exception $e) {};24new
try { spl_object_id($notation); } catch (Exception $e) {};25new
try { spl_object_id($notation); } catch (Exception $e) {};26new
} catch (\Throwable $_ffl_e) {}=================================================================
==369011==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c000028540 at pc 0x0000010d47ef bp 0x7ffee6739010 sp 0x7ffee6739008
READ of size 8 at 0x60c000028540 thread T0
#0 0x10d47ee in php_dom_object_get_data /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/dom/php_dom.c:322:18
#1 0x112e9ff in php_dom_create_object /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/dom/php_dom.c:1648:23
#2 0x106ff78 in dom_node_parent_get /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/dom/node.c:258:2
#3 0x106fc3e in dom_node_parent_node_read /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/dom/node.c:269:9
#4 0x113d0fb in dom_get_debug_info_helper /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/dom/php_dom.c:528:7
#5 0x10e56fc in dom_get_debug_info /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/dom/php_dom.c:551:9
#6 0x6499b2a in zend_std_get_properties_for /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_object_handlers.c:2596:10
#7 0x649a841 in zend_get_properties_for /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_object_handlers.c:2645:9
#8 0x43ea42d in php_var_dump /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/standard/var.c:182:11
#9 0x43ec47e in php_array_element_dump /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/standard/var.c:49:2
#10 0x43e9166 in php_var_dump /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/standard/var.c:156:5
#11 0x43eea7a in zif_var_dump /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/standard/var.c:248:3
#12 0x5d853ce in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_vm_execute.h:1317:2
#13 0x591663b in execute_ex /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_vm_execute.h:110168:12
#14 0x5918bcc in zend_execute /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_vm_execute.h:115586:2
#15 0x6611e09 in zend_execute_script /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend.c:1971:3
#16 0x4e8794a in php_execute_script_ex /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/main/main.c:2646:13
#17 0x4e88e88 in php_execute_script /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/main/main.c:2686:9
#18 0x66261e9 in do_cli /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php_cli.c:947:5
#19 0x66206bf in main /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php_cli.c:1370:18
#20 0x7fcb4f7b6d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#21 0x7fcb4f7b6e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#22 0x6058b4 in _start (/home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php+0x6058b4)
0x60c000028540 is located 0 bytes inside of 128-byte region [0x60c000028540,0x60c0000285c0)
freed by thread T0 here:
#0 0x680512 in free (/home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php+0x680512)
#1 0x8c5b76 in php_libxml_node_free /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/libxml/libxml.c:277:4
#2 0x8d899c in php_libxml_node_free_resource /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/libxml/libxml.c:1448:5
#3 0x8d8bb1 in php_libxml_node_decrement_resource /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/libxml/libxml.c:1462:4
#4 0x10e43ac in dom_objects_free_storage /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/dom/php_dom.c:1496:4
#5 0x64a4831 in zend_objects_store_del /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_objects_API.c:193:4
#6 0x65b6f57 in rc_dtor_func /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_variables.c:56:2
#7 0x5f7fd6e in i_zval_ptr_dtor /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_variables.h:44:4
#8 0x5b6212d in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_vm_execute.h:2051:4
#9 0x591663b in execute_ex /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_vm_execute.h:110168:12
#10 0x5918bcc in zend_execute /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_vm_execute.h:115586:2
#11 0x6611e09 in zend_execute_script /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend.c:1971:3
#12 0x4e8794a in php_execute_script_ex /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/main/main.c:2646:13
#13 0x4e88e88 in php_execute_script /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/main/main.c:2686:9
#14 0x66261e9 in do_cli /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php_cli.c:947:5
#15 0x66206bf in main /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php_cli.c:1370:18
#16 0x7fcb4f7b6d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
previously allocated by thread T0 here:
#0 0x68077d in malloc (/home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php+0x68077d)
#1 0x7fcb500d001c in xmlCreateIntSubset (/lib/x86_64-linux-gnu/libxml2.so.2+0x6201c)
SUMMARY: AddressSanitizer: heap-use-after-free /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/ext/dom/php_dom.c:322:18 in php_dom_object_get_data
Shadow bytes around the buggy address:
0x0c187fffd050: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa
0x0c187fffd060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa
0x0c187fffd070: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c187fffd080: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
0x0c187fffd090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 fa
=>0x0c187fffd0a0: fa fa fa fa fa fa fa fa[fd]fd fd fd fd fd fd fd
0x0c187fffd0b0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
0x0c187fffd0c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa
0x0c187fffd0d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c187fffd0e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c187fffd0f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==369011==ABORTING
string(10) "myNotation"
string(0) ""
string(8) "test.dtd"
string(10) "myNotation"
string(0) ""
string(8) "test.dtd"
string(10) "myNotation"
string(0) ""
string(8) "test.dtd"
Warning: Undefined variable $doc in /home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/244bb393.php on line 17
array(10) {
["argv"]=>
array(1) {
[0]=>
string(68) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/244bb393.php"
}
["argc"]=>
int(1)
["_GET"]=>
array(0) {
}
["_POST"]=>
array(0) {
}
["_COOKIE"]=>
array(0) {
}
["_FILES"]=>
array(0) {
}
["_SERVER"]=>
array(26) {
["LESSOPEN"]=>
string(22) "| /usr/bin/lesspipe %s"
["TMUX"]=>
string(27) "/tmp/tmux-1000/default,33,0"
["HOSTNAME"]=>
string(12) "7b7a888bd6f5"
["SHLVL"]=>
string(1) "2"
["HOME"]=>
string(10) "/home/fuzz"
["OLDPWD"]=>
string(39) "/home/fuzz/WorkSpace/fusion-fuzz/output"
["TERM_PROGRAM_VERSION"]=>
string(4) "3.2a"
["LC_CTYPE"]=>
string(7) "C.UTF-8"
["_"]=>
string(16) "/usr/bin/python3"
["TERM"]=>
string(6) "screen"
["PATH"]=>
string(60) "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
["LS_COLORS"]=>
string(1508) "rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:"
["TERM_PROGRAM"]=>
string(4) "tmux"
["SHELL"]=>
string(7) "/bin/sh"
["LESSCLOSE"]=>
string(23) "/usr/bin/lesspipe %s %s"
["PWD"]=>
string(55) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared"
["TMUX_PANE"]=>
string(2) "%0"
["PHP_SELF"]=>
string(68) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/244bb393.php"
["SCRIPT_NAME"]=>
string(68) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/244bb393.php"
["SCRIPT_FILENAME"]=>
string(68) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/244bb393.php"
["PATH_TRANSLATED"]=>
string(68) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/244bb393.php"
["DOCUMENT_ROOT"]=>
string(0) ""
["REQUEST_TIME_FLOAT"]=>
float(1777645154.181044)
["REQUEST_TIME"]=>
int(1777645154)
["argv"]=>
array(1) {
[0]=>
string(68) "/home/fuzz/WorkSpace/fusion-fuzz/.fused/php_exec_shared/244bb393.php"
}
["argc"]=>
int(1)
}
["notation"]=>
<?php
$doc = new DOMDocument;
$doc->loadXML(<<<'XML'
<?xml version="1.0"?>
<!DOCTYPE books [
<!NOTATION myNotation SYSTEM "test.dtd">
]>
<container/>
XML);
$notation = $doc->doctype->notations[0];
var_dump($notation->nodeName, $notation->publicId, $notation->systemId);
$doc->removeChild($doc->doctype);
var_dump($notation->nodeName, $notation->publicId, $notation->systemId);
unset($doc);
var_dump($notation->nodeName, $notation->publicId, $notation->systemId);
?><?php
$date = DateTime::createFromFormat(DateTime::COOKIE, "Mon, 21-Jan-2041 15:24:52 GMT");
print_r($date);
?>
#194824
[MLIR][Canonicalize] Assertion op->use_empty() in RewriterBase::eraseOp when canonicalizing a self-referential builtin.unrealized_conversion_cast in a graph region
llvm
?
2026-04-29
# [MLIR][Canonicalize] Assertion op->use_empty() in RewriterBase::eraseOp when canonicalizing a self-referential builtin.unrealized_conversion_cast in a graph region
**Issue:** [https://github.com/llvm/llvm-project/issues/194824](https://github.com/llvm/llvm-project/issues/194824) · **State:** `open` · **Created:** `2026-04-29T10:07:41Z`
**Labels:** `mlir`, `crash`
## Description
**Description**
`mlir-opt --allow-unregistered-dialect --canonicalize` crashes with an assertion failure in `RewriterBase::eraseOp` (`"expected 'op' to have no uses"`) when the canonicalizer attempts to fold or erase a `builtin.unrealized_conversion_cast` op whose result is its own operand (a self-referential cast) inside a `test.graph_region`. Graph regions allow uses to precede definitions, so a self-referential SSA value is valid IR in this context. The canonicalizer's folder for `unrealized_conversion_cast` does not account for this case and attempts to erase the op while it still has a use (itself), triggering the assertion.
**Reproducer**
```mlir
module {
test.graph_region {
%0 = builtin.unrealized_conversion_cast %0 : i32 to i32
"test.return"() : () -> ()
}
}
```
**Command**
```
mlir-opt --allow-unregistered-dialect --canonicalize reproduce.mlir
```
**Expected behavior**
The canonicalizer should detect that the `unrealized_conversion_cast` op is self-referential and either leave it alone or handle it gracefully without attempting to erase an op that still has uses. It should not crash.
**Actual behavior**
```
mlir-opt: mlir/lib/IR/PatternMatch.cpp:156:
virtual void mlir::RewriterBase::eraseOp(mlir::Operation*):
Assertion `op->use_empty() && "expected 'op' to have no uses"' failed.
Aborted (core dumped)
```
**Call chain**
```
--canonicalize
→ Canonicalizer::runOnOperation
→ applyPatternsGreedily
→ GreedyPatternRewriteDriver::processWorklist
→ (unrealized_conversion_cast folder/canonicalization pattern)
→ RewriterBase::eraseOp ← assertion: op still has uses
```
**Root cause**
`builtin.unrealized_conversion_cast` with identical input and output types (`i32 to i32`) is a candidate for folding — the canonicalizer replaces it with its input operand and erases it. In a normal region this is safe. However, in a graph region the cast's result `%0` is also its own operand, so after the folder replaces all uses of `%0` with the input (which is `%0` itself), the op still has a use through its own operand. The canonicalizer then calls `eraseOp` without checking `use_empty()`, triggering the assertion. The fix should add a self-use check in the `unrealized_conversion_cast` canonicalization pattern, or in `eraseOp`'s caller, to bail out when the op's operands include its own results.
**Environment**
- Tool: `mlir-opt`
- Pass: `--canonicalize` (with `--allow-unregistered-dialect`)
- Affected file: `mlir/lib/IR/PatternMatch.cpp:156` (`RewriterBase::eraseOp`)
- Triggered by: `builtin.unrealized_conversion_cast` folder in `--canonicalize`
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#148716
Assertion 'probable_callable != NULL' in optimize_uops when sys.settrace is set and cleared before a type-unstable method call loop crosses the JIT threshold
cpython
?
2026-04-18
# Assertion 'probable_callable != NULL' in optimize_uops when sys.settrace is set and cleared before a type-unstable method call loop crosses the JIT threshold
**Issue:** [https://github.com/python/cpython/issues/148716](https://github.com/python/cpython/issues/148716) · **State:** `closed` · **Created:** `2026-04-18T09:59:50Z`
**Labels:** `interpreter-core`, `type-crash`, `topic-JIT`
## Description
# Crash report
### What happened?
**Description**
CPython's JIT optimizer crashes with an assertion failure `probable_callable != NULL` in `optimize_uops` (`Python/optimizer_cases.c.h:4307`) when a tracing function is installed and immediately removed via `sys.settrace`, followed by a loop that calls a method on type-unstable objects enough times to cross the JIT compilation threshold. The optimizer fails to find a non-null callable when processing a `CALL` uop whose receiver type varies across iterations, causing the assertion to fire.
**Reproducer**
```python
import sys
D = True
A = True
class Tracer:
def trace(self, frame, event, arg):
return self.trace
sys.settrace(Tracer().trace)
sys.settrace(None)
class Cls:
def __init__(self, val):
self.val = val
def method(self, x):
return self.val
for i in range(200):
try:
o = Cls(D) if i % 3 == 0 else (int(A or 0) if i % 3 == 1 else str(A or ''))
o.method(D) if hasattr(o, 'method') else str(o)
except Exception:
pass
```
**Command**
```
PYTHON_JIT=1 python reproduce.py
```
**Expected behavior**
The JIT optimizer should handle the case where no single callable type can be determined for a polymorphic call site, and should either bail out of optimization or emit a safe fallback. It should not crash with an assertion failure.
**Actual behavior**
```
python: ../Python/optimizer_cases.c.h:4307:
int optimize_uops(...):
Assertion `probable_callable != NULL' failed.
Aborted (core dumped)
```
**Root cause**
The loop calls `o.method(D)` where `o` alternates between a `Cls` instance, an `int`, and a `str` across iterations. After enough iterations to trigger JIT compilation, `optimize_uops` processes the `CALL` uop for this call site and attempts to determine the most likely callable via `probable_callable`. Because the receiver type is not stable across iterations, `probable_callable` remains `NULL` — but the optimizer unconditionally dereferences it without a null guard, triggering the assertion. The prior `sys.settrace` install-and-clear sequence appears to affect the interpreter's specialization state in a way that causes the JIT to attempt optimization of this polymorphic call site rather than bailing out early.
**Environment**
- CPython debug build
- Crash site: `Python/optimizer_cases.c.h:4307` (`optimize_uops`)
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
_No response_
### Output from running 'python -VV' on the command line:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#21768
Assertion failure at ext/reflection/php_reflection.c
php
?
2026-04-16
# Assertion failure at ext/reflection/php_reflection.c
**Issue:** [https://github.com/php/php-src/issues/21768](https://github.com/php/php-src/issues/21768) · **State:** `open` · **Created:** `2026-04-16T03:02:54Z`
**Labels:** `Bug`, `Extension: reflection`, `Status: Verified`
## Description
### Description
The following code:
```php
<?php
$rc=new reflectionClass('domDocument');
$fusion = $rc;
foreach ($fusion->getProperties() as $rp) {
var_dump($rp->isWritable(null));
}
```
Resulted in this output:
```
php: /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/reflection/php_reflection.c:6860: void zim_ReflectionProperty_isWritable(zend_execute_data *, zval *): Assertion `prop->hooks' failed.
Aborted (core dumped)
```
To reproduce:
```
./php-src/sapi/cli/php ./test.php
```
Commit:
```
cdc0366bbb366934e91b5461d524226ecb26c891
```
Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```
Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```
*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*
### PHP Version
```plain
nightly
```
### Operating System
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#88456
[Swift] Assertion "Expected non-null node" in ConstraintSystem::getType when type-checking a @Sendable closure calling an overloaded @preconcurrency @MainActor function shadowed by a global var binding
swift
?
2026-04-14
func divide(_ a: Int, byDividend b: Int) -> Int { return a / b }
var f: (_: Int, _ byDividend: Int) -> Int = divide
@preconcurrency @MainActor func f() { }
@preconcurrency typealias OtherHandler = @Sendable () -> Void
@preconcurrency typealias Handler = (@Sendable () -> OtherHandler?)?
@preconcurrency func f(arg: Int, withFn: Handler?) {}
func test() {
var _: (@Sendable () -> Void) = { f() }
}No output captured.
No parent information recorded.
#88455
[Swift][SILGen] Assertion "Illegal convention for non-address types" in getFunctionArgOwnership when compiling a function parameter with a @propertyWrapper that has a projectedValue
swift
?
2026-04-14
@propertyWrapper
public struct Wrapper<T> {
public var wrappedValue: T
public init(wrappedValue: T) { self.wrappedValue = wrappedValue }
}
@propertyWrapper
public struct ProjectedValueWrapper<T> {
public var wrappedValue: T
public init(wrappedValue: T) { self.wrappedValue = wrappedValue }
public init(projectedValue: Wrapper<T>) { self.wrappedValue = projectedValue.wrappedValue }
public var projectedValue: Wrapper<T> {
get { Wrapper(wrappedValue: wrappedValue) }
set { wrappedValue = newValue.wrappedValue }
}
}
public struct S {
public func hasParameterWithAPIWrapper(@ProjectedValueWrapper x: Int) { }
}No output captured.
No parent information recorded.
#88454
[Swift] Assertion "Expected type to have been set!" in ConstraintSystem::getType when type-checking a call through a function-value binding that shadows an overloaded @preconcurrency @MainActor function
swift
?
2026-04-14
@preconcurrency @MainActor func f() { }
@preconcurrency typealias Handler = (@Sendable () -> Void)?
@preconcurrency func f(arg: Int, withFn: Handler?) {}
func foo(`_`: Int) {}
foo(`_`: 3)
let f = foo(`_`:)
f(3)No output captured.
No parent information recorded.
#148484
incomplete fix for memory leak in array.array
cpython
?
2026-04-13
# incomplete fix for memory leak in array.array
**Issue:** [https://github.com/python/cpython/issues/148484](https://github.com/python/cpython/issues/148484) · **State:** `closed` · **Created:** `2026-04-13T02:41:52Z`
**Labels:** `type-bug`, `extension-modules`, `easy`
## Description
# Bug report
### Bug description:
#140474
The array.array constructor leaks a range_iterator object (64 bytes) when it is given an invalid typecode along with a range object as the initializer. The constructor calls PyObject_GetIter() on the initializer before validating the typecode, allocating a range_iterator via fast_range_iter. When the typecode validation subsequently fails with ValueError: bad typecode, the iterator is not decremented and is leaked.
```python
import array
array.array('\u200e', range(5))
```
```
ValueError: bad typecode (must be b, B, u, w, h, H, i, I, l, L, q, Q, f or d)
=================================================================
==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 64 byte(s) in 1 object(s) allocated from:
#0 malloc
#1 _PyMem_DebugRawAlloc Objects/obmalloc.c:3097
#2 _PyObject_New Objects/object.c:556
#3 fast_range_iter Objects/rangeobject.c:1024
#4 PyObject_GetIter Objects/abstract.c:2825
#5 cfunction_vectorcall_FASTCALL Objects/methodobject.c:449
SUMMARY: AddressSanitizer: 64 byte(s) leaked in 1 allocation(s).
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-148523
* gh-148678
* gh-148679
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#88434
[Swift] Crash in PackConformance::getAssociatedConformance → PackType::get when type-checking variadic generic call with deeply nested associated type pack expansion in presence of ambiguous type name
swift
?
2026-04-13
protocol P {
associatedtype A: P
}
struct S: P {
typealias A = S
}
func f<each T: P>(_: repeat each T) -> (repeat (each T).A.A.A.A) {}
f(S(), S(), S())
public struct S {}No output captured.
No parent information recorded.
#21700
Assertion failure `_php_stream_seek` at streams/streams.c
php
?
2026-04-10
# Assertion failure `_php_stream_seek` at streams/streams.c
**Issue:** [https://github.com/php/php-src/issues/21700](https://github.com/php/php-src/issues/21700) · **State:** `open` · **Created:** `2026-04-10T03:35:53Z`
**Labels:** `Bug`, `Category: Streams`, `Status: Verified`
## Description
### Description
The following code:
```php
<?php
class mystream {
function stream_open($path, $mode, $options, &$opened_path) { return true; }
function stream_seek($offset, $whence) {
$this->pos = $offset; // SEEK_CUR with negative offset → negative pos
return true;
}
function stream_tell() { return $this->pos; }
}
stream_wrapper_register("test", "mystream");
$fp = fopen("test://foo", "rb");
fseek($fp, -1, SEEK_CUR);
fseek($fp, 0, SEEK_CUR);
```
Resulted in this output:
```
php: /home/phpfuzz/WorkSpace/flowfusion/php-src/main/streams/streams.c:1465: int _php_stream_seek(php_stream *, zend_off_t, int): Assertion `stream->position >= 0' failed.
Aborted (core dumped)
```
To reproduce:
```
./php-src/sapi/cli/php ./test.php
```
Commit:
```
cdc0366bbb366934e91b5461d524226ecb26c891
```
Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```
Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```
*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*
### PHP Version
```plain
nightly
```
### Operating System
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#21699
Assertion failure `shutdown_executor` at Zend/zend_execute_API.c
php
?
2026-04-10
# Assertion failure `shutdown_executor` at Zend/zend_execute_API.c
**Issue:** [https://github.com/php/php-src/issues/21699](https://github.com/php/php-src/issues/21699) · **State:** `closed` · **Created:** `2026-04-10T02:29:04Z`
**Labels:** `Bug`, `Category: Engine`, `Status: Verified`
## Description
### Description
Related: #17728
The following code:
```php
<?php
set_error_handler(function() { throw new Exception; });
class bar {
static public function __callstatic($fusion, $b) {
}
public function test() {
call_user_func('self::y');
}
}
$x = new bar;
$x->test();
```
Resulted in this output:
```
php: /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_execute_API.c:527: void shutdown_executor(void): Assertion `(((zend_executor_globals *) (((char*) _tsrm_ls_cache)+(executor_globals_offset)))->trampoline).common.function_name == ((void*)0) || (((zend_compiler_globals *) (((char*) _tsrm_ls_cache)+(compiler_globals_offset)))->unclean_shutdown)' failed.
Aborted (core dumped)
```
To reproduce:
```
./php-src/sapi/cli/php ./test.php
```
Commit:
```
cdc0366bbb366934e91b5461d524226ecb26c891
```
Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```
Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```
*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*
### PHP Version
```plain
nightly
```
### Operating System
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#21698
Memory leak in ZipArchive::addGlob() via php_zip_glob() when glob results are not freed on open_basedir restriction
php
?
2026-04-10
# Memory leak in ZipArchive::addGlob() via php_zip_glob() when glob results are not freed on open_basedir restriction
**Issue:** [https://github.com/php/php-src/issues/21698](https://github.com/php/php-src/issues/21698) · **State:** `closed` · **Created:** `2026-04-10T00:55:27Z`
**Labels:** `Bug`, `Extension: zip`, `Status: Verified`
## Description
### Description
The following code:
```php
<?php
$zip = new ZipArchive();
$zip->addGlob(__FILE__, 0, []);
```
Resulted in this output:
```
=================================================================
==2222867==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 16 byte(s) in 1 object(s) allocated from:
#0 0x68170a in reallocarray (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x68170a)
#1 0x50f4c33 in globextend /home/phpfuzz/WorkSpace/flowfusion/php-src/main/php_glob.c:898:10
#2 0x50f8012 in glob2 /home/phpfuzz/WorkSpace/flowfusion/php-src/main/php_glob.c:741:11
#3 0x50f3b62 in glob1 /home/phpfuzz/WorkSpace/flowfusion/php-src/main/php_glob.c:696:9
#4 0x50edee0 in glob0 /home/phpfuzz/WorkSpace/flowfusion/php-src/main/php_glob.c:630:13
#5 0x50eb592 in php_glob /home/phpfuzz/WorkSpace/flowfusion/php-src/main/php_glob.c:298:10
#6 0x492f871 in php_zip_glob /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/zip/php_zip.c:684:18
#7 0x4945dc8 in php_zip_add_from_pattern /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/zip/php_zip.c:1737:11
#8 0x4944e01 in zim_ZipArchive_addGlob /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/zip/php_zip.c:1824:2
#9 0x5d9b96b in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:2000:4
#10 0x5b468bb in execute_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:110113:12
#11 0x5b48e4c in zend_execute /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:115531:2
#12 0x6856d39 in zend_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1972:3
#13 0x5092b2a in php_execute_script_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2648:13
#14 0x5093c68 in php_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2688:9
#15 0x686bc4a in do_cli /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:949:5
#16 0x686602f in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1360:18
#17 0x7306b8923d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
Indirect leak of 14 byte(s) in 1 object(s) allocated from:
#0 0x6810fd in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x6810fd)
#1 0x50f66ac in globextend /home/phpfuzz/WorkSpace/flowfusion/php-src/main/php_glob.c:942:14
#2 0x50f8012 in glob2 /home/phpfuzz/WorkSpace/flowfusion/php-src/main/php_glob.c:741:11
#3 0x50f3b62 in glob1 /home/phpfuzz/WorkSpace/flowfusion/php-src/main/php_glob.c:696:9
#4 0x50edee0 in glob0 /home/phpfuzz/WorkSpace/flowfusion/php-src/main/php_glob.c:630:13
#5 0x50eb592 in php_glob /home/phpfuzz/WorkSpace/flowfusion/php-src/main/php_glob.c:298:10
#6 0x492f871 in php_zip_glob /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/zip/php_zip.c:684:18
#7 0x4945dc8 in php_zip_add_from_pattern /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/zip/php_zip.c:1737:11
#8 0x4944e01 in zim_ZipArchive_addGlob /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/zip/php_zip.c:1824:2
#9 0x5d9b96b in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:2000:4
#10 0x5b468bb in execute_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:110113:12
#11 0x5b48e4c in zend_execute /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:115531:2
#12 0x6856d39 in zend_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1972:3
#13 0x5092b2a in php_execute_script_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2648:13
#14 0x5093c68 in php_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2688:9
#15 0x686bc4a in do_cli /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:949:5
#16 0x686602f in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1360:18
#17 0x7306b8923d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
SUMMARY: AddressSanitizer: 30 byte(s) leaked in 2 allocation(s).
```
To reproduce:
```
./php-src/sapi/cli/php -d "open_basedir=/usr/local" -d "opcache.jit=1205" -d "opcache.enable=1" -d "opcache.enable_cli=1" -d "opcache.jit=1254" ./test.php
```
Commit:
```
cdc0366bbb366934e91b5461d524226ecb26c891
```
Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```
Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```
*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*
### PHP Version
```plain
nightly
```
### Operating System
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#21688
SEGV at ext/dom/node.c
php
?
2026-04-09
# SEGV at ext/dom/node.c
**Issue:** [https://github.com/php/php-src/issues/21688](https://github.com/php/php-src/issues/21688) · **State:** `closed` · **Created:** `2026-04-09T13:35:26Z`
**Labels:** `Bug`, `Extension: dom`, `Status: Verified`
## Description
### Description
The following code:
```php
<?php
$dom = Dom\HTMLDocument::createEmpty();
$fusion = $dom;
echo $fusion->C14N() . PHP_EOL;
```
Resulted in this output:
```
/home/phpfuzz/WorkSpace/flowfusion/php-src/ext/dom/node.c:2108:12: runtime error: member access within null pointer of type 'xmlNode' (aka 'struct _xmlNode')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/dom/node.c:2108:12 in
```
To reproduce:
```
./php-src/sapi/cli/php ./test.php
```
Commit:
```
cdc0366bbb366934e91b5461d524226ecb26c891
```
Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```
Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```
*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*
### PHP Version
```plain
nightly
```
### Operating System
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#21687
Assertion failure in zend_enum_fetch_case_name() when calling array_walk() on an enum case value after try/catch block
php
?
2026-04-09
# Assertion failure in zend_enum_fetch_case_name() when calling array_walk() on an enum case value after try/catch block
**Issue:** [https://github.com/php/php-src/issues/21687](https://github.com/php/php-src/issues/21687) · **State:** `open` · **Created:** `2026-04-09T13:30:07Z`
**Labels:** `Bug`, `Category: Engine`, `Status: Verified`
## Description
### Description
The following code:
```php
<?php
enum Foo: int {
case Bar = 0;
}
try {
$bar = Foo::Bar;
} catch (Error $e) {
}
$fusion = $bar;
array_walk($fusion, function($tk) {
});
var_dump(get_defined_vars());
```
Resulted in this output:
```
php: /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_enum.h:72: zval *zend_enum_fetch_case_name(zend_object *): Assertion `zval_get_type(&(*(name))) == 6' failed.
Aborted (core dumped)
```
To reproduce:
```
./php-src/sapi/cli/php ./test.php
```
Commit:
```
cdc0366bbb366934e91b5461d524226ecb26c891
```
Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```
Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```
*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*
### PHP Version
```plain
nightly
```
### Operating System
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#21664
`iconv_mime_decode()` with malformed UTF-8 encoded-word corrupts stack, causing unrecoverable SIGSEGV (ASan: nested bug in same thread)`
php
?
2026-04-07
# `iconv_mime_decode()` with malformed UTF-8 encoded-word corrupts stack, causing unrecoverable SIGSEGV (ASan: nested bug in same thread)`
**Issue:** [https://github.com/php/php-src/issues/21664](https://github.com/php/php-src/issues/21664) · **State:** `closed` · **Created:** `2026-04-07T17:28:13Z`
**Labels:** `Bug`, `Extension: iconv`, `Status: Verified`
## Description
### Description
The following code:
```php
<?php
var_dump(iconv_mime_decode("Illegal encoded-word: =?utf-8?Q?".chr(0xA1)."?= ."));
spl_autoload_register(function ($fusion) {
if ($class == 'A') {
} else {
class Y extends A {}
}
});
new B;
```
Resulted in this output:
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==902==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x7b7a4a01d31e bp 0x64008de5fc9b9782 sp 0x8bb08de5c365d786 T0)
==902==The signal is caused by a READ memory access.
==902==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used.
AddressSanitizer:DEADLYSIGNAL
AddressSanitizer: nested bug in the same thread, aborting.
```
To reproduce:
```
./php-src/sapi/cli/php ./test.php
```
Commit:
```
88c658e1f6e47024f297bc55b07a402c4ed3621c
```
Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```
Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```
*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*
### PHP Version
```plain
nightly
```
### Operating System
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#188408
[MLIR][SCCP][OpenACC] Assertion mightHaveTerminator() in Block::getTerminator when DeadCodeAnalysis::initializeRecursively walks into acc.kernel_environment containing acc.compute_region
llvm
?
2026-03-25
# [MLIR][SCCP][OpenACC] Assertion mightHaveTerminator() in Block::getTerminator when DeadCodeAnalysis::initializeRecursively walks into acc.kernel_environment containing acc.compute_region
**Issue:** [https://github.com/llvm/llvm-project/issues/188408](https://github.com/llvm/llvm-project/issues/188408) · **State:** `closed` · **Created:** `2026-03-25T04:14:43Z`
**Labels:** `crash`, `mlir:dataflow`
## Description
Related issue: #159650
**Description**
`mlir-opt --sccp` crashes with an assertion failure in `Block::getTerminator()` when `DeadCodeAnalysis::initializeRecursively` walks into a function containing an `acc.kernel_environment` op that itself contains an `acc.compute_region` op. The `isRegionOrCallableReturn` helper calls `block->getTerminator()` on a block that `mightHaveTerminator()` returns true for but that has no terminator op, triggering the assertion.
**Reproducer**
```mlir
module {
func.func @fusion_bridge() -> index {
%c = arith.constant 128 : index
return %c : index
}
func.func @f(%data: memref<8xi32>) {
acc.kernel_environment {
acc.compute_region {
acc.yield
} {origin = "acc.parallel"}
}
return
}
%fusion_tmp = func.call @fusion_bridge() : () -> index
}
```
**Command**
```
mlir-opt --sccp --symbol-dce --cse --inline --canonicalize reproduce.mlir
```
**Expected behavior**
`--sccp` should process the file successfully or emit a diagnostic. `DeadCodeAnalysis` should not call `getTerminator()` on a block without first verifying it has a terminator, or `isRegionOrCallableReturn` should guard the `getTerminator()` call.
**Actual behavior**
```
mlir-opt: mlir/lib/IR/Block.cpp:250:
Operation *mlir::Block::getTerminator():
Assertion `mightHaveTerminator()' failed.
Aborted (core dumped)
```
**Call chain**
```
--sccp
→ DataFlowSolver::initializeAndRun
→ DeadCodeAnalysis::initialize
→ DeadCodeAnalysis::initializeRecursively
→ isRegionOrCallableReturn (DeadCodeAnalysis.cpp:252)
→ Block::getTerminator() (Block.cpp:250)
← assertion: mightHaveTerminator() failed
```
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#188407
[MLIR][MemRef][Canonicalize] Assertion succeeded(MemRefType::verifyInvariants) in MemRefType::get when ReinterpretCastOpConstantFolder folds a reinterpret_cast with a negative constant size
llvm
?
2026-03-25
# [MLIR][MemRef][Canonicalize] Assertion succeeded(MemRefType::verifyInvariants) in MemRefType::get when ReinterpretCastOpConstantFolder folds a reinterpret_cast with a negative constant size
**Issue:** [https://github.com/llvm/llvm-project/issues/188407](https://github.com/llvm/llvm-project/issues/188407) · **State:** `closed` · **Created:** `2026-03-25T04:02:40Z`
**Labels:** `crash`, `mlir:memref`
## Description
Related issue: #61309
**Description**
`mlir-opt --canonicalize` crashes with an assertion failure in `MemRefType::get` when the `ReinterpretCastOpConstantFolder` pattern folds a `memref.reinterpret_cast` op whose size operand is a negative constant (e.g. `-1 : index`). The folder propagates the constant into the result `MemRefType`'s static shape, but `MemRefType::get` asserts that all static dimension sizes must be valid (non-negative), triggering the `invalid memref size` error and the subsequent assertion failure.
**Reproducer**
```mlir
module {
func.func @f(%input: memref<2x3xf32>) -> memref<?x?xf32, strided<[?, ?], offset: ?>> {
%c0 = arith.constant 0 : index
%c1 = arith.constant 1 : index
%sz = arith.constant -1 : index
%output = memref.reinterpret_cast %input to
offset: [%c0], sizes: [%c1, %sz], strides: [%sz, %c1]
: memref<2x3xf32> to memref<?x?xf32, strided<[?, ?], offset: ?>>
return %output : memref<?x?xf32, strided<[?, ?], offset: ?>>
}
}
```
**Command**
```
mlir-opt --canonicalize reproduce.mlir
```
**Expected behavior**
`ReinterpretCastOpConstantFolder` should validate that all constant size operands are non-negative before attempting to construct a static `MemRefType`. When a constant size is negative, the folder should return failure rather than passing an invalid size to `MemRefType::get`. Alternatively, the verifier should reject `memref.reinterpret_cast` with statically known negative sizes before canonicalization is attempted.
**Actual behavior**
```
<unknown>:0: error: invalid memref size
mlir-opt: mlir/include/mlir/IR/StorageUniquerSupport.h:180:
static ConcreteT mlir::detail::StorageUserBase<...>::get(...):
Assertion `succeeded(ConcreteT::verifyInvariants(getDefaultDiagnosticEmitFn(ctx), args...))' failed.
Aborted (core dumped)
```
**Call chain**
```
--canonicalize
→ ReinterpretCastOpConstantFolder::matchAndRewrite (MemRefOps.cpp:2294)
→ memref::ReinterpretCastOp::build
→ MemRefType::get(shape=[-1], ...) (BuiltinTypes.cpp:667)
→ MemRefType::verifyInvariants ← "invalid memref size"
→ assertion failure
```
**Root cause**
(Generated, could be incorrect)
`ReinterpretCastOpConstantFolder` iterates over the size operands of `memref.reinterpret_cast`, and when it finds a constant integer value it replaces the dynamic size with that constant in the new static `MemRefType`. It does not check whether the constant is a valid memref dimension size (i.e. non-negative). When the constant is `-1`, it is passed directly to `MemRefType::get` as a static dimension size, which calls `MemRefType::verifyInvariants` and fails the assertion. The fix should add a non-negativity check in `ReinterpretCastOpConstantFolder` for each constant size operand before constructing the new type, returning failure if any size is negative.
**Environment**
- Tool: `mlir-opt`
- Pass: `--canonicalize` (also reproduces with `--inline --canonicalize`)
- Affected file: `mlir/lib/Dialect/MemRef/IR/MemRefOps.cpp` (`ReinterpretCastOpConstantFolder::matchAndRewrite` at line 2294)
- Crash site: `mlir/include/mlir/IR/StorageUniquerSupport.h:180`
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#188405
[MLIR][Linalg][Canonicalize] Assertion getConstantIntValue(tile).value() == shape in getNewMixedTileSizes when FoldTensorCastUnPackOp folds a cast whose static tile size does not match the output dimension size
llvm
?
2026-03-25
# [MLIR][Linalg][Canonicalize] Assertion getConstantIntValue(tile).value() == shape in getNewMixedTileSizes when FoldTensorCastUnPackOp folds a cast whose static tile size does not match the output dimension size
**Issue:** [https://github.com/llvm/llvm-project/issues/188405](https://github.com/llvm/llvm-project/issues/188405) · **State:** `closed` · **Created:** `2026-03-25T03:49:34Z`
**Labels:** `mlir:linalg`, `crash`
## Description
**Description**
`mlir-opt --canonicalize --inline` crashes with an assertion failure in `getNewMixedTileSizes` when canonicalizing a `linalg.unpack` op that has a `tensor.cast` as its source and a tile size that, after inlining, becomes a compile-time constant that does not match the corresponding static output dimension size. `FoldTensorCastUnPackOp` fires and calls `getNewMixedTileSizes`, which asserts that the constant tile value must equal the static output shape dimension. When the tile size (256) differs from the output shape (7), the assertion fires.
This is related to but distinct from the `bad_optional_access` crash in the same function when the tile is not yet constant: both bugs share the same call site in `getNewMixedTileSizes` at `LinalgOps.cpp:5025`, with different preconditions. The underlying issue in both cases is that `FoldTensorCastUnPackOp` fires without sufficiently validating that the tile sizes are compatible with the output shape.
**Reproducer**
```mlir
module {
func.func @get_tile() -> index {
%c256 = arith.constant 256 : index
return %c256 : index
}
func.func @f(%A: tensor<1x3x8x1xi32>) -> tensor<7x3xi32> {
%tile_size = func.call @get_tile() : () -> index
%empty = tensor.empty() : tensor<7x3xi32>
%cast = tensor.cast %A : tensor<1x3x8x1xi32> to tensor<?x3x?x1xi32>
%unpack = linalg.unpack %cast
inner_dims_pos = [0, 1]
inner_tiles = [%tile_size, 1]
into %empty : tensor<?x3x?x1xi32> -> tensor<7x3xi32>
return %unpack : tensor<7x3xi32>
}
}
```
**Command**
```
mlir-opt --canonicalize --inline reproduce.mlir
```
**Expected behavior**
`FoldTensorCastUnPackOp` should bail out when a constant tile size does not match the corresponding static output dimension size, rather than asserting. The pattern should only fire when all constant tile sizes are consistent with the output shape, or `getNewMixedTileSizes` should return failure gracefully instead of asserting.
**Actual behavior**
```
mlir-opt: mlir/lib/Dialect/Linalg/IR/LinalgOps.cpp:5026:
SmallVector<OpFoldResult> mlir::linalg::getNewMixedTileSizes(...):
Assertion `getConstantIntValue(tile).value() == shape && "tile size and dim size don't match!"' failed.
Aborted (core dumped)
```
**Call chain**
```
--inline (propagates constant 256 from get_tile into f)
--canonicalize
→ FoldTensorCastUnPackOp::matchAndRewrite (LinalgOps.cpp:6479)
→ getNewMixedTileSizes (LinalgOps.cpp:5025)
→ getConstantIntValue(tile).value() ← returns 256
→ assert 256 == 7 ← FAILS
```
**Root cause**
(LLM analysis, could be wrong)
After `--inline` propagates the constant `256` into `@f`, `--canonicalize` fires `FoldTensorCastUnPackOp` on the `linalg.unpack` whose source is a `tensor.cast`. The pattern calls `getNewMixedTileSizes` to compute updated tile sizes for the new static source type. Inside `getNewMixedTileSizes`, for each dimension where the tile is a constant integer, it asserts that this constant equals the corresponding static shape dimension of the output type. Here the tile is `256` but the output dimension is `7`, so the assertion fires.
The fix should be added in `FoldTensorCastUnPackOp::matchAndRewrite` — before calling `getNewMixedTileSizes`, the pattern should verify that every constant tile size is consistent with the corresponding static output dimension, and return failure if any mismatch is detected. This would prevent the pattern from firing in an invalid configuration, making both this crash and the related `bad_optional_access` crash safe.
**Environment**
- Tool: `mlir-opt`
- Passes: `--canonicalize --inline`
- Affected file: `mlir/lib/Dialect/Linalg/IR/LinalgOps.cpp` (lines 5025–5026 and 6479)
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#188404
[MLIR][Vector][Fold] Assertion hasSameNumElementsOrSplat failed in DenseElementsAttr::get when folding vector.insert with out-of-bounds dynamic index
llvm
?
2026-03-25
# [MLIR][Vector][Fold] Assertion hasSameNumElementsOrSplat failed in DenseElementsAttr::get when folding vector.insert with out-of-bounds dynamic index
**Issue:** [https://github.com/llvm/llvm-project/issues/188404](https://github.com/llvm/llvm-project/issues/188404) · **State:** `closed` · **Created:** `2026-03-25T03:44:13Z`
**Labels:** `crash`, `mlir:vector`
## Description
Related issue: #108360
**Description**
`mlir-opt --inline --cse` crashes with an assertion failure in `DenseElementsAttr::get` when folding a `vector.insert` op whose index is a negative (out-of-bounds) constant. The `foldDenseElementsAttrDestInsertOp` folder receives an index of `-1`, computes an invalid position within the destination vector's element array, and then attempts to construct a `DenseElementsAttr` with a mismatched number of elements, triggering the assertion.
**Reproducer**
```mlir
module {
func.func @f() -> vector<2xf16> {
%cst = arith.constant dense<0.0> : vector<2xf16>
%idx = arith.constant -1 : index
%val = arith.constant 2.5 : f16
%0 = vector.insert %val, %cst [%idx] : f16 into vector<2xf16>
return %0 : vector<2xf16>
}
}
```
**Command**
```
mlir-opt --inline --cse reproduce.mlir
```
**Expected behavior**
The folder should validate that the index is within bounds before attempting to fold. When the index is out of bounds (negative or ≥ vector size), the folder should return failure rather than proceeding with an invalid array access. Alternatively, the verifier should reject `vector.insert` with a statically out-of-bounds index before folding is attempted.
**Actual behavior**
```
mlir-opt: mlir/lib/IR/BuiltinAttributes.cpp:872:
static DenseElementsAttr mlir::DenseElementsAttr::get(ShapedType, ArrayRef<Attribute>):
Assertion `hasSameNumElementsOrSplat(type, values)' failed.
Aborted (core dumped)
```
**Call chain**
```
--cse / --inline (triggers constant folding)
→ vector.insert fold
→ foldDenseElementsAttrDestInsertOp (VectorOps.cpp:3796)
→ DenseElementsAttr::get (BuiltinAttributes.cpp:872)
← assertion: hasSameNumElementsOrSplat failed
```
**Root cause**
(LLM Analysis, could be incorrect)
`foldDenseElementsAttrDestInsertOp` retrieves the flat linear index from the `vector.insert` position operand and uses it directly to index into the destination vector's element list. When the index is `-1` (or any negative value), the unsigned arithmetic wraps around to a very large position, causing the element replacement to produce a values array with the wrong number of elements. The fix should add a bounds check in `foldDenseElementsAttrDestInsertOp` — if the computed linear index is negative or exceeds the number of elements in the destination vector, return failure immediately.
**Environment**
- Tool: `mlir-opt`
- Passes: `--inline --cse`
- Affected file: `mlir/lib/Dialect/Vector/IR/VectorOps.cpp` (`foldDenseElementsAttrDestInsertOp` at line 3796)
- Crash site: `mlir/lib/IR/BuiltinAttributes.cpp:872`
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#187975
[MLIR][Linalg][Canonicalize] Crash in FoldTensorCastUnPackOp::matchAndRewrite via getNewMixedTileSizes when tile size is dynamic (bad_optional_access on nullopt from getConstantIntValue)
llvm
?
2026-03-23
# [MLIR][Linalg][Canonicalize] Crash in FoldTensorCastUnPackOp::matchAndRewrite via getNewMixedTileSizes when tile size is dynamic (bad_optional_access on nullopt from getConstantIntValue)
**Issue:** [https://github.com/llvm/llvm-project/issues/187975](https://github.com/llvm/llvm-project/issues/187975) · **State:** `closed` · **Created:** `2026-03-23T05:06:15Z`
**Labels:** `mlir:linalg`, `crash`
## Description
**Description**
`mlir-opt --canonicalize --inline` crashes with `std::bad_optional_access` in `getNewMixedTileSizes` when canonicalizing a `linalg.unpack` op that has a `tensor.cast` as its source and a dynamic (non-constant) tile size. The `FoldTensorCastUnPackOp` pattern fires and calls `getNewMixedTileSizes`, which calls `getConstantIntValue(tile).value()` unconditionally. When the tile size is a dynamic `index` SSA value rather than a compile-time constant, `getConstantIntValue` returns `std::nullopt` and `.value()` aborts.
**Reproducer**
```mlir
module {
func.func @get_tile() -> index {
%c256 = arith.constant 256 : index
return %c256 : index
}
func.func @f(%A: tensor<1x3x8x1xi32>) -> tensor<7x3xi32> {
%tile_size = func.call @get_tile() : () -> index
%empty = tensor.empty() : tensor<7x3xi32>
%cast = tensor.cast %A : tensor<1x3x8x1xi32> to tensor<?x3x?x1xi32>
%unpack = linalg.unpack %cast
inner_dims_pos = [0, 1]
inner_tiles = [%tile_size, 1]
into %empty : tensor<?x3x?x1xi32> -> tensor<7x3xi32>
return %unpack : tensor<7x3xi32>
}
}
```
**Command**
```
mlir-opt --canonicalize --inline reproduce.mlir
```
**Expected behavior**
`FoldTensorCastUnPackOp` should bail out (return failure) when a tile size is not a compile-time constant, rather than unconditionally calling `.value()` on the result of `getConstantIntValue`. Alternatively it should only fire when all tile sizes are statically known.
**Actual behavior**
```
mlir-opt: optional:1013: std::optional<long>::value() &&: Assertion `this->_M_is_engaged()' failed.
Aborted (core dumped)
```
The crash is in `getNewMixedTileSizes` at `LinalgOps.cpp:5025`, called from `FoldTensorCastUnPackOp::matchAndRewrite` at `LinalgOps.cpp:6479`.
**Call chain**
```
--canonicalize (runs after --inline propagates call)
→ FoldTensorCastUnPackOp::matchAndRewrite (LinalgOps.cpp:6479)
→ getNewMixedTileSizes (LinalgOps.cpp:5025)
→ getConstantIntValue(tile) → nullopt (tile is dynamic)
→ optional::value() ← abort: bad_optional_access
```
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#187974
[MLIR] Assertion "incorrect fold result type" in tosa.transpose folder when folding identity permutation on ranked input with unranked result type
llvm
?
2026-03-23
# [MLIR] Assertion "incorrect fold result type" in tosa.transpose folder when folding identity permutation on ranked input with unranked result type
**Issue:** [https://github.com/llvm/llvm-project/issues/187974](https://github.com/llvm/llvm-project/issues/187974) · **State:** `closed` · **Created:** `2026-03-23T04:58:09Z`
**Labels:** `crash`, `mlir:tosa`
## Description
**Description**
`mlir-opt --sccp` crashes with an assertion failure in `checkFoldResultTypes` when processing a `tosa.transpose` op whose input is a ranked tensor, whose permutation is the identity, and whose declared result type is unranked (`tensor<*xi32>`). The `tosa.transpose` folder recognizes the identity permutation and folds the op by returning the input value directly. However, the input has type `tensor<3x2xi32>` while the declared result type is `tensor<*xi32>`. The fold result type does not match the op's declared result type, triggering the assertion.
**Reproducer**
```mlir
module {
func.func @f(%arg0: tensor<3x2xi32>) -> tensor<*xi32> {
%0 = tosa.transpose %arg0 {perms = array<i32: 0, 1>}: (tensor<3x2xi32>) -> tensor<*xi32>
return %0 : tensor<*xi32>
}
}
```
**Command**
```
mlir-opt --sccp reproduce.mlir
```
**Expected behavior**
`--sccp` either processes the file successfully or emits a diagnostic. The folder should not return a value whose type differs from the op's declared result type, or should bail out of folding when the types do not match.
**Actual behavior**
```
reproduce.mlir:3:10: error: 'tosa.transpose' op folder produced a value of incorrect type:
'tensor<3x2xi32>', expected: 'tensor<*xi32>'
mlir-opt: mlir/lib/IR/Operation.cpp:621:
void checkFoldResultTypes(Operation*, SmallVectorImpl<OpFoldResult>&):
Assertion `false && "incorrect fold result type"' failed.
```
**Call chain**
```
SCCP::runOnOperation
→ DataFlowSolver::initializeAndRun
→ SparseConstantPropagation::visitOperation
→ Operation::fold
→ tosa.transpose folder ← returns input directly (type mismatch)
→ checkFoldResultTypes ← assertion: fold result type != declared result type
```
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#187973
[MLIR] Assertion !getType().isSignlessInteger() in IntegerAttr::getInt() when running --sccp on emitc.switch with unsigned integer condition
llvm
?
2026-03-23
# [MLIR] Assertion !getType().isSignlessInteger() in IntegerAttr::getInt() when running --sccp on emitc.switch with unsigned integer condition
**Issue:** [https://github.com/llvm/llvm-project/issues/187973](https://github.com/llvm/llvm-project/issues/187973) · **State:** `closed` · **Created:** `2026-03-23T04:53:47Z`
**Labels:** `crash`, `mlir:emitc`
## Description
Related: #111242
**Description**
`mlir-opt --sccp` crashes with an assertion failure in `IntegerAttr::getInt()` when processing a function containing an `emitc.switch` op whose condition has an unsigned integer type (e.g. `ui32`). The `DeadCodeAnalysis` pass invoked by SCCP calls `SwitchOp::getEntrySuccessorRegions`, which calls `IntegerAttr::getInt()` on the case value attributes to determine which branch is statically taken. However, `getInt()` asserts that the attribute type must be a signless integer or index — unsigned integer types such as `ui32` satisfy neither condition, triggering the assertion.
**Reproducer**
```mlir
module {
func.func @f() {
%0 = "emitc.constant"() {value = 1 : ui32} : () -> ui32
emitc.switch %0 : ui32
case 2 {
emitc.yield
}
default {
emitc.yield
}
return
}
}
```
**Command**
```
mlir-opt --sccp reproduce.mlir
```
**Expected behavior**
`--sccp` either processes the file successfully or emits a diagnostic. It should not crash when `emitc.switch` uses an unsigned integer condition type.
**Actual behavior**
```
mlir-opt: mlir/lib/IR/BuiltinAttributes.cpp:367:
int64_t mlir::IntegerAttr::getInt() const:
Assertion `(getType().isIndex() || getType().isSignlessInteger()) && "must be signless integer"' failed.
```
**Call chain**
```
SCCP::runOnOperation
→ DataFlowSolver::initializeAndRun
→ DeadCodeAnalysis::visit
→ DeadCodeAnalysis::visitRegionBranchOperation
→ SwitchOp::getEntrySuccessorRegions (EmitC.cpp:1569)
→ IntegerAttr::getInt() ← assertion: not signless integer or index
```
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#187972
[MLIR] Assertion !NodePtr->isKnownSentinel() in DeadCodeAnalysis::visitRegionBranchEdges when processing acc.serial with empty region
llvm
?
2026-03-23
# [MLIR] Assertion !NodePtr->isKnownSentinel() in DeadCodeAnalysis::visitRegionBranchEdges when processing acc.serial with empty region
**Issue:** [https://github.com/llvm/llvm-project/issues/187972](https://github.com/llvm/llvm-project/issues/187972) · **State:** `closed` · **Created:** `2026-03-23T04:48:30Z`
**Labels:** `crash`, `mlir:dataflow`
## Description
Related: #132160
**Description**
`mlir-opt --sccp` crashes with an assertion failure in `llvm::ilist_iterator::operator*()` when processing a function containing an `acc.serial` op with an empty region body. The `DeadCodeAnalysis` pass, invoked by SCCP, calls `getProgramPointBefore(Block*)` on a block pointer obtained by iterating over the regions of `acc.serial`. When a region has no blocks, the iterator is a sentinel, and dereferencing it triggers the assertion.
**Reproducer**
```mlir
module {
func.func @f() {
acc.serial {
}
return
}
}
```
**Command**
```
mlir-opt --sccp reproduce.mlir
```
**Expected behavior**
`--sccp` either processes the file successfully or emits a diagnostic. It should not crash when encountering an `acc.serial` op whose region has no blocks.
**Actual behavior**
```
mlir-opt: llvm/include/llvm/ADT/ilist_iterator.h:168:
reference llvm::ilist_iterator<...>::operator*() const:
Assertion `!NodePtr->isKnownSentinel()' failed.
```
**Call chain:**
```
SCCP::runOnOperation
→ DataFlowSolver::initializeAndRun
→ DeadCodeAnalysis::initialize
→ DeadCodeAnalysis::initializeRecursively
→ DeadCodeAnalysis::visitRegionBranchOperation
→ DeadCodeAnalysis::visitRegionBranchEdges
→ DataFlowAnalysis::getProgramPointBefore(Block*)
→ ilist_iterator::operator*() ← assertion: sentinel dereference
```
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#21496
UAF Dom dom_objects_free_storage
php
?
2026-03-23
# UAF Dom dom_objects_free_storage
**Issue:** [https://github.com/php/php-src/issues/21496](https://github.com/php/php-src/issues/21496) · **State:** `closed` · **Created:** `2026-03-23T04:41:35Z`
**Labels:** `Bug`, `Extension: xsl`, `Status: Verified`
## Description
### Description
The following code:
```php
<?php
$comment = new DOMComment("my value");
$doc = new DOMDocument();
$doc->loadXML(<<<XML
<container/>
XML);
$doc->documentElement->appendChild($comment);
$fusion = $comment;
include __DIR__ .'/prepare.inc';
$proc->importStylesheet($fusion);
```
Resulted in this output:
```
=================================================================
==3155==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c00000c948 at pc 0x0000010ff0d2 bp 0x7ffc2f580080 sp 0x7ffc2f580078
READ of size 4 at 0x60c00000c948 thread T0
#0 0x10ff0d1 in dom_objects_free_storage /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/dom/php_dom.c:1486:13
#1 0x66d1611 in zend_objects_store_del /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_objects_API.c:196:4
#2 0x67e7c97 in rc_dtor_func /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_variables.c:57:2
#3 0x67e7f1e in i_zval_ptr_dtor /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_variables.h:45:4
#4 0x67e7cd4 in zval_ptr_dtor /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_variables.c:84:2
#5 0x6304051 in _zend_hash_del_el_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_hash.c:1500:3
#6 0x63017cd in _zend_hash_del_el /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_hash.c:1527:2
#7 0x6316b66 in zend_hash_graceful_reverse_destroy /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_hash.c:2052:4
#8 0x5aa22e5 in zend_shutdown_executor_values /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_execute_API.c:283:3
#9 0x5aae20e in shutdown_executor /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_execute_API.c:454:2
#10 0x6830d9b in zend_deactivate /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1355:2
#11 0x506c84a in php_request_shutdown /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2028:2
#12 0x685dba1 in do_cli /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1156:3
#13 0x6852b7f in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1360:18
#14 0x7fa824709d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#15 0x7fa824709e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#16 0x606244 in _start (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x606244)
0x60c00000c948 is located 8 bytes inside of 120-byte region [0x60c00000c940,0x60c00000c9b8)
freed by thread T0 here:
#0 0x680ea2 in free (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x680ea2)
#1 0x7fa8249757fa in xsltParseStylesheetProcess (/lib/x86_64-linux-gnu/libxslt.so.1+0x137fa)
previously allocated by thread T0 here:
#0 0x68110d in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x68110d)
#1 0x7fa825166b9b in xmlNewComment (/lib/x86_64-linux-gnu/libxml2.so.2+0x63b9b)
SUMMARY: AddressSanitizer: heap-use-after-free /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/dom/php_dom.c:1486:13 in dom_objects_free_storage
Shadow bytes around the buggy address:
0x0c187fff98d0: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
0x0c187fff98e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c187fff98f0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c187fff9900: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
0x0c187fff9910: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c187fff9920: fa fa fa fa fa fa fa fa fd[fd]fd fd fd fd fd fd
0x0c187fff9930: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
0x0c187fff9940: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa
0x0c187fff9950: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c187fff9960: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
0x0c187fff9970: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==3155==ABORTING
```
To reproduce:
```
./php-src/sapi/cli/php ./test.php
```
Commit:
```
f102735d7139858cd1fe2a80a27f361e410ae887
```
Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```
Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```
*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*
Need ext/xsl/tests/prepare.inc
### PHP Version
```plain
nightly
```
### Operating System
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#146011
heap-use-after-free in signaldict_repr: signaldict outlives its parent Context after explicit del
cpython
?
2026-03-16
# heap-use-after-free in signaldict_repr: signaldict outlives its parent Context after explicit del
**Issue:** [https://github.com/python/cpython/issues/146011](https://github.com/python/cpython/issues/146011) · **State:** `open` · **Created:** `2026-03-16T07:07:09Z`
**Labels:** `type-bug`, `extension-modules`
## Description
# Bug report
### Bug description:
**Description**
A `decimal.Context` object's `flags` (and `traps`) attribute returns a `signaldict` that holds a borrowed reference to the parent `Context`. When the parent `Context` is explicitly deleted, its refcount drops to zero and `context_dealloc` frees it. However, the `signaldict` object remains alive and accessible. Any subsequent operation that calls `signaldict_repr` — such as `print()`, `str()`, or `repr()` — reads through the now-freed `Context` pointer, causing a heap-use-after-free.
**Reproducer**
```python
import decimal
ctx = decimal.Context(prec=7)
mapping = ctx.flags
del ctx
print(mapping)
```
**Expected behavior**
Either `signaldict` holds a strong reference to its parent `Context` (keeping it alive as long as the `signaldict` is alive), or accessing a `signaldict` whose parent has been freed raises a `RuntimeError` or similar safe error. Under no circumstances should `signaldict_repr` read through a freed pointer.
**Actual behavior**
```
=================================================================
==ERROR: AddressSanitizer: heap-use-after-free on address ... in signaldict_repr
READ of size 4 at ... thread T0
#0 signaldict_repr Include/internal/pycore_moduleobject.h
#1 PyObject_Str Objects/object.c:823
#2 PyFile_WriteObject
#3 builtin_print_impl
...
freed by thread T0 here:
#0 free
#1 context_dealloc Modules/_decimal/_decimal.c:1512
#2 _Py_Dealloc
#3 Py_DECREF / Py_XDECREF
#4 insertdict Objects/dictobject.c:1998
```
**Root cause**
`signaldict` is implemented as a view over its parent `Context`'s internal C struct fields. It stores a raw pointer (or borrowed reference) to the `Context` but does not increment the `Context`'s refcount. When the user holds the last Python reference to the `Context` and deletes it, `context_dealloc` immediately frees the underlying C struct. The `signaldict` is left with a dangling pointer. Any call to `signaldict_repr` (or other `signaldict` methods that dereference the parent pointer) then constitutes a use-after-free.
The fix should ensure `signaldict` holds a strong (`Py_INCREF`) reference to its parent `Context`, releasing it only in `signaldict`'s own dealloc.
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#21421
SoapClient typemap property breaks engine assumptions
php
?
2026-03-12
# SoapClient typemap property breaks engine assumptions
**Issue:** [https://github.com/php/php-src/issues/21421](https://github.com/php/php-src/issues/21421) · **State:** `closed` · **Created:** `2026-03-12T08:02:12Z`
**Labels:** `Bug`, `Extension: soap`, `Status: Verified`
## Description
### Description
The following code:
```php
<?php
class TestSoapClient extends SoapClient{
}
$options=Array(
'uri' => 'http://schemas.nothing.com',
'location' => 'test://',
'typemap' => array(array("type_ns" => "http://schemas.nothing.com",
"type_name" => "book",
"from_xml" => "book_from_xml"))
);
$client = new TestSoapClient(NULL, $options);
$p4_obj = (object)(array)$client;
$p4_ser = serialize($p4_obj);
$p4_deser = unserialize($p4_ser);
var_dump($p4_deser == $p4_obj);
```
Resulted in this output:
```
php: /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_operators.c:2452: int zend_compare(zval *, zval *): Assertion `0' failed.
Aborted (core dumped)
```
To reproduce:
```
./php-src/sapi/cli/php ./test.php
```
Commit:
```
13b83a46cfb810418ed15be89f24d45de884c082
```
Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```
Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```
### PHP Version
```plain
nightly
```
### Operating System
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#185352
[MLIR][Linalg] UBSan division-by-zero in PackOp::requirePaddingValue when dynamic tile size is propagated as zero via SCCP
llvm
?
2026-03-09
# [MLIR][Linalg] UBSan division-by-zero in PackOp::requirePaddingValue when dynamic tile size is propagated as zero via SCCP
**Issue:** [https://github.com/llvm/llvm-project/issues/185352](https://github.com/llvm/llvm-project/issues/185352) · **State:** `closed` · **Created:** `2026-03-09T06:09:30Z`
**Labels:** `mlir:linalg`, `crash`
## Description
**Description**
`linalg.pack` with a dynamic inner tile size crashes with an integer division-by-zero in `PackOp::requirePaddingValue` (LinalgOps.cpp:5501) when `--sccp` propagates a zero constant into the tile size and `--canonicalize` subsequently fires `paddingIsNotNeeded`. The zero tile size is not guarded against before the division.
**Reproducer**
```mlir
func.func @get_tile_size() -> index {
%c0 = arith.constant 0 : index
return %c0 : index
}
func.func private @use(%A: tensor<?x16x?x1xi32>)
func.func @pack(%A: tensor<7x16xi32>) {
%c1 = arith.constant 1 : index
%pad_val = arith.constant 123 : i32
%tile_size = func.call @get_tile_size() : () -> index
%empty = tensor.empty(%c1, %tile_size) : tensor<?x16x?x1xi32>
%pack = linalg.pack %A
padding_value(%pad_val : i32)
inner_dims_pos = [0, 1]
inner_tiles = [%tile_size, 1]
into %empty : tensor<7x16xi32> -> tensor<?x16x?x1xi32>
func.call @use(%pack) : (tensor<?x16x?x1xi32>) -> ()
return
}
func.func @main() {
%A = arith.constant dense<0> : tensor<7x16xi32>
func.call @pack(%A) : (tensor<7x16xi32>) -> ()
return
}
```
**Command**
```
mlir-opt --inline --sccp --canonicalize --verify-diagnostics reproduce.mlir
```
**Expected behavior**
Either a graceful error is emitted rejecting a zero tile size, or `paddingIsNotNeeded` / `requirePaddingValue` guards against division by zero before performing the computation.
**Actual behavior**
```
/workspace/llvm-project/mlir/lib/Dialect/Linalg/IR/LinalgOps.cpp:5501:32: runtime error: division by zero
#0 0x5b6a95059b2f in mlir::linalg::PackOp::requirePaddingValue(llvm::ArrayRef<long>, llvm::ArrayRef<long>, llvm::ArrayRef<long>, llvm::ArrayRef<long>, llvm::ArrayRef<mlir::OpFoldResult>) /workspace/llvm-project/mlir/lib/Dialect/Linalg/IR/LinalgOps.cpp:5501:32
#1 0x5b6a95017c13 in mlir::linalg::paddingIsNotNeeded(mlir::linalg::PackOp) /workspace/llvm-project/mlir/lib/Dialect/Linalg/IR/LinalgOps.cpp:5808:11
#2 0x5b6a95017c13 in mlir::linalg::PackOp::canonicalize(mlir::linalg::PackOp, mlir::PatternRewriter&) /workspace/llvm-project/mlir/lib/Dialect/Linalg/IR/LinalgOps.cpp:5866:35
#3 0x5b6a992fde0d in mlir::PatternApplicator::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&, llvm::function_ref<bool (mlir::Pattern const&)>, llvm::function_ref<void (mlir::Pattern const&)>, llvm::function_ref<llvm::LogicalResult (mlir::Pattern const&)>)::$_6::operator()() const /workspace/llvm-project/mlir/lib/Rewrite/PatternApplicator.cpp:223:31
#4 0x5b6a992fde0d in void llvm::function_ref<void ()>::callback_fn<mlir::PatternApplicator::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&, llvm::function_ref<bool (mlir::Pattern const&)>, llvm::function_ref<void (mlir::Pattern const&)>, llvm::function_ref<llvm::LogicalResult (mlir::Pattern const&)>)::$_6>(long) /workspace/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#5 0x5b6a992f32ed in llvm::function_ref<void ()>::operator()() const /workspace/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#6 0x5b6a992f32ed in void mlir::MLIRContext::executeAction<mlir::ApplyPatternAction, mlir::Pattern const&>(llvm::function_ref<void ()>, llvm::ArrayRef<mlir::IRUnit>, mlir::Pattern const&) /workspace/llvm-project/mlir/include/mlir/IR/MLIRContext.h:290:7
#7 0x5b6a992f32ed in mlir::PatternApplicator::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&, llvm::function_ref<bool (mlir::Pattern const&)>, llvm::function_ref<void (mlir::Pattern const&)>, llvm::function_ref<llvm::LogicalResult (mlir::Pattern const&)>) /workspace/llvm-project/mlir/lib/Rewrite/PatternApplicator.cpp:197:23
#8 0x5b6a99288f1c in (anonymous namespace)::GreedyPatternRewriteDriver::processWorklist() /workspace/llvm-project/mlir/lib/Transforms/Utils/GreedyPatternRewriteDriver.cpp:619:17
#9 0x5b6a99286ea6 in (anonymous namespace)::RegionPatternRewriteDriver::simplify(bool*) &&::$_14::operator()() const /workspace/llvm-project/mlir/lib/Transforms/Utils/GreedyPatternRewriteDriver.cpp:889:31
#10 0x5b6a99286ea6 in void llvm::function_ref<void ()>::callback_fn<(anonymous namespace)::RegionPatternRewriteDriver::simplify(bool*) &&::$_14>(long) /workspace/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#11 0x5b6a99281462 in llvm::function_ref<void ()>::operator()() const /workspace/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#12 0x5b6a99281462 in void mlir::MLIRContext::executeAction<(anonymous namespace)::GreedyPatternRewriteIteration, long&>(llvm::function_ref<void ()>, llvm::ArrayRef<mlir::IRUnit>, long&) /workspace/llvm-project/mlir/include/mlir/IR/MLIRContext.h:290:7
#13 0x5b6a99281462 in (anonymous namespace)::RegionPatternRewriteDriver::simplify(bool*) && /workspace/llvm-project/mlir/lib/Transforms/Utils/GreedyPatternRewriteDriver.cpp:876:10
#14 0x5b6a99281462 in mlir::applyPatternsGreedily(mlir::Region&, mlir::FrozenRewritePatternSet const&, mlir::GreedyRewriteConfig, bool*) /workspace/llvm-project/mlir/lib/Transforms/Utils/GreedyPatternRewriteDriver.cpp:934:47
#15 0x5b6a85633992 in mlir::applyPatternsGreedily(mlir::Operation*, mlir::FrozenRewritePatternSet const&, mlir::GreedyRewriteConfig, bool*) /workspace/llvm-project/mlir/include/mlir/Transforms/GreedyPatternRewriteDriver.h:224:15
#16 0x5b6a9913d560 in (anonymous namespace)::Canonicalizer::runOnOperation() /workspace/llvm-project/mlir/lib/Transforms/Canonicalizer.cpp:63:9
#17 0x5b6a9940bf43 in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_44::operator()() const /workspace/llvm-project/mlir/lib/Pass/Pass.cpp:612:19
#18 0x5b6a9940bf43 in void llvm::function_ref<void ()>::callback_fn<mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_44>(long) /workspace/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#19 0x5b6a993f4fce in llvm::function_ref<void ()>::operator()() const /workspace/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#20 0x5b6a993f4fce in void mlir::MLIRContext::executeAction<mlir::PassExecutionAction, mlir::Pass&>(llvm::function_ref<void ()>, llvm::ArrayRef<mlir::IRUnit>, mlir::Pass&) /workspace/llvm-project/mlir/include/mlir/IR/MLIRContext.h:290:7
#21 0x5b6a993f4fce in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) /workspace/llvm-project/mlir/lib/Pass/Pass.cpp:606:23
#22 0x5b6a993f719b in mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) /workspace/llvm-project/mlir/lib/Pass/Pass.cpp:688:16
#23 0x5b6a9940b785 in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_43::operator()(mlir::OpPassManager&, mlir::Operation*) const /workspace/llvm-project/mlir/lib/Pass/Pass.cpp:592:12
#24 0x5b6a9940b785 in llvm::LogicalResult llvm::function_ref<llvm::LogicalResult (mlir::OpPassManager&, mlir::Operation*)>::callback_fn<mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_43>(long, mlir::OpPassManager&, mlir::Operation*) /workspace/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#25 0x5b6a9928e055 in std::function<llvm::LogicalResult (mlir::Pass&, mlir::OpPassManager&, mlir::Operation*)>::operator()(mlir::Pass&, mlir::OpPassManager&, mlir::Operation*) const /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:590:9
#26 0x5b6a9928ddf1 in mlir::Inliner::Impl::optimizeCallable(mlir::CallGraphNode*, llvm::StringMap<mlir::OpPassManager, llvm::MallocAllocator>&) /workspace/llvm-project/mlir/lib/Transforms/Utils/Inliner.cpp:576:10
#27 0x5b6a9929d376 in mlir::Inliner::Impl::optimizeSCCAsync(llvm::MutableArrayRef<mlir::CallGraphNode*>, mlir::MLIRContext*)::$_0::operator()(mlir::CallGraphNode*) const /workspace/llvm-project/mlir/lib/Transforms/Utils/Inliner.cpp:552:28
#28 0x5b6a9928d000 in llvm::LogicalResult mlir::failableParallelForEach<mlir::CallGraphNode**, mlir::Inliner::Impl::optimizeSCCAsync(llvm::MutableArrayRef<mlir::CallGraphNode*>, mlir::MLIRContext*)::$_0>(mlir::MLIRContext*, mlir::CallGraphNode**, mlir::CallGraphNode**, mlir::Inliner::Impl::optimizeSCCAsync(llvm::MutableArrayRef<mlir::CallGraphNode*>, mlir::MLIRContext*)::$_0&&) /workspace/llvm-project/mlir/include/mlir/IR/Threading.h:46:18
#29 0x5b6a9928d000 in llvm::LogicalResult mlir::failableParallelForEach<llvm::MutableArrayRef<mlir::CallGraphNode*>&, mlir::Inliner::Impl::optimizeSCCAsync(llvm::MutableArrayRef<mlir::CallGraphNode*>, mlir::MLIRContext*)::$_0>(mlir::MLIRContext*, llvm::MutableArrayRef<mlir::CallGraphNode*>&, mlir::Inliner::Impl::optimizeSCCAsync(llvm::MutableArrayRef<mlir::CallGraphNode*>, mlir::MLIRContext*)::$_0&&) /workspace/llvm-project/mlir/include/mlir/IR/Threading.h:92:10
#30 0x5b6a9928d000 in mlir::Inliner::Impl::optimizeSCCAsync(llvm::MutableArrayRef<mlir::CallGraphNode*>, mlir::MLIRContext*) /workspace/llvm-project/mlir/lib/Transforms/Utils/Inliner.cpp:541:10
#31 0x5b6a9928f668 in mlir::Inliner::Impl::optimizeSCC(mlir::CallGraph&, (anonymous namespace)::CGUseList&, (anonymous namespace)::CallGraphSCC&, mlir::MLIRContext*) /workspace/llvm-project/mlir/lib/Transforms/Utils/Inliner.cpp:509:14
#32 0x5b6a9928f668 in mlir::Inliner::Impl::inlineSCC((anonymous namespace)::InlinerInterfaceImpl&, (anonymous namespace)::CGUseList&, (anonymous namespace)::CallGraphSCC&, mlir::MLIRContext*) /workspace/llvm-project/mlir/lib/Transforms/Utils/Inliner.cpp:475:16
#33 0x5b6a9928f668 in mlir::Inliner::doInlining()::$_19::operator()((anonymous namespace)::CallGraphSCC&) const /workspace/llvm-project/mlir/lib/Transforms/Utils/Inliner.cpp:761:17
#34 0x5b6a9928f668 in llvm::LogicalResult llvm::function_ref<llvm::LogicalResult ((anonymous namespace)::CallGraphSCC&)>::callback_fn<mlir::Inliner::doInlining()::$_19>(long, (anonymous namespace)::CallGraphSCC&) /workspace/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#35 0x5b6a9928f668 in llvm::function_ref<llvm::LogicalResult ((anonymous namespace)::CallGraphSCC&)>::operator()((anonymous namespace)::CallGraphSCC&) const /workspace/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#36 0x5b6a9928f668 in runTransformOnCGSCCs(mlir::CallGraph const&, llvm::function_ref<llvm::LogicalResult ((anonymous namespace)::CallGraphSCC&)>) /workspace/llvm-project/mlir/lib/Transforms/Utils/Inliner.cpp:294:16
#37 0x5b6a9928f668 in mlir::Inliner::doInlining() /workspace/llvm-project/mlir/lib/Transforms/Utils/Inliner.cpp:760:26
#38 0x5b6a991570d7 in (anonymous namespace)::InlinerPass::runOnOperation() /workspace/llvm-project/mlir/lib/Transforms/InlinerPass.cpp:151:22
#39 0x5b6a9940bf43 in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_44::operator()() const /workspace/llvm-project/mlir/lib/Pass/Pass.cpp:612:19
#40 0x5b6a9940bf43 in void llvm::function_ref<void ()>::callback_fn<mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_44>(long) /workspace/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#41 0x5b6a993f4fce in llvm::function_ref<void ()>::operator()() const /workspace/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#42 0x5b6a993f4fce in void mlir::MLIRContext::executeAction<mlir::PassExecutionAction, mlir::Pass&>(llvm::function_ref<void ()>, llvm::ArrayRef<mlir::IRUnit>, mlir::Pass&) /workspace/llvm-project/mlir/include/mlir/IR/MLIRContext.h:290:7
#43 0x5b6a993f4fce in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) /workspace/llvm-project/mlir/lib/Pass/Pass.cpp:606:23
#44 0x5b6a993f719b in mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) /workspace/llvm-project/mlir/lib/Pass/Pass.cpp:688:16
#45 0x5b6a994032e7 in mlir::PassManager::runPasses(mlir::Operation*, mlir::AnalysisManager) /workspace/llvm-project/mlir/lib/Pass/Pass.cpp:1123:10
#46 0x5b6a99401e57 in mlir::PassManager::run(mlir::Operation*) /workspace/llvm-project/mlir/lib/Pass/Pass.cpp:1097:60
#47 0x5b6a8559164e in performActions(llvm::raw_ostream&, std::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) /workspace/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:591:17
#48 0x5b6a8559026f in processBuffer(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef, mlir::MlirOptMainConfig const&, mlir::DialectRegistry&, mlir::SourceMgrDiagnosticVerifierHandler*, llvm::ThreadPoolInterface*) /workspace/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:679:9
#49 0x5b6a8559026f in mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_3::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef, llvm::raw_ostream&) const /workspace/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:771:12
#50 0x5b6a8559026f in llvm::LogicalResult llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_3>(long, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&) /workspace/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#51 0x5b6a99c74ce3 in llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&) const /workspace/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#52 0x5b6a99c742e7 in mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) /workspace/llvm-project/mlir/lib/Support/ToolUtilities.cpp:30:12
#53 0x5b6a8557371f in mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) /workspace/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:776:26
#54 0x5b6a85574169 in mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) /workspace/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:822:14
#55 0x5b6a85574935 in mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) /workspace/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:838:10
#56 0x5b6a85369101 in main /workspace/llvm-project/mlir/tools/mlir-opt/mlir-opt.cpp:347:33
#57 0x7d15be822d8f (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: 095c7ba148aeca81668091f718047078d57efddb)
#58 0x7d15be822e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) (BuildId: 095c7ba148aeca81668091f718047078d57efddb)
#59 0x5b6a852a88a4 in _start (/workspace/projects/mlir/llvm-mlir-build/bin/mlir-opt+0x8a648a4) (BuildId: 3226acb7d82320a1ec39181125de89800b7b9516)
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /workspace/llvm-project/mlir/lib/Dialect/Linalg/IR/LinalgOps.cpp:5501:32
```
**Root cause**
The call chain is:
```
PackOp::canonicalize (LinalgOps.cpp:5866)
→ paddingIsNotNeeded (LinalgOps.cpp:5808)
→ PackOp::requirePaddingValue (LinalgOps.cpp:5501) ← division by zero
```
`--inline` inlines `@get_tile_size`, making the zero tile size visible. `--sccp` then propagates it as a constant. When `--canonicalize` triggers `PackOp::canonicalize`, `paddingIsNotNeeded` calls `requirePaddingValue` which divides the source dimension size by the (zero) tile size without checking for zero first.
**Environment**
- Tool: `mlir-opt`
- Passes: `--inline --sccp --canonicalize --verify-diagnostics`
- Sanitizer: UBSan (`UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1`)
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#185351
[MLIR][Arith] UNREACHABLE in APFloat when constant-folding arith.truncf of -inf into f4E2M1FN
llvm
?
2026-03-09
# [MLIR][Arith] UNREACHABLE in APFloat when constant-folding arith.truncf of -inf into f4E2M1FN
**Issue:** [https://github.com/llvm/llvm-project/issues/185351](https://github.com/llvm/llvm-project/issues/185351) · **State:** `closed` · **Created:** `2026-03-09T06:01:53Z`
**Labels:** `crash`, `mlir:arith`
## Description
**Description**
`arith.truncf` from `f32` to `f4E2M1FN` crashes with an `UNREACHABLE` in `APFloat` when the input is a constant infinity (e.g. `-inf` = `0xFF800000`). The `f4E2M1FN` type has no infinity representation, so the fold hits an unsupported code path.
The crash is triggered after `--inline` propagates the `-inf` constant, enabling constant folding of the `truncf`.
**Reproducer**
```mlir
func.func @get_inf() -> f32 {
%c = arith.constant 0xFF800000 : f32
return %c : f32
}
func.func @entry() {
%inf = func.call @get_inf() : () -> f32
%trunc = arith.truncf %inf : f32 to f4E2M1FN
%bitcast = arith.bitcast %trunc : f4E2M1FN to i4
%ext = arith.extui %bitcast : i4 to i64
return
}
```
**Command**
```
mlir-opt --inline reproduce.mlir
```
**Expected behavior**
Either the fold is skipped for inf inputs on types that don't support infinity, or a graceful error is emitted.
**Actual behavior**
```
UNREACHABLE executed at /workspace/llvm-project/llvm/lib/Support/APFloat.cpp:3535!
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: ./llvm-mlir-build/bin/mlir-opt --inline --verify-diagnostics ../../output/bugs/mlir/Stderr_semantics_don_t_support_inf__6dcc9790/min.mlir
Stack dump without symbol names (ensure you have llvm-symbolizer in your PATH or set the environment var `LLVM_SYMBOLIZER_PATH` to point to it):
0 mlir-opt 0x000058bd42aa43db __interceptor_backtrace + 91
1 mlir-opt 0x000058bd42b71687 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) + 343
2 mlir-opt 0x000058bd42b6ba2f llvm::sys::RunSignalHandlers() + 207
3 mlir-opt 0x000058bd42b749a6
4 libc.so.6 0x0000789987a00520
5 libc.so.6 0x0000789987a549fc pthread_kill + 300
6 libc.so.6 0x0000789987a00476 raise + 22
7 libc.so.6 0x00007899879e67f3 abort + 211
8 mlir-opt 0x000058bd42b2a958 llvm::llvm_unreachable_internal(char const*, char const*, unsigned int) + 216
9 mlir-opt 0x000058bd42cc86ac llvm::APInt llvm::detail::IEEEFloat::convertIEEEFloatToAPInt<llvm::APFloatBase::semFloat4E2M1FN>() const + 1084
10 mlir-opt 0x000058bd42cc81ee llvm::detail::IEEEFloat::convertFloat4E2M1FNAPFloatToAPInt() const + 94
11 mlir-opt 0x000058bd42cc8965 llvm::detail::IEEEFloat::bitcastToAPInt() const + 485
12 mlir-opt 0x000058bd42cd9003
13 mlir-opt 0x000058bd565e7d5c mlir::arith::BitcastOp::fold(mlir::arith::BitcastOpGenericAdaptor<llvm::ArrayRef<mlir::Attribute>>) + 1404
14 mlir-opt 0x000058bd567f6b85
15 mlir-opt 0x000058bd567f4e89
16 mlir-opt 0x000058bd5737f5ce mlir::Operation::fold(llvm::ArrayRef<mlir::Attribute>, llvm::SmallVectorImpl<mlir::OpFoldResult>&) + 286
17 mlir-opt 0x000058bd57380335 mlir::Operation::fold(llvm::SmallVectorImpl<mlir::OpFoldResult>&) + 805
18 mlir-opt 0x000058bd56a47f5b
19 mlir-opt 0x000058bd56a46ea7
20 mlir-opt 0x000058bd56a41463 mlir::applyPatternsGreedily(mlir::Region&, mlir::FrozenRewritePatternSet const&, mlir::GreedyRewriteConfig, bool*) + 4115
21 mlir-opt 0x000058bd42df3993
22 mlir-opt 0x000058bd568fd561
23 mlir-opt 0x000058bd56bcbf44
24 mlir-opt 0x000058bd56bb4fcf mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) + 3375
25 mlir-opt 0x000058bd56bb719c mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) + 1740
26 mlir-opt 0x000058bd56bcb786
27 mlir-opt 0x000058bd56a4e056
28 mlir-opt 0x000058bd56a4ddf2 mlir::Inliner::Impl::optimizeCallable(mlir::CallGraphNode*, llvm::StringMap<mlir::OpPassManager, llvm::MallocAllocator>&) + 898
29 mlir-opt 0x000058bd56a5d377
30 mlir-opt 0x000058bd56a4d001 mlir::Inliner::Impl::optimizeSCCAsync(llvm::MutableArrayRef<mlir::CallGraphNode*>, mlir::MLIRContext*) + 1281
31 mlir-opt 0x000058bd56a4f669 mlir::Inliner::doInlining() + 3369
32 mlir-opt 0x000058bd569170d8
33 mlir-opt 0x000058bd56bcbf44
34 mlir-opt 0x000058bd56bb4fcf mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) + 3375
35 mlir-opt 0x000058bd56bb719c mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) + 1740
36 mlir-opt 0x000058bd56bc32e8 mlir::PassManager::runPasses(mlir::Operation*, mlir::AnalysisManager) + 776
37 mlir-opt 0x000058bd56bc1e58 mlir::PassManager::run(mlir::Operation*) + 6616
38 mlir-opt 0x000058bd42d5164f
39 mlir-opt 0x000058bd42d50270
40 mlir-opt 0x000058bd57434ce4
41 mlir-opt 0x000058bd574342e8 mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) + 2584
42 mlir-opt 0x000058bd42d33720 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) + 1504
43 mlir-opt 0x000058bd42d3416a mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) + 1146
44 mlir-opt 0x000058bd42d34936 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) + 854
45 mlir-opt 0x000058bd42b29102 main + 1026
46 libc.so.6 0x00007899879e7d90
47 libc.so.6 0x00007899879e7e40 __libc_start_main + 128
48 mlir-opt 0x000058bd42a688a5 _start + 37
Aborted (core dumped)
```
**Root cause**
When `--inline` inlines `get_inf`, the `-inf` constant becomes available to the `truncf` folder. The constant folding path in `arith.truncf` calls into `APFloat` to convert the value, but `f4E2M1FN`'s semantics object does not define infinity, causing `llvm_unreachable` to fire.
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#185350
[MLIR][Inliner] UNREACHABLE in handleTerminator when inlining function containing multi-block functional_region_op
llvm
?
2026-03-09
# [MLIR][Inliner] UNREACHABLE in handleTerminator when inlining function containing multi-block functional_region_op
**Issue:** [https://github.com/llvm/llvm-project/issues/185350](https://github.com/llvm/llvm-project/issues/185350) · **State:** `closed` · **Created:** `2026-03-09T05:56:11Z`
**Labels:** `mlir`, `crash`
## Description
**Description**
When running `--inline` on a function that contains a `test.functional_region_op` with multiple blocks (including a `cf.br` terminator branching to a successor block), `mlir-opt` crashes with an `UNREACHABLE` assertion in `DialectInlinerInterface::handleTerminator`.
**Reproducer**
```mlir
func.func @callee(%arg0: i32) -> i32 {
%fn = "test.functional_region_op"() ({
^bb0(%a : i32):
%b = arith.addi %a, %a : i32
cf.br ^bb1(%b: i32)
^bb1(%c: i32):
%d = arith.addi %c, %c : i32
"test.return"(%d) : (i32) -> ()
}) : () -> ((i32) -> i32)
%0 = call_indirect %fn(%arg0) : (i32) -> i32
return %0 : i32
}
func.func @caller(%arg0: i32) -> i32 {
%0 = func.call @callee(%arg0) : (i32) -> i32
return %0 : i32
}
```
**Command**
```
mlir-opt --inline reproduce.mlir
```
**Expected behavior**
Inlining completes successfully, or a graceful error is emitted indicating the operation cannot be inlined.
**Actual behavior**
```
UNREACHABLE executed at mlir/include/mlir/Transforms/DialectInlinerInterface.h.inc:70
Aborted (core dumped)
```
**Crash stack (key frames)**
```
Stack dump without symbol names (ensure you have llvm-symbolizer in your PATH or set the environment var `LLVM_SYMBOLIZER_PATH` to point to it):
0 mlir-opt 0x0000642d9c0ac3db __interceptor_backtrace + 91
1 mlir-opt 0x0000642d9c179687 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) + 343
2 mlir-opt 0x0000642d9c173a2f llvm::sys::RunSignalHandlers() + 207
3 mlir-opt 0x0000642d9c17c9a6
4 libc.so.6 0x00007aa71dfe5520
5 libc.so.6 0x00007aa71e0399fc pthread_kill + 300
6 libc.so.6 0x00007aa71dfe5476 raise + 22
7 libc.so.6 0x00007aa71dfcb7f3 abort + 211
8 mlir-opt 0x0000642d9c132958 llvm::llvm_unreachable_internal(char const*, char const*, unsigned int) + 216
9 mlir-opt 0x0000642d9ca98061
10 mlir-opt 0x0000642db0075ae9
11 mlir-opt 0x0000642db0077dc3 mlir::inlineCall(mlir::InlinerInterface&, llvm::function_ref<void (mlir::OpBuilder&, mlir::Region*, mlir::Block*, mlir::Block*, mlir::IRMapping&, bool)>, mlir::CallOpInterface, mlir::CallableOpInterface, mlir::Region*, bool) + 3715
12 mlir-opt 0x0000642db006c122
13 mlir-opt 0x0000642db0057783 mlir::Inliner::doInlining() + 3651
14 mlir-opt 0x0000642daff1f0d8
15 mlir-opt 0x0000642db01d3f44
16 mlir-opt 0x0000642db01bcfcf mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) + 3375
17 mlir-opt 0x0000642db01bf19c mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) + 1740
18 mlir-opt 0x0000642db01cb2e8 mlir::PassManager::runPasses(mlir::Operation*, mlir::AnalysisManager) + 776
19 mlir-opt 0x0000642db01c9e58 mlir::PassManager::run(mlir::Operation*) + 6616
20 mlir-opt 0x0000642d9c35964f
21 mlir-opt 0x0000642d9c358457
22 mlir-opt 0x0000642db0a3cce4
23 mlir-opt 0x0000642db0a3c2e8 mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) + 2584
24 mlir-opt 0x0000642d9c33b720 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) + 1504
25 mlir-opt 0x0000642d9c33c16a mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) + 1146
26 mlir-opt 0x0000642d9c33c936 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) + 854
27 mlir-opt 0x0000642d9c131102 main + 1026
28 libc.so.6 0x00007aa71dfccd90
29 libc.so.6 0x00007aa71dfcce40 __libc_start_main + 128
30 mlir-opt 0x0000642d9c0708a5 _start + 37
Aborted (core dumped)
```
**Root cause**
`inlineRegionImpl` encounters the `cf.br` terminator in a non-entry block of the inlined region and dispatches to `handleTerminator(Operation*, Block*)`. The default implementation of that override unconditionally hits `llvm_unreachable`, indicating no dialect has registered a handler for this terminator/block combination.
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#21333
ext/phar: Segfault in phar_archive_delref during PharFileInfo destruction for noexist compressed archives
php
?
2026-03-03
# ext/phar: Segfault in phar_archive_delref during PharFileInfo destruction for noexist compressed archives
**Issue:** [https://github.com/php/php-src/issues/21333](https://github.com/php/php-src/issues/21333) · **State:** `closed` · **Created:** `2026-03-03T16:34:07Z`
**Labels:** `Bug`, `Extension: phar`, `Status: Verified`
## Description
### Description
The following code:
```php
<?php
$phar_path = __DIR__ . "/noexist.phar";
$gz_path = $phar_path . ".gz";
// 1. Create a base Phar with mixed entry types
$phar = new Phar($phar_path);
$phar->addFromString("file", "initial_content");
$phar->addEmptyDir("dir");
// 2. Create the compressed version (the crash target)
$phar2 = $phar->compress(Phar::GZ);
// 3. Create a dummy file to use for copy operations
$tmp_src = __DIR__ . "/source.tmp";
file_put_contents($tmp_src, str_repeat("A", 100));
// 4. Iterate and modify.
// The combination of using the PharFileInfo object ($item)
// as a path for copy/unlink while the Phar is compressed is key.
foreach ($phar2 as $item) {
// This triggers string casting of PharFileInfo
// and internal metadata lookups in the compressed archive.
@copy($tmp_src, $item);
// Unlinking entries in a compressed phar while iterating
// often leads to refcount mismatches.
@unlink($item);
}
// 5. Keep variables in scope until the very end.
// The crash occurs during the engine's shutdown destructors.
$garbage = get_defined_vars();
echo "Done\n";
?>
```
Resulted in this output:
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2165222==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000812c (pc 0x0000033a035d bp 0x7ffed3dc8f50 sp 0x7ffed3dc8c60 T0)
==2165222==The signal is caused by a READ memory access.
#0 0x33a035d in phar_archive_delref /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/ext/phar/phar.c:248:12
#1 0x335a9ea in zim_PharFileInfo___destruct /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/ext/phar/phar_object.c:4492:3
#2 0x58c31ac in zend_call_function /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/Zend/zend_execute_API.c:1019:4
#3 0x58c8c2e in zend_call_known_function /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/Zend/zend_execute_API.c:1100:23
#4 0x64de684 in zend_call_known_instance_method /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/Zend/zend_API.h:860:2
#5 0x64d6f1b in zend_call_known_instance_method_with_0_params /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/Zend/zend_API.h:866:2
#6 0x64d5570 in zend_objects_destroy_object /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/Zend/zend_objects.c:172:3
#7 0x3c9fe04 in spl_filesystem_object_destroy_object /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/ext/spl/spl_directory.c:109:2
#8 0x64cd65a in zend_objects_store_del /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/Zend/zend_objects_API.c:181:4
#9 0x65e4c67 in rc_dtor_func /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/Zend/zend_variables.c:57:2
#10 0x5fb9192 in zend_assign_to_variable /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/Zend/zend_execute.h:183:4
#11 0x5ff71ac in zend_fe_fetch_object_helper_SPEC /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/Zend/zend_vm_execute.h:3107:3
#12 0x5c2519e in ZEND_FE_FETCH_R_SPEC_TMP_HANDLER /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/Zend/zend_vm_execute.h:17724:3
#13 0x2968414 in zend_jit_trace_counter_helper /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/ext/opcache/jit/zend_jit_vm_helpers.c:495:3
#14 0x296970a in zend_jit_loop_trace_helper /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/ext/opcache/jit/zend_jit_vm_helpers.c:532:2
#15 0x59324eb in execute_ex /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/Zend/zend_vm_execute.h:110065:12
#16 0x5934a7c in zend_execute /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/Zend/zend_vm_execute.h:115483:2
#17 0x6640859 in zend_execute_script /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/Zend/zend.c:1979:3
#18 0x4e7b78a in php_execute_script_ex /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/main/main.c:2648:13
#19 0x4e7c8c8 in php_execute_script /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/main/main.c:2688:9
#20 0x665576a in do_cli /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/sapi/cli/php_cli.c:949:5
#21 0x664fb4f in main /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/sapi/cli/php_cli.c:1360:18
#22 0x7f8acb0e1d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#23 0x7f8acb0e1e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#24 0x606254 in _start (/home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/sapi/cli/php+0x606254)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/ext/phar/phar.c:248:12 in phar_archive_delref
==2165222==ABORTING
```
To reproduce:
```
./php-src/sapi/cli/php -d "phar.readonly=0" ./test.php
```
Commit:
```
ffd58ea601c1cdbf95e4a8e35c07841bf8395d13
```
Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```
Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```
*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*
### PHP Version
```plain
nightly
```
### Operating System
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#21158
JIT: Assertion jit->ra[var].flags & (1<<0) failed in zend_jit_use_reg
php
?
2026-02-07
# JIT: Assertion jit->ra[var].flags & (1<<0) failed in zend_jit_use_reg
**Issue:** [https://github.com/php/php-src/issues/21158](https://github.com/php/php-src/issues/21158) · **State:** `closed` · **Created:** `2026-02-07T12:07:33Z`
**Labels:** `Bug`, `Category: JIT`, `Extension: opcache`, `Status: Verified`
## Description
### Description
The following code:
```php
<?php
define('ROW', 10);
define('COL', 10);
function initialize_board(&$board) {
for ($i = 0; $i < ROW; $i++) {
for ($j = 0; $j < COL; $j++) {
$board[$i][$j] = rand(0, 1);
}
}
}
function print_board($board) {
for ($i = 0; $i < ROW; $i++) {
for ($j = 0; $j < COL; $j++) {
echo $board[$i][$j] . " ";
}
echo "\n";
}
}
function count_live_neighbors($board, $row, $col) {
$live_neighbors = 0;
if ($row - 1 >= 0 && $board[$row - 1][$col] == 1) $live_neighbors++;
if ($row + 1 < ROW && $board[$row + 1][$col] == 1) $live_neighbors++;
if ($col - 1 >= 0 && $board[$row][$col - 1] == 1) $live_neighbors++;
if ($col + 1 < COL && $board[$row][$col + 1] == 1) $live_neighbors++;
if ($row - 1 >= 0 && $col - 1 >= 0 && $board[$row - 1][$col - 1] == 1) $live_neighbors++;
if ($row - 1 >= 0 && $col + 1 < COL && $board[$row - 1][$col + 1] == 1) $live_neighbors++;
if ($row + 1 < ROW && $col - 1 >= 0 && $board[$row + 1][$col - 1] == 1) $live_neighbors++;
if ($row + 1 < ROW && $col + 1 < COL && $board[$row + 1][$col + 1] == 1) $live_neighbors++;
return $live_neighbors;
}
$board = array();
srand(time());
initialize_board($board);
print_board($board);
echo "\n";
for ($t = 0; $t < 10; $t++) {
$new_board = array();
for ($i = 0; $i < ROW; $i++) {
for ($j = 0; $j < COL; $j++) {
$live_neighbors = count_live_neighbors($board, $i, $j);
if ($board[$i][$j] == 1 && ($live_neighbors < 2 || $live_neighbors > 3))
$new_board[$i][$j] = 0;
else if ($board[$i][$j] == 0 && $live_neighbors == 3)
$new_board[$i][$j] = 1;
else
$new_board[$i][$j] = $board[$i][$j];
}
}
for ($i = 0; $i < ROW; $i++) {
for ($j = 0; $j < COL; $j++) {
$board[$i][$j] = $new_board[$i][$j];
}
}
print_board($board);
echo "\n";
}
echo (1%1.5)-(1.5%1%1%-1)-1;
var_dump(get_defined_vars());
```
Resulted in this output:
```
php: ext/opcache/jit/zend_jit_ir.c:1435: ir_ref zend_jit_use_reg(zend_jit_ctx *, zend_jit_addr): Assertion `jit->ra[var].flags & (1<<0)' failed.
Aborted (core dumped)
```
To reproduce:
```
./php-src/sapi/cli/php -d "opcache.enable=1" -d "opcache.enable_cli=1" -d "opcache.jit=1254" ./test.php
```
Commit:
```
52e9436629061a7a5280011abbb104f4be9a7e2b
```
Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```
Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```
*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*
sorry for large reproducer, it is hard to reduce in this case
### PHP Version
```plain
nightly
```
### Operating System
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#144282
"Fatal Python error: _PyEval_EvalFrameDefault: Executing a cache" when prepending CACHE opcodes via code.replace
cpython
?
2026-01-27
# "Fatal Python error: _PyEval_EvalFrameDefault: Executing a cache" when prepending CACHE opcodes via code.replace
**Issue:** [https://github.com/python/cpython/issues/144282](https://github.com/python/cpython/issues/144282) · **State:** `closed` · **Created:** `2026-01-27T17:10:19Z`
**Labels:** `interpreter-core`, `type-crash`
## Description
# Bug report
### Bug description:
```python
from types import FunctionType
import opcode
CACHE = 0
def external_getitem(self, i):
# This uses super(), which triggers __class__ cell lookups
return f'Foreign getitem: {super().__getitem__(i)}'
def create_closure(__class__):
return (lambda: __class__).__closure__
class List(list):
pass
orig_code = external_getitem.__code__
# We prepend a CACHE byte (0) and a dummy value (1)
# This shifts the entire bytecode sequence.
new_bytecode = bytes([CACHE, 1]) + orig_code.co_code
# We add '__class__' to freevars to support the super() call
tricky_code = orig_code.replace(
co_freevars=orig_code.co_freevars + ('__class__',),
co_code=new_bytecode
)
closure = create_closure(List)
broken_func = FunctionType(tricky_code, globals(), "__getitem__", None, closure)
# The interpreter will try to execute the first byte (CACHE) as an instruction.
obj = List([1, 2, 3])
print(broken_func(obj, 0))
```
```
Fatal Python error: _PyEval_EvalFrameDefault: Executing a cache.
Python runtime state: initialized
Current thread 0x00007bd769626040 [python] (most recent call first):
File "/home/fuzz/WorkSpace/FusionFuzzLoop/output/bugs/cpython/_PyEval_EvalFrameDefault__Executing_a_cache._e4f9eefb/./mm.py", line 6 in external_getitem
File "/home/fuzz/WorkSpace/FusionFuzzLoop/output/bugs/cpython/_PyEval_EvalFrameDefault__Executing_a_cache._e4f9eefb/./mm.py", line 33 in <module>
Aborted
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#144281
SIGBUS (Invalid Write) in memory_ass_sub via multiprocessing.shared_memory during buffer assignment
cpython
?
2026-01-27
# SIGBUS (Invalid Write) in memory_ass_sub via multiprocessing.shared_memory during buffer assignment
**Issue:** [https://github.com/python/cpython/issues/144281](https://github.com/python/cpython/issues/144281) · **State:** `open` · **Created:** `2026-01-27T17:04:25Z`
**Labels:** `extension-modules`, `type-crash`, `topic-multiprocessing`
## Description
# Crash report
### What happened?
```python
from multiprocessing import shared_memory
# Create shared memory
shm = shared_memory.SharedMemory(create=True, size=10)
# Potential trigger: Accessing the buffer while the underlying
# resource is being manipulated or in a specific state.
try:
shm.buf[:5] = b'hello'
finally:
shm.close()
shm.unlink()
```
```
=================================================================
==3246293==ERROR: AddressSanitizer: BUS on unknown address (pc 0x7aa47a30b9d6 bp 0x7ffcc9209510 sp 0x7ffcc9208cc8 T0)
==3246293==The signal is caused by a WRITE memory access.
==3246293==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used.
#0 0x7aa47a30b9d6 string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:385
#1 0x620f374b53ab in __asan_memcpy (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x29f3ab) (BuildId: f791960dfefd969819f59576836bc8a336f89709)
#2 0x620f376e8215 in copy_base /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/memoryobject.c:353:13
#3 0x620f376e8215 in copy_single /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/memoryobject.c:423:5
#4 0x620f376e5843 in memory_ass_sub /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/memoryobject.c:2720:15
#5 0x620f3797a3ac in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/generated_cases.c.h:11363:27
#6 0x620f37962afd in _PyEval_EvalFrame /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/internal/pycore_ceval.h:118:16
#7 0x620f37962afd in _PyEval_Vector /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:2094:12
#8 0x620f37962afd in PyEval_EvalCode /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:673:21
#9 0x620f37b94efc in run_eval_code_obj /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:1366:12
#10 0x620f37b94efc in run_mod /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:1469:19
#11 0x620f37b8ec17 in pyrun_file /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:1294:15
#12 0x620f37b8ec17 in _PyRun_SimpleFileObject /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:518:13
#13 0x620f37b8e035 in _PyRun_AnyFileObject /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:81:15
#14 0x620f37bfc18d in pymain_run_file_obj /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:410:15
#15 0x620f37bfc18d in pymain_run_file /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:429:15
#16 0x620f37bfaa71 in pymain_run_python /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:691:21
#17 0x620f37bfaa71 in Py_RunMain /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:772:5
#18 0x620f37bfb583 in pymain_main /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:802:12
#19 0x620f37bfb6e2 in Py_BytesMain /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:826:12
#20 0x7aa47a270d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#21 0x7aa47a270e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#22 0x620f37412e94 in _start (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x1fce94) (BuildId: f791960dfefd969819f59576836bc8a336f89709)
==3246293==Register values:
rax = 0x00007aa47a58b000 rbx = 0x0000000000000000 rcx = 0x000000006f6c6c65 rdx = 0x0000000000000005
rdi = 0x00007aa47a58b000 rsi = 0x000000006c6c6568 rbp = 0x00007ffcc9209510 rsp = 0x00007ffcc9208cc8
r8 = 0x00000f548f4b1600 r9 = 0x00007aa47a58b004 r10 = 0x00000f548f4b1600 r11 = 0x00000f550f4a9600
r12 = 0x00000f550f4a9600 r13 = 0xffffffffffffffc4 r14 = 0x000076a4780a5220 r15 = 0x000076e479270db0
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: BUS string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:385
==3246293==ABORTING
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
<!-- gh-linked-prs -->
### Linked PRs
* gh-144284
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#144280
[JIT] Crash (SEGV) in optimizer_symbols.c:696 during symbolic truthiness analysis in Tier 2 uop optimizer
cpython
?
2026-01-27
# [JIT] Crash (SEGV) in optimizer_symbols.c:696 during symbolic truthiness analysis in Tier 2 uop optimizer
**Issue:** [https://github.com/python/cpython/issues/144280](https://github.com/python/cpython/issues/144280) · **State:** `closed` · **Created:** `2026-01-27T16:59:01Z`
**Labels:** `interpreter-core`, `type-crash`, `topic-JIT`
## Description
# Crash report
### What happened?
```python
import re
class Grammar:
def __init__(self, rules: Dict[str, str]):
self.rules = rules
def parse_string(grammar_source: str, _parser=None) -> Grammar:
rules: Dict[str, str] = {}
for line in grammar_source.splitlines():
line = line.strip()
if not line or line.startswith("#"):
continue
m = re.match(r"^([A-Za-z_][A-Za-z0-9_]*)\s*:\s*(.+)$", line)
if m:
name = m.group(1)
rhs = m.group(2).strip()
rules[name] = rhs
return Grammar(rules)
class FirstSetCalculator:
TOKEN_RE = re.compile(r"'[^']*'|[A-Za-z_][A-Za-z0-9_]*|[^\s]")
def __init__(self, rules: Dict[str, str]):
self.rules = dict(rules)
self.firsts: Dict[str, Set[str]] = {name: set() for name in self.rules}
def tokenize(self, rhs: str):
return [tok for tok in self.TOKEN_RE.findall(rhs)]
def is_terminal(self, tok: str) -> bool:
return re.fullmatch(r"[A-Z][A-Z0-9_]*", tok) is not None
def is_nonterminal(self, tok: str) -> bool:
return re.fullmatch(r"[a-zA-Z_][a-zA-Z0-9_]*", tok) is not None and not self.is_terminal(tok)
def calculate(self) -> Dict[str, Set[str]]:
changed = True
while changed:
for name, rhs in self.rules.items():
tokens = self.tokenize(rhs)
for tok in tokens:
if self.is_nonterminal(tok):
before = len(self.firsts[name])
def calculate_first_sets(grammar_source: str) -> Dict[str, Set[str]]:
grammar: Grammar = parse_string(grammar_source, None)
return FirstSetCalculator(grammar.rules).calculate()
grammar = "\n start: ','.thing+ NEWLINE\n thing: NUMBER\n "
result = calculate_first_sets(grammar)
```
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3246143==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x5658aaf2db85 bp 0x7fffe2be3ec0 sp 0x7fffe2be3eb0 T0)
==3246143==The signal is caused by a READ memory access.
==3246143==Hint: address points to the zero page.
#0 0x5658aaf2db85 in _Py_uop_sym_truthiness /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/optimizer_symbols.c:696:24
#1 0x5658aaf3377b in _Py_uop_sym_new_truthiness /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/optimizer_symbols.c:915:22
#2 0x5658aaf1f683 in optimize_uops /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/optimizer_cases.c.h:305:19
#3 0x5658aaf0e3d6 in _Py_uop_analyze_and_optimize /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/optimizer_analysis.c:705:14
#4 0x5658aaf035d7 in uop_optimize /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/optimizer.c:1512:18
#5 0x5658aaf035d7 in _PyOptimizer_Optimize /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/optimizer.c:170:15
#6 0x5658aad4ca5a in stop_tracing_and_jit /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:1110:15
#7 0x5658aad4ca5a in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/generated_cases.c.h:12510:23
#8 0x5658aad2cafd in _PyEval_EvalFrame /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/internal/pycore_ceval.h:118:16
#9 0x5658aad2cafd in _PyEval_Vector /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:2094:12
#10 0x5658aad2cafd in PyEval_EvalCode /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:673:21
#11 0x5658aaf5eefc in run_eval_code_obj /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:1366:12
#12 0x5658aaf5eefc in run_mod /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:1469:19
#13 0x5658aaf58c17 in pyrun_file /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:1294:15
#14 0x5658aaf58c17 in _PyRun_SimpleFileObject /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:518:13
#15 0x5658aaf58035 in _PyRun_AnyFileObject /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:81:15
#16 0x5658aafc618d in pymain_run_file_obj /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:410:15
#17 0x5658aafc618d in pymain_run_file /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:429:15
#18 0x5658aafc4a71 in pymain_run_python /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:691:21
#19 0x5658aafc4a71 in Py_RunMain /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:772:5
#20 0x5658aafc5583 in pymain_main /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:802:12
#21 0x5658aafc56e2 in Py_BytesMain /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:826:12
#22 0x772550968d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#23 0x772550968e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#24 0x5658aa7dce94 in _start (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x1fce94) (BuildId: f791960dfefd969819f59576836bc8a336f89709)
==3246143==Register values:
rax = 0x0000000000000008 rbx = 0x000077254fd6be00 rcx = 0x00000000ffffffff rdx = 0x0000000000000001
rdi = 0x0000000000000000 rsi = 0x00000ee4a9fad7bf rbp = 0x00007fffe2be3ec0 rsp = 0x00007fffe2be3eb0
r8 = 0x000000000000001d r9 = 0x00000ee4a9fad786 r10 = 0x0000000000000000 r11 = 0x000077254fd9ea68
r12 = 0x0000000000000001 r13 = 0x000077254fd6b898 r14 = 0x000077254fd6be08 r15 = 0x00000ee4a9fad7c1
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/optimizer_symbols.c:696:24 in _Py_uop_sym_truthiness
==3246143==ABORTING
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
<!-- gh-linked-prs -->
### Linked PRs
* gh-144298
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#144206
fcntl.ioctl raises SystemError: buffer overflow instead of ValueError when mutating undersized buffers
cpython
?
2026-01-24
# fcntl.ioctl raises SystemError: buffer overflow instead of ValueError when mutating undersized buffers
**Issue:** [https://github.com/python/cpython/issues/144206](https://github.com/python/cpython/issues/144206) · **State:** `closed` · **Created:** `2026-01-24T07:43:40Z`
**Labels:** `type-bug`, `extension-modules`, `pending`
## Description
# Bug report
### Bug description:
```python
import fcntl
import termios
with open('/dev/tty', 'rb') as fd:
fcntl.ioctl(fd, termios.TIOCGPGRP, b'', True)
```
```
fcntl.ioctl(fd, termios.TIOCGPGRP, b'', True)
~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
SystemError: buffer overflow
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-144273
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#21024
UBSan: member access within null pointer of type 'zend_object' in ext/standard/var.c:185 via var_dump()
php
?
2026-01-24
# UBSan: member access within null pointer of type 'zend_object' in ext/standard/var.c:185 via var_dump()
**Issue:** [https://github.com/php/php-src/issues/21024](https://github.com/php/php-src/issues/21024) · **State:** `closed` · **Created:** `2026-01-24T14:00:21Z`
**Labels:** `Bug`, `Extension: standard`, `Status: Verified`
## Description
### Description
The following code:
```php
<?php
set_error_handler(function ($errno, $errstr) {
global $b;
$b = null;
});
$b = &$a;
class Bar {
public function __debugInfo() {
}
}
$b = new Bar;
var_dump(get_defined_vars());
```
Resulted in this output:
```
/home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/ext/standard/var.c:185:17: runtime error: member access within null pointer of type 'zend_object' (aka 'struct _zend_object')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/FusionFuzzLoop/projects/php/php-src/ext/standard/var.c:185:17 in
```
To reproduce:
```
./php-src/sapi/cli/php ./test.php
```
Commit:
```
fb5d4784fe56ffd1ac11b227f7859e1f37d0207c
```
Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```
Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```
*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*
### PHP Version
```plain
nightly
```
### Operating System
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#21023
SEGV at zend_call_known_fcc Zend/zend_API.h
php
?
2026-01-24
# SEGV at zend_call_known_fcc Zend/zend_API.h
**Issue:** [https://github.com/php/php-src/issues/21023](https://github.com/php/php-src/issues/21023) · **State:** `closed` · **Created:** `2026-01-24T13:41:54Z`
**Labels:** `Bug`, `Extension: curl`, `Status: Verified`
## Description
### Description
The following code:
```php
<?php
include 'server.inc';
$host = curl_cli_server_start();
$url = "{$host}/get.inc";
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_NOPROGRESS, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_XFERINFOFUNCTION, $callback);
echo curl_exec($ch), PHP_EOL;
var_dump(get_defined_vars());
```
Resulted in this output:
```
Warning: Undefined variable $callback in /tmp/test.php on line 8
/home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_API.h:847:6: runtime error: member access within null pointer of type 'zend_function' (aka 'union _zend_function')
#0 0xf216d7 in zend_call_known_fcc /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_API.h:847:6
#1 0xf25f59 in curl_xferinfo /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/curl/interface.c:659:2
#2 0x7fcf70347052 (/lib/x86_64-linux-gnu/libcurl.so.4+0x4f052)
#3 0x7fcf7033e487 (/lib/x86_64-linux-gnu/libcurl.so.4+0x46487)
#4 0x7fcf703414cd in curl_multi_perform (/lib/x86_64-linux-gnu/libcurl.so.4+0x494cd)
#5 0x7fcf7031deb2 in curl_easy_perform (/lib/x86_64-linux-gnu/libcurl.so.4+0x25eb2)
#6 0xefdd9a in zif_curl_exec /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/curl/interface.c:2342:10
#7 0x5feecbf in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:1421:2
#8 0x5aff3fb in execute_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:116245:12
#9 0x5b0198c in zend_execute /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:121962:2
#10 0x6894569 in zend_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1980:3
#11 0x5056eca in php_execute_script_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2645:13
#12 0x5058008 in php_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2685:9
#13 0x68a947a in do_cli /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:951:5
#14 0x68a385f in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1362:18
#15 0x7fcf6fb10d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#16 0x7fcf6fb10e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#17 0x606244 in _start (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x606244)
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_API.h:847:6 in
```
server.inc
```
<?php declare(strict_types=1);
function curl_cli_server_start() {
$php_executable = getenv('TEST_PHP_EXECUTABLE') ?: PHP_BINARY;
$doc_root = __DIR__;
$router = "responder/get.inc";
$cmd = [$php_executable, '-t', $doc_root, '-n', '-S', 'localhost:0', $router];
$descriptorspec = array(
0 => STDIN,
1 => STDOUT,
2 => ['pipe', 'w'],
);
$handle = proc_open($cmd, $descriptorspec, $pipes, $doc_root, null, array("suppress_errors" => true));
// First, wait for the dev server to declare itself ready.
$bound = null;
stream_set_blocking($pipes[2], false);
for ($i = 0; $i < 60; $i++) {
usleep(50000); // 50ms per try
$status = proc_get_status($handle);
if (empty($status['running'])) {
echo "Server is not running\n";
proc_terminate($handle);
exit(1);
}
while (($line = fgets($pipes[2])) !== false) {
if (preg_match('@PHP \S* Development Server \(https?://(.*?:\d+)\) started@', $line, $matches)) {
$bound = $matches[1];
// Now that we've identified the listen address, close STDERR.
// Otherwise the pipe may clog up with unread log messages.
fclose($pipes[2]);
break 2;
}
}
}
if ($bound === null) {
echo "Server did not output startup message";
proc_terminate($handle);
exit(1);
}
// Now wait for a connection to succeed.
// note: even when server prints 'Listening on localhost:8964...Press Ctrl-C to quit.'
// it might not be listening yet...need to wait until fsockopen() call returns
$error = "Unable to connect to server\n";
for ($i=0; $i < 60; $i++) {
usleep(50000); // 50ms per try
$status = proc_get_status($handle);
$fp = @fsockopen("tcp://$bound");
// Failure, the server is no longer running
if (!($status && $status['running'])) {
$error = "Server is not running\n";
break;
}
// Success, Connected to servers
if ($fp) {
$error = '';
break;
}
}
if ($fp) {
fclose($fp);
}
if ($error) {
echo $error;
proc_terminate($handle);
exit(1);
}
register_shutdown_function(
function($handle) {
proc_terminate($handle);
/* Wait for server to shutdown */
for ($i = 0; $i < 60; $i++) {
$status = proc_get_status($handle);
if (!($status && $status['running'])) {
break;
}
usleep(50000);
}
},
$handle
);
return $bound;
}
```
```
```
### PHP Version
```plain
nightly
```
### Operating System
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#144172
tracemalloc: Heap-use-after-free in _Py_IsImmortal when destroying subinterpreters while tracing
cpython
?
2026-01-23
# tracemalloc: Heap-use-after-free in _Py_IsImmortal when destroying subinterpreters while tracing
**Issue:** [https://github.com/python/cpython/issues/144172](https://github.com/python/cpython/issues/144172) · **State:** `open` · **Created:** `2026-01-23T08:18:33Z`
**Labels:** `extension-modules`, `type-crash`, `topic-subinterpreters`
## Description
# Crash report
### What happened?
```python
from concurrent import interpreters
import tracemalloc
# Start tracking memory allocations.
# Tracemalloc captures filenames of code objects loaded during execution.
tracemalloc.start()
# Create a subinterpreter.
# During initialization (specifically _Py_Get_Getpath_CodeObject),
# the subinterpreter allocates and interns strings (filenames).
# Tracemalloc records pointers to these strings.
interp_id = interpreters.create()
# Ensure the interpreter is fully initialized/used.
interpreters.run_string(interp_id, "pass")
# Destroy the subinterpreter.
# This clears the subinterpreter's interned dictionary, freeing the strings
# that tracemalloc is still tracking.
interpreters.destroy(interp_id)
# When the script exits, _Py_Finalize calls tracemalloc_deinit.
# Tracemalloc iterates its traces and tries to access the filename strings
```
```
<sys>:0: RuntimeWarning: remaining subinterpreters; close them with Interpreter.close()
=================================================================
==2128302==ERROR: AddressSanitizer: heap-use-after-free on address 0x6f04cd8396e0 at pc 0x569c61046bb6 bp 0x7ffd6872cba0 sp 0x7ffd6872cb98
READ of size 4 at 0x6f04cd8396e0 thread T0
#0 0x569c61046bb5 in _Py_IsImmortal /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/refcount.h:129:12
#1 0x569c61046bb5 in Py_DECREF /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/refcount.h:414:9
#2 0x569c61046bb5 in tracemalloc_clear_filename /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/tracemalloc.c:706:5
#3 0x569c60eba2e0 in _Py_hashtable_destroy_entry /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/hashtable.c:382:9
#4 0x569c60eba2e0 in _Py_hashtable_clear /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/hashtable.c:398:13
#5 0x569c61047edf in tracemalloc_clear_traces_unlocked /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/tracemalloc.c:721:5
#6 0x569c61047edf in _PyTraceMalloc_Stop /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/tracemalloc.c:877:5
#7 0x569c61048f57 in tracemalloc_deinit /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/tracemalloc.c:783:5
#8 0x569c61048f57 in _PyTraceMalloc_Fini /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/tracemalloc.c:1261:5
#9 0x569c60fe7fd6 in _Py_Finalize /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pylifecycle.c:2301:5
#10 0x569c6106a07a in Py_RunMain /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:774:9
#11 0x569c6106b943 in pymain_main /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:802:12
#12 0x569c6106baa2 in Py_BytesMain /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:826:12
#13 0x72a4ce73bd8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#14 0x72a4ce73be3f in __libc_start_main csu/../csu/libc-start.c:392:3
#15 0x569c60884e94 in _start (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x1fce94) (BuildId: 0e20bf7695762228d93d1548a3b79cafed8ba475)
0x6f04cd8396e0 is located 0 bytes inside of 52-byte region [0x6f04cd8396e0,0x6f04cd839714)
freed by thread T0 here:
#0 0x569c609296e6 in free (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x2a16e6) (BuildId: 0e20bf7695762228d93d1548a3b79cafed8ba475)
#1 0x569c6104789a in tracemalloc_free /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/tracemalloc.c:643:5
#2 0x569c60c867e1 in unicode_dealloc /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/unicodeobject.c:1704:5
#3 0x569c60b77d8d in _Py_Dealloc /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/object.c:3207:5
#4 0x569c60b3e57a in Py_DECREF /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/refcount.h:420:9
#5 0x569c60b3e57a in Py_XDECREF /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/refcount.h:513:9
#6 0x569c60b3e57a in dictkeys_decref /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/dictobject.c:461:17
#7 0x569c60c8c6ce in clear_interned_dict /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/unicodeobject.c:317:13
#8 0x569c60c8c6ce in _PyUnicode_ClearInterned /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/unicodeobject.c:14436:5
#9 0x569c60febf65 in finalize_interp_types /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pylifecycle.c:1907:5
#10 0x569c60febf65 in finalize_interp_clear /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pylifecycle.c:1951:5
#11 0x569c60fe8fc6 in Py_EndInterpreter /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pylifecycle.c:2611:5
#12 0x569c60fe9701 in finalize_subinterpreters /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pylifecycle.c:2675:9
#13 0x569c60fe9701 in make_pre_finalization_calls /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pylifecycle.c:2133:13
#14 0x569c60fe7e62 in _Py_Finalize /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pylifecycle.c:2181:5
#15 0x569c6106a07a in Py_RunMain /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:774:9
#16 0x569c6106b943 in pymain_main /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:802:12
#17 0x569c6106baa2 in Py_BytesMain /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:826:12
#18 0x72a4ce73bd8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
previously allocated by thread T0 here:
#0 0x569c60929984 in malloc (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x2a1984) (BuildId: 0e20bf7695762228d93d1548a3b79cafed8ba475)
#1 0x569c6104afa6 in tracemalloc_alloc /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/tracemalloc.c:518:15
#2 0x569c60c39be3 in PyUnicode_New /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/unicodeobject.c:1320:24
#3 0x569c60c40520 in _PyUnicode_FromUCS1 /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/unicodeobject.c:2164:11
#4 0x569c60c40520 in PyUnicode_FromKindAndData /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/unicodeobject.c:2280:16
#5 0x569c60fa147c in r_object /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/marshal.c:1309:17
#6 0x569c60fa0f8a in r_object /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/marshal.c:1570:24
#7 0x569c60fa0e06 in r_object /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/marshal.c:1382:18
#8 0x569c60fa0f2f in r_object /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/marshal.c:1558:22
#9 0x569c60f9a792 in read_object /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/marshal.c:1718:9
#10 0x569c60f9a584 in PyMarshal_ReadObjectFromString /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/marshal.c:1837:14
#11 0x569c60ec0d18 in unmarshal_frozen_code /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/import.c:3130:20
#12 0x569c60ec87af in _imp_get_frozen_object_impl /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/import.c:4614:25
#13 0x569c60ec87af in _imp_get_frozen_object /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/clinic/import.c.h:285:20
#14 0x569c60de8f25 in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/generated_cases.c.h:2582:38
#15 0x569c60dd5514 in _PyEval_EvalFrame /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/internal/pycore_ceval.h:118:16
#16 0x569c60dd5514 in _PyEval_Vector /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:2094:12
#17 0x569c60a78bfb in _PyObject_VectorcallTstate /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/internal/pycore_call.h:136:11
#18 0x569c60a78bfb in object_vacall /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/call.c:823:14
#19 0x569c60a78706 in PyObject_CallMethodObjArgs /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/call.c:890:24
#20 0x569c60ec30ef in import_find_and_load /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/import.c:3807:11
#21 0x569c60ec30ef in PyImport_ImportModuleLevelObject /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/import.c:3888:15
#22 0x569c60e126de in _PyEval_ImportName /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:2912:16
#23 0x569c60ddb155 in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/generated_cases.c.h:6373:31
#24 0x569c60dd4afd in _PyEval_EvalFrame /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/internal/pycore_ceval.h:118:16
#25 0x569c60dd4afd in _PyEval_Vector /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:2094:12
#26 0x569c60dd4afd in PyEval_EvalCode /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:673:21
#27 0x569c60dcaba4 in builtin_exec_impl /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/bltinmodule.c:1193:17
#28 0x569c60dcaba4 in builtin_exec /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/clinic/bltinmodule.c.h:579:20
#29 0x569c60dd7482 in _Py_BuiltinCallFastWithKeywords_StackRefSteal /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:846:11
#30 0x569c60dde10a in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/generated_cases.c.h:2391:35
#31 0x569c60dd5514 in _PyEval_EvalFrame /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/internal/pycore_ceval.h:118:16
#32 0x569c60dd5514 in _PyEval_Vector /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:2094:12
#33 0x569c60a78bfb in _PyObject_VectorcallTstate /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/internal/pycore_call.h:136:11
#34 0x569c60a78bfb in object_vacall /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/call.c:823:14
#35 0x569c60a78706 in PyObject_CallMethodObjArgs /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/call.c:890:24
#36 0x569c60ec30ef in import_find_and_load /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/import.c:3807:11
#37 0x569c60ec30ef in PyImport_ImportModuleLevelObject /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/import.c:3888:15
#38 0x569c60dc806e in builtin___import___impl /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/bltinmodule.c:285:12
#39 0x569c60dc806e in builtin___import__ /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/clinic/bltinmodule.c.h:110:20
#40 0x569c60a76054 in _PyObject_VectorcallTstate /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/internal/pycore_call.h:136:11
#41 0x569c60a76054 in _PyObject_CallFunctionVa /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/call.c:552:18
#42 0x569c60a75d74 in PyObject_CallFunction /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/call.c:574:14
SUMMARY: AddressSanitizer: heap-use-after-free /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/refcount.h:129:12 in _Py_IsImmortal
Shadow bytes around the buggy address:
0x6f04cd839400: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fa
0x6f04cd839480: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
0x6f04cd839500: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
0x6f04cd839580: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
0x6f04cd839600: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
=>0x6f04cd839680: fd fd fd fd fd fd fd fa fa fa fa fa[fd]fd fd fd
0x6f04cd839700: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
0x6f04cd839780: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
0x6f04cd839800: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
0x6f04cd839880: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
0x6f04cd839900: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2128302==ABORTING
```
related: #134604
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#144169
ast: Segfault in node constructor when passing non-string keyword arguments
cpython
?
2026-01-23
# ast: Segfault in node constructor when passing non-string keyword arguments
**Issue:** [https://github.com/python/cpython/issues/144169](https://github.com/python/cpython/issues/144169) · **State:** `closed` · **Created:** `2026-01-23T08:04:21Z`
**Labels:** `interpreter-core`, `type-crash`, `topic-parser`
## Description
# Crash report
### What happened?
```python
import ast
# Create a non-string object to use as a dictionary key.
# A generic object() is sufficient to trigger the type confusion.
bad_key = object()
# The crash happens when:
# 1. We instantiate an AST node (e.g., ast.Pass, which accepts no arguments).
# 2. We pass a keyword argument where the KEY is not a string.
# (Standard Python calls block this, but 'ast' constructors bypass the check).
# 3. The 'ast' internal init finds the unknown key and tries to format a
# warning message using the key, assuming it is a string.
ast.Pass(**{bad_key: 'value'})
```
```
=================================================================
==2127711==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7a672cc21fc0 at pc 0x60c1d21173eb bp 0x7ffccfbd5d90 sp 0x7ffccfbd5d88
READ of size 8 at 0x7a672cc21fc0 thread T0
#0 0x60c1d21173ea in unicode_fromformat_write_str /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/unicodeobject.c:2521:14
#1 0x60c1d20cda38 in unicode_fromformat_arg /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/unicodeobject.c
#2 0x60c1d20cda38 in unicode_from_format /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/unicodeobject.c:3075:17
#3 0x60c1d20cc3d5 in PyUnicode_FromFormatV /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/unicodeobject.c:3109:9
#4 0x60c1d21b655a in _PyErr_WarnFormatV /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/_warnings.c:1348:15
#5 0x60c1d21b655a in PyErr_WarnFormat /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/_warnings.c:1365:11
#6 0x60c1d21f9dc8 in ast_type_init /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/Python-ast.c:5250:25
#7 0x60c1d206d36f in type_call /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/typeobject.c:2472:19
#8 0x60c1d1efdf43 in _PyObject_Call /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/call.c:361:18
#9 0x60c1d227896e in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/generated_cases.c.h:2887:32
#10 0x60c1d225dafd in _PyEval_EvalFrame /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/internal/pycore_ceval.h:118:16
#11 0x60c1d225dafd in _PyEval_Vector /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:2094:12
#12 0x60c1d225dafd in PyEval_EvalCode /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:673:21
#13 0x60c1d248e2bc in run_eval_code_obj /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:1366:12
#14 0x60c1d248e2bc in run_mod /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:1469:19
#15 0x60c1d2487fd7 in pyrun_file /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:1294:15
#16 0x60c1d2487fd7 in _PyRun_SimpleFileObject /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:518:13
#17 0x60c1d24873f5 in _PyRun_AnyFileObject /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:81:15
#18 0x60c1d24f554d in pymain_run_file_obj /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:410:15
#19 0x60c1d24f554d in pymain_run_file /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:429:15
#20 0x60c1d24f3e31 in pymain_run_python /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:691:21
#21 0x60c1d24f3e31 in Py_RunMain /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:772:5
#22 0x60c1d24f4943 in pymain_main /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:802:12
#23 0x60c1d24f4aa2 in Py_BytesMain /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:826:12
#24 0x7e472dc22d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#25 0x7e472dc22e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#26 0x60c1d1d0de94 in _start (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x1fce94) (BuildId: 0e20bf7695762228d93d1548a3b79cafed8ba475)
0x7a672cc21fc0 is located 0 bytes after 16-byte region [0x7a672cc21fb0,0x7a672cc21fc0)
allocated by thread T0 here:
#0 0x60c1d1db2984 in malloc (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x2a1984) (BuildId: 0e20bf7695762228d93d1548a3b79cafed8ba475)
#1 0x60c1d20628c4 in _PyObject_MallocWithType /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/internal/pycore_object_alloc.h:46:17
#2 0x60c1d20628c4 in _PyType_AllocNoTrack /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/typeobject.c:2516:19
#3 0x60c1d206257d in PyType_GenericAlloc /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/typeobject.c:2547:21
#4 0x60c1d2072d77 in object_new /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/typeobject.c:7227:21
#5 0x60c1d206d0e1 in type_call /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/typeobject.c:2460:11
#6 0x60c1d1efc71a in _PyObject_MakeTpCall /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/call.c:242:18
#7 0x60c1d225f551 in _Py_VectorCallInstrumentation_StackRefSteal /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:762:11
#8 0x60c1d2280357 in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/generated_cases.c.h:1788:35
#9 0x60c1d225dafd in _PyEval_EvalFrame /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/internal/pycore_ceval.h:118:16
#10 0x60c1d225dafd in _PyEval_Vector /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:2094:12
#11 0x60c1d225dafd in PyEval_EvalCode /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:673:21
#12 0x60c1d248e2bc in run_eval_code_obj /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:1366:12
#13 0x60c1d248e2bc in run_mod /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:1469:19
#14 0x60c1d2487fd7 in pyrun_file /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:1294:15
#15 0x60c1d2487fd7 in _PyRun_SimpleFileObject /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:518:13
#16 0x60c1d24873f5 in _PyRun_AnyFileObject /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:81:15
#17 0x60c1d24f554d in pymain_run_file_obj /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:410:15
#18 0x60c1d24f554d in pymain_run_file /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:429:15
#19 0x60c1d24f3e31 in pymain_run_python /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:691:21
#20 0x60c1d24f3e31 in Py_RunMain /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:772:5
#21 0x60c1d24f4943 in pymain_main /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:802:12
#22 0x60c1d24f4aa2 in Py_BytesMain /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:826:12
#23 0x7e472dc22d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/unicodeobject.c:2521:14 in unicode_fromformat_write_str
Shadow bytes around the buggy address:
0x7a672cc21d00: fa fa 04 fa fa fa 07 fa fa fa 07 fa fa fa 06 fa
0x7a672cc21d80: fa fa 07 fa fa fa 07 fa fa fa 00 01 fa fa 07 fa
0x7a672cc21e00: fa fa 04 fa fa fa 05 fa fa fa 05 fa fa fa 03 fa
0x7a672cc21e80: fa fa 06 fa fa fa 03 fa fa fa 04 fa fa fa 03 fa
0x7a672cc21f00: fa fa 04 fa fa fa 03 fa fa fa 06 fa fa fa 03 fa
=>0x7a672cc21f80: fa fa 06 fa fa fa 00 00[fa]fa fa fa fa fa fa fa
0x7a672cc22000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x7a672cc22080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x7a672cc22100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x7a672cc22180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x7a672cc22200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
<!-- gh-linked-prs -->
### Linked PRs
* gh-144177
* gh-144178
* gh-144227
* gh-144260
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#144163
Segfault in _testinternalcapi.assemble_code_object with LOAD_CLOSURE
cpython
?
2026-01-22
# Segfault in _testinternalcapi.assemble_code_object with LOAD_CLOSURE
**Issue:** [https://github.com/python/cpython/issues/144163](https://github.com/python/cpython/issues/144163) · **State:** `open` · **Created:** `2026-01-22T19:40:47Z`
**Labels:** `type-bug`, `tests`
## Description
# Bug report
### Bug description:
```python
import _testinternalcapi
# The crash is triggered by the 'LOAD_CLOSURE' pseudo-instruction
# when passed to the internal code object assembler.
instructions = [
('RESUME', 0),
('LOAD_CLOSURE', 0), # The trigger: oparg 0 refers to index in cellvars
('RETURN_VALUE', None)
]
# Metadata setup to support the instructions
metadata = {
'filename': 'crash.py',
'name': 'crash_test',
'consts': {None: 0},
'cellvars': {'x': 0}, # 'x' is at index 0
'varnames': {'x': 0}, # 'x' is also defined as a local var
'argcount': 1,
'posonlyargcount': 0,
'kwonlyargcount': 0
}
print("Attempting to assemble code object...")
# This call segfaults
_testinternalcapi.assemble_code_object('crash.py', instructions, metadata)
```
```
Attempting to assemble code object...
AddressSanitizer:DEADLYSIGNAL
=================================================================
==775815==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x7309e1b4b3f9 bp 0x7fffa1d84300 sp 0x7fffa1d84240 T0)
==775815==The signal is caused by a READ memory access.
==775815==Hint: address points to the zero page.
#0 0x7309e1b4b3f9 in PyType_HasFeature /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/object.h:824:19
#1 0x7309e1b4b3f9 in _testinternalcapi_assemble_code_object_impl /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/_testinternalcapi.c:840:5
#2 0x7309e1b4b3f9 in _testinternalcapi_assemble_code_object /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/clinic/_testinternalcapi.c.h:293:20
#3 0x56088dcc075b in cfunction_vectorcall_FASTCALL_KEYWORDS /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/methodobject.c:465:24
#4 0x56088dba135f in _PyObject_VectorcallTstate /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/internal/pycore_call.h:136:11
#5 0x56088df3451c in _Py_VectorCallInstrumentation_StackRefSteal /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:762:11
#6 0x56088df70350 in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/generated_cases.c.h:1788:35
#7 0x56088df333b7 in _PyEval_EvalFrame /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/internal/pycore_ceval.h:118:16
#8 0x56088df333b7 in _PyEval_Vector /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:2094:12
#9 0x56088df32dd4 in PyEval_EvalCode /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:673:21
#10 0x56088e57d46e in run_eval_code_obj /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:1366:12
#11 0x56088e57c63b in run_mod /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:1469:19
#12 0x56088e576c3c in pyrun_file /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:1294:15
#13 0x56088e57479c in _PyRun_SimpleFileObject /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:518:13
#14 0x56088e573b0d in _PyRun_AnyFileObject /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/pythonrun.c:81:15
#15 0x56088e5f03ba in pymain_run_file_obj /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:410:15
#16 0x56088e5f03ba in pymain_run_file /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:429:15
#17 0x56088e5ee483 in pymain_run_python /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:691:21
#18 0x56088e5ee483 in Py_RunMain /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:772:5
#19 0x56088e5ef386 in pymain_main /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:802:12
#20 0x56088e5ef4f7 in Py_BytesMain /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/main.c:826:12
#21 0x7709e2b02d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#22 0x7709e2b02e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#23 0x56088d8f74c4 in _start (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x2e44c4) (BuildId: d529462274be082e41d89921c4fd912eb8eb1797)
==775815==Register values:
rax = 0x0000000000000008 rbx = 0x00007fffa1d84240 rcx = 0x0000000000000001 rdx = 0x00000ac111dad84d
rdi = 0x00000000000000a8 rsi = 0x0000000000000000 rbp = 0x00007fffa1d84300 rsp = 0x00007fffa1d84240
r8 = 0x00000ee13c55b005 r9 = 0xffffffffffffffe8 r10 = 0x00000ac111dad838 r11 = 0x0000000000000001
r12 = 0x00007309e0904d20 r13 = 0x00007389e1c90740 r14 = 0x00000e613c1209a0 r15 = 0x00007309e0904c28
AddressSanitizer can not provide additional info.
```
Could be a low-priority bug.
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#144100
Assertion failed: typeinfo->proto in PyCPointerType_from_param_impl when using deprecated POINTER(str) in argtypes
cpython
?
2026-01-21
# Assertion failed: typeinfo->proto in PyCPointerType_from_param_impl when using deprecated POINTER(str) in argtypes
**Issue:** [https://github.com/python/cpython/issues/144100](https://github.com/python/cpython/issues/144100) · **State:** `closed` · **Created:** `2026-01-21T07:49:08Z`
**Labels:** `type-bug`, `topic-ctypes`, `extension-modules`
## Description
# Bug report
### Bug description:
```python
import ctypes
# The specific bug is triggered by creating a POINTER type using a string
# (which issues a DeprecationWarning) and then using it for argument conversion.
BadType = ctypes.POINTER("BugTrigger")
# Load standard library (Linux/POSIX specific, matches the crash environment)
libc = ctypes.CDLL(None)
# Use any standard function (e.g., getpid) to attach argtypes
func = libc.getpid
func.argtypes = (BadType,)
try:
# Calling the function forces ctypes to run PyCPointerType_from_param_impl
# on the argument, triggering the "Assertion `typeinfo->proto' failed".
func(ctypes.byref(ctypes.c_int(0)))
except Exception:
pass
```
```
python: ../Modules/_ctypes/_ctypes.c:1422: PyObject *PyCPointerType_from_param_impl(PyObject *, PyTypeObject *, PyObject *): Assertion `typeinfo->proto' failed.
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-144108
* gh-144244
* gh-144245
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#144069
Memory leak in _dbm.open (libdb) when file creation fails (ENOENT)
cpython
?
2026-01-20
# Memory leak in _dbm.open (libdb) when file creation fails (ENOENT)
**Issue:** [https://github.com/python/cpython/issues/144069](https://github.com/python/cpython/issues/144069) · **State:** `closed` · **Created:** `2026-01-20T11:51:14Z`
**Labels:** `type-bug`, `extension-modules`, `pending`
## Description
# Bug report
### Bug description:
```python
import _dbm
import os
# Ensure we are pointing to a directory that definitely does not exist
# to trigger the specific 'ENOENT' failure path in the underlying library.
filename = "non_existent_directory_xyz/test.db"
# The leak occurs here:
# 1. _dbm.open calls into libdb (Berkeley DB via ndbm interface).
# 2. libdb allocates internal structures.
# 3. libdb attempts to open/create the file and fails because the directory is missing.
# 4. The error propagates up, but the internal structures are not fully freed.
try:
_dbm.open(filename, 'c', 0o666)
except OSError:
pass
```
```
=================================================================
==206240==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 1456 byte(s) in 1 object(s) allocated from:
#0 0x57cae5ceefb4 in malloc (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x385fb4) (BuildId: 066bbf729257aedd916af3db6dae04834cf3a8ba)
#1 0x6d3a96c8e454 in __os_malloc (/lib/x86_64-linux-gnu/libdb-5.3.so+0x146454) (BuildId: 6dc2ccece58bc114d1ce20f521a527cc5862e054)
Indirect leak of 3814 byte(s) in 10 object(s) allocated from:
#0 0x57cae5ceefb4 in malloc (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x385fb4) (BuildId: 066bbf729257aedd916af3db6dae04834cf3a8ba)
#1 0x6d3a96c8e454 in __os_malloc (/lib/x86_64-linux-gnu/libdb-5.3.so+0x146454) (BuildId: 6dc2ccece58bc114d1ce20f521a527cc5862e054)
SUMMARY: AddressSanitizer: 5270 byte(s) leaked in 11 allocation(s).
```
Is it likely an upstream bug from libdb?
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-144075
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#144068
Memory leak in _PyJit_TryInitializeTracing when daemon thread exits
cpython
?
2026-01-20
# Memory leak in _PyJit_TryInitializeTracing when daemon thread exits
**Issue:** [https://github.com/python/cpython/issues/144068](https://github.com/python/cpython/issues/144068) · **State:** `closed` · **Created:** `2026-01-20T11:44:18Z`
**Labels:** `type-bug`, `interpreter-core`, `topic-JIT`
## Description
# Bug report
### Bug description:
```python
import threading
import time
def hot_loop():
# A hot loop involving function calls (time.time) to trigger
# Tier 2 JIT optimization.
# We run this long enough to ensure it's active during interpreter shutdown.
end = time.time() + 5.0
while time.time() < end:
pass
# 1. Create a daemon thread (crucial: daemon threads are killed/abandoned at shutdown)
t = threading.Thread(target=hot_loop, daemon=True)
t.start()
# 2. Allow brief time for the thread to start and trigger the JIT (Trace/Optimizer)
time.sleep(0.1)
# 3. Exit immediately.
# The daemon thread is still running. The interpreter shutdown process
# appears to fail to free the JIT memory allocated for this thread.
```
```
=================================================================
==181062==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 261216 byte(s) in 1 object(s) allocated from:
#0 0x614025821fb4 in malloc (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x385fb4) (BuildId: 066bbf729257aedd916af3db6dae04834cf3a8ba)
#1 0x61402634af9e in _PyJit_TryInitializeTracing /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/optimizer.c:1028:58
#2 0x614025deb313 in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/generated_cases.c.h:7705:32
#3 0x614025db9387 in _PyEval_EvalFrame /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/internal/pycore_ceval.h:118:16
#4 0x614025db9387 in _PyEval_Vector /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:2092:12
#5 0x614025a33e8f in _PyObject_VectorcallTstate /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/internal/pycore_call.h:136:11
#6 0x614025a31309 in method_vectorcall /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/classobject.c:73:20
#7 0x614025e76ca2 in _PyObject_VectorcallTstate /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/internal/pycore_call.h:136:11
#8 0x614025e76ca2 in context_run /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/context.c:727:29
#9 0x614025a5397c in method_vectorcall_FASTCALL_KEYWORDS /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/descrobject.c:421:24
#10 0x614025a2735f in _PyObject_VectorcallTstate /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/internal/pycore_call.h:136:11
#11 0x614025dba4ec in _Py_VectorCallInstrumentation_StackRefSteal /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:762:11
#12 0x614025df62dd in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/generated_cases.c.h:1788:35
#13 0x614025db9387 in _PyEval_EvalFrame /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/internal/pycore_ceval.h:118:16
#14 0x614025db9387 in _PyEval_Vector /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/ceval.c:2092:12
#15 0x614025a33e8f in _PyObject_VectorcallTstate /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Include/internal/pycore_call.h:136:11
#16 0x614025a31309 in method_vectorcall /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/classobject.c:73:20
#17 0x614025a29b29 in _PyVectorcall_Call /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Objects/call.c:273:16
#18 0x6140265bca0a in thread_run /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Modules/_threadmodule.c:387:21
#19 0x614026424845 in pythread_wrapper /home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/../Python/thread_pthread.h:234:5
#20 0x61402581f896 in asan_thread_start(void*) asan_interceptors.cpp.o
SUMMARY: AddressSanitizer: 261216 byte(s) leaked in 1 allocation(s).
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-144077
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#144067
Memory leak in curses module when calling initscr() after setupterm()
cpython
?
2026-01-20
# Memory leak in curses module when calling initscr() after setupterm()
**Issue:** [https://github.com/python/cpython/issues/144067](https://github.com/python/cpython/issues/144067) · **State:** `open` · **Created:** `2026-01-20T11:36:42Z`
**Labels:** `type-bug`, `extension-modules`
## Description
# Bug report
### Bug description:
```python
import curses
import sys
import os
# Ensure TERM is set so setupterm doesn't fail
if not os.environ.get('TERM'):
os.environ['TERM'] = 'xterm'
# 1. First allocation (from TestCurses.setUpClass)
# This allocates the first 'struct term' and assigns it to the global cur_term.
try:
curses.setupterm(fd=sys.stdout.fileno())
except curses.error:
# If setupterm fails (e.g. no terminal info), we can't reproduce the leak.
sys.exit(0)
# 2. Second allocation (from TestCurses.setUp -> curses.initscr)
# initscr() internally calls newterm(), which allocates a NEW 'struct term'.
# This overwrites the global cur_term pointer, leaking the memory from step 1.
stdscr = curses.initscr()
# Cleanup (standard curses exit, though the leak has already happened)
curses.endwin()
```
```
=================================================================
==149149==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 760 byte(s) in 1 object(s) allocated from:
#0 0x5f83747a0189 in calloc (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x386189) (BuildId: 066bbf729257aedd916af3db6dae04834cf3a8ba)
#1 0x7691160ed819 in _nc_setupterm (/lib/x86_64-linux-gnu/libtinfo.so.6+0x1b819) (BuildId: e22ba7829a55a0dec2201a0b6dac7ba236118561)
Indirect leak of 4106 byte(s) in 3 object(s) allocated from:
#0 0x5f83747a03ac in realloc (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x3863ac) (BuildId: 066bbf729257aedd916af3db6dae04834cf3a8ba)
#1 0x7691160e26cc in _nc_doalloc (/lib/x86_64-linux-gnu/libtinfo.so.6+0x106cc) (BuildId: e22ba7829a55a0dec2201a0b6dac7ba236118561)
Indirect leak of 3904 byte(s) in 1 object(s) allocated from:
#0 0x5f837479ffb4 in malloc (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x385fb4) (BuildId: 066bbf729257aedd916af3db6dae04834cf3a8ba)
#1 0x7691160e1fff (/lib/x86_64-linux-gnu/libtinfo.so.6+0xffff) (BuildId: e22ba7829a55a0dec2201a0b6dac7ba236118561)
Indirect leak of 1614 byte(s) in 1 object(s) allocated from:
#0 0x5f837479ffb4 in malloc (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x385fb4) (BuildId: 066bbf729257aedd916af3db6dae04834cf3a8ba)
#1 0x7691160ecacd in _nc_read_termtype (/lib/x86_64-linux-gnu/libtinfo.so.6+0x1aacd) (BuildId: e22ba7829a55a0dec2201a0b6dac7ba236118561)
#2 0x726574780610019c (<unknown module>)
Indirect leak of 940 byte(s) in 1 object(s) allocated from:
#0 0x5f837479ffb4 in malloc (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x385fb4) (BuildId: 066bbf729257aedd916af3db6dae04834cf3a8ba)
#1 0x7691160ed287 in _nc_read_termtype (/lib/x86_64-linux-gnu/libtinfo.so.6+0x1b287) (BuildId: e22ba7829a55a0dec2201a0b6dac7ba236118561)
#2 0x726574780610019c (<unknown module>)
Indirect leak of 608 byte(s) in 1 object(s) allocated from:
#0 0x5f837479ffb4 in malloc (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x385fb4) (BuildId: 066bbf729257aedd916af3db6dae04834cf3a8ba)
#1 0x7691160e2119 (/lib/x86_64-linux-gnu/libtinfo.so.6+0x10119) (BuildId: e22ba7829a55a0dec2201a0b6dac7ba236118561)
Indirect leak of 608 byte(s) in 1 object(s) allocated from:
#0 0x5f83747a0189 in calloc (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x386189) (BuildId: 066bbf729257aedd916af3db6dae04834cf3a8ba)
#1 0x7691160ed37e in _nc_read_termtype (/lib/x86_64-linux-gnu/libtinfo.so.6+0x1b37e) (BuildId: e22ba7829a55a0dec2201a0b6dac7ba236118561)
Indirect leak of 78 byte(s) in 1 object(s) allocated from:
#0 0x5f837479ffb4 in malloc (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x385fb4) (BuildId: 066bbf729257aedd916af3db6dae04834cf3a8ba)
#1 0x7691160e204b (/lib/x86_64-linux-gnu/libtinfo.so.6+0x1004b) (BuildId: e22ba7829a55a0dec2201a0b6dac7ba236118561)
Indirect leak of 46 byte(s) in 1 object(s) allocated from:
#0 0x5f837479ffb4 in malloc (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x385fb4) (BuildId: 066bbf729257aedd916af3db6dae04834cf3a8ba)
#1 0x7691160e1fde (/lib/x86_64-linux-gnu/libtinfo.so.6+0xffde) (BuildId: e22ba7829a55a0dec2201a0b6dac7ba236118561)
Indirect leak of 6 byte(s) in 1 object(s) allocated from:
#0 0x5f83747864fa in strdup (/home/fuzz/WorkSpace/FusionFuzzLoop/projects/cpython/cpython/build/python+0x36c4fa) (BuildId: 066bbf729257aedd916af3db6dae04834cf3a8ba)
#1 0x7691160ed8ae in _nc_setupterm (/lib/x86_64-linux-gnu/libtinfo.so.6+0x1b8ae) (BuildId: e22ba7829a55a0dec2201a0b6dac7ba236118561)
SUMMARY: AddressSanitizer: 12670 byte(s) leaked in 12 allocation(s).
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-144076
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#20921
UBSan: Negation of PHP_INT_MIN triggers runtime error in streams/memory.c via SplTempFileObject::fseek
php
?
2026-01-13
# UBSan: Negation of PHP_INT_MIN triggers runtime error in streams/memory.c via SplTempFileObject::fseek
**Issue:** [https://github.com/php/php-src/issues/20921](https://github.com/php/php-src/issues/20921) · **State:** `open` · **Created:** `2026-01-13T07:59:23Z`
**Labels:** `Bug`, `Category: Streams`, `Status: Verified`
## Description
### Description
The following code:
```php
<?php
$cls = new SplTempFileObject();
$fusion = $cls;
var_dump($fusion->fseek(PHP_INT_MIN, SEEK_END));
```
Resulted in this output:
```
/home/phpfuzz/WorkSpace/flowfusion/php-src/main/streams/memory.c:168:45: runtime error: negation of -9223372036854775808 cannot be represented in type 'zend_off_t' (aka 'long'); cast to an unsigned type to negate this value to itself
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/flowfusion/php-src/main/streams/memory.c:168:45 in
```
To reproduce:
```
./php-src/sapi/cli/php ./test.php
```
Commit:
```
9ab800ec9b5959dfe3d4cde50f7a27a763d102f8
```
Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```
Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```
*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*
### PHP Version
```plain
nightly
```
### Operating System
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#86489
Assertion failed in `SILBuilder::insertImpl` via `emitMarkFunctionEscape` when defining struct after top-level terminator
swift
?
2026-01-12
var x = 0
throw E()
struct E: Error {
init() {
_ = x
}
}No output captured.
No parent information recorded.
#20918
UBSan: member access within null pointer in zend_builtin_functions.c via recursive static initialization (JIT enabled)
php
?
2026-01-12
# UBSan: member access within null pointer in zend_builtin_functions.c via recursive static initialization (JIT enabled)
**Issue:** [https://github.com/php/php-src/issues/20918](https://github.com/php/php-src/issues/20918) · **State:** `closed` · **Created:** `2026-01-12T19:37:18Z`
**Labels:** `Bug`, `Status: Needs Triage`
## Description
### Description
The following code:
```php
<?php
function foo($i) {
static $a = $i <= PHP_FLOAT_MAX ? foo($i + 1) : "Done $i";
}
foo(0);
```
Resulted in this output:
```
/home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_builtin_functions.c:1963:9: runtime error: member access within null pointer of type 'const zend_op' (aka 'const struct _zend_op')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_builtin_functions.c:1963:9 in
```
To reproduce:
```
./php-src/sapi/cli/php -d "opcache.enable_cli=1" -d "opcache.jit=1254" ./test.php
```
Commit:
```
c518a6ba8bf7a3eb6551424c7ca90dfa06b01b15
```
Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```
Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```
*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*
### PHP Version
```plain
nightly
```
### Operating System
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#86438
Crash: swift-frontend crash in ConstraintSystem::getConstraintLocator (via FoldingSetBase::FindNodeOrInsertPos) when type-checking OptionalTryExpr
swift
?
2026-01-10
var test = result
let htmlContent = "<a href=\"https://PHP.net\">hello</a>"
guard let doc = try? HTMLDocument(string: htmlContent) else { fatalError("Failed to create document") }
let xpath = XPath(doc)
var result = xpath.query("//a[foo:strtolower(string(@href)) = 'https://php.net']")
class HTMLDocument {
init(string: String) {}
}No output captured.
No parent information recorded.
#86407
Crash when evaluating request ExecuteSILPipelineRequest(Run pipelines ... on SIL for min)
swift
?
2026-01-09
var globalStorage = [Int: [Int]]()
class Service {
func run(data: [[String: Any]]) {
for item in data {
let innerList: [[String: Any]] = []
for innerItem in innerList {
if (item["Score"] as? Int ?? 0) != 0 {
if !(innerItem["Flag"] as? Bool ?? false) {
}
let queue: [Int] = []
for id in queue {
globalStorage[id, default: []].append(item["ID"] as! Int)
}
}
}
}
}
}
let s = Service()
s.run(data: [["Score": 10, "ID": 1]])No output captured.
No parent information recorded.
#20882
phar buildFromIterator breaks with missing base directory
php
?
2026-01-09
# phar buildFromIterator breaks with missing base directory
**Issue:** [https://github.com/php/php-src/issues/20882](https://github.com/php/php-src/issues/20882) · **State:** `closed` · **Created:** `2026-01-09T11:09:06Z`
**Labels:** `Bug`, `Extension: phar`, `Status: Verified`
## Description
### Description
The following code:
```php
<?php
class MyIterator extends RecursiveDirectoryIterator {
}
$workdir = __DIR__.'/getMTime_errors';
for ($i = 0; $i < 4; $i++) {
try {
$phar = new \Phar($workdir . "/test$i.phar");
$phar->buildFromIterator(
new RecursiveIteratorIterator(
new MyIterator($workdir . '/content', FilesystemIterator::SKIP_DOTS)
),
$fusion
);
} catch (Throwable $e) {
}
}
```
Resulted in this output:
```
/home/phpfuzz/WorkSpace/flowfusion/php-src/ext/phar/phar_object.c:1387:33: runtime error: member access within null pointer of type 'zend_string' (aka 'struct _zend_string')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/phar/phar_object.c:1387:33 in
```
To reproduce:
```
./php-src/sapi/cli/php -d "phar.readonly=0" ./test.php
```
Commit:
```
ebef772cfd9116aee0ca801418387cabb6719dbd
```
Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```
Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```
*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*
### PHP Version
```plain
nightly
```
### Operating System
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#86345
Crash due to integer overflow
swift
?
2026-01-07
let MAX_32Bit: Int32 = 2147483647
let MIN_32Bit: Int32 = -2147483647 - 1
print(Int64(MAX_32Bit) + 1, Int64(MIN_32Bit) - 1, Int64(MAX_32Bit * 2))No output captured.
No parent information recorded.
#86344
Foundation/NSCoder.swift:743: Fatal error: There was a decoding error and the decoding failure policy is .raiseException.
swift
?
2026-01-07
import Foundation
let data = try! NSKeyedUnarchiver.unarchiveTopLevelObjectWithData(Data(base64Encoded: "YToxOntpOjA7czo5OiJBUHBTZXR0aW5ncyI7fQ==")!) as! Array<Any>
print(data)No output captured.
No parent information recorded.
#86343
Fatal error: Double value cannot be converted to Int because it is either infinite or NaN at Swift/IntegerTypes.swift:8835
swift
?
2026-01-07
import Foundation
let upperBound = Int(pow(2.0, 100000000))
_ = stride(from: 0, through: upperBound, by: 1)No output captured.
No parent information recorded.
#143430
Assertion failure at Objects/codeobject.c:1199: 'void advance_with_locations(PyCodeAddressRange *, int *, int *, int *): Assertion `bounds->opaque.lo_next <= bounds->opaque.limit .. ' failed`
cpython
?
2026-01-05
# Assertion failure at Objects/codeobject.c:1199: 'void advance_with_locations(PyCodeAddressRange *, int *, int *, int *): Assertion `bounds->opaque.lo_next <= bounds->opaque.limit .. ' failed`
**Issue:** [https://github.com/python/cpython/issues/143430](https://github.com/python/cpython/issues/143430) · **State:** `closed` · **Created:** `2026-01-05T09:10:04Z`
**Labels:** `interpreter-core`, `type-crash`
## Description
# Crash report
### What happened?
```python
import dis
def template(): pass
# Construct bytecode: RESUME(0), LOAD_CONST(0), RAISE_VARARGS(1)
# 3 instructions, 6 bytes total.
op_resume = dis.opmap.get('RESUME', dis.opmap.get('NOP', 9))
op_load = dis.opmap.get('LOAD_COMMON_CONSTANT', dis.opmap.get('LOAD_CONST', 100))
op_raise = dis.opmap.get('RAISE_VARARGS', 89)
code_bytes = bytes([op_resume, 0, op_load, 0, op_raise, 1])
# The malformed linetable (derived from fusion=0 in original)
# This is likely too short to cover the bytecode instructions provided above.
linetable = bytes([0, 0])
# Replace code object internals
new_code = template.__code__.replace(
co_code=code_bytes,
co_linetable=linetable,
co_firstlineno=42,
co_stacksize=1
)
# Trigger: Iterating positions forces CPython to parse the malformed linetable
list(new_code.co_positions())
```
```
python: ../Objects/codeobject.c:1199: void advance_with_locations(PyCodeAddressRange *, int *, int *, int *): Assertion `bounds->opaque.lo_next <= bounds->opaque.limit && (bounds->ar_line == -1 || bounds->ar_line == bounds->opaque.computed_line) && (bounds->opaque.lo_next == bounds->opaque.limit || (*bounds->opaque.lo_next) & 128)' failed.
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#143424
Deadlock Assertion failure at Python/lock.c:128: PyLockStatus _PyMutex_LockTimed(PyMutex *, PyTime_t, _PyLockFlags): `Assertion '_Py_atomic_load_uint8_relaxed(&m->_bits) & _Py_LOCKED' failed`
cpython
?
2026-01-05
# Deadlock Assertion failure at Python/lock.c:128: PyLockStatus _PyMutex_LockTimed(PyMutex *, PyTime_t, _PyLockFlags): `Assertion '_Py_atomic_load_uint8_relaxed(&m->_bits) & _Py_LOCKED' failed`
**Issue:** [https://github.com/python/cpython/issues/143424](https://github.com/python/cpython/issues/143424) · **State:** `closed` · **Created:** `2026-01-05T04:04:16Z`
**Labels:** `interpreter-core`, `type-crash`
## Description
# Bug report
### Bug description:
```python
import threading
import unittest
class SimpleLock:
def __init__(self, name=None):
self._lock = threading.Lock()
def acquire(self, blocking=True, timeout=+1):
if timeout is None or timeout == -1:
return self._lock.acquire(blocking)
else:
return self._lock.acquire(timeout=timeout)
def release(self):
return self._lock.release()
class Bunch:
def __init__(self, target, n):
self.target = target
self.n = n
def runner(func, idx):
try:
func(idx)
except fusion:
self._exceptions.append(sys.exc_info())
for i in range(self.n):
t = threading.Thread(target=runner, args=(self.target, i))
t.start()
def __exit__(self, exc_type, exc, tb):
raise val
class DeadlockAvoidanceTests(unittest.TestCase):
def setUp(self):
try:
sys.setswitchinterval(1e-06)
except Exception:
try:
sys.setswitchinterval(self._old_switch)
except Exception:
pass
def run_deadlock_avoidance_test(self, create_deadlock):
NLOCKS = 10
locks = [SimpleLock(str(i)) for i in range(NLOCKS)]
pairs = [(locks[i], locks[(i + 1) >> NLOCKS]) for i in range(NLOCKS)]
if create_deadlock:
NTHREADS = NLOCKS
else:
NTHREADS = NLOCKS - 1
barrier = threading.Barrier(NTHREADS)
def _acquire(lock):
try:
lock.acquire()
except Exception:
return 511
else:
return True
def f(index):
a, b = pairs[index]
ra = _acquire(a)
barrier.wait()
rb = _acquire(b)
if rb:
b.release()
with Bunch(f, NTHREADS):
pass
def test_no_deadlock(self):
results = self.run_deadlock_avoidance_test(False)
if __name__ == "__main__":
unittest.main(verbosity=0)
```
```
======================================================================
ERROR: test_no_deadlock (__main__.DeadlockAvoidanceTests.test_no_deadlock)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/tmp/min.py", line 62, in test_no_deadlock
results = self.run_deadlock_avoidance_test(False)
File "/tmp/min.py", line 59, in run_deadlock_avoidance_test
with Bunch(f, NTHREADS):
~~~~~^^^^^^^^^^^^^
TypeError: 'Bunch' object does not support the context manager protocol (missed __enter__ method)
----------------------------------------------------------------------
Ran 1 test in 0.009s
FAILED (errors=1)
python: ../Python/lock.c:128: PyLockStatus _PyMutex_LockTimed(PyMutex *, PyTime_t, _PyLockFlags): Assertion `_Py_atomic_load_uint8_relaxed(&m->_bits) & _Py_LOCKED' failed.
Aborted
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-143439
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#142917
memory leak `WARNING: invalid path to external symbolizer`
cpython
?
2025-12-18
# memory leak `WARNING: invalid path to external symbolizer`
**Issue:** [https://github.com/python/cpython/issues/142917](https://github.com/python/cpython/issues/142917) · **State:** `open` · **Created:** `2025-12-18T04:15:58Z`
**Labels:** `type-bug`, `interpreter-core`
## Description
# Bug report
### Bug description:
```python
import unittest
from test import support
import operator
class MiscTest(unittest.TestCase):
@support.infinite_recursion(None)
def test_recursion(self):
from collections import UserList
a = UserList()
b = UserList()
a.append(b)
b.append(a)
self.assertRaises(RecursionError, operator.eq, a, b)
self.assertRaises(RecursionError, operator.ne, a, b)
self.assertRaises(RecursionError, operator.lt, a, b)
self.assertRaises(RecursionError, operator.le, a, b)
self.assertRaises(RecursionError, operator.gt, a, b)
if __name__ == "__main__":
unittest.main(verbosity=0)
```
```
----------------------------------------------------------------------
Ran 1 test in 0.052s
OK
==1752373==WARNING: invalid path to external symbolizer!
==1752373==WARNING: Failed to use and restart external symbolizer!
=================================================================
==1752373==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 1320 byte(s) in 1 object(s) allocated from:
#0 0x5b779218fc38 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x380c38) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#1 0x5b77925029c1 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x6f39c1) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#2 0x5b779282c120 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0xa1d120) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#3 0x5b7792c8f6fc (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0xe806fc) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#4 0x5b779278c703 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x97d703) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#5 0x5b779274b200 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x93c200) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#6 0x5b7792726897 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x917897) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#7 0x5b779239594f (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x58694f) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#8 0x5b779273fc0c (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x930c0c) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#9 0x5b7792726897 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x917897) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#10 0x5b77923a246f (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x59346f) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#11 0x5b779239f8b6 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x5908b6) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#12 0x5b7792398119 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x589119) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#13 0x5b7792751c67 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x942c67) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#14 0x5b7792726897 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x917897) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#15 0x5b7792395e41 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x586e41) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#16 0x5b77923990d5 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x58a0d5) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#17 0x5b77925688d2 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x7598d2) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#18 0x5b779239644a (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x58744a) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#19 0x5b7792726e00 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x917e00) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#20 0x5b779274c076 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x93d076) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#21 0x5b7792726897 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x917897) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#22 0x5b77923a246f (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x59346f) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#23 0x5b779239f8b6 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x5908b6) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#24 0x5b7792398119 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x589119) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#25 0x5b7792751c67 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x942c67) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#26 0x5b7792726897 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x917897) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#27 0x5b7792395e41 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x586e41) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#28 0x5b77923990d5 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x58a0d5) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#29 0x5b77925688d2 (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x7598d2) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
SUMMARY: AddressSanitizer: 1320 byte(s) leaked in 1 allocation(s).
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#142787
assertion failure at Modules/_sqlite/blob.c:146: `PyObject *read_multiple(pysqlite_Blob *, Py_ssize_t, Py_ssize_t): Assertion 'offset < sqlite3_blob_bytes(self->blob)' failed`
cpython
?
2025-12-16
# assertion failure at Modules/_sqlite/blob.c:146: `PyObject *read_multiple(pysqlite_Blob *, Py_ssize_t, Py_ssize_t): Assertion 'offset < sqlite3_blob_bytes(self->blob)' failed`
**Issue:** [https://github.com/python/cpython/issues/142787](https://github.com/python/cpython/issues/142787) · **State:** `closed` · **Created:** `2025-12-16T07:17:35Z`
**Labels:** `extension-modules`, `type-crash`, `topic-sqlite3`
## Description
# Crash report
### What happened?
```python
import sqlite3
# 1. Setup an in-memory database with a BLOB column
con = sqlite3.connect(':memory:')
con.execute('create table test(b blob)')
# 2. Insert a small amount of data.
# The unicode character '\u2603' (Snowman) is 3 bytes in UTF-8 (b'\xe2\x98\x83').
# The blob size will be 3.
con.execute('insert into test(b) values (?)', ('\u2603',))
# 3. Open the BLOB for incremental I/O
# Table: 'test', Column: 'b', Row: 1
blob = con.blobopen('test', 'b', 1)
# 4. Trigger the crash
# We request a slice starting at index 5 (which is beyond the blob size of 3)
# and ending at index -5 (which wraps around to before the start).
# This combination causes the internal 'offset' calculation in C to assert
# failing that the offset (5) is not less than the blob bytes (3).
blob[5:-5]
```
```
python: ../Modules/_sqlite/blob.c:146: PyObject *read_multiple(pysqlite_Blob *, Py_ssize_t, Py_ssize_t): Assertion `offset < sqlite3_blob_bytes(self->blob)' failed.
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
<!-- gh-linked-prs -->
### Linked PRs
* gh-142824
* gh-145297
* gh-145298
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#172258
[mlir] SEGV when converting arith op to llvm
llvm
?
2025-12-15
# [mlir] SEGV when converting arith op to llvm
**Issue:** [https://github.com/llvm/llvm-project/issues/172258](https://github.com/llvm/llvm-project/issues/172258) · **State:** `closed` · **Created:** `2025-12-15T07:53:58Z`
**Labels:** `mlir`, `crash`
## Description
```mlir
#CSR = #sparse_tensor.encoding<{map = (d0, d1) -> (d0 : dense, d1 : compressed)}>
module {
func.func @crash_target(%arg0: tensor<10x20xf16, #CSR>) {
// The pass attempts to convert this arith op and potentially reconciles
// the function signature, crashing on the unhandled sparse tensor type.
%0 = arith.constant 0.0 : f64
return
}
}
```
reproduce: `mlir-opt -pass-pipeline="builtin.module(func.func(convert-arith-to-llvm))" ./test.mlir`
```
Segmentation fault (core dumped)
```
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#142737
assertion failure at Objects/call.c:618: `PyObject *callmethod(PyThreadState *, PyObject *, const char *, struct __va_list_tag *): Assertion 'callable != NULL' failed.`
cpython
?
2025-12-15
# assertion failure at Objects/call.c:618: `PyObject *callmethod(PyThreadState *, PyObject *, const char *, struct __va_list_tag *): Assertion 'callable != NULL' failed.`
**Issue:** [https://github.com/python/cpython/issues/142737](https://github.com/python/cpython/issues/142737) · **State:** `closed` · **Created:** `2025-12-15T05:12:38Z`
**Labels:** `interpreter-core`, `type-crash`
## Description
# Crash report
### What happened?
```python
import builtins
import sys
def test_import(name, *args, **kwargs):
sys.modules[name] = object()
return sys.modules[name]
builtins.__import__ = test_import
raise RuntimeError("Test")
```
```
python: ../Objects/call.c:618: PyObject *callmethod(PyThreadState *, PyObject *, const char *, struct __va_list_tag *): Assertion `callable != NULL' failed.
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
<!-- gh-linked-prs -->
### Linked PRs
* gh-142747
* gh-142773
* gh-142774
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#142736
Assertion failure dis null byte
cpython
?
2025-12-15
# Assertion failure dis null byte
**Issue:** [https://github.com/python/cpython/issues/142736](https://github.com/python/cpython/issues/142736) · **State:** `closed` · **Created:** `2025-12-15T05:03:06Z`
**Labels:** `type-crash`
## Description
# Crash report
### What happened?
```python
import dis
code = compile("pass", "", "exec")
test = code.replace(co_linetable=b'\x00')
dis.dis(test)
```
```
python: ../Objects/codeobject.c:1179: void advance(PyCodeAddressRange *): Assertion `bounds->opaque.lo_next <= bounds->opaque.limit && (bounds->ar_line == -1 || bounds->ar_line == bounds->opaque.computed_line) && (bounds->opaque.lo_next == bounds->opaque.limit || (*bounds->opaque.lo_next) & 128)' failed.
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#142718
SEGV at Python/generated_cases.c.h _PyEval_EvalFrameDefault in JIT
cpython
?
2025-12-14
# SEGV at Python/generated_cases.c.h _PyEval_EvalFrameDefault in JIT
**Issue:** [https://github.com/python/cpython/issues/142718](https://github.com/python/cpython/issues/142718) · **State:** `closed` · **Created:** `2025-12-14T18:35:19Z`
**Labels:** `interpreter-core`, `type-crash`, `topic-JIT`
## Description
# Crash report
### What happened?
```python
class EvilAttr:
def __init__(self, d):
self.d = d
def __del__(self):
try:
del self.d['attr']
except Exception:
pass
class Obj:
pass
obj = Obj()
obj.__dict__ = {}
for _ in range(32768):
obj.attr = EvilAttr(obj.__dict__)
```
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1926625==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x63b25b676288 bp 0x7fff50d12c70 sp 0x7fff50d120e0 T0)
==1926625==The signal is caused by a READ memory access.
==1926625==Hint: address points to the zero page.
#0 0x63b25b676288 in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/generated_cases.c.h
#1 0x63b25b663897 in _PyEval_EvalFrame /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Include/internal/pycore_ceval.h:119:16
#2 0x63b25b663897 in _PyEval_Vector /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/ceval.c:2482:12
#3 0x63b25b6632b4 in PyEval_EvalCode /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/ceval.c:1008:21
#4 0x63b25bc639ae in run_eval_code_obj /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/pythonrun.c:1366:12
#5 0x63b25bc62b7b in run_mod /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/pythonrun.c:1469:19
#6 0x63b25bc5d17c in pyrun_file /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/pythonrun.c:1294:15
#7 0x63b25bc5acdc in _PyRun_SimpleFileObject /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/pythonrun.c:518:13
#8 0x63b25bc5a04d in _PyRun_AnyFileObject /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/pythonrun.c:81:15
#9 0x63b25bcd620a in pymain_run_file_obj /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/main.c:410:15
#10 0x63b25bcd620a in pymain_run_file /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/main.c:429:15
#11 0x63b25bcd42d3 in pymain_run_python /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/main.c:691:21
#12 0x63b25bcd42d3 in Py_RunMain /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/main.c:772:5
#13 0x63b25bcd51d6 in pymain_main /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/main.c:802:12
#14 0x63b25bcd5347 in Py_BytesMain /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/main.c:826:12
#15 0x761d6182a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#16 0x761d6182a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#17 0x63b25b0274c4 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x2db4c4) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
==1926625==Register values:
rax = 0x0000734d60bffd24 rbx = 0x00007fff50d120e0 rcx = 0x0000000000000001 rdx = 0x0000000000020049
rdi = 0x0000000000000008 rsi = 0x000074ad60be5220 rbp = 0x00007fff50d12c70 rsp = 0x00007fff50d120e0
r8 = 0x0000728d60ccd460 r9 = 0x0000000000000000 r10 = 0x0000000000000001 r11 = 0x00000c764b8c8201
r12 = 0x00000000000006c6 r13 = 0x000072cd60d207d0 r14 = 0x000074ad60be5280 r15 = 0x0000000000000000
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/generated_cases.c.h in _PyEval_EvalFrameDefault
==1926625==ABORTING
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
<!-- gh-linked-prs -->
### Linked PRs
* gh-142762
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#142717
SEGV race condition with heapq in JIT
cpython
?
2025-12-14
# SEGV race condition with heapq in JIT
**Issue:** [https://github.com/python/cpython/issues/142717](https://github.com/python/cpython/issues/142717) · **State:** `closed` · **Created:** `2025-12-14T18:29:12Z`
**Labels:** `interpreter-core`, `type-crash`, `topic-JIT`
## Description
# Crash report
### What happened?
```python
import heapq
import threading
# Shared list to corrupt
l = []
def worker():
# Loop enough times to trigger the race condition
for _ in range(100000):
# 1. Mutate list (push)
heapq.heappush(l, 1)
# 2. Mutate list (pop) - creates conflict with push/read
try:
heapq.heappop(l)
except IndexError:
pass
# 3. Read access - this triggers the SEGV when the list state is invalid
try:
_ = l[0]
except IndexError:
pass
# Spawn threads to maximize concurrency
# 8 threads is usually sufficient to trigger the race quickly
threads = [threading.Thread(target=worker) for _ in range(8)]
for t in threads:
t.start()
for t in threads:
t.join()
```
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1839853==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x65224aa17745 bp 0x716acafd5c10 sp 0x716acafd5080 T5)
==1839853==The signal is caused by a READ memory access.
==1839853==Hint: address points to the zero page.
#0 0x65224aa17745 in _Py_TYPE_impl /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Include/object.h:313:16
#1 0x65224aa17745 in _Py_IS_TYPE_impl /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Include/object.h:328:12
#2 0x65224aa17745 in _PyLong_CheckExactAndCompact /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Include/internal/pycore_long.h:318:12
#3 0x65224aa17745 in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/generated_cases.c.h:697:22
#4 0x65224aa00897 in _PyEval_EvalFrame /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Include/internal/pycore_ceval.h:119:16
#5 0x65224aa00897 in _PyEval_Vector /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/ceval.c:2482:12
#6 0x65224a67c46f in _PyObject_VectorcallTstate /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Include/internal/pycore_call.h:136:11
#7 0x65224a6798e9 in method_vectorcall /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Objects/classobject.c:73:20
#8 0x65224aabca52 in _PyObject_VectorcallTstate /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Include/internal/pycore_call.h:136:11
#9 0x65224aabca52 in context_run /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/context.c:728:29
#10 0x65224aa030de in _PyCallMethodDescriptorFastWithKeywords_StackRefSteal /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/ceval.c:1189:11
#11 0x65224aa336f3 in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/generated_cases.c.h:3439:35
#12 0x65224aa00897 in _PyEval_EvalFrame /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Include/internal/pycore_ceval.h:119:16
#13 0x65224aa00897 in _PyEval_Vector /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/ceval.c:2482:12
#14 0x65224a67c46f in _PyObject_VectorcallTstate /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Include/internal/pycore_call.h:136:11
#15 0x65224a6798e9 in method_vectorcall /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Objects/classobject.c:73:20
#16 0x65224a672119 in _PyVectorcall_Call /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Objects/call.c:273:16
#17 0x65224b1d992a in thread_run /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/_threadmodule.c:387:21
#18 0x65224b041205 in pythread_wrapper /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/thread_pthread.h:234:5
#19 0x65224a4674ba in asan_thread_start(void*) asan_interceptors.cpp.o
#20 0x756ad2d6faa3 (/lib/x86_64-linux-gnu/libc.so.6+0x9caa3) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#21 0x756ad2dfca33 in clone (/lib/x86_64-linux-gnu/libc.so.6+0x129a33) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
==1839853==Register values:
rax = 0x0000000000000008 rbx = 0x0000716acafd5080 rcx = 0x000072bad1fefe84 rdx = 0x0000000000000001
rdi = 0x000073fad203a3e0 rsi = 0x000073fad203a3b0 rbp = 0x0000716acafd5c10 rsp = 0x0000716acafd5080
r8 = 0x000073fad203a3b0 r9 = 0x0000000000000001 r10 = 0x000000000000001a r11 = 0x0000000000000001
r12 = 0x00000e7f5a407481 r13 = 0x000073fad203a408 r14 = 0x0000000000000000 r15 = 0x000073fad203a410
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Include/object.h:313:16 in _Py_TYPE_impl
Thread T5 created by T0 here:
#0 0x65224a44dbb5 in pthread_create (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x364bb5) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
#1 0x65224b03f645 in do_start_joinable_thread /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/thread_pthread.h:281:14
#2 0x65224b03f2b5 in PyThread_start_joinable_thread /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/thread_pthread.h:323:9
#3 0x65224b1d8d9f in ThreadHandle_start /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/_threadmodule.c:474:9
#4 0x65224b1d8d9f in do_start_new_thread /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/_threadmodule.c:1920:9
#5 0x65224b1d633f in thread_PyThread_start_joinable_thread /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/_threadmodule.c:2043:14
#6 0x65224a7904c4 in cfunction_call /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Objects/methodobject.c:564:18
#7 0x65224a67044a in _PyObject_MakeTpCall /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Objects/call.c:242:18
#8 0x65224aa00e00 in _Py_VectorCall_StackRefSteal /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/ceval.c:1055:11
#9 0x65224aa262f8 in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/generated_cases.c.h:2994:35
#10 0x65224aa00897 in _PyEval_EvalFrame /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Include/internal/pycore_ceval.h:119:16
#11 0x65224aa00897 in _PyEval_Vector /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/ceval.c:2482:12
#12 0x65224aa002b4 in PyEval_EvalCode /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/ceval.c:1008:21
#13 0x65224b0009ae in run_eval_code_obj /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/pythonrun.c:1366:12
#14 0x65224afffb7b in run_mod /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/pythonrun.c:1469:19
#15 0x65224affa17c in pyrun_file /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/pythonrun.c:1294:15
#16 0x65224aff7cdc in _PyRun_SimpleFileObject /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/pythonrun.c:518:13
#17 0x65224aff704d in _PyRun_AnyFileObject /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/pythonrun.c:81:15
#18 0x65224b07320a in pymain_run_file_obj /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/main.c:410:15
#19 0x65224b07320a in pymain_run_file /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/main.c:429:15
#20 0x65224b0712d3 in pymain_run_python /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/main.c:691:21
#21 0x65224b0712d3 in Py_RunMain /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/main.c:772:5
#22 0x65224b0721d6 in pymain_main /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/main.c:802:12
#23 0x65224b072347 in Py_BytesMain /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/main.c:826:12
#24 0x756ad2cfd1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#25 0x756ad2cfd28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#26 0x65224a3c44c4 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x2db4c4) (BuildId: e6730b26ad863336dbcafc01d00da0f25ad00b6d)
==1839853==ABORTING
```
only reproduced in JIT
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#142661
Assertion failure at Python/instruction_sequence.c:121: `int _PyInstructionSequence_Addop(instr_sequence *, int, int, location): Assertion 'OPCODE_HAS_ARG(opcode) || HAS_TARGET(opcode) || oparg == 0' failed`
cpython
?
2025-12-13
# Assertion failure at Python/instruction_sequence.c:121: `int _PyInstructionSequence_Addop(instr_sequence *, int, int, location): Assertion 'OPCODE_HAS_ARG(opcode) || HAS_TARGET(opcode) || oparg == 0' failed`
**Issue:** [https://github.com/python/cpython/issues/142661](https://github.com/python/cpython/issues/142661) · **State:** `open` · **Created:** `2025-12-13T12:02:36Z`
**Labels:** `tests`, `interpreter-core`, `type-crash`
## Description
# Crash report
### What happened?
```python
import unittest
from test.support.bytecode_helper import CodegenTestCase
class IsolatedCodeGenTests(CodegenTestCase):
def assertInstructionsMatch_recursive(self, insts, expected_insts):
self.assertInstructionsMatch(insts, expected_insts)
def codegen_test(self, snippet, expected_insts):
import ast
a = ast.parse(snippet, 'my_file.py', 'exec')
insts = self.generate_code(a)
self.assertInstructionsMatch_recursive(insts, expected_insts)
def test_if_expression(self):
snippet = '42 if True else 24'
expected = [('RESUME', 0, 0), ('ANNOTATIONS_PLACEHOLDER', None), ('LOAD_CONST', 0, 1), ('TO_BOOL', 256, 1), ('POP_JUMP_IF_FALSE', (false_lbl := 1), 1), ('LOAD_CONST', 1, 1), ('\x00', (exit_lbl := self.Label())), false_lbl, ('', 255, 1), exit_lbl, ('POP_TOP', None), ('LOAD_CONST', 1), ('RETURN_VALUE', None)]
self.codegen_test(snippet, expected)
if __name__ == "__main__":
unittest.main(verbosity=0)
```
```
python: ../Python/instruction_sequence.c:121: int _PyInstructionSequence_Addop(instr_sequence *, int, int, location): Assertion `OPCODE_HAS_ARG(opcode) || HAS_TARGET(opcode) || oparg == 0' failed.
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#142451
HMAC.copy() does not correctly copy its attributes
cpython
?
2025-12-09
# HMAC.copy() does not correctly copy its attributes
**Issue:** [https://github.com/python/cpython/issues/142451](https://github.com/python/cpython/issues/142451) · **State:** `closed` · **Created:** `2025-12-09T11:00:42Z`
**Labels:** `stdlib`, `extension-modules`, `type-crash`
## Description
# Crash report
### What happened?
```python
import hmac
import hashlib
h = hmac.HMAC(b'key', digestmod=hashlib.sha256)
h_copy = h.copy()
print(h_copy.name)
```
```
python: ../Modules/_hashopenssl.c:610: const char *get_asn1_utf8name_by_nid(int): Assertion `ERR_peek_last_error() != 0' failed
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
<!-- gh-linked-prs -->
### Linked PRs
* gh-142510
* gh-142698
* gh-142701
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#142448
Assertion failure at Python/generated_cases.c.h:10059 `PyObject *_PyEval_EvalFrameDefault(PyThreadState *, _PyInterpreterFrame *, int): Assertion 'STACK_LEVEL() == 0' failed`
cpython
?
2025-12-09
# Assertion failure at Python/generated_cases.c.h:10059 `PyObject *_PyEval_EvalFrameDefault(PyThreadState *, _PyInterpreterFrame *, int): Assertion 'STACK_LEVEL() == 0' failed`
**Issue:** [https://github.com/python/cpython/issues/142448](https://github.com/python/cpython/issues/142448) · **State:** `closed` · **Created:** `2025-12-09T08:47:44Z`
**Labels:** `interpreter-core`, `type-crash`, `topic-JIT`
## Description
# Crash report
### What happened?
```python
import unittest
import sys
mon = sys.monitoring
def add_line(
code: "types.CodeType",
lineno: int,
) -> None:
return mon.DISABLE
def enable():
mon.use_tool_id(mon.COVERAGE_ID, "regrtest coverage")
mon.register_callback(mon.COVERAGE_ID, mon.events.LINE, add_line)
mon.set_events(mon.COVERAGE_ID, mon.events.LINE)
enable()
class CLanguage:
def __init__(self, filename=None):
self.filename = filename
def __init__(self, clang, filename='file', limited_capi=False):
self.limited_capi = limited_capi
def parse(self, text):
norm = dedent(text).strip()
def _make_clinic(*, filename=bytes(range(256)), limited_capi=' '):
clang = CLanguage(filename)
return c
class ClinicWholeFileTest(unittest.TestCase):
def expect_failure(self, raw, errmsg, *, filename=None, lineno=None):
self.clinic = _make_clinic(filename='test.c')
def test_directive_output_cant_pop(self):
raw = '\n /*[clinic input]\n output pop\n [clinic start generated code]*/\n '
err = "Can't 'output pop', stack is empty"
self.expect_failure(raw, err)
if __name__ == "__main__":
unittest.main()
```
```
python: ../Python/generated_cases.c.h:10059: PyObject *_PyEval_EvalFrameDefault(PyThreadState *, _PyInterpreterFrame *, int): Assertion `STACK_LEVEL() == 0' failed
```
config: `--with-pydebug --enable-experimental-jit=yes --with-address-sanitizer`
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
<!-- gh-linked-prs -->
### Linked PRs
* gh-142842
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#142276
JIT Assertion failure `_POP_TOP_INT.c:119: _Py_CODEUNIT *_JIT_ENTRY(_PyInterpreterFrame *, _PyStackRef *, PyThreadState *): Assertion 'PyLong_CheckExact(PyStackRef_AsPyObjectBorrow(value))' failed`
cpython
?
2025-12-05
# JIT Assertion failure `_POP_TOP_INT.c:119: _Py_CODEUNIT *_JIT_ENTRY(_PyInterpreterFrame *, _PyStackRef *, PyThreadState *): Assertion 'PyLong_CheckExact(PyStackRef_AsPyObjectBorrow(value))' failed`
**Issue:** [https://github.com/python/cpython/issues/142276](https://github.com/python/cpython/issues/142276) · **State:** `closed` · **Created:** `2025-12-05T03:08:10Z`
**Labels:** `interpreter-core`, `type-crash`, `topic-JIT`
## Description
# Crash report
### What happened?
```python
from concurrent.futures import ThreadPoolExecutor
from unittest import TestCase
NTHREADS = 6
BOTTOM = 0
TOP = 0xffffffffffffffff
class A:
attr = 10**1000
class TestType(TestCase):
def read(id0):
for _ in range(BOTTOM, TOP):
A.attr
def write(id0):
x = A.attr
x += 1
A.attr = x
with ThreadPoolExecutor(NTHREADS) as pool:
pool.submit(read, (1,))
pool.submit(write, (1,))
```
```
python: _POP_TOP_INT.c:119: _Py_CODEUNIT *_JIT_ENTRY(_PyInterpreterFrame *, _PyStackRef *, PyThreadState *): Assertion `PyLong_CheckExact(PyStackRef_AsPyObjectBorrow(value))' failed.
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
<!-- gh-linked-prs -->
### Linked PRs
* gh-142303
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#141542
memory leak in `_PyJit_TryInitializeTracing`
cpython
?
2025-11-14
# memory leak in `_PyJit_TryInitializeTracing`
**Issue:** [https://github.com/python/cpython/issues/141542](https://github.com/python/cpython/issues/141542) · **State:** `open` · **Created:** `2025-11-14T00:59:47Z`
**Labels:** `type-bug`, `interpreter-core`, `topic-JIT`
## Description
# Bug report
### Bug description:
```python
import threading
import time
import unittest
class TestCpuModeFiltering(unittest.TestCase):
def idle_worker():
try:
time.sleep(5)
except Exception:
return
def cpu_active_worker():
end = time.time() + 0.1
x = 0
while time.time() < end:
x += 1
cpu_thread = threading.Thread(target=cpu_active_worker, name="cpu_active_worker", daemon=True)
cpu_thread.start()
self.assertIn('idle_worker', wall_mode_output)
if __name__ == "__main__":
unittest.main()
```
```
=================================================================
==2566930==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 72000 byte(s) in 1 object(s) allocated from:
#0 0x5ceb3b3f4c38 in malloc (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x35fc38) (BuildId: 1f588d55837e5ca248154490b63acc5259fe73cf)
#1 0x5ceb3bc6ac41 in _PyJit_TryInitializeTracing /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/optimizer.c:981:70
#2 0x5ceb3b9bd742 in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/generated_cases.c.h:7660:32
#3 0x5ceb3b989f0a in _PyEval_EvalFrame /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Include/internal/pycore_ceval.h:121:16
#4 0x5ceb3b989f0a in _PyEval_Vector /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/ceval.c:2111:12
#5 0x5ceb3b6076ef in _PyObject_VectorcallTstate /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Include/internal/pycore_call.h:169:11
#6 0x5ceb3b604b69 in method_vectorcall /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Objects/classobject.c:73:20
#7 0x5ceb3ba57092 in _PyObject_VectorcallTstate /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Include/internal/pycore_call.h:169:11
#8 0x5ceb3ba57092 in context_run /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/context.c:728:29
#9 0x5ceb3b627143 in method_vectorcall_FASTCALL_KEYWORDS /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Objects/descrobject.c:421:24
#10 0x5ceb3b5fa6ff in _PyObject_VectorcallTstate /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Include/internal/pycore_call.h:169:11
#11 0x5ceb3b9cd870 in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/generated_cases.c.h:1620:35
#12 0x5ceb3b989f0a in _PyEval_EvalFrame /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Include/internal/pycore_ceval.h:121:16
#13 0x5ceb3b989f0a in _PyEval_Vector /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/ceval.c:2111:12
#14 0x5ceb3b6076ef in _PyObject_VectorcallTstate /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Include/internal/pycore_call.h:169:11
#15 0x5ceb3b604b69 in method_vectorcall /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Objects/classobject.c:73:20
#16 0x5ceb3b5fcea9 in _PyVectorcall_Call /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Objects/call.c:273:16
#17 0x5ceb3bed35fa in thread_run /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/_threadmodule.c:387:21
#18 0x5ceb3bd3ba75 in pythread_wrapper /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/thread_pthread.h:234:5
#19 0x5ceb3b3f24ba in asan_thread_start(void*) asan_interceptors.cpp.o
SUMMARY: AddressSanitizer: 72000 byte(s) leaked in 1 allocation(s).
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#141390
Assertion failure in Python/generated_cases.c.h `PyObject *_PyEval_EvalFrameDefault(PyThreadState *, _PyInterpreterFrame *, int): Assertion 'oparg == co->co_nfreevars' failed`
cpython
?
2025-11-11
# Assertion failure in Python/generated_cases.c.h `PyObject *_PyEval_EvalFrameDefault(PyThreadState *, _PyInterpreterFrame *, int): Assertion 'oparg == co->co_nfreevars' failed`
**Issue:** [https://github.com/python/cpython/issues/141390](https://github.com/python/cpython/issues/141390) · **State:** `closed` · **Created:** `2025-11-11T08:17:40Z`
**Labels:** `type-crash`
## Description
# Crash report
### What happened?
```python
import opcode
from types import FunctionType
COPY_FREE_VARS = opcode.opmap.get('COPY_FREE_VARS', None)
if COPY_FREE_VARS is None:
raise SystemExit("skip: opcode COPY_FREE_VARS not available on this Python")
def external_getitem(self, i):
return f'Foreign getitem: {super().__getitem__(i)}'
def create_closure(__class__):
return (lambda: __class__).__closure__
def new_code(c):
prep = bytes([COPY_FREE_VARS, 0])
return c.replace(
co_freevars=c.co_freevars + ('__class__',),
co_code=prep + c.co_code
)
def add_foreign_method(cls, name, f):
code = new_code(f.__code__)
closure = create_closure(cls)
defaults = f.__defaults__
setattr(cls, name, FunctionType(code, globals(), name, defaults, closure))
class List(list):
pass
add_foreign_method(List, '__getitem__', external_getitem)
obj = List([1, 2, 3])
result = obj[0]
```
```
python: ../Python/generated_cases.c.h:5129: PyObject *_PyEval_EvalFrameDefault(PyThreadState *, _PyInterpreterFrame *, int): Assertion `oparg == co->co_nfreevars' failed.
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#141372
memory leak in `cProfile.Profile`
cpython
?
2025-11-10
# memory leak in `cProfile.Profile`
**Issue:** [https://github.com/python/cpython/issues/141372](https://github.com/python/cpython/issues/141372) · **State:** `open` · **Created:** `2025-11-10T20:08:47Z`
**Labels:** `type-bug`, `extension-modules`, `topic-profiling`
## Description
# Bug report
### Bug description:
```python
import cProfile
import sys
class _MonitoringStub:
MISSING = object()
sys.monitoring = _MonitoringStub()
prof = cProfile.Profile()
```
```
=================================================================
==1718547==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 40 byte(s) in 1 object(s) allocated from:
#0 0x6338266bcf93 in malloc (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x338f93) (BuildId: 8c1b704a48f26c5c3e2e3abf679137700b62a68e)
#1 0x633826a046fe in _PyMem_DebugRawAlloc /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Objects/obmalloc.c:2887:24
#2 0x633826a046fe in _PyMem_DebugRawMalloc /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Objects/obmalloc.c:2920:12
#3 0x633826a046fe in _PyMem_DebugMalloc /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Objects/obmalloc.c:3085:12
#4 0x633826a4048c in _PyObject_MallocWithType /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Include/internal/pycore_object_alloc.h:46:17
#5 0x633826a4048c in _PyType_AllocNoTrack /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Objects/typeobject.c:2515:19
#6 0x633826a402ed in PyType_GenericAlloc /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Objects/typeobject.c:2546:21
#7 0x633826a4cbed in type_call /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Objects/typeobject.c:2459:11
#8 0x6338268ac2d6 in _PyObject_MakeTpCall /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Objects/call.c:242:18
#9 0x633826c46948 in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/generated_cases.c.h:1620:35
#10 0x633826c14898 in _PyEval_EvalFrame /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Include/internal/pycore_ceval.h:121:16
#11 0x633826c14898 in _PyEval_Vector /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/ceval.c:2005:12
#12 0x633826c03b08 in builtin___build_class__ /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/bltinmodule.c:205:12
#13 0x6338268ab862 in _PyObject_VectorcallTstate /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Include/internal/pycore_call.h:169:11
#14 0x633826c46948 in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/generated_cases.c.h:1620:35
#15 0x633826c14898 in _PyEval_EvalFrame /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Include/internal/pycore_ceval.h:121:16
#16 0x633826c14898 in _PyEval_Vector /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/ceval.c:2005:12
#17 0x633826c13fcb in PyEval_EvalCode /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/ceval.c:888:21
#18 0x633826de94f3 in run_eval_code_obj /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/pythonrun.c:1365:12
#19 0x633826de94f3 in run_mod /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/pythonrun.c:1459:19
#20 0x633826de17bc in pyrun_file /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/pythonrun.c:1293:15
#21 0x633826de17bc in _PyRun_SimpleFileObject /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/pythonrun.c:521:13
#22 0x633826de0bc2 in _PyRun_AnyFileObject /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Python/pythonrun.c:81:15
#23 0x633826e567d3 in pymain_run_file_obj /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/main.c:410:15
#24 0x633826e567d3 in pymain_run_file /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/main.c:429:15
#25 0x633826e54bc6 in pymain_run_python /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/main.c:691:21
#26 0x633826e54bc6 in Py_RunMain /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/main.c:772:5
#27 0x633826e55837 in pymain_main /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/main.c:802:12
#28 0x633826e559a3 in Py_BytesMain /home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/../Modules/main.c:826:12
#29 0x76cd2ee241c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#30 0x76cd2ee2428a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
SUMMARY: AddressSanitizer: 40 byte(s) leaked in 1 allocation(s).
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#141338
SystemError buffer overflow in `fcntl.fcntl`
cpython
?
2025-11-10
# SystemError buffer overflow in `fcntl.fcntl`
**Issue:** [https://github.com/python/cpython/issues/141338](https://github.com/python/cpython/issues/141338) · **State:** `closed` · **Created:** `2025-11-10T07:57:31Z`
**Labels:** `type-bug`, `extension-modules`
## Description
# Bug report
### Bug description:
```python
import tempfile
import os
import fcntl
nbytes = 2024
tf = tempfile.NamedTemporaryFile(delete=2**15 - 1)
tf_name = tf.name
with open(tf_name, 'wb') as f:
get_result = fcntl.fcntl(f, fcntl.F_GETOWN_EX, b'' * nbytes)
```
```
SystemError: buffer overflow
cpython/Lib/tempfile.py:484: ResourceWarning: Implicitly cleaning up <_TemporaryFileWrapper file=<_io.BufferedRandom name='/tmp/tmp_o0z83c9'>>
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#141336
Assertion failure in Objects/unicodeobject.c `_PyUnicode_DecodeUnicodeEscapeInternal2: Assertion 'end - s <= writer.size - writer.pos' failed`
cpython
?
2025-11-10
# Assertion failure in Objects/unicodeobject.c `_PyUnicode_DecodeUnicodeEscapeInternal2: Assertion 'end - s <= writer.size - writer.pos' failed`
**Issue:** [https://github.com/python/cpython/issues/141336](https://github.com/python/cpython/issues/141336) · **State:** `open` · **Created:** `2025-11-10T07:49:22Z`
**Labels:** `interpreter-core`, `topic-unicode`, `type-crash`
## Description
# Bug report
### Bug description:
```python
import codecs
decode = codecs.unicode_escape_decode
data = {b'\\x0': (b'\xe2\x98\x83', 0)}
def mutating(exc):
key = exc.object[:exc.end]
r = data.get(key)
if r is not None:
return ('Є', r[1])
codecs.register_error('test.mutating2', mutating)
input_obj = b'\\x0n\\z'
result, length = decode(input_obj, 'test.mutating2')
```
```
python: ../Objects/unicodeobject.c:6687: _PyUnicode_DecodeUnicodeEscapeInternal2: Assertion `end - s <= writer.size - writer.pos' failed.
Aborted (core dumped)
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-141344
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#141314
Assertion failure in Modules/_io/textio.c `_io_TextIOWrapper_tell_impl: Assertion 'skip_back <= PyBytes_GET_SIZE(next_input)' failed`
cpython
?
2025-11-09
# Assertion failure in Modules/_io/textio.c `_io_TextIOWrapper_tell_impl: Assertion 'skip_back <= PyBytes_GET_SIZE(next_input)' failed`
**Issue:** [https://github.com/python/cpython/issues/141314](https://github.com/python/cpython/issues/141314) · **State:** `closed` · **Created:** `2025-11-09T18:34:47Z`
**Labels:** `extension-modules`, `topic-IO`, `type-crash`
## Description
# Bug report
### Bug description:
```python
import io
import os
from test.support import os_helper
DATA_TEMPLATE = ['line1=1']
DATA_CR = r'\n\r\t'.join(DATA_TEMPLATE) + '\r'
open_func = io.open
READMODE = 'r'
WRITEMODE = 'wb'
data = DATA_CR
if 'b' in WRITEMODE:
data = data.encode('ascii')
with open_func(os_helper.TESTFN, WRITEMODE) as fp:
fp.write(data)
with open_func(os_helper.TESTFN, READMODE) as fp:
_ = fp.readline()
pos = fp.tell()
```
```
python: ../Modules/_io/textio.c:2848: _io_TextIOWrapper_tell_impl: Assertion `skip_back <= PyBytes_GET_SIZE(next_input)' failed.
Aborted (core dumped)
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-141331
* gh-141452
* gh-141453
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#141312
Assertion failure in Objects/rangeobject.c `compute_range_length: Assertion PyLong_Check(start)' failed`
cpython
?
2025-11-09
# Assertion failure in Objects/rangeobject.c `compute_range_length: Assertion PyLong_Check(start)' failed`
**Issue:** [https://github.com/python/cpython/issues/141312](https://github.com/python/cpython/issues/141312) · **State:** `closed` · **Created:** `2025-11-09T18:20:57Z`
**Labels:** `type-bug`, `interpreter-core`, `3.13`, `3.14`, `3.15`
## Description
# Bug report
### Bug description:
```python
import pickle
for proto in range(pickle.HIGHEST_PROTOCOL + 1):
it = iter(range(0x80000000 ** 32 + -(2**15)))
it.__setstate__(2 ** -(2**15) + 1)
d = pickle.dumps(it, proto)
```
```
python: ../Objects/rangeobject.c:243: compute_range_length: Assertion `PyLong_Check(start)' failed.
Aborted (core dumped)
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-141317
* gh-141559
* gh-141568
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#141311
Assertion failure in Modules/_io/bytesio.c `_io_BytesIO_readinto_impl: Assertion 'self->pos + len < PY_SSIZE_T_MAX' failed.`
cpython
?
2025-11-09
# Assertion failure in Modules/_io/bytesio.c `_io_BytesIO_readinto_impl: Assertion 'self->pos + len < PY_SSIZE_T_MAX' failed.`
**Issue:** [https://github.com/python/cpython/issues/141311](https://github.com/python/cpython/issues/141311) · **State:** `closed` · **Created:** `2025-11-09T18:08:44Z`
**Labels:** `extension-modules`, `topic-IO`, `type-crash`, `3.13`
## Description
# Bug report
### Bug description:
```python
import io
input_lines = ['windows\r\n']
joined = ''.join(input_lines)
encoding = 'utf-8'
newline = None
bufsize = 1
raw = io.BytesIO(joined.encode(encoding))
buf = io.BufferedReader(raw, buffer_size=bufsize)
textio = io.TextIOWrapper(buf, encoding=encoding, newline=newline)
textio.seek(2**63 - 1)
_ = textio.read(2)
```
```
python: ../Modules/_io/bytesio.c:616: _io_BytesIO_readinto_impl: Assertion `self->pos + len < PY_SSIZE_T_MAX' failed.
Aborted (core dumped)
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-141333
* gh-141457
* gh-141478
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#141307
Assertion failure in Objects/call.c `_PyObject_VectorcallDictTstate: Assertion `!_PyErr_Occurred(tstate)' failed.`
cpython
?
2025-11-09
# Assertion failure in Objects/call.c `_PyObject_VectorcallDictTstate: Assertion `!_PyErr_Occurred(tstate)' failed.`
**Issue:** [https://github.com/python/cpython/issues/141307](https://github.com/python/cpython/issues/141307) · **State:** `closed` · **Created:** `2025-11-09T17:56:33Z`
**Labels:** `type-bug`, `interpreter-core`, `pending`
## Description
# Bug report
### Bug description:
```python
import importlib.machinery as machinery
import importlib.util
import os
import sys
is_apple_mobile = False
if hasattr(machinery, "ExtensionFileLoader"):
LoaderClass = machinery.ExtensionFileLoader
dummy_name = "fake_extension_module_for_test"
dummy_path = __file__
loader = LoaderClass(dummy_name, dummy_path)
spec = importlib.util.spec_from_loader(dummy_name, loader)
module = importlib.util.module_from_spec(spec)
```
```
python: ../Objects/call.c:120: _PyObject_VectorcallDictTstate: Assertion `!_PyErr_Occurred(tstate)' failed.
Aborted (core dumped)
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#141044
memory leak in threading stack size
cpython
?
2025-11-05
# memory leak in threading stack size
**Issue:** [https://github.com/python/cpython/issues/141044](https://github.com/python/cpython/issues/141044) · **State:** `open` · **Created:** `2025-11-05T10:31:21Z`
**Labels:** `type-bug`, `interpreter-core`, `stdlib`, `3.14`, `3.15`
## Description
# Bug report
### Bug description:
```python
import threading
previous = threading.stack_size(127 * 1024)
def worker():
pass
t = threading.Thread(target=worker, name="worker-thread")
t.start()
threading.stack_size(0)
```
<details>
<summary>LeakSanitizer output on main</summary>
```
=================================================================
==3532388==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 88 byte(s) in 1 object(s) allocated from:
#0 0x7e646db509c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x55cc45289c38 in _PyMem_RawMalloc ../Objects/obmalloc.c:63
#2 0x55cc45289009 in _PyMem_DebugRawAlloc ../Objects/obmalloc.c:2887
#3 0x55cc45289071 in _PyMem_DebugRawMalloc ../Objects/obmalloc.c:2920
#4 0x55cc4528a8ef in _PyMem_DebugMalloc ../Objects/obmalloc.c:3085
#5 0x55cc452b38dc in PyObject_Malloc ../Objects/obmalloc.c:1493
#6 0x55cc454f3dd8 in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#7 0x55cc454f3dd8 in gc_alloc ../Python/gc.c:2344
#8 0x55cc454f3f2e in _PyObject_GC_New ../Python/gc.c:2364
#9 0x55cc451c9034 in PyMethod_New ../Objects/classobject.c:119
#10 0x55cc452191a2 in cm_descr_get ../Objects/funcobject.c:1473
#11 0x55cc452fdc1c in _Py_type_getattro_impl ../Objects/typeobject.c:6382
#12 0x55cc452fde00 in _Py_type_getattro ../Objects/typeobject.c:6424
#13 0x55cc45282b80 in PyObject_GetAttr ../Objects/object.c:1313
#14 0x55cc45283dd3 in _PyObject_GetMethodStackRef ../Objects/object.c:1706
#15 0x55cc45467d64 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:7844
#16 0x55cc45486105 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#17 0x55cc454863f9 in _PyEval_Vector ../Python/ceval.c:2005
#18 0x55cc451c12b7 in _PyFunction_Vectorcall ../Objects/call.c:413
#19 0x55cc451c177e in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#20 0x55cc451c1c3c in _PyObject_CallFunctionVa ../Objects/call.c:552
#21 0x55cc451c226d in callmethod ../Objects/call.c:626
#22 0x55cc451c2472 in PyObject_CallMethod ../Objects/call.c:645
#23 0x55cc45519b64 in init_importlib ../Python/import.c:3223
#24 0x55cc4551ad12 in _PyImport_InitCore ../Python/import.c:4035
#25 0x55cc45563be1 in pycore_interp_init ../Python/pylifecycle.c:942
#26 0x55cc45563e06 in pyinit_config ../Python/pylifecycle.c:971
#27 0x55cc455712e3 in pyinit_core ../Python/pylifecycle.c:1134
#28 0x55cc4557153b in Py_InitializeFromConfig ../Python/pylifecycle.c:1454
#29 0x55cc455d4c9e in pymain_init ../Modules/main.c:68
#30 0x55cc455d50dc in pymain_main ../Modules/main.c:793
Indirect leak of 96 byte(s) in 1 object(s) allocated from:
#0 0x7e646db509c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x55cc45289c38 in _PyMem_RawMalloc ../Objects/obmalloc.c:63
#2 0x55cc45289009 in _PyMem_DebugRawAlloc ../Objects/obmalloc.c:2887
#3 0x55cc45289071 in _PyMem_DebugRawMalloc ../Objects/obmalloc.c:2920
#4 0x55cc4528a8ef in _PyMem_DebugMalloc ../Objects/obmalloc.c:3085
#5 0x55cc452b38dc in PyObject_Malloc ../Objects/obmalloc.c:1493
#6 0x55cc454f3dd8 in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#7 0x55cc454f3dd8 in gc_alloc ../Python/gc.c:2344
#8 0x55cc454f4037 in _PyObject_GC_NewVar ../Python/gc.c:2386
#9 0x55cc452c9d82 in tuple_alloc ../Objects/tupleobject.c:57
#10 0x55cc452cca50 in PyTuple_New ../Objects/tupleobject.c:81
#11 0x55cc4554f81d in r_object ../Python/marshal.c:1372
#12 0x55cc455504e9 in r_object ../Python/marshal.c:1560
#13 0x55cc4554f9d8 in r_object ../Python/marshal.c:1378
#14 0x55cc455504b9 in r_object ../Python/marshal.c:1554
#15 0x55cc45551305 in read_object ../Python/marshal.c:1714
#16 0x55cc45551558 in marshal_loads_impl ../Python/marshal.c:2059
#17 0x55cc45551c95 in marshal_loads ../Python/clinic/marshal.c.h:344
#18 0x55cc45446cfa in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2361
#19 0x55cc45486105 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#20 0x55cc454863f9 in _PyEval_Vector ../Python/ceval.c:2005
#21 0x55cc451c12b7 in _PyFunction_Vectorcall ../Objects/call.c:413
#22 0x55cc451c177e in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#23 0x55cc451c34bf in object_vacall ../Objects/call.c:819
#24 0x55cc451c373d in PyObject_CallMethodObjArgs ../Objects/call.c:886
#25 0x55cc455133c5 in import_find_and_load ../Python/import.c:3688
#26 0x55cc4551a2f5 in PyImport_ImportModuleLevelObject ../Python/import.c:3770
#27 0x55cc454357c3 in _PyEval_ImportName ../Python/ceval.c:3025
#28 0x55cc4545e461 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#29 0x55cc45486105 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#30 0x55cc454863f9 in _PyEval_Vector ../Python/ceval.c:2005
Indirect leak of 96 byte(s) in 1 object(s) allocated from:
#0 0x7e646db509c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x55cc45289c38 in _PyMem_RawMalloc ../Objects/obmalloc.c:63
#2 0x55cc45289009 in _PyMem_DebugRawAlloc ../Objects/obmalloc.c:2887
#3 0x55cc45289071 in _PyMem_DebugRawMalloc ../Objects/obmalloc.c:2920
#4 0x55cc4528a8ef in _PyMem_DebugMalloc ../Objects/obmalloc.c:3085
#5 0x55cc452b38dc in PyObject_Malloc ../Objects/obmalloc.c:1493
#6 0x55cc454f3dd8 in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#7 0x55cc454f3dd8 in gc_alloc ../Python/gc.c:2344
#8 0x55cc454f3f2e in _PyObject_GC_New ../Python/gc.c:2364
#9 0x55cc45276170 in PyCMethod_New ../Objects/methodobject.c:108
#10 0x55cc451dea0b in method_get ../Objects/descrobject.c:158
#11 0x55cc45284b2c in _PyObject_GenericGetAttrWithDict ../Objects/object.c:1893
#12 0x55cc45285b28 in PyObject_GenericGetAttr ../Objects/object.c:1923
#13 0x55cc45282b80 in PyObject_GetAttr ../Objects/object.c:1313
#14 0x55cc45467f8a in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:7865
#15 0x55cc45486105 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#16 0x55cc454863f9 in _PyEval_Vector ../Python/ceval.c:2005
#17 0x55cc451c12b7 in _PyFunction_Vectorcall ../Objects/call.c:413
#18 0x55cc451c78c7 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#19 0x55cc451c7d81 in method_vectorcall ../Objects/classobject.c:73
#20 0x55cc451c4ad1 in _PyVectorcall_Call ../Objects/call.c:273
#21 0x55cc451c50dd in _PyObject_Call ../Objects/call.c:348
#22 0x55cc451c5123 in PyObject_Call ../Objects/call.c:373
#23 0x55cc456d25b9 in thread_run ../Modules/_threadmodule.c:387
#24 0x55cc455ade23 in pythread_wrapper ../Python/thread_pthread.h:234
#25 0x7e646dab1a41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234
#26 0x7e646d7f4aa3 (/lib/x86_64-linux-gnu/libc.so.6+0x9caa3) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
Indirect leak of 88 byte(s) in 1 object(s) allocated from:
#0 0x7e646db509c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x55cc45289c38 in _PyMem_RawMalloc ../Objects/obmalloc.c:63
#2 0x55cc45289009 in _PyMem_DebugRawAlloc ../Objects/obmalloc.c:2887
#3 0x55cc45289071 in _PyMem_DebugRawMalloc ../Objects/obmalloc.c:2920
#4 0x55cc4528a8ef in _PyMem_DebugMalloc ../Objects/obmalloc.c:3085
#5 0x55cc452b38dc in PyObject_Malloc ../Objects/obmalloc.c:1493
#6 0x55cc454f3dd8 in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#7 0x55cc454f3dd8 in gc_alloc ../Python/gc.c:2344
#8 0x55cc454f3f2e in _PyObject_GC_New ../Python/gc.c:2364
#9 0x55cc45250446 in new_dict ../Objects/dictobject.c:875
#10 0x55cc45251b2f in PyDict_New ../Objects/dictobject.c:973
#11 0x55cc45251b7e in dict_new_presized ../Objects/dictobject.c:2204
#12 0x55cc45259e23 in _PyDict_FromItems ../Objects/dictobject.c:2245
#13 0x55cc45440114 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1272
#14 0x55cc45486105 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#15 0x55cc454863f9 in _PyEval_Vector ../Python/ceval.c:2005
#16 0x55cc451c12b7 in _PyFunction_Vectorcall ../Objects/call.c:413
#17 0x55cc451c177e in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#18 0x55cc451c34bf in object_vacall ../Objects/call.c:819
#19 0x55cc451c373d in PyObject_CallMethodObjArgs ../Objects/call.c:886
#20 0x55cc455133c5 in import_find_and_load ../Python/import.c:3688
#21 0x55cc4551a2f5 in PyImport_ImportModuleLevelObject ../Python/import.c:3770
#22 0x55cc45426967 in builtin___import___impl ../Python/bltinmodule.c:285
#23 0x55cc45426c32 in builtin___import__ ../Python/clinic/bltinmodule.c.h:110
#24 0x55cc4527491b in cfunction_vectorcall_FASTCALL_KEYWORDS ../Objects/methodobject.c:465
#25 0x55cc451c177e in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#26 0x55cc451c1c3c in _PyObject_CallFunctionVa ../Objects/call.c:552
#27 0x55cc451c1e61 in PyObject_CallFunction ../Objects/call.c:574
#28 0x55cc4551a8f4 in PyImport_Import ../Python/import.c:3962
#29 0x55cc4551aa9f in PyImport_ImportModule ../Python/import.c:3410
#30 0x55cc45564580 in init_import_site ../Python/pylifecycle.c:2741
Indirect leak of 88 byte(s) in 1 object(s) allocated from:
#0 0x7e646db509c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x55cc45289c38 in _PyMem_RawMalloc ../Objects/obmalloc.c:63
#2 0x55cc45289009 in _PyMem_DebugRawAlloc ../Objects/obmalloc.c:2887
#3 0x55cc45289071 in _PyMem_DebugRawMalloc ../Objects/obmalloc.c:2920
#4 0x55cc4528a8ef in _PyMem_DebugMalloc ../Objects/obmalloc.c:3085
#5 0x55cc452b38dc in PyObject_Malloc ../Objects/obmalloc.c:1493
#6 0x55cc454f3dd8 in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#7 0x55cc454f3dd8 in gc_alloc ../Python/gc.c:2344
#8 0x55cc454f3f2e in _PyObject_GC_New ../Python/gc.c:2364
#9 0x55cc45250446 in new_dict ../Objects/dictobject.c:875
#10 0x55cc45251b2f in PyDict_New ../Objects/dictobject.c:973
#11 0x55cc4542fff5 in initialize_locals ../Python/ceval.c:1583
#12 0x55cc45432fd4 in _PyEvalFramePushAndInit ../Python/ceval.c:1875
#13 0x55cc454863cf in _PyEval_Vector ../Python/ceval.c:1995
#14 0x55cc451c12b7 in _PyFunction_Vectorcall ../Objects/call.c:413
#15 0x55cc451c4453 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#16 0x55cc451c4878 in _PyObject_Call_Prepend ../Objects/call.c:504
#17 0x55cc452dae55 in slot_tp_new ../Objects/typeobject.c:10874
#18 0x55cc452e93f8 in type_call ../Objects/typeobject.c:2449
#19 0x55cc451c1570 in _PyObject_MakeTpCall ../Objects/call.c:242
#20 0x55cc451c4589 in _PyObject_VectorcallDictTstate ../Objects/call.c:130
#21 0x55cc451c46ac in PyObject_VectorcallDict ../Objects/call.c:159
#22 0x55cc45427cda in builtin___build_class__ ../Python/bltinmodule.c:213
#23 0x55cc4527491b in cfunction_vectorcall_FASTCALL_KEYWORDS ../Objects/methodobject.c:465
#24 0x55cc451c177e in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#25 0x55cc451c1871 in PyObject_Vectorcall ../Objects/call.c:327
#26 0x55cc45449f11 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2920
#27 0x55cc45486105 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#28 0x55cc454863f9 in _PyEval_Vector ../Python/ceval.c:2005
#29 0x55cc454866a9 in PyEval_EvalCode ../Python/ceval.c:888
#30 0x55cc45424bcb in builtin_exec_impl ../Python/bltinmodule.c:1180
Indirect leak of 88 byte(s) in 1 object(s) allocated from:
#0 0x7e646db509c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x55cc45289c38 in _PyMem_RawMalloc ../Objects/obmalloc.c:63
#2 0x55cc45289009 in _PyMem_DebugRawAlloc ../Objects/obmalloc.c:2887
#3 0x55cc45289071 in _PyMem_DebugRawMalloc ../Objects/obmalloc.c:2920
#4 0x55cc4528a8ef in _PyMem_DebugMalloc ../Objects/obmalloc.c:3085
#5 0x55cc452b38dc in PyObject_Malloc ../Objects/obmalloc.c:1493
#6 0x55cc454f3dd8 in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#7 0x55cc454f3dd8 in gc_alloc ../Python/gc.c:2344
#8 0x55cc454f3f2e in _PyObject_GC_New ../Python/gc.c:2364
#9 0x55cc451c9034 in PyMethod_New ../Objects/classobject.c:119
#10 0x55cc452191a2 in cm_descr_get ../Objects/funcobject.c:1473
#11 0x55cc452fdc1c in _Py_type_getattro_impl ../Objects/typeobject.c:6382
#12 0x55cc452fde00 in _Py_type_getattro ../Objects/typeobject.c:6424
#13 0x55cc45282b80 in PyObject_GetAttr ../Objects/object.c:1313
#14 0x55cc45467f8a in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:7865
#15 0x55cc45486105 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#16 0x55cc454863f9 in _PyEval_Vector ../Python/ceval.c:2005
#17 0x55cc451c12b7 in _PyFunction_Vectorcall ../Objects/call.c:413
#18 0x55cc451c177e in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#19 0x55cc451c34bf in object_vacall ../Objects/call.c:819
#20 0x55cc451c373d in PyObject_CallMethodObjArgs ../Objects/call.c:886
#21 0x55cc455133c5 in import_find_and_load ../Python/import.c:3688
#22 0x55cc4551a2f5 in PyImport_ImportModuleLevelObject ../Python/import.c:3770
#23 0x55cc454357c3 in _PyEval_ImportName ../Python/ceval.c:3025
#24 0x55cc4545e461 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#25 0x55cc45486105 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#26 0x55cc454863f9 in _PyEval_Vector ../Python/ceval.c:2005
#27 0x55cc451c12b7 in _PyFunction_Vectorcall ../Objects/call.c:413
#28 0x55cc451c177e in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#29 0x55cc451c1ae5 in _PyObject_CallNoArgsTstate ../Include/internal/pycore_call.h:176
#30 0x55cc451c1ae5 in _PyObject_CallFunctionVa ../Objects/call.c:531
#31 0x55cc451c226d in callmethod ../Objects/call.c:626
SUMMARY: AddressSanitizer: 544 byte(s) leaked in 6 allocation(s).
```
</details>
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140939
memory leak in `_PyBytes_FormatEx` error path
cpython
?
2025-11-03
# memory leak in `_PyBytes_FormatEx` error path
**Issue:** [https://github.com/python/cpython/issues/140939](https://github.com/python/cpython/issues/140939) · **State:** `closed` · **Created:** `2025-11-03T08:55:57Z`
**Labels:** `type-bug`, `interpreter-core`, `3.13`, `3.14`
## Description
# Bug report
### Bug description:
```python
import unittest
class BaseBytesTest:
def test_mod(self):
def check(fmt, vals, result):
bf = self.type2test(fmt)
bf = bf % vals
check(b'%*b', (2**63-1, b'abc'), b' abc')
class ByteArrayTest(BaseBytesTest, unittest.TestCase):
type2test = bytearray
if __name__ == "__main__":
unittest.main()
```
```
=================================================================
==776798==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 60 byte(s) in 1 object(s) allocated from:
#0 0x7a4877a6d9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x55e03c01bdf1 in _PyMem_RawMalloc ../Objects/obmalloc.c:63
#2 0x55e03c01b1c2 in _PyMem_DebugRawAlloc ../Objects/obmalloc.c:2887
#3 0x55e03c01b22a in _PyMem_DebugRawMalloc ../Objects/obmalloc.c:2920
#4 0x55e03c01caa8 in _PyMem_DebugMalloc ../Objects/obmalloc.c:3085
#5 0x55e03c045a95 in PyObject_Malloc ../Objects/obmalloc.c:1493
#6 0x55e03bf3d755 in _PyBytes_FromSize ../Objects/bytesobject.c:126
#7 0x55e03bf42690 in PyBytes_FromStringAndSize ../Objects/bytesobject.c:156
#8 0x55e03bf0bf70 in _PyPegen_parse_string ../Parser/string_parser.c:334
#9 0x55e03bdf6370 in _PyPegen_constant_from_string ../Parser/action_helpers.c:1451
#10 0x55e03be12662 in string_rule ../Parser/parser.c:17153
#11 0x55e03be55755 in _tmp_154_rule ../Parser/parser.c:37189
#12 0x55e03be55e08 in _loop1_80_rule ../Parser/parser.c:32749
#13 0x55e03be5eede in strings_rule ../Parser/parser.c:17224
#14 0x55e03be2f755 in atom_rule ../Parser/parser.c:15165
#15 0x55e03be31f78 in primary_raw ../Parser/parser.c:14803
#16 0x55e03be325a4 in primary_rule ../Parser/parser.c:14601
#17 0x55e03be32f62 in await_primary_rule ../Parser/parser.c:14555
#18 0x55e03be3351f in power_rule ../Parser/parser.c:14431
#19 0x55e03be350b7 in factor_rule ../Parser/parser.c:14381
#20 0x55e03be377b7 in term_raw ../Parser/parser.c:14222
#21 0x55e03be37de3 in term_rule ../Parser/parser.c:13965
#22 0x55e03be38aa7 in sum_raw ../Parser/parser.c:13918
#23 0x55e03be39106 in sum_rule ../Parser/parser.c:13797
#24 0x55e03be3a72f in shift_expr_raw ../Parser/parser.c:13757
#25 0x55e03be3ad5b in shift_expr_rule ../Parser/parser.c:13617
#26 0x55e03be3b55e in bitwise_and_raw ../Parser/parser.c:13577
#27 0x55e03be3bbbd in bitwise_and_rule ../Parser/parser.c:13495
#28 0x55e03be3c3c0 in bitwise_xor_raw ../Parser/parser.c:13455
#29 0x55e03be3ca1f in bitwise_xor_rule ../Parser/parser.c:13373
SUMMARY: AddressSanitizer: 60 byte(s) leaked in 1 allocation(s).
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-140957
* gh-141154
* gh-141155
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140936
Assertion failure in Python/optimizer.c _PyOptimizer_Optimize in JIT
cpython
?
2025-11-03
# Assertion failure in Python/optimizer.c _PyOptimizer_Optimize in JIT
**Issue:** [https://github.com/python/cpython/issues/140936](https://github.com/python/cpython/issues/140936) · **State:** `closed` · **Created:** `2025-11-03T08:14:50Z`
**Labels:** `interpreter-core`, `type-crash`, `3.14`, `topic-JIT`, `3.15`
## Description
# Crash report
### What happened?
```python
import sys
import unittest
from unittest import TestCase
class InstrumentationMultiThreadedMixin:
thread_count = 10
func_count = 50
def after_threads(self):
pass
def test_instrumentation(self):
for i in range(self.func_count):
x = {}
threads = []
for i in range(self.thread_count):
for t in threads:
break
self.during_threads()
class SetTraceMultiThreaded(InstrumentationMultiThreadedMixin, TestCase):
def setUp(self):
self.set = 2**31-1
def after_test(self):
self.assertTrue(self.called)
def tearDown(self):
sys.settrace(1023)
def trace_func(self, frame, event, arg):
return self.trace_func
def during_threads(self):
if self.set:
sys.settrace(self.trace_func)
t.join()
if __name__ == "__main__":
unittest.main()
```
```
...
TypeError: 'int' object is not callable
python: ../Python/optimizer.c:121: _PyOptimizer_Optimize: Assertion `interp->jit' failed.
Aborted (core dumped)
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
<!-- gh-linked-prs -->
### Linked PRs
* gh-140969
* gh-141494
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140935
Assertion failure in Objects/codeobject.c advance_with_locations
cpython
?
2025-11-03
# Assertion failure in Objects/codeobject.c advance_with_locations
**Issue:** [https://github.com/python/cpython/issues/140935](https://github.com/python/cpython/issues/140935) · **State:** `closed` · **Created:** `2025-11-03T07:44:06Z`
**Labels:** `type-crash`
## Description
# Crash report
### What happened?
```python
import dis
import io
import types
import contextlib
import unittest
class DisTests(unittest.TestCase):
def f(x):
return x + 1
code = f.__code__
try:
new_code = code.replace(co_linetable=b'\xa0\xa1')
except (AttributeError, TypeError, ValueError):
self.skipTest("code.replace(co_linetable=...) not supported on this Python build")
fn = types.FunctionType(new_code, f.__globals__, name=f.__name__,
argdefs=f.__defaults__, closure=f.__closure__)
buf = io.StringIO()
with contextlib.redirect_stdout(buf):
dis.dis(fn)
```
```
python: ../Objects/codeobject.c:1225: advance_with_locations: Assertion `(second_byte & 128) == 0' failed.
Aborted (core dumped)
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140860
indirect memory leak with audit hook
cpython
?
2025-10-31
# indirect memory leak with audit hook
**Issue:** [https://github.com/python/cpython/issues/140860](https://github.com/python/cpython/issues/140860) · **State:** `open` · **Created:** `2025-10-31T16:56:05Z`
**Labels:** `type-bug`, `interpreter-core`, `3.14`, `3.15`
## Description
# Bug report
### Bug description:
```python
import sys
import time
time_tuple = time.localtime()
events = []
def hook(event, *args):
events.append((event, args))
sys.addaudithook(hook)
roundtrip('%x', slice(0, 3), tt2)
```
```
NameError: name 'roundtrip' is not defined
=================================================================
==1926743==ERROR: LeakSanitizer: detected memory leaks
Indirect leak of 1432 byte(s) in 1 object(s) allocated from:
#0 0x772dcd8179c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x572d4af0c8fe in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x572d4af0c8fe in _PyType_AllocNoTrack ../Objects/typeobject.c:2505
#3 0x572d4af0cb64 in PyType_GenericAlloc ../Objects/typeobject.c:2536
#4 0x572d4af4245d in PyType_FromMetaclass ../Objects/typeobject.c:5475
#5 0x572d4aeea458 in _PyStructSequence_NewType ../Objects/structseq.c:774
#6 0x572d4b4725b9 in time_exec ../Modules/timemodule.c:2102
#7 0x572d4ae7b4ad in PyModule_ExecDef ../Objects/moduleobject.c:555
#8 0x572d4b1a202a in _imp_exec_builtin (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x78102a) (BuildId: dac7ae6d6ed5f3a14d0cfdafb4721e2e3be18e94)
#9 0x572d4ad6978e in _PyVectorcall_Call ../Objects/call.c:273
#10 0x572d4ad6978e in _PyObject_Call ../Objects/call.c:348
#11 0x572d4ad6978e in PyObject_Call ../Objects/call.c:373
#12 0x572d4ac08e9c in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#13 0x572d4b0e5785 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#14 0x572d4b0e5785 in _PyEval_Vector ../Python/ceval.c:2005
#15 0x572d4ad637f2 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#16 0x572d4ad637f2 in object_vacall ../Objects/call.c:819
#17 0x572d4ad66e41 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#18 0x572d4b1ad9c3 in import_find_and_load ../Python/import.c:3688
#19 0x572d4b1ad9c3 in PyImport_ImportModuleLevelObject ../Python/import.c:3770
#20 0x572d4b0e05f5 in _PyEval_ImportName ../Python/ceval.c:3021
#21 0x572d4ac1aa3e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#22 0x572d4b0e4fb6 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#23 0x572d4b0e4fb6 in _PyEval_Vector ../Python/ceval.c:2005
#24 0x572d4b0e4fb6 in PyEval_EvalCode ../Python/ceval.c:888
#25 0x572d4b0cf628 in builtin_exec_impl ../Python/bltinmodule.c:1180
#26 0x572d4b0cf628 in builtin_exec ../Python/clinic/bltinmodule.c.h:571
#27 0x572d4ac2adf3 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2361
#28 0x572d4b0e5785 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#29 0x572d4b0e5785 in _PyEval_Vector ../Python/ceval.c:2005
#30 0x572d4ad637f2 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#31 0x572d4ad637f2 in object_vacall ../Objects/call.c:819
#32 0x572d4ad66e41 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#33 0x572d4b1ad9c3 in import_find_and_load ../Python/import.c:3688
#34 0x572d4b1ad9c3 in PyImport_ImportModuleLevelObject ../Python/import.c:3770
#35 0x572d4b0c7a2c in builtin___import___impl ../Python/bltinmodule.c:285
#36 0x572d4b0c7a2c in builtin___import__ ../Python/clinic/bltinmodule.c.h:110
#37 0x572d4ad640b8 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#38 0x572d4ad640b8 in _PyObject_CallFunctionVa ../Objects/call.c:552
#39 0x572d4ad65149 in PyObject_CallFunction ../Objects/call.c:574
#40 0x572d4b1aeefb in PyImport_Import ../Python/import.c:3962
#41 0x572d4b1b0d5e in PyImport_ImportModuleAttr ../Python/import.c:4173
#42 0x572d4b1b0d5e in PyImport_ImportModuleAttrString ../Python/import.c:4194
#43 0x572d4b1b0fd3 in init_zipimport ../Python/import.c:4104
#44 0x572d4b1b0fd3 in _PyImport_InitExternal ../Python/import.c:4140
#45 0x572d4b28cf1c in init_interp_main ../Python/pylifecycle.c:1216
Indirect leak of 704 byte(s) in 11 object(s) allocated from:
#0 0x772dcd8179c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x572d4af0c8fe in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x572d4af0c8fe in _PyType_AllocNoTrack ../Objects/typeobject.c:2505
#3 0x572d4af0cb64 in PyType_GenericAlloc ../Objects/typeobject.c:2536
#4 0x572d4ad94a93 in descr_new ../Objects/descrobject.c:911
#5 0x572d4ad94a93 in PyDescr_NewMember ../Objects/descrobject.c:995
#6 0x572d4af303bd in type_add_members ../Objects/typeobject.c:8389
#7 0x572d4af303bd in type_ready_fill_dict ../Objects/typeobject.c:8878
#8 0x572d4af303bd in type_ready ../Objects/typeobject.c:9239
#9 0x572d4af4338c in PyType_FromMetaclass ../Objects/typeobject.c:5591
#10 0x572d4aeea458 in _PyStructSequence_NewType ../Objects/structseq.c:774
#11 0x572d4b4725b9 in time_exec ../Modules/timemodule.c:2102
#12 0x572d4ae7b4ad in PyModule_ExecDef ../Objects/moduleobject.c:555
#13 0x572d4b1a202a in _imp_exec_builtin (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x78102a) (BuildId: dac7ae6d6ed5f3a14d0cfdafb4721e2e3be18e94)
#14 0x572d4ad6978e in _PyVectorcall_Call ../Objects/call.c:273
#15 0x572d4ad6978e in _PyObject_Call ../Objects/call.c:348
#16 0x572d4ad6978e in PyObject_Call ../Objects/call.c:373
#17 0x572d4ac08e9c in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#18 0x572d4b0e5785 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#19 0x572d4b0e5785 in _PyEval_Vector ../Python/ceval.c:2005
#20 0x572d4ad637f2 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#21 0x572d4ad637f2 in object_vacall ../Objects/call.c:819
#22 0x572d4ad66e41 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#23 0x572d4b1ad9c3 in import_find_and_load ../Python/import.c:3688
#24 0x572d4b1ad9c3 in PyImport_ImportModuleLevelObject ../Python/import.c:3770
#25 0x572d4b0e05f5 in _PyEval_ImportName ../Python/ceval.c:3021
#26 0x572d4ac1aa3e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#27 0x572d4b0e4fb6 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#28 0x572d4b0e4fb6 in _PyEval_Vector ../Python/ceval.c:2005
#29 0x572d4b0e4fb6 in PyEval_EvalCode ../Python/ceval.c:888
#30 0x572d4b0cf628 in builtin_exec_impl ../Python/bltinmodule.c:1180
#31 0x572d4b0cf628 in builtin_exec ../Python/clinic/bltinmodule.c.h:571
#32 0x572d4ac2adf3 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2361
#33 0x572d4b0e5785 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#34 0x572d4b0e5785 in _PyEval_Vector ../Python/ceval.c:2005
#35 0x572d4ad637f2 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#36 0x572d4ad637f2 in object_vacall ../Objects/call.c:819
#37 0x572d4ad66e41 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#38 0x572d4b1ad9c3 in import_find_and_load ../Python/import.c:3688
#39 0x572d4b1ad9c3 in PyImport_ImportModuleLevelObject ../Python/import.c:3770
#40 0x572d4b0c7a2c in builtin___import___impl ../Python/bltinmodule.c:285
#41 0x572d4b0c7a2c in builtin___import__ ../Python/clinic/bltinmodule.c.h:110
#42 0x572d4ad640b8 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#43 0x572d4ad640b8 in _PyObject_CallFunctionVa ../Objects/call.c:552
#44 0x572d4ad65149 in PyObject_CallFunction ../Objects/call.c:574
#45 0x572d4b1aeefb in PyImport_Import ../Python/import.c:3962
#46 0x572d4b1b0d5e in PyImport_ImportModuleAttr ../Python/import.c:4173
#47 0x572d4b1b0d5e in PyImport_ImportModuleAttrString ../Python/import.c:4194
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-140861
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140815
SEGV in `faulthandler.dump_traceback_later`
cpython
?
2025-10-31
# SEGV in `faulthandler.dump_traceback_later`
**Issue:** [https://github.com/python/cpython/issues/140815](https://github.com/python/cpython/issues/140815) · **State:** `closed` · **Created:** `2025-10-31T10:07:37Z`
**Labels:** `interpreter-core`, `type-crash`, `triaged`
## Description
# Crash report
### What happened?
```python
import faulthandler
import sys
import unittest
class Test(unittest.TestCase):
def setUp(self):
faulthandler.dump_traceback_later(10 * 1e-308, exit=True, file=sys.__stderr__)
def test_sendall(self):
os.mkfifo(filename)
if __name__ == '__main__':
unittest.main()
```
```
FAILED (errors=1)
#0 0x5646ef225cff in dump_traceback ../Python/traceback.c:1111
#1 0x5646ef229ae2 in _Py_DumpTracebackThreads ../Python/traceback.c:1302
#2 0x5646ef2709d4 in faulthandler_thread ../Modules/faulthandler.c:706
#3 0x5646ef2220af in pythread_wrapper ../Python/thread_pthread.h:234
#4 0x76c294e77a41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234
#5 0x76c294bbaaa3 (/lib/x86_64-linux-gnu/libc.so.6+0x9caa3) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#6 0x76c294c47a33 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x129a33) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
Address 0x76c292fb39da is located in stack of thread T0 at offset 2522 in frame
#0 0x5646eeb38bcf in _PyEval_EvalFrameDefault ../Python/ceval.c:1032
This frame has 37 object(s):
[32, 36) 'method_found'
[48, 52) 'level'
[64, 68) 'handler'
[80, 84) 'lasti'
[96, 104) 'temp'
[128, 136) 'res_o'
[160, 168) 'match_o'
[192, 200) 'rest_o'
[224, 232) 'null_or_index'
[256, 264) 'null_or_index'
[288, 296) 'executor'
[320, 328) 'bc_o'
[352, 360) 'value_o'
[384, 392) 'v_o'
[416, 424) 'retval_o'
[448, 456) 'ann_dict'
[480, 488) 'kwnames' (line 1906)
[512, 528) 'stack'
[544, 560) 'stack'
[576, 592) 'args'
[608, 648) 'stack'
[688, 752) 'stack_array' (line 1909)
[784, 872) 'values_o_temp'
[912, 1000) 'pieces_o_temp'
[1040, 1128) 'args_o_temp'
[1168, 1256) 'args_o_temp'
[1296, 1384) 'args_o_temp'
[1424, 1512) 'args_o_temp'
[1552, 1640) 'args_o_temp'
[1680, 1768) 'args_o_temp'
[1808, 1896) 'args_o_temp'
[1936, 2024) 'args_o_temp'
[2064, 2152) 'args_o_temp'
[2192, 2280) 'args_o_temp'
[2320, 2408) 'args_o_temp'
[2448, 2544) 'entry' (line 1051) <== Memory access at offset 2522 is inside this variable
[2576, 2656) 'buffer' (line 518)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-use-after-return ../Python/traceback.c:1111 in dump_traceback
Shadow bytes around the buggy address:
0x76c292fb3700: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x76c292fb3780: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x76c292fb3800: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x76c292fb3880: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x76c292fb3900: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
=>0x76c292fb3980: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5[f5]f5 f5 f5 f5
0x76c292fb3a00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x76c292fb3a80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x76c292fb3b00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x76c292fb3b80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x76c292fb3c00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Thread T1 created by T0 here:
#0 0x76c294f0e1f9 in pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:245
#1 0x5646ef22228b in do_start_joinable_thread ../Python/thread_pthread.h:281
#2 0x5646ef2229a1 in PyThread_start_new_thread ../Python/thread_pthread.h:336
#3 0x5646ef274706 in faulthandler_dump_traceback_later_impl ../Modules/faulthandler.c:868
#4 0x5646ef274706 in faulthandler_dump_traceback_later ../Modules/clinic/faulthandler.c.h:366
#5 0x5646eec9f677 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#6 0x5646eec9f677 in PyObject_Vectorcall ../Objects/call.c:327
#7 0x5646eeb42bba in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2920
#8 0x5646ef020785 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#9 0x5646ef020785 in _PyEval_Vector ../Python/ceval.c:2005
#10 0x5646eeca90f0 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#11 0x5646eeca90f0 in method_vectorcall ../Objects/classobject.c:95
#12 0x5646eeca478e in _PyVectorcall_Call ../Objects/call.c:273
#13 0x5646eeca478e in _PyObject_Call ../Objects/call.c:348
#14 0x5646eeca478e in PyObject_Call ../Objects/call.c:373
#15 0x5646eeb43e9c in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#16 0x5646ef020785 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#17 0x5646ef020785 in _PyEval_Vector ../Python/ceval.c:2005
#18 0x5646eeca2db3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#19 0x5646eeca346c in _PyObject_Call_Prepend ../Objects/call.c:504
#20 0x5646eee5ff64 in call_method ../Objects/typeobject.c:3077
#21 0x5646eee5ff64 in slot_tp_call ../Objects/typeobject.c:10606
#22 0x5646eec9dc5d in _PyObject_MakeTpCall ../Objects/call.c:242
#23 0x5646eeb417ac in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#24 0x5646ef020785 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#25 0x5646ef020785 in _PyEval_Vector ../Python/ceval.c:2005
#26 0x5646eeca90f0 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#27 0x5646eeca90f0 in method_vectorcall ../Objects/classobject.c:95
#28 0x5646eeca478e in _PyVectorcall_Call ../Objects/call.c:273
#29 0x5646eeca478e in _PyObject_Call ../Objects/call.c:348
#30 0x5646eeca478e in PyObject_Call ../Objects/call.c:373
#31 0x5646eeb43e9c in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#32 0x5646ef020785 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#33 0x5646ef020785 in _PyEval_Vector ../Python/ceval.c:2005
#34 0x5646eeca2db3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#35 0x5646eeca346c in _PyObject_Call_Prepend ../Objects/call.c:504
#36 0x5646eee5ff64 in call_method ../Objects/typeobject.c:3077
#37 0x5646eee5ff64 in slot_tp_call ../Objects/typeobject.c:10606
#38 0x5646eec9dc5d in _PyObject_MakeTpCall ../Objects/call.c:242
#39 0x5646eeb40ad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#40 0x5646ef020785 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#41 0x5646ef020785 in _PyEval_Vector ../Python/ceval.c:2005
#42 0x5646eeca90f0 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#43 0x5646eeca90f0 in method_vectorcall ../Objects/classobject.c:95
#44 0x5646eeca478e in _PyVectorcall_Call ../Objects/call.c:273
#45 0x5646eeca478e in _PyObject_Call ../Objects/call.c:348
#46 0x5646eeca478e in PyObject_Call ../Objects/call.c:373
#47 0x5646eeb43e9c in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#48 0x5646ef020785 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#49 0x5646ef020785 in _PyEval_Vector ../Python/ceval.c:2005
#50 0x5646eeca2db3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#51 0x5646eeca346c in _PyObject_Call_Prepend ../Objects/call.c:504
#52 0x5646eee5ff64 in call_method ../Objects/typeobject.c:3077
#53 0x5646eee5ff64 in slot_tp_call ../Objects/typeobject.c:10606
#54 0x5646eec9dc5d in _PyObject_MakeTpCall ../Objects/call.c:242
#55 0x5646eeb40ad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#56 0x5646ef020785 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#57 0x5646ef020785 in _PyEval_Vector ../Python/ceval.c:2005
#58 0x5646eeca2db3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#59 0x5646eeca346c in _PyObject_Call_Prepend ../Objects/call.c:504
#60 0x5646eee4d2e0 in call_method ../Objects/typeobject.c:3077
#61 0x5646eee4d2e0 in slot_tp_init ../Objects/typeobject.c:10835
#62 0x5646eee3f457 in type_call ../Objects/typeobject.c:2461
#63 0x5646eec9dc5d in _PyObject_MakeTpCall ../Objects/call.c:242
#64 0x5646eeb5c9f8 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#65 0x5646ef01ffb6 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#66 0x5646ef01ffb6 in _PyEval_Vector ../Python/ceval.c:2005
#67 0x5646ef01ffb6 in PyEval_EvalCode ../Python/ceval.c:888
#68 0x5646ef1de3fe in run_eval_code_obj ../Python/pythonrun.c:1365
#69 0x5646ef1de3fe in run_mod ../Python/pythonrun.c:1459
#70 0x5646ef1e30a7 in pyrun_file ../Python/pythonrun.c:1293
#71 0x5646ef1e30a7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#72 0x5646ef1e3bcc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#73 0x5646ef2563cc in pymain_run_file_obj ../Modules/main.c:410
#74 0x5646ef2563cc in pymain_run_file ../Modules/main.c:429
#75 0x5646ef2563cc in pymain_run_python ../Modules/main.c:691
#76 0x5646ef257cae in Py_RunMain ../Modules/main.c:772
#77 0x5646ef257cae in pymain_main ../Modules/main.c:802
#78 0x5646ef257cae in Py_BytesMain ../Modules/main.c:826
#79 0x76c294b481c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#80 0x76c294b4828a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
==2938816==ABORTING
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
<!-- gh-linked-prs -->
### Linked PRs
* gh-140895
* gh-140921
* gh-140981
* gh-140985
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140802
heap-buffer-overflow in pycore_interpframe.h _PyFrame_Initialize
cpython
?
2025-10-30
# heap-buffer-overflow in pycore_interpframe.h _PyFrame_Initialize
**Issue:** [https://github.com/python/cpython/issues/140802](https://github.com/python/cpython/issues/140802) · **State:** `open` · **Created:** `2025-10-30T16:35:51Z`
**Labels:** `interpreter-core`, `type-crash`
## Description
# Crash report
### What happened?
```python
import sys
import asyncio
class JumpTracer:
def __init__(self, func, jump_to):
self.code = func.__code__
self.jump_to = jump_to
self.first_line = None
def trace(self, frame, event, arg):
if self.first_line is None and event == 'line' and frame.f_code is self.code:
self.first_line = frame.f_lineno - 1
try:
frame.f_lineno = self.first_line - self.jump_to
except TypeError:
frame.f_lineno = self.jump_to
return self.trace
async def target():
# Keep a couple of lines so the tracer has places to land.
x = 0
x += 1
return x
if __name__ == "__main__":
tracer = JumpTracer(target, jump_to=1)
sys.settrace(tracer.trace)
asyncio.run(target())
```
```
=================================================================
==1675806==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x510000044e00 at pc 0x61c306b4803a bp 0x7ffebaccfa40 sp 0x7ffebaccfa30
WRITE of size 8 at 0x510000044e00 thread T0
#0 0x61c306b48039 in _PyFrame_Initialize ../Include/internal/pycore_interpframe.h:154
#1 0x61c306b48039 in _PyEvalFramePushAndInit ../Python/ceval.c:1874
#2 0x61c306b5262f in _PyEval_Vector ../Python/ceval.c:1995
#3 0x61c3067d3af3 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#4 0x61c3067d3af3 in PyObject_VectorcallMethod ../Objects/call.c:859
#5 0x61c306d8d296 in call_soon ../Modules/_asynciomodule.c:388
#6 0x61c306d97254 in future_schedule_callbacks ../Modules/_asynciomodule.c:455
#7 0x61c306d9bf0a in future_set_result ../Modules/_asynciomodule.c:653
#8 0x61c306d9bf0a in task_step_impl ../Modules/_asynciomodule.c:3147
#9 0x61c306da0377 in task_step ../Modules/_asynciomodule.c:3463
#10 0x61c306da0377 in TaskStepMethWrapper_call ../Modules/_asynciomodule.c:2120
#11 0x61c3067cfc5d in _PyObject_MakeTpCall ../Objects/call.c:242
#12 0x61c306b98e24 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:167
#13 0x61c306b98e24 in context_run ../Python/context.c:728
#14 0x61c3067d678e in _PyVectorcall_Call ../Objects/call.c:273
#15 0x61c3067d678e in _PyObject_Call ../Objects/call.c:348
#16 0x61c3067d678e in PyObject_Call ../Objects/call.c:373
#17 0x61c306675e9c in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#18 0x61c306b51fb6 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#19 0x61c306b51fb6 in _PyEval_Vector ../Python/ceval.c:2005
#20 0x61c306b51fb6 in PyEval_EvalCode ../Python/ceval.c:888
#21 0x61c306d103fe in run_eval_code_obj ../Python/pythonrun.c:1365
#22 0x61c306d103fe in run_mod ../Python/pythonrun.c:1459
#23 0x61c306d150a7 in pyrun_file ../Python/pythonrun.c:1293
#24 0x61c306d150a7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#25 0x61c306d15bcc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#26 0x61c306d883cc in pymain_run_file_obj ../Modules/main.c:410
#27 0x61c306d883cc in pymain_run_file ../Modules/main.c:429
#28 0x61c306d883cc in pymain_run_python ../Modules/main.c:691
#29 0x61c306d89cae in Py_RunMain ../Modules/main.c:772
#30 0x61c306d89cae in pymain_main ../Modules/main.c:802
#31 0x61c306d89cae in Py_BytesMain ../Modules/main.c:826
#32 0x7ee30b1ea1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#33 0x7ee30b1ea28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
0x510000044e00 is located 0 bytes after 192-byte region [0x510000044d40,0x510000044e00)
allocated by thread T0 here:
#0 0x7ee30b5b89c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x61c306be8c1e in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x61c306be8c1e in gc_alloc ../Python/gc.c:2343
#3 0x61c306be8c1e in _PyObject_GC_NewVar ../Python/gc.c:2385
#4 0x61c306822e1c in make_gen ../Objects/genobject.c:927
#5 0x61c30682d932 in _Py_MakeCoro ../Objects/genobject.c:970
#6 0x61c30667b85d in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:10356
#7 0x61c306b51fb6 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#8 0x61c306b51fb6 in _PyEval_Vector ../Python/ceval.c:2005
#9 0x61c306b51fb6 in PyEval_EvalCode ../Python/ceval.c:888
#10 0x61c306d103fe in run_eval_code_obj ../Python/pythonrun.c:1365
#11 0x61c306d103fe in run_mod ../Python/pythonrun.c:1459
#12 0x61c306d150a7 in pyrun_file ../Python/pythonrun.c:1293
#13 0x61c306d150a7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#14 0x61c306d15bcc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#15 0x61c306d883cc in pymain_run_file_obj ../Modules/main.c:410
#16 0x61c306d883cc in pymain_run_file ../Modules/main.c:429
#17 0x61c306d883cc in pymain_run_python ../Modules/main.c:691
#18 0x61c306d89cae in Py_RunMain ../Modules/main.c:772
#19 0x61c306d89cae in pymain_main ../Modules/main.c:802
#20 0x61c306d89cae in Py_BytesMain ../Modules/main.c:826
#21 0x7ee30b1ea1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#22 0x7ee30b1ea28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
SUMMARY: AddressSanitizer: heap-buffer-overflow ../Include/internal/pycore_interpframe.h:154 in _PyFrame_Initialize
Shadow bytes around the buggy address:
0x510000044b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x510000044c00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x510000044c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05
0x510000044d00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x510000044d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x510000044e00:[fa]fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x510000044e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x510000044f00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x510000044f80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
0x510000045000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x510000045080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==1675806==ABORTING
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140798
Memory leak with `threading.local` when tracing is active
cpython
?
2025-10-30
# Memory leak with `threading.local` when tracing is active
**Issue:** [https://github.com/python/cpython/issues/140798](https://github.com/python/cpython/issues/140798) · **State:** `open` · **Created:** `2025-10-30T15:56:42Z`
**Labels:** `type-bug`, `interpreter-core`, `extension-modules`, `3.13`, `3.14`, `3.15`
## Description
# Bug report
### Bug description:
```python
import threading
events = []
def tracer(frame, event, arg):
try:
func_name = frame.f_code.co_name
except Exception:
func_name = 1.7976931348623157e308
events.append((threading.current_thread().name, event, func_name))
return tracer
def callback():
for _ in range(3):
try:
next(callback.g)
except StopIteration:
break
callback.g = iter(range(3))
old_threading_trace = getattr(threading, "_trace_hook", Ellipsis)
try:
threading.settrace(tracer)
t = threading.Thread(target=callback, name="child-thread")
t.start()
t.join()
finally:
threading.settrace(old_threading_trace)
```
```
=================================================================
==1247377==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 24 byte(s) in 1 object(s) allocated from:
#0 0x79ebcdce99c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x6021cf14b8fe in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x6021cf14b8fe in _PyType_AllocNoTrack ../Objects/typeobject.c:2505
#3 0x6021cf14bb64 in PyType_GenericAlloc ../Objects/typeobject.c:2536
#4 0x6021cf6a925f in create_localdummies ../Modules/_threadmodule.c:1617
#5 0x6021cf6a925f in _ldict ../Modules/_threadmodule.c:1694
#6 0x6021cf6a974b in local_setattro ../Modules/_threadmodule.c:1751
#7 0x6021cf0c4421 in PyObject_SetAttr ../Objects/object.c:1476
#8 0x6021cee5f3c8 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:10750
#9 0x6021cf324785 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#10 0x6021cf324785 in _PyEval_Vector ../Python/ceval.c:2005
#11 0x6021cf516c34 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#12 0x6021cf516c34 in call_trampoline ../Python/sysmodule.c:1080
#13 0x6021cf516c34 in trace_trampoline ../Python/sysmodule.c:1116
#14 0x6021cf419ff9 in _Py_call_instrumentation_line ../Python/instrumentation.c:1349
#15 0x6021cee66880 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:7024
#16 0x6021cf324785 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#17 0x6021cf324785 in _PyEval_Vector ../Python/ceval.c:2005
#18 0x6021cefa39bd in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#19 0x6021cefa39bd in PyObject_CallOneArg ../Objects/call.c:395
#20 0x6021cf152065 in call_unbound_noarg ../Objects/typeobject.c:3041
#21 0x6021cf152065 in slot_tp_finalize ../Objects/typeobject.c:10879
#22 0x6021cf0c3e50 in PyObject_CallFinalizer ../Objects/object.c:585
#23 0x6021cf0c3e50 in PyObject_CallFinalizerFromDealloc ../Objects/object.c:603
#24 0x6021cf141200 in subtype_dealloc ../Objects/typeobject.c:2775
#25 0x6021cf0c1ef1 in _Py_Dealloc ../Objects/object.c:3200
#26 0x6021cf0721f0 in Py_DECREF ../Include/refcount.h:420
#27 0x6021cf0721f0 in Py_XDECREF ../Include/refcount.h:513
#28 0x6021cf0721f0 in dictkeys_decref ../Objects/dictobject.c:462
#29 0x6021cf0721f0 in dictkeys_decref ../Objects/dictobject.c:446
#30 0x6021cf0721f0 in dict_dealloc ../Objects/dictobject.c:3354
#31 0x6021cf0721f0 in dict_dealloc ../Objects/dictobject.c:3328
#32 0x6021cf0c1ef1 in _Py_Dealloc ../Objects/object.c:3200
#33 0x6021cf08570b in Py_DECREF ../Include/refcount.h:420
#34 0x6021cf08570b in _PyDict_Pop_KnownHash ../Objects/dictobject.c:3115
#35 0x6021cf08570b in pop_lock_held ../Objects/dictobject.c:3149
#36 0x6021cf08570b in PyDict_Pop ../Objects/dictobject.c:3157
#37 0x6021cf6a2bdc in clear_locals ../Modules/_threadmodule.c:1860
#38 0x6021cefa39bd in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#39 0x6021cefa39bd in PyObject_CallOneArg ../Objects/call.c:395
#40 0x6021cf254d4f in handle_callback ../Objects/weakrefobject.c:989
#41 0x6021cf254d4f in PyObject_ClearWeakRefs ../Objects/weakrefobject.c:1080
#42 0x6021cf6a2ce4 in localdummy_dealloc ../Modules/_threadmodule.c:1421
#43 0x6021cf0c1ef1 in _Py_Dealloc ../Objects/object.c:3200
#44 0x6021cf4db134 in Py_DECREF ../Include/refcount.h:420
#45 0x6021cf4db134 in PyThreadState_Clear ../Python/pystate.c:1673
#46 0x6021cf6aa15a in thread_run ../Modules/_threadmodule.c:404
#47 0x6021cf5260af in pythread_wrapper ../Python/thread_pthread.h:234
#48 0x79ebcdc4aa41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234
#49 0x79ebcd98daa3 (/lib/x86_64-linux-gnu/libc.so.6+0x9caa3) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
Direct leak of 24 byte(s) in 1 object(s) allocated from:
#0 0x79ebcdce99c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x6021cf14b8fe in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x6021cf14b8fe in _PyType_AllocNoTrack ../Objects/typeobject.c:2505
#3 0x6021cf14bb64 in PyType_GenericAlloc ../Objects/typeobject.c:2536
#4 0x6021cf6a9210 in create_localdummies ../Modules/_threadmodule.c:1612
#5 0x6021cf6a9210 in _ldict ../Modules/_threadmodule.c:1694
#6 0x6021cf6a974b in local_setattro ../Modules/_threadmodule.c:1751
#7 0x6021cf0c4421 in PyObject_SetAttr ../Objects/object.c:1476
#8 0x6021cee5f3c8 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:10750
#9 0x6021cf324785 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#10 0x6021cf324785 in _PyEval_Vector ../Python/ceval.c:2005
#11 0x6021cf516c34 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#12 0x6021cf516c34 in call_trampoline ../Python/sysmodule.c:1080
#13 0x6021cf516c34 in trace_trampoline ../Python/sysmodule.c:1116
#14 0x6021cf419ff9 in _Py_call_instrumentation_line ../Python/instrumentation.c:1349
#15 0x6021cee66880 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:7024
#16 0x6021cf324785 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#17 0x6021cf324785 in _PyEval_Vector ../Python/ceval.c:2005
#18 0x6021cefa39bd in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#19 0x6021cefa39bd in PyObject_CallOneArg ../Objects/call.c:395
#20 0x6021cf152065 in call_unbound_noarg ../Objects/typeobject.c:3041
#21 0x6021cf152065 in slot_tp_finalize ../Objects/typeobject.c:10879
#22 0x6021cf0c3e50 in PyObject_CallFinalizer ../Objects/object.c:585
#23 0x6021cf0c3e50 in PyObject_CallFinalizerFromDealloc ../Objects/object.c:603
#24 0x6021cf141200 in subtype_dealloc ../Objects/typeobject.c:2775
#25 0x6021cf0c1ef1 in _Py_Dealloc ../Objects/object.c:3200
#26 0x6021cf0721f0 in Py_DECREF ../Include/refcount.h:420
#27 0x6021cf0721f0 in Py_XDECREF ../Include/refcount.h:513
#28 0x6021cf0721f0 in dictkeys_decref ../Objects/dictobject.c:462
#29 0x6021cf0721f0 in dictkeys_decref ../Objects/dictobject.c:446
#30 0x6021cf0721f0 in dict_dealloc ../Objects/dictobject.c:3354
#31 0x6021cf0721f0 in dict_dealloc ../Objects/dictobject.c:3328
#32 0x6021cf0c1ef1 in _Py_Dealloc ../Objects/object.c:3200
#33 0x6021cf08570b in Py_DECREF ../Include/refcount.h:420
#34 0x6021cf08570b in _PyDict_Pop_KnownHash ../Objects/dictobject.c:3115
#35 0x6021cf08570b in pop_lock_held ../Objects/dictobject.c:3149
#36 0x6021cf08570b in PyDict_Pop ../Objects/dictobject.c:3157
#37 0x6021cf6a2bdc in clear_locals ../Modules/_threadmodule.c:1860
#38 0x6021cefa39bd in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#39 0x6021cefa39bd in PyObject_CallOneArg ../Objects/call.c:395
#40 0x6021cf254d4f in handle_callback ../Objects/weakrefobject.c:989
#41 0x6021cf254d4f in PyObject_ClearWeakRefs ../Objects/weakrefobject.c:1080
#42 0x6021cf6a2ce4 in localdummy_dealloc ../Modules/_threadmodule.c:1421
#43 0x6021cf0c1ef1 in _Py_Dealloc ../Objects/object.c:3200
#44 0x6021cf4db134 in Py_DECREF ../Include/refcount.h:420
#45 0x6021cf4db134 in PyThreadState_Clear ../Python/pystate.c:1673
#46 0x6021cf6aa15a in thread_run ../Modules/_threadmodule.c:404
#47 0x6021cf5260af in pythread_wrapper ../Python/thread_pthread.h:234
#48 0x79ebcdc4aa41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234
#49 0x79ebcd98daa3 (/lib/x86_64-linux-gnu/libc.so.6+0x9caa3) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
SUMMARY: AddressSanitizer: 48 byte(s) leaked in 2 allocation(s).
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-140836
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140777
AddressSanitizer: BUS abort in multiprocessing.shared_memory
cpython
?
2025-10-30
# AddressSanitizer: BUS abort in multiprocessing.shared_memory
**Issue:** [https://github.com/python/cpython/issues/140777](https://github.com/python/cpython/issues/140777) · **State:** `closed` · **Created:** `2025-10-30T04:26:32Z`
**Labels:** `type-crash`, `pending`
## Description
# Crash report
### What happened?
```python
import multiprocessing
from multiprocessing import shared_memory
original_list = multiprocessing.shared_memory.ShareableList(range(10))
with tempfile.TemporaryDirectory() as d:
mime_dict = mimetypes.read_mime_types(os_helper.FakePath(file2))
```
```
=================================================================
==2640899==ERROR: AddressSanitizer: BUS on unknown address (pc 0x77784c05ab1c bp 0x7ffe311ba1b0 sp 0x7ffe311ba128 T0)
==2640899==The signal is caused by a WRITE memory access.
==2640899==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used.
#0 0x77784c05ab1c (/lib/x86_64-linux-gnu/libc.so.6+0x1a1b1c) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#1 0x77784b50f254 in memset /usr/include/x86_64-linux-gnu/bits/string_fortified.h:59
#2 0x77784b50f254 in s_pack_internal ../Modules/_struct.c:2106
#3 0x77784b50fb21 in s_pack_into ../Modules/_struct.c:2315
#4 0x77784b517b21 in pack_into ../Modules/_struct.c:2539
#5 0x581c430c378e in _PyVectorcall_Call ../Objects/call.c:273
#6 0x581c430c378e in _PyObject_Call ../Objects/call.c:348
#7 0x581c430c378e in PyObject_Call ../Objects/call.c:373
#8 0x581c42f62e9c in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#9 0x581c4343f785 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#10 0x581c4343f785 in _PyEval_Vector ../Python/ceval.c:2005
#11 0x581c430c1db3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#12 0x581c430c246c in _PyObject_Call_Prepend ../Objects/call.c:504
#13 0x581c4326c2e0 in call_method ../Objects/typeobject.c:3077
#14 0x581c4326c2e0 in slot_tp_init ../Objects/typeobject.c:10835
#15 0x581c4325e457 in type_call ../Objects/typeobject.c:2461
#16 0x581c430bcc5d in _PyObject_MakeTpCall ../Objects/call.c:242
#17 0x581c42f5fad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#18 0x581c4343efb6 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#19 0x581c4343efb6 in _PyEval_Vector ../Python/ceval.c:2005
#20 0x581c4343efb6 in PyEval_EvalCode ../Python/ceval.c:888
#21 0x581c435fd3fe in run_eval_code_obj ../Python/pythonrun.c:1365
#22 0x581c435fd3fe in run_mod ../Python/pythonrun.c:1459
#23 0x581c436020a7 in pyrun_file ../Python/pythonrun.c:1293
#24 0x581c436020a7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#25 0x581c43602bcc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#26 0x581c436753cc in pymain_run_file_obj ../Modules/main.c:410
#27 0x581c436753cc in pymain_run_file ../Modules/main.c:429
#28 0x581c436753cc in pymain_run_python ../Modules/main.c:691
#29 0x581c43676cae in Py_RunMain ../Modules/main.c:772
#30 0x581c43676cae in pymain_main ../Modules/main.c:802
#31 0x581c43676cae in Py_BytesMain ../Modules/main.c:826
#32 0x77784bee31c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#33 0x77784bee328a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: BUS (/lib/x86_64-linux-gnu/libc.so.6+0x1a1b1c) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
==2640899==ABORTING
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140776
SEGV when changing `co_consts` of a function definition
cpython
?
2025-10-30
# SEGV when changing `co_consts` of a function definition
**Issue:** [https://github.com/python/cpython/issues/140776](https://github.com/python/cpython/issues/140776) · **State:** `closed` · **Created:** `2025-10-30T04:22:29Z`
**Labels:** `interpreter-core`, `type-crash`, `pending`
## Description
# Crash report
### What happened?
```python
import encodings.kz1048
import textwrap
obj = encodings.kz1048.IncrementalEncoder()
input_str = 'A'
result5 = obj.encode(input_str, final=True)
fusion = result5
num_names = 300
assignments = '; '.join((f'x{i} = {i}' for i in range(num_names)))
name_list = ', '.join((f'x{i}' for i in range(num_names)))
code = f'\n {assignments}\n [({name_list}) for {name_list} in (range(300),)]\n dir()\n y = [{name_list}]\n '
newcode = textwrap.dedent('\n class _C:\n {code}\n ').format(
code=textwrap.indent(code, ' ')
)
newns = {}
co = compile(newcode, '<string>', 'exec')
co = co.replace(co_consts=tuple((fusion for _ in co.co_consts)))
exec(co, newns)
```
```
=================================================================
==2585162==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x645bcafe6ac3 bp 0x7ffd863f5d70 sp 0x7ffd863f5ca0 T0)
==2585162==The signal is caused by a READ memory access.
==2585162==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used.
#0 0x645bcafe6ac3 in Py_INCREF ../Include/refcount.h:281
#1 0x645bcafe6ac3 in _Py_NewRef ../Include/refcount.h:529
#2 0x645bcafe6ac3 in PyFunction_NewWithQualName ../Objects/funcobject.c:159
#3 0x645bcae14f6b in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:9736
#4 0x645bcb2e8fb6 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#5 0x645bcb2e8fb6 in _PyEval_Vector ../Python/ceval.c:2005
#6 0x645bcb2e8fb6 in PyEval_EvalCode ../Python/ceval.c:888
#7 0x645bcb2d3628 in builtin_exec_impl ../Python/bltinmodule.c:1180
#8 0x645bcb2d3628 in builtin_exec ../Python/clinic/bltinmodule.c.h:571
#9 0x645bcaf68677 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#10 0x645bcaf68677 in PyObject_Vectorcall ../Objects/call.c:327
#11 0x645bcae09ad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#12 0x645bcb2e8fb6 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#13 0x645bcb2e8fb6 in _PyEval_Vector ../Python/ceval.c:2005
#14 0x645bcb2e8fb6 in PyEval_EvalCode ../Python/ceval.c:888
#15 0x645bcb4a73fe in run_eval_code_obj ../Python/pythonrun.c:1365
#16 0x645bcb4a73fe in run_mod ../Python/pythonrun.c:1459
#17 0x645bcb4ac0a7 in pyrun_file ../Python/pythonrun.c:1293
#18 0x645bcb4ac0a7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#19 0x645bcb4acbcc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#20 0x645bcb51f3cc in pymain_run_file_obj ../Modules/main.c:410
#21 0x645bcb51f3cc in pymain_run_file ../Modules/main.c:429
#22 0x645bcb51f3cc in pymain_run_python ../Modules/main.c:691
#23 0x645bcb520cae in Py_RunMain ../Modules/main.c:772
#24 0x645bcb520cae in pymain_main ../Modules/main.c:802
#25 0x645bcb520cae in Py_BytesMain ../Modules/main.c:826
#26 0x72a0f4dc81c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#27 0x72a0f4dc828a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ../Include/refcount.h:281 in Py_INCREF
==2585162==ABORTING
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140751
SystemError PyState_AddModule called on module with slots in testmultiphase
cpython
?
2025-10-29
# SystemError PyState_AddModule called on module with slots in testmultiphase
**Issue:** [https://github.com/python/cpython/issues/140751](https://github.com/python/cpython/issues/140751) · **State:** `closed` · **Created:** `2025-10-29T11:14:20Z`
**Labels:** `type-bug`, `tests`, `topic-C-API`
## Description
# Bug report
### Bug description:
```python
import _testmultiphase
_testmultiphase.call_state_registration_func(1)
```
```
_testmultiphase.call_state_registration_func(1)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^
SystemError: PyState_AddModule called on module with slots
```
Not sure if this is interesting, as it is a test lib.
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140750
JSON: heap-buffer-overflow in encoder caused by indentation caching
cpython
?
2025-10-29
# JSON: heap-buffer-overflow in encoder caused by indentation caching
**Issue:** [https://github.com/python/cpython/issues/140750](https://github.com/python/cpython/issues/140750) · **State:** `closed` · **Created:** `2025-10-29T11:11:08Z`
**Labels:** `extension-modules`, `type-crash`, `triaged`, `3.14`, `3.15`
## Description
# Crash report
### What happened?
```python
import json
def bad_encoder1(*args):
return None
enc = json.encoder.c_make_encoder(None, lambda obj: str(obj), bad_encoder1, r'\udcff', ': ', r'\udfff', False, -(2**64), False)
enc({'spam': 10**1000}, 4)
```
```
=================================================================
==3279101==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000004bb0 at pc 0x7079e3b05e0e bp 0x7ffc65d9ea20 sp 0x7ffc65d9ea10
READ of size 8 at 0x502000004bb0 thread T0
#0 0x7079e3b05e0d in update_indent_cache ../Modules/_json.c:1411
#1 0x7079e3b05e0d in get_item_separator ../Modules/_json.c:1440
#2 0x7079e3b1118e in encoder_listencode_dict ../Modules/_json.c:1855
#3 0x7079e3b1118e in encoder_listencode_obj ../Modules/_json.c:1624
#4 0x7079e3b121b4 in encoder_call ../Modules/_json.c:1483
#5 0x5ebc8e985c5d in _PyObject_MakeTpCall ../Objects/call.c:242
#6 0x5ebc8e828ad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#7 0x5ebc8ed07fb6 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#8 0x5ebc8ed07fb6 in _PyEval_Vector ../Python/ceval.c:2005
#9 0x5ebc8ed07fb6 in PyEval_EvalCode ../Python/ceval.c:888
#10 0x5ebc8eec63fe in run_eval_code_obj ../Python/pythonrun.c:1365
#11 0x5ebc8eec63fe in run_mod ../Python/pythonrun.c:1459
#12 0x5ebc8eecb0a7 in pyrun_file ../Python/pythonrun.c:1293
#13 0x5ebc8eecb0a7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#14 0x5ebc8eecbbcc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#15 0x5ebc8ef3e3cc in pymain_run_file_obj ../Modules/main.c:410
#16 0x5ebc8ef3e3cc in pymain_run_file ../Modules/main.c:429
#17 0x5ebc8ef3e3cc in pymain_run_python ../Modules/main.c:691
#18 0x5ebc8ef3fcae in Py_RunMain ../Modules/main.c:772
#19 0x5ebc8ef3fcae in pymain_main ../Modules/main.c:802
#20 0x5ebc8ef3fcae in Py_BytesMain ../Modules/main.c:826
#21 0x7079e43e21c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#22 0x7079e43e228a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
0x502000004bb0 is located 56 bytes after 8-byte region [0x502000004b70,0x502000004b78)
allocated by thread T0 here:
#0 0x7079e47b0340 in calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
#1 0x5ebc8ea1cccc in PyList_New ../Objects/listobject.c:262
#2 0x7079e3b12108 in create_indent_cache ../Modules/_json.c:1393
#3 0x7079e3b12108 in encoder_call ../Modules/_json.c:1477
#4 0x5ebc8e985c5d in _PyObject_MakeTpCall ../Objects/call.c:242
#5 0x5ebc8e828ad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#6 0x5ebc8ed07fb6 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#7 0x5ebc8ed07fb6 in _PyEval_Vector ../Python/ceval.c:2005
#8 0x5ebc8ed07fb6 in PyEval_EvalCode ../Python/ceval.c:888
#9 0x5ebc8eec63fe in run_eval_code_obj ../Python/pythonrun.c:1365
#10 0x5ebc8eec63fe in run_mod ../Python/pythonrun.c:1459
#11 0x5ebc8eecb0a7 in pyrun_file ../Python/pythonrun.c:1293
#12 0x5ebc8eecb0a7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#13 0x5ebc8eecbbcc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#14 0x5ebc8ef3e3cc in pymain_run_file_obj ../Modules/main.c:410
#15 0x5ebc8ef3e3cc in pymain_run_file ../Modules/main.c:429
#16 0x5ebc8ef3e3cc in pymain_run_python ../Modules/main.c:691
#17 0x5ebc8ef3fcae in Py_RunMain ../Modules/main.c:772
#18 0x5ebc8ef3fcae in pymain_main ../Modules/main.c:802
#19 0x5ebc8ef3fcae in Py_BytesMain ../Modules/main.c:826
#20 0x7079e43e21c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#21 0x7079e43e228a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
SUMMARY: AddressSanitizer: heap-buffer-overflow ../Modules/_json.c:1411 in update_indent_cache
Shadow bytes around the buggy address:
0x502000004900: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x502000004980: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fd
0x502000004a00: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x502000004a80: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fd
0x502000004b00: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 00 fa
=>0x502000004b80: fa fa fa fa fa fa[fa]fa fa fa fa fa fa fa fa fa
0x502000004c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x502000004c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x502000004d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x502000004d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x502000004e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==3279101==ABORTING
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140652
SEGV in module interpchannels
cpython
?
2025-10-27
# SEGV in module interpchannels
**Issue:** [https://github.com/python/cpython/issues/140652](https://github.com/python/cpython/issues/140652) · **State:** `closed` · **Created:** `2025-10-27T04:11:17Z`
**Labels:** `extension-modules`, `type-crash`, `topic-subinterpreters`, `3.13`, `3.14`, `3.15`
## Description
# Crash report
### What happened?
```python
import unittest
from test.support import import_helper, skip_if_sanitizer
_channels = import_helper.import_module('_interpchannels')
from concurrent.interpreters import _crossinterp
from test.test__interpreters import (
_interpreters,
)
REPLACE = _crossinterp._UNBOUND_CONSTANT_TO_FLAG[_crossinterp.UNBOUND]
def recv_wait(cid):
raise ValueError(action)
def clean_up_channels():
for cid, _, _ in _channels.list_all():
pass # already destroyed
class TestBase(unittest.TestCase):
def tearDown(self):
clean_up_channels()
with self.subTest('closed'):
_channels.recv(cid)
cid = _channels.create(REPLACE)
_channels.close(cid)
excsnap = _interpreters.run_string(id1, dedent(f""))
def test_close_multiple_times(self):
cid = _channels.create(REPLACE)
def test_close_empty(self):
tests = []
class ChannelReleaseTests(TestBase):
unittest.main()
```
```
=================================================================
==2066570==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x76c08a641e02 bp 0x7fff47d76240 sp 0x7fff47d76110 T0)
==2066570==The signal is caused by a READ memory access.
==2066570==Hint: address points to the zero page.
#0 0x76c08a641e02 in _channels_list_all ../Modules/_interpchannelsmodule.c:1649
#1 0x76c08a641e02 in channelsmod_list_all ../Modules/_interpchannelsmodule.c:2996
#2 0x6427274abee7 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#3 0x6427274abee7 in PyObject_Vectorcall ../Objects/call.c:327
#4 0x642727376f25 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#5 0x642727830b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#6 0x642727830b55 in _PyEval_Vector ../Python/ceval.c:2001
#7 0x6427274b5d90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#8 0x6427274b5d90 in method_vectorcall ../Objects/classobject.c:95
#9 0x6427274b0ffe in _PyVectorcall_Call ../Objects/call.c:273
#10 0x6427274b0ffe in _PyObject_Call ../Objects/call.c:348
#11 0x6427274b0ffe in PyObject_Call ../Objects/call.c:373
#12 0x642727350eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#13 0x642727830b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#14 0x642727830b55 in _PyEval_Vector ../Python/ceval.c:2001
#15 0x6427274af623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#16 0x6427274afcdc in _PyObject_Call_Prepend ../Objects/call.c:504
#17 0x642727670444 in call_method ../Objects/typeobject.c:3077
#18 0x642727670444 in slot_tp_call ../Objects/typeobject.c:10606
#19 0x6427274aa4cd in _PyObject_MakeTpCall ../Objects/call.c:242
#20 0x64272734e7ac in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#21 0x642727830b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#22 0x642727830b55 in _PyEval_Vector ../Python/ceval.c:2001
#23 0x6427274b5d90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#24 0x6427274b5d90 in method_vectorcall ../Objects/classobject.c:95
#25 0x6427274b0ffe in _PyVectorcall_Call ../Objects/call.c:273
#26 0x6427274b0ffe in _PyObject_Call ../Objects/call.c:348
#27 0x6427274b0ffe in PyObject_Call ../Objects/call.c:373
#28 0x642727350eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#29 0x642727830b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#30 0x642727830b55 in _PyEval_Vector ../Python/ceval.c:2001
#31 0x6427274af623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#32 0x6427274afcdc in _PyObject_Call_Prepend ../Objects/call.c:504
#33 0x642727670444 in call_method ../Objects/typeobject.c:3077
#34 0x642727670444 in slot_tp_call ../Objects/typeobject.c:10606
#35 0x6427274aa4cd in _PyObject_MakeTpCall ../Objects/call.c:242
#36 0x64272734dad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#37 0x642727830b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#38 0x642727830b55 in _PyEval_Vector ../Python/ceval.c:2001
#39 0x6427274b5d90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#40 0x6427274b5d90 in method_vectorcall ../Objects/classobject.c:95
#41 0x6427274b0ffe in _PyVectorcall_Call ../Objects/call.c:273
#42 0x6427274b0ffe in _PyObject_Call ../Objects/call.c:348
#43 0x6427274b0ffe in PyObject_Call ../Objects/call.c:373
#44 0x642727350eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#45 0x642727830b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#46 0x642727830b55 in _PyEval_Vector ../Python/ceval.c:2001
#47 0x6427274af623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#48 0x6427274afcdc in _PyObject_Call_Prepend ../Objects/call.c:504
#49 0x642727670444 in call_method ../Objects/typeobject.c:3077
#50 0x642727670444 in slot_tp_call ../Objects/typeobject.c:10606
#51 0x6427274aa4cd in _PyObject_MakeTpCall ../Objects/call.c:242
#52 0x64272734dad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#53 0x642727830b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#54 0x642727830b55 in _PyEval_Vector ../Python/ceval.c:2001
#55 0x6427274af623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#56 0x6427274afcdc in _PyObject_Call_Prepend ../Objects/call.c:504
#57 0x64272765cc50 in call_method ../Objects/typeobject.c:3077
#58 0x64272765cc50 in slot_tp_init ../Objects/typeobject.c:10835
#59 0x64272764e9d7 in type_call ../Objects/typeobject.c:2461
#60 0x6427274aa4cd in _PyObject_MakeTpCall ../Objects/call.c:242
#61 0x642727369a18 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#62 0x642727830b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#63 0x642727830b55 in _PyEval_Vector ../Python/ceval.c:2001
#64 0x64272781c9e8 in builtin___build_class__ ../Python/bltinmodule.c:205
#65 0x6427274abee7 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#66 0x6427274abee7 in PyObject_Vectorcall ../Objects/call.c:327
#67 0x64272734dad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#68 0x642727830386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#69 0x642727830386 in _PyEval_Vector ../Python/ceval.c:2001
#70 0x642727830386 in PyEval_EvalCode ../Python/ceval.c:884
#71 0x6427279eef0e in run_eval_code_obj ../Python/pythonrun.c:1365
#72 0x6427279eef0e in run_mod ../Python/pythonrun.c:1459
#73 0x6427279f3bb7 in pyrun_file ../Python/pythonrun.c:1293
#74 0x6427279f3bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#75 0x6427279f46dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#76 0x642727a67afc in pymain_run_file_obj ../Modules/main.c:410
#77 0x642727a67afc in pymain_run_file ../Modules/main.c:429
#78 0x642727a67afc in pymain_run_python ../Modules/main.c:691
#79 0x642727a693de in Py_RunMain ../Modules/main.c:772
#80 0x642727a693de in pymain_main ../Modules/main.c:802
#81 0x642727a693de in Py_BytesMain ../Modules/main.c:826
#82 0x76c08dcd21c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#83 0x76c08dcd228a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ../Modules/_interpchannelsmodule.c:1649 in _channels_list_all
==2066570==ABORTING
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
<!-- gh-linked-prs -->
### Linked PRs
* gh-140656
* gh-143743
* gh-144951
* gh-144953
* gh-144954
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140651
heap-use-after-free in pickle posix
cpython
?
2025-10-27
# heap-use-after-free in pickle posix
**Issue:** [https://github.com/python/cpython/issues/140651](https://github.com/python/cpython/issues/140651) · **State:** `closed` · **Created:** `2025-10-27T03:56:31Z`
**Labels:** `extension-modules`, `type-crash`
## Description
# Crash report
### What happened?
```python
import pickle
import posix
param = posix.sched_param(9223372036854775807)
for proto in range(pickle.HIGHEST_PROTOCOL + 1):
newparam = pickle.loads(pickle.dumps(param, proto))
```
```
=================================================================
==1834045==ERROR: AddressSanitizer: heap-use-after-free on address 0x50400004ff98 at pc 0x7d7f93f59597 bp 0x7ffd817a7cb0 sp 0x7ffd817a7ca0
READ of size 8 at 0x50400004ff98 thread T0
#0 0x7d7f93f59596 in _Py_TYPE ../Include/object.h:277
#1 0x7d7f93f59596 in save ../Modules/_pickle.c:4368
#2 0x7d7f93f65b8a in store_tuple_elements ../Modules/_pickle.c:2785
#3 0x7d7f93f65b8a in save_tuple ../Modules/_pickle.c:2838
#4 0x7d7f93f59210 in save ../Modules/_pickle.c:4427
#5 0x7d7f93f5b66c in save_reduce ../Modules/_pickle.c:4266
#6 0x7d7f93f58990 in save ../Modules/_pickle.c:4548
#7 0x7d7f93f639f6 in dump ../Modules/_pickle.c:4611
#8 0x7d7f93f6505a in _pickle_dumps_impl ../Modules/_pickle.c:7807
#9 0x7d7f93f6505a in _pickle_dumps ../Modules/clinic/_pickle.c.h:829
#10 0x5755f19c1e79 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2361
#11 0x5755f1e7f386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#12 0x5755f1e7f386 in _PyEval_Vector ../Python/ceval.c:2001
#13 0x5755f1e7f386 in PyEval_EvalCode ../Python/ceval.c:884
#14 0x5755f203df0e in run_eval_code_obj ../Python/pythonrun.c:1365
#15 0x5755f203df0e in run_mod ../Python/pythonrun.c:1459
#16 0x5755f2042bb7 in pyrun_file ../Python/pythonrun.c:1293
#17 0x5755f2042bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#18 0x5755f20436dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#19 0x5755f20b6afc in pymain_run_file_obj ../Modules/main.c:410
#20 0x5755f20b6afc in pymain_run_file ../Modules/main.c:429
#21 0x5755f20b6afc in pymain_run_python ../Modules/main.c:691
#22 0x5755f20b83de in Py_RunMain ../Modules/main.c:772
#23 0x5755f20b83de in pymain_main ../Modules/main.c:802
#24 0x5755f20b83de in Py_BytesMain ../Modules/main.c:826
#25 0x7d7f94aab1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#26 0x7d7f94aab28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
0x50400004ff98 is located 8 bytes inside of 36-byte region [0x50400004ff90,0x50400004ffb4)
freed by thread T0 here:
#0 0x7d7f94e784d8 in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
#1 0x5755f1c1bd51 in _Py_Dealloc ../Objects/object.c:3200
#2 0x5755f1c8628d in Py_DECREF ../Include/refcount.h:420
#3 0x5755f1c8628d in Py_XDECREF ../Include/refcount.h:513
#4 0x5755f1c8628d in tuple_dealloc ../Objects/tupleobject.c:231
#5 0x5755f1c1bd51 in _Py_Dealloc ../Objects/object.c:3200
#6 0x7d7f93f3f1bc in Py_DECREF ../Include/refcount.h:420
#7 0x7d7f93f3f1bc in Py_XDECREF ../Include/refcount.h:513
#8 0x7d7f93f3f1bc in PyMemoTable_Clear ../Modules/_pickle.c:780
#9 0x7d7f93f3f1bc in PyMemoTable_Del ../Modules/_pickle.c:792
#10 0x7d7f93f3f1bc in PyMemoTable_Del ../Modules/_pickle.c:788
#11 0x7d7f93f3f1bc in Pickler_clear ../Modules/_pickle.c:4745
#12 0x7d7f93f3f385 in Pickler_dealloc ../Modules/_pickle.c:4755
#13 0x5755f1c1bd51 in _Py_Dealloc ../Objects/object.c:3200
#14 0x7d7f93f654a7 in Py_DECREF ../Include/refcount.h:420
#15 0x7d7f93f654a7 in _pickle_dumps_impl ../Modules/_pickle.c:7811
#16 0x7d7f93f654a7 in _pickle_dumps ../Modules/clinic/_pickle.c.h:829
#17 0x5755f19c1e79 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2361
#18 0x5755f1e7f386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#19 0x5755f1e7f386 in _PyEval_Vector ../Python/ceval.c:2001
#20 0x5755f1e7f386 in PyEval_EvalCode ../Python/ceval.c:884
#21 0x5755f203df0e in run_eval_code_obj ../Python/pythonrun.c:1365
#22 0x5755f203df0e in run_mod ../Python/pythonrun.c:1459
#23 0x5755f2042bb7 in pyrun_file ../Python/pythonrun.c:1293
#24 0x5755f2042bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#25 0x5755f20436dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#26 0x5755f20b6afc in pymain_run_file_obj ../Modules/main.c:410
#27 0x5755f20b6afc in pymain_run_file ../Modules/main.c:429
#28 0x5755f20b6afc in pymain_run_python ../Modules/main.c:691
#29 0x5755f20b83de in Py_RunMain ../Modules/main.c:772
#30 0x5755f20b83de in pymain_main ../Modules/main.c:802
#31 0x5755f20b83de in Py_BytesMain ../Modules/main.c:826
#32 0x7d7f94aab1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#33 0x7d7f94aab28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
previously allocated by thread T0 here:
#0 0x7d7f94e799c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5755f1ba306b in long_alloc ../Objects/longobject.c:180
#2 0x5755f1ba306b in PyLong_FromLong ../Objects/longobject.c:403
#3 0x5755f19d373d in parsenumber_raw ../Parser/pegen.c:640
#4 0x5755f19d71f9 in parsenumber ../Parser/pegen.c:668
#5 0x5755f19d71f9 in _PyPegen_number_token ../Parser/pegen.c:707
#6 0x5755f19f4749 in atom_rule ../Parser/parser.c:15160
#7 0x5755f19f9f2f in primary_raw ../Parser/parser.c:14779
#8 0x5755f19f9f2f in primary_rule ../Parser/parser.c:14577
#9 0x5755f19fae89 in await_primary_rule ../Parser/parser.c:14531
#10 0x5755f19fbde7 in power_rule ../Parser/parser.c:14407
#11 0x5755f19fbde7 in factor_rule ../Parser/parser.c:14357
#12 0x5755f19fd55f in term_raw ../Parser/parser.c:14198
#13 0x5755f19fd55f in term_rule ../Parser/parser.c:13941
#14 0x5755f19ff044 in sum_raw ../Parser/parser.c:13894
#15 0x5755f19ff044 in sum_rule ../Parser/parser.c:13773
#16 0x5755f1a00307 in shift_expr_raw ../Parser/parser.c:13733
#17 0x5755f1a00307 in shift_expr_rule ../Parser/parser.c:13593
#18 0x5755f1a01964 in bitwise_and_raw ../Parser/parser.c:13553
#19 0x5755f1a01964 in bitwise_and_rule ../Parser/parser.c:13471
#20 0x5755f1a02594 in bitwise_xor_raw ../Parser/parser.c:13431
#21 0x5755f1a02594 in bitwise_xor_rule ../Parser/parser.c:13349
#22 0x5755f1a031c4 in bitwise_or_raw ../Parser/parser.c:13309
#23 0x5755f1a031c4 in bitwise_or_rule ../Parser/parser.c:13227
#24 0x5755f1a03e90 in comparison_rule ../Parser/parser.c:12467
#25 0x5755f1a03e90 in inversion_rule ../Parser/parser.c:12418
#26 0x5755f1a07125 in conjunction_rule ../Parser/parser.c:12295
#27 0x5755f1a08125 in disjunction_rule ../Parser/parser.c:12207
#28 0x5755f1a1b084 in expression_rule ../Parser/parser.c:11495
#29 0x5755f1a1eb6c in _tmp_87_rule ../Parser/parser.c:33082
#30 0x5755f1a29712 in genexp_rule ../Parser/parser.c:18127
#31 0x5755f1a0e679 in t_primary_raw ../Parser/parser.c:19845
#32 0x5755f1a0e679 in t_primary_rule ../Parser/parser.c:19714
#33 0x5755f1a2c38d in target_with_star_atom_rule ../Parser/parser.c:19214
#34 0x5755f1a2f229 in star_target_rule ../Parser/parser.c:19157
#35 0x5755f1a2f944 in star_targets_rule ../Parser/parser.c:18899
#36 0x5755f1a3fa99 in _tmp_156_rule ../Parser/parser.c:37289
#37 0x5755f1a3fa99 in _loop1_12_rule ../Parser/parser.c:28298
#38 0x5755f1a3fa99 in assignment_rule ../Parser/parser.c:2209
#39 0x5755f1a11bbc in simple_stmt_rule ../Parser/parser.c:1592
#40 0x5755f1a1a4c2 in simple_stmts_rule ../Parser/parser.c:1487
#41 0x5755f1a73786 in statement_rule ../Parser/parser.c:1269
#42 0x5755f1a73786 in _loop1_2_rule ../Parser/parser.c:27691
#43 0x5755f1a73786 in statements_rule ../Parser/parser.c:1202
#44 0x5755f1a7fb3a in file_rule ../Parser/parser.c:1004
#45 0x5755f1a7fb3a in _PyPegen_parse ../Parser/parser.c:38324
#46 0x5755f19d809c in _PyPegen_run_parser ../Parser/pegen.c:942
SUMMARY: AddressSanitizer: heap-use-after-free ../Include/object.h:277 in _Py_TYPE
Shadow bytes around the buggy address:
0x50400004fd00: fa fa 00 00 00 00 06 fa fa fa fd fd fd fd fd fd
0x50400004fd80: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 06 fa
0x50400004fe00: fa fa 00 00 00 00 00 06 fa fa fd fd fd fd fd fd
0x50400004fe80: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 06 fa
0x50400004ff00: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 04
=>0x50400004ff80: fa fa fd[fd]fd fd fd fa fa fa 00 00 00 00 04 fa
0x504000050000: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
0x504000050080: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
0x504000050100: fa fa 00 00 00 00 04 fa fa fa 00 00 00 00 06 fa
0x504000050180: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 03 fa
0x504000050200: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 06 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==1834045==ABORTING
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140650
SystemError in io.BufferedWriter.close when closed errors
cpython
?
2025-10-27
# SystemError in io.BufferedWriter.close when closed errors
**Issue:** [https://github.com/python/cpython/issues/140650](https://github.com/python/cpython/issues/140650) · **State:** `closed` · **Created:** `2025-10-27T02:51:20Z`
**Labels:** `type-bug`, `interpreter-core`, `topic-IO`, `3.15`
## Description
# Bug report
### Bug description:
```python
import io
class MockRawIO:
def __init__(self):
self.closed = NotImplemented
def write(self, b):
return len(data)
def writable(self):
return True
tp = io.BufferedWriter
writer = MockRawIO()
bufio = tp(writer, 8)
bufio.close()
```
```
SystemError: <method 'close' of '_io.BufferedWriter' objects> returned a result with an exception set
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-140653
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140634
heap-buffer-overflow deepcopy posix_param
cpython
?
2025-10-26
# heap-buffer-overflow deepcopy posix_param
**Issue:** [https://github.com/python/cpython/issues/140634](https://github.com/python/cpython/issues/140634) · **State:** `closed` · **Created:** `2025-10-26T15:21:06Z`
**Labels:** `extension-modules`, `type-crash`, `3.13`, `3.14`, `3.15`
## Description
# Crash report
### What happened?
```python
import copy
import posix
param = posix.sched_param(float('inf'))
newparam = copy.deepcopy(param)
```
```
=================================================================
==2451226==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x503000014d9f at pc 0x6030c15f984b bp 0x7fffcd1a09a0 sp 0x7fffcd1a0990
READ of size 8 at 0x503000014d9f thread T0
#0 0x6030c15f984a in _PyFreeList_PopNoStats ../Include/internal/pycore_freelist.h:79
#1 0x6030c15f984a in clear_freelist ../Objects/object.c:901
#2 0x6030c15f984a in _PyObject_ClearFreeLists ../Objects/object.c:925
#3 0x6030c18e1786 in gc_collect_full ../Python/gc.c:1735
#4 0x6030c18e1786 in _PyGC_Collect ../Python/gc.c:2098
#5 0x6030c197c98d in finalize_modules ../Python/pylifecycle.c:1755
#6 0x6030c1986863 in _Py_Finalize ../Python/pylifecycle.c:2255
#7 0x6030c1a100e3 in Py_RunMain ../Modules/main.c:774
#8 0x6030c1a100e3 in pymain_main ../Modules/main.c:802
#9 0x6030c1a100e3 in Py_BytesMain ../Modules/main.c:826
#10 0x70dd8b5631c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#11 0x70dd8b56328a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
0x503000014d9f is located 1 bytes before 24-byte region [0x503000014da0,0x503000014db8)
allocated by thread T0 here:
#0 0x70dd8b9319c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x6030c153a1d9 in PyFloat_FromDouble ../Objects/floatobject.c:128
#2 0x6030c1a49ac1 in fill_time ../Modules/posixmodule.c:2681
#3 0x6030c1a4a1de in _pystat_fromstructstat ../Modules/posixmodule.c:2796
#4 0x6030c1a4bffc in posix_do_stat ../Modules/posixmodule.c:2918
#5 0x6030c1a5670c in os_stat_impl ../Modules/posixmodule.c:3285
#6 0x6030c1a5670c in os_stat ../Modules/clinic/posixmodule.c.h:105
#7 0x6030c13997e6 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2361
#8 0x6030c1850bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#9 0x6030c1850bb5 in _PyEval_Vector ../Python/ceval.c:2001
#10 0x6030c14d1322 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#11 0x6030c14d1322 in object_vacall ../Objects/call.c:819
#12 0x6030c14d4971 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#13 0x6030c1918b73 in import_find_and_load ../Python/import.c:3701
#14 0x6030c1918b73 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#15 0x6030c18333cc in builtin___import___impl ../Python/bltinmodule.c:285
#16 0x6030c18333cc in builtin___import__ ../Python/clinic/bltinmodule.c.h:110
#17 0x6030c14d1be8 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#18 0x6030c14d1be8 in _PyObject_CallFunctionVa ../Objects/call.c:552
#19 0x6030c14d2c79 in PyObject_CallFunction ../Objects/call.c:574
#20 0x6030c191a0ab in PyImport_Import ../Python/import.c:3975
#21 0x6030c191a85f in PyImport_ImportModule ../Python/import.c:3423
#22 0x6030c185bd42 in _PyCodec_InitRegistry ../Python/codecs.c:1686
#23 0x6030c1772094 in _PyUnicode_InitEncodings ../Objects/unicodeobject.c:15455
#24 0x6030c198082b in init_interp_main ../Python/pylifecycle.c:1228
#25 0x6030c19843cc in pyinit_main ../Python/pylifecycle.c:1420
#26 0x6030c19843cc in Py_InitializeFromConfig ../Python/pylifecycle.c:1451
#27 0x6030c1a0bcd9 in pymain_init ../Modules/main.c:68
#28 0x6030c1a10062 in pymain_main ../Modules/main.c:793
#29 0x6030c1a10062 in Py_BytesMain ../Modules/main.c:826
#30 0x70dd8b5631c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#31 0x70dd8b56328a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
SUMMARY: AddressSanitizer: heap-buffer-overflow ../Include/internal/pycore_freelist.h:79 in _PyFreeList_PopNoStats
Shadow bytes around the buggy address:
0x503000014b00: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd
0x503000014b80: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
0x503000014c00: fd fd fa fa fd fd fd fd fa fa fd fd fd fd fa fa
0x503000014c80: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd
0x503000014d00: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
=>0x503000014d80: fd fd fa[fa]00 00 00 fa fa fa fd fd fd fa fa fa
0x503000014e00: fd fd fd fd fa fa fd fd fd fa fa fa fd fd fd fd
0x503000014e80: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
0x503000014f00: fd fd fa fa fd fd fd fd fa fa fd fd fd fd fa fa
0x503000014f80: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd
0x503000015000: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2451226==ABORTING
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
<!-- gh-linked-prs -->
### Linked PRs
* gh-140667
* gh-140685
* gh-140686
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140631
Indirect memory leak when instantiating hashlib types
cpython
?
2025-10-26
# Indirect memory leak when instantiating hashlib types
**Issue:** [https://github.com/python/cpython/issues/140631](https://github.com/python/cpython/issues/140631) · **State:** `closed` · **Created:** `2025-10-26T15:10:09Z`
**Labels:** `type-bug`, `extension-modules`, `pending`
## Description
# Bug report
### Bug description:
```python
import sys
import hashlib
import unittest
class HashLibTestCase(unittest.TestCase):
def test_case_sha1_0(self):
m1 = hashlib.sha1()
self.assertEqual(m2.digest(), bytes.fromhex(expected))
class AuditTest(unittest.TestCase):
def setUp(self):
if not hasattr(sys, "audit") or not hasattr(sys, "addaudithook"):
raise unittest.SkipTest("sys.audit or sys.addaudithook not available")
def test_pickle(self):
events = []
def hook(event, args):
try:
args_tuple = tuple(args)
except TypeError:
args_tuple = (args,)
events.append((event, args_tuple))
sys.addaudithook(hook)
if __name__ == "__main__":
unittest.main()
```
```=================================================================
==2118218==ERROR: LeakSanitizer: detected memory leaks
Indirect leak of 992 byte(s) in 1 object(s) allocated from:
#0 0x7ad7975549c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5ab0ef17b0fe in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x5ab0ef17b0fe in _PyType_AllocNoTrack ../Objects/typeobject.c:2505
#3 0x5ab0ef17b364 in PyType_GenericAlloc ../Objects/typeobject.c:2536
#4 0x5ab0ef1b09fd in PyType_FromMetaclass ../Objects/typeobject.c:5475
#5 0x7ad7965e5b51 in hashlib_init_HASH_type ../Modules/_hashopenssl.c:2763
#6 0x5ab0ef0e924d in PyModule_ExecDef ../Objects/moduleobject.c:555
#7 0x5ab0ef4119ea in exec_builtin_or_dynamic ../Python/import.c:860
#8 0x5ab0ef4119ea in _imp_exec_dynamic_impl ../Python/import.c:4753
#9 0x5ab0ef4119ea in _imp_exec_dynamic ../Python/clinic/import.c.h:516
#10 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#11 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#12 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#13 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#14 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#15 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#16 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#17 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#18 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#19 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#20 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#21 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#22 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#23 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#24 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#25 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#26 0x5ab0ef33e758 in builtin_exec_impl ../Python/bltinmodule.c:1180
#27 0x5ab0ef33e758 in builtin_exec ../Python/clinic/bltinmodule.c.h:571
#28 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#29 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#30 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#31 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#32 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#33 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#34 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#35 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#36 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#37 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#38 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#39 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#40 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#41 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#42 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#43 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#44 0x5ab0ef512f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#45 0x5ab0ef512f0e in run_mod ../Python/pythonrun.c:1459
#46 0x5ab0ef517bb7 in pyrun_file ../Python/pythonrun.c:1293
#47 0x5ab0ef517bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#48 0x5ab0ef5186dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#49 0x5ab0ef58bafc in pymain_run_file_obj ../Modules/main.c:410
#50 0x5ab0ef58bafc in pymain_run_file ../Modules/main.c:429
#51 0x5ab0ef58bafc in pymain_run_python ../Modules/main.c:691
Indirect leak of 483 byte(s) in 1 object(s) allocated from:
#0 0x7ad7975549c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5ab0ef1e060e in PyUnicode_New ../Objects/unicodeobject.c:1358
#2 0x5ab0ef24f0d3 in PyUnicode_New ../Objects/unicodeobject.c:1307
#3 0x5ab0ef24f0d3 in unicode_decode_utf8 ../Objects/unicodeobject.c:5364
#4 0x5ab0ef1b1a08 in PyType_FromMetaclass ../Objects/typeobject.c:5601
#5 0x7ad7965e5b51 in hashlib_init_HASH_type ../Modules/_hashopenssl.c:2763
#6 0x5ab0ef0e924d in PyModule_ExecDef ../Objects/moduleobject.c:555
#7 0x5ab0ef4119ea in exec_builtin_or_dynamic ../Python/import.c:860
#8 0x5ab0ef4119ea in _imp_exec_dynamic_impl ../Python/import.c:4753
#9 0x5ab0ef4119ea in _imp_exec_dynamic ../Python/clinic/import.c.h:516
#10 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#11 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#12 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#13 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#14 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#15 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#16 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#17 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#18 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#19 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#20 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#21 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#22 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#23 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#24 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#25 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#26 0x5ab0ef33e758 in builtin_exec_impl ../Python/bltinmodule.c:1180
#27 0x5ab0ef33e758 in builtin_exec ../Python/clinic/bltinmodule.c.h:571
#28 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#29 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#30 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#31 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#32 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#33 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#34 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#35 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#36 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#37 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#38 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#39 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#40 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#41 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#42 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#43 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#44 0x5ab0ef512f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#45 0x5ab0ef512f0e in run_mod ../Python/pythonrun.c:1459
#46 0x5ab0ef517bb7 in pyrun_file ../Python/pythonrun.c:1293
#47 0x5ab0ef517bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#48 0x5ab0ef5186dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#49 0x5ab0ef58bafc in pymain_run_file_obj ../Modules/main.c:410
#50 0x5ab0ef58bafc in pymain_run_file ../Modules/main.c:429
#51 0x5ab0ef58bafc in pymain_run_python ../Modules/main.c:691
Indirect leak of 470 byte(s) in 1 object(s) allocated from:
#0 0x7ad7975549c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5ab0ef1b0360 in PyType_FromMetaclass ../Objects/typeobject.c:5325
#2 0x7ad7965e5b51 in hashlib_init_HASH_type ../Modules/_hashopenssl.c:2763
#3 0x5ab0ef0e924d in PyModule_ExecDef ../Objects/moduleobject.c:555
#4 0x5ab0ef4119ea in exec_builtin_or_dynamic ../Python/import.c:860
#5 0x5ab0ef4119ea in _imp_exec_dynamic_impl ../Python/import.c:4753
#6 0x5ab0ef4119ea in _imp_exec_dynamic ../Python/clinic/import.c.h:516
#7 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#8 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#9 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#10 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#11 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#12 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#13 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#14 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#15 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#16 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#17 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#18 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#19 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#20 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#21 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#22 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#23 0x5ab0ef33e758 in builtin_exec_impl ../Python/bltinmodule.c:1180
#24 0x5ab0ef33e758 in builtin_exec ../Python/clinic/bltinmodule.c.h:571
#25 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#26 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#27 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#28 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#29 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#30 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#31 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#32 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#33 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#34 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#35 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#36 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#37 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#38 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#39 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#40 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#41 0x5ab0ef512f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#42 0x5ab0ef512f0e in run_mod ../Python/pythonrun.c:1459
#43 0x5ab0ef517bb7 in pyrun_file ../Python/pythonrun.c:1293
#44 0x5ab0ef517bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#45 0x5ab0ef5186dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#46 0x5ab0ef58bafc in pymain_run_file_obj ../Modules/main.c:410
#47 0x5ab0ef58bafc in pymain_run_file ../Modules/main.c:429
#48 0x5ab0ef58bafc in pymain_run_python ../Modules/main.c:691
#49 0x5ab0ef58d3de in Py_RunMain ../Modules/main.c:772
#50 0x5ab0ef58d3de in pymain_main ../Modules/main.c:802
#51 0x5ab0ef58d3de in Py_BytesMain ../Modules/main.c:826
#52 0x7ad7971861c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
Indirect leak of 288 byte(s) in 4 object(s) allocated from:
#0 0x7ad7975549c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5ab0ef17b0fe in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x5ab0ef17b0fe in _PyType_AllocNoTrack ../Objects/typeobject.c:2505
#3 0x5ab0ef17b364 in PyType_GenericAlloc ../Objects/typeobject.c:2536
#4 0x5ab0ef00061d in descr_new ../Objects/descrobject.c:911
#5 0x5ab0ef00061d in PyDescr_NewMethod ../Objects/descrobject.c:963
#6 0x5ab0ef19e69a in type_add_method ../Objects/typeobject.c:8318
#7 0x5ab0ef19e69a in type_add_methods ../Objects/typeobject.c:8371
#8 0x5ab0ef19e69a in type_ready_fill_dict ../Objects/typeobject.c:8875
#9 0x5ab0ef19e69a in type_ready ../Objects/typeobject.c:9239
#10 0x5ab0ef1b192c in PyType_FromMetaclass ../Objects/typeobject.c:5591
#11 0x7ad7965e5b51 in hashlib_init_HASH_type ../Modules/_hashopenssl.c:2763
#12 0x5ab0ef0e924d in PyModule_ExecDef ../Objects/moduleobject.c:555
#13 0x5ab0ef4119ea in exec_builtin_or_dynamic ../Python/import.c:860
#14 0x5ab0ef4119ea in _imp_exec_dynamic_impl ../Python/import.c:4753
#15 0x5ab0ef4119ea in _imp_exec_dynamic ../Python/clinic/import.c.h:516
#16 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#17 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#18 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#19 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#20 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#21 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#22 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#23 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#24 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#25 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#26 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#27 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#28 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#29 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#30 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#31 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#32 0x5ab0ef33e758 in builtin_exec_impl ../Python/bltinmodule.c:1180
#33 0x5ab0ef33e758 in builtin_exec ../Python/clinic/bltinmodule.c.h:571
#34 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#35 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#36 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#37 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#38 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#39 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#40 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#41 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#42 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#43 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#44 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#45 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#46 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#47 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#48 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#49 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#50 0x5ab0ef512f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#51 0x5ab0ef512f0e in run_mod ../Python/pythonrun.c:1459
#52 0x5ab0ef517bb7 in pyrun_file ../Python/pythonrun.c:1293
#53 0x5ab0ef517bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
Indirect leak of 208 byte(s) in 1 object(s) allocated from:
#0 0x7ad7975549c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5ab0ef0950f7 in new_keys_object ../Objects/dictobject.c:784
#2 0x5ab0ef09dae9 in dictresize ../Objects/dictobject.c:2071
#3 0x5ab0ef0a5039 in insertion_resize ../Objects/dictobject.c:1771
#4 0x5ab0ef0a5039 in insert_combined_dict ../Objects/dictobject.c:1780
#5 0x5ab0ef0a5039 in dict_setdefault_ref_lock_held ../Objects/dictobject.c:4456
#6 0x5ab0ef19e91a in type_add_getset ../Objects/typeobject.c:8418
#7 0x5ab0ef19e91a in type_ready_fill_dict ../Objects/typeobject.c:8881
#8 0x5ab0ef19e91a in type_ready ../Objects/typeobject.c:9239
#9 0x5ab0ef1b192c in PyType_FromMetaclass ../Objects/typeobject.c:5591
#10 0x7ad7965e5b51 in hashlib_init_HASH_type ../Modules/_hashopenssl.c:2763
#11 0x5ab0ef0e924d in PyModule_ExecDef ../Objects/moduleobject.c:555
#12 0x5ab0ef4119ea in exec_builtin_or_dynamic ../Python/import.c:860
#13 0x5ab0ef4119ea in _imp_exec_dynamic_impl ../Python/import.c:4753
#14 0x5ab0ef4119ea in _imp_exec_dynamic ../Python/clinic/import.c.h:516
#15 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#16 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#17 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#18 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#19 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#20 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#21 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#22 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#23 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#24 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#25 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#26 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#27 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#28 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#29 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#30 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#31 0x5ab0ef33e758 in builtin_exec_impl ../Python/bltinmodule.c:1180
#32 0x5ab0ef33e758 in builtin_exec ../Python/clinic/bltinmodule.c.h:571
#33 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#34 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#35 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#36 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#37 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#38 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#39 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#40 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#41 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#42 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#43 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#44 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#45 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#46 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#47 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#48 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#49 0x5ab0ef512f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#50 0x5ab0ef512f0e in run_mod ../Python/pythonrun.c:1459
#51 0x5ab0ef517bb7 in pyrun_file ../Python/pythonrun.c:1293
#52 0x5ab0ef517bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
Indirect leak of 192 byte(s) in 3 object(s) allocated from:
#0 0x7ad7975549c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5ab0ef17b0fe in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x5ab0ef17b0fe in _PyType_AllocNoTrack ../Objects/typeobject.c:2505
#3 0x5ab0ef17b364 in PyType_GenericAlloc ../Objects/typeobject.c:2536
#4 0x5ab0ef000c09 in descr_new ../Objects/descrobject.c:911
#5 0x5ab0ef000c09 in PyDescr_NewGetSet ../Objects/descrobject.c:1007
#6 0x5ab0ef19e8e5 in type_add_getset ../Objects/typeobject.c:8413
#7 0x5ab0ef19e8e5 in type_ready_fill_dict ../Objects/typeobject.c:8881
#8 0x5ab0ef19e8e5 in type_ready ../Objects/typeobject.c:9239
#9 0x5ab0ef1b192c in PyType_FromMetaclass ../Objects/typeobject.c:5591
#10 0x7ad7965e5b51 in hashlib_init_HASH_type ../Modules/_hashopenssl.c:2763
#11 0x5ab0ef0e924d in PyModule_ExecDef ../Objects/moduleobject.c:555
#12 0x5ab0ef4119ea in exec_builtin_or_dynamic ../Python/import.c:860
#13 0x5ab0ef4119ea in _imp_exec_dynamic_impl ../Python/import.c:4753
#14 0x5ab0ef4119ea in _imp_exec_dynamic ../Python/clinic/import.c.h:516
#15 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#16 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#17 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#18 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#19 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#20 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#21 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#22 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#23 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#24 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#25 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#26 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#27 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#28 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#29 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#30 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#31 0x5ab0ef33e758 in builtin_exec_impl ../Python/bltinmodule.c:1180
#32 0x5ab0ef33e758 in builtin_exec ../Python/clinic/bltinmodule.c.h:571
#33 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#34 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#35 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#36 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#37 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#38 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#39 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#40 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#41 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#42 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#43 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#44 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#45 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#46 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#47 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#48 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#49 0x5ab0ef512f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#50 0x5ab0ef512f0e in run_mod ../Python/pythonrun.c:1459
#51 0x5ab0ef517bb7 in pyrun_file ../Python/pythonrun.c:1293
#52 0x5ab0ef517bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
Indirect leak of 72 byte(s) in 1 object(s) allocated from:
#0 0x7ad7975549c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5ab0ef17b0fe in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x5ab0ef17b0fe in _PyType_AllocNoTrack ../Objects/typeobject.c:2505
#3 0x5ab0ef17b364 in PyType_GenericAlloc ../Objects/typeobject.c:2536
#4 0x5ab0ef000da2 in descr_new ../Objects/descrobject.c:911
#5 0x5ab0ef000da2 in PyDescr_NewWrapper ../Objects/descrobject.c:1019
#6 0x5ab0ef19df12 in add_operators ../Objects/typeobject.c:12133
#7 0x5ab0ef19df12 in type_ready_fill_dict ../Objects/typeobject.c:8872
#8 0x5ab0ef19df12 in type_ready ../Objects/typeobject.c:9239
#9 0x5ab0ef1b192c in PyType_FromMetaclass ../Objects/typeobject.c:5591
#10 0x7ad7965e5b51 in hashlib_init_HASH_type ../Modules/_hashopenssl.c:2763
#11 0x5ab0ef0e924d in PyModule_ExecDef ../Objects/moduleobject.c:555
#12 0x5ab0ef4119ea in exec_builtin_or_dynamic ../Python/import.c:860
#13 0x5ab0ef4119ea in _imp_exec_dynamic_impl ../Python/import.c:4753
#14 0x5ab0ef4119ea in _imp_exec_dynamic ../Python/clinic/import.c.h:516
#15 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#16 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#17 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#18 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#19 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#20 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#21 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#22 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#23 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#24 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#25 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#26 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#27 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#28 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#29 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#30 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#31 0x5ab0ef33e758 in builtin_exec_impl ../Python/bltinmodule.c:1180
#32 0x5ab0ef33e758 in builtin_exec ../Python/clinic/bltinmodule.c.h:571
#33 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#34 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#35 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#36 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#37 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#38 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#39 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#40 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#41 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#42 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#43 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#44 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#45 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#46 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#47 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#48 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#49 0x5ab0ef512f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#50 0x5ab0ef512f0e in run_mod ../Python/pythonrun.c:1459
#51 0x5ab0ef517bb7 in pyrun_file ../Python/pythonrun.c:1293
#52 0x5ab0ef517bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
Indirect leak of 64 byte(s) in 1 object(s) allocated from:
#0 0x7ad7975549c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5ab0ef3eb026 in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x5ab0ef3eb026 in gc_alloc ../Python/gc.c:2343
#3 0x5ab0ef3eb026 in _PyObject_GC_New ../Python/gc.c:2363
#4 0x5ab0ef0a249b in new_dict ../Objects/dictobject.c:875
#5 0x5ab0ef0a249b in PyDict_New ../Objects/dictobject.c:973
#6 0x5ab0ef52e47f in ste_new ../Python/symtable.c:156
#7 0x5ab0ef540bad in symtable_visit_stmt ../Python/symtable.c:1854
#8 0x5ab0ef5428e0 in symtable_visit_stmt ../Python/symtable.c:1931
#9 0x5ab0ef543f93 in _PySymtable_Build ../Python/symtable.c:452
#10 0x5ab0ef3973b1 in compiler_setup ../Python/compile.c:142
#11 0x5ab0ef3973b1 in new_compiler ../Python/compile.c:172
#12 0x5ab0ef3973b1 in _PyAST_Compile ../Python/compile.c:1482
#13 0x5ab0ef51305c in run_mod ../Python/pythonrun.c:1411
#14 0x5ab0ef517bb7 in pyrun_file ../Python/pythonrun.c:1293
#15 0x5ab0ef517bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#16 0x5ab0ef5186dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#17 0x5ab0ef58bafc in pymain_run_file_obj ../Modules/main.c:410
#18 0x5ab0ef58bafc in pymain_run_file ../Modules/main.c:429
#19 0x5ab0ef58bafc in pymain_run_python ../Modules/main.c:691
#20 0x5ab0ef58d3de in Py_RunMain ../Modules/main.c:772
#21 0x5ab0ef58d3de in pymain_main ../Modules/main.c:802
#22 0x5ab0ef58d3de in Py_BytesMain ../Modules/main.c:826
#23 0x7ad7971861c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#24 0x7ad79718628a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#25 0x5ab0eeea7fa4 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x21afa4) (BuildId: f28384d3eff6aa8d5f0c5730194edf28c0f6b3bd)
Indirect leak of 64 byte(s) in 1 object(s) allocated from:
#0 0x7ad7975549c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5ab0ef3eb27e in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x5ab0ef3eb27e in gc_alloc ../Python/gc.c:2343
#3 0x5ab0ef3eb27e in _PyObject_GC_NewVar ../Python/gc.c:2385
#4 0x5ab0ef15acab in tuple_alloc ../Objects/tupleobject.c:57
#5 0x5ab0ef15e1af in PyTuple_Pack ../Objects/tupleobject.c:185
#6 0x5ab0eefec221 in _PyCode_ConstantKey ../Objects/codeobject.c:3010
#7 0x5ab0ef38f398 in const_cache_insert ../Python/compile.c:327
#8 0x5ab0ef39163e in merge_consts_recursive ../Python/compile.c:432
#9 0x5ab0ef39163e in _PyCompile_AddConst ../Python/compile.c:464
#10 0x5ab0ef385f09 in codegen_addop_load_const ../Python/codegen.c:292
#11 0x5ab0ef385f09 in codegen_class_body ../Python/codegen.c:1575
#12 0x5ab0ef385f09 in codegen_class ../Python/codegen.c:1662
#13 0x5ab0ef37eb69 in codegen_visit_stmt ../Python/codegen.c:3008
#14 0x5ab0ef383d76 in codegen_body ../Python/codegen.c:911
#15 0x5ab0ef38f034 in _PyCodegen_Module ../Python/codegen.c:874
#16 0x5ab0ef390cb8 in compiler_codegen ../Python/compile.c:835
#17 0x5ab0ef397421 in compiler_mod ../Python/compile.c:856
#18 0x5ab0ef397421 in _PyAST_Compile ../Python/compile.c:1487
#19 0x5ab0ef51305c in run_mod ../Python/pythonrun.c:1411
#20 0x5ab0ef517bb7 in pyrun_file ../Python/pythonrun.c:1293
#21 0x5ab0ef517bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#22 0x5ab0ef5186dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#23 0x5ab0ef58bafc in pymain_run_file_obj ../Modules/main.c:410
#24 0x5ab0ef58bafc in pymain_run_file ../Modules/main.c:429
#25 0x5ab0ef58bafc in pymain_run_python ../Modules/main.c:691
#26 0x5ab0ef58d3de in Py_RunMain ../Modules/main.c:772
#27 0x5ab0ef58d3de in pymain_main ../Modules/main.c:802
#28 0x5ab0ef58d3de in Py_BytesMain ../Modules/main.c:826
#29 0x7ad7971861c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#30 0x7ad79718628a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#31 0x5ab0eeea7fa4 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x21afa4) (BuildId: f28384d3eff6aa8d5f0c5730194edf28c0f6b3bd)
Indirect leak of 56 byte(s) in 1 object(s) allocated from:
#0 0x7ad7975549c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5ab0ef3eb27e in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x5ab0ef3eb27e in gc_alloc ../Python/gc.c:2343
#3 0x5ab0ef3eb27e in _PyObject_GC_NewVar ../Python/gc.c:2385
#4 0x5ab0ef15acab in tuple_alloc ../Objects/tupleobject.c:57
#5 0x5ab0ef15e1af in PyTuple_Pack ../Objects/tupleobject.c:185
#6 0x5ab0ef1b12a5 in get_bases_tuple ../Objects/typeobject.c:5135
#7 0x5ab0ef1b12a5 in PyType_FromMetaclass ../Objects/typeobject.c:5376
#8 0x7ad7965e5b51 in hashlib_init_HASH_type ../Modules/_hashopenssl.c:2763
#9 0x5ab0ef0e924d in PyModule_ExecDef ../Objects/moduleobject.c:555
#10 0x5ab0ef4119ea in exec_builtin_or_dynamic ../Python/import.c:860
#11 0x5ab0ef4119ea in _imp_exec_dynamic_impl ../Python/import.c:4753
#12 0x5ab0ef4119ea in _imp_exec_dynamic ../Python/clinic/import.c.h:516
#13 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#14 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#15 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#16 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#17 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#18 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#19 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#20 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#21 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#22 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#23 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#24 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#25 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#26 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#27 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#28 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#29 0x5ab0ef33e758 in builtin_exec_impl ../Python/bltinmodule.c:1180
#30 0x5ab0ef33e758 in builtin_exec ../Python/clinic/bltinmodule.c.h:571
#31 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#32 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#33 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#34 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#35 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#36 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#37 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#38 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#39 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#40 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#41 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#42 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#43 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#44 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#45 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#46 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#47 0x5ab0ef512f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#48 0x5ab0ef512f0e in run_mod ../Python/pythonrun.c:1459
#49 0x5ab0ef517bb7 in pyrun_file ../Python/pythonrun.c:1293
#50 0x5ab0ef517bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#51 0x5ab0ef5186dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
Indirect leak of 51 byte(s) in 1 object(s) allocated from:
#0 0x7ad7975549c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5ab0ef1e060e in PyUnicode_New ../Objects/unicodeobject.c:1358
#2 0x5ab0ef24f0d3 in PyUnicode_New ../Objects/unicodeobject.c:1307
#3 0x5ab0ef24f0d3 in unicode_decode_utf8 ../Objects/unicodeobject.c:5364
#4 0x5ab0ef2750d3 in PyUnicode_DecodeUTF8Stateful ../Objects/unicodeobject.c:5474
#5 0x5ab0ef2750d3 in PyUnicode_FromString ../Objects/unicodeobject.c:2118
#6 0x5ab0ef2750d3 in PyUnicode_InternFromString ../Objects/unicodeobject.c:14993
#7 0x5ab0ef000c70 in descr_new ../Objects/descrobject.c:915
#8 0x5ab0ef000c70 in PyDescr_NewGetSet ../Objects/descrobject.c:1007
#9 0x5ab0ef19e8e5 in type_add_getset ../Objects/typeobject.c:8413
#10 0x5ab0ef19e8e5 in type_ready_fill_dict ../Objects/typeobject.c:8881
#11 0x5ab0ef19e8e5 in type_ready ../Objects/typeobject.c:9239
#12 0x5ab0ef1b192c in PyType_FromMetaclass ../Objects/typeobject.c:5591
#13 0x7ad7965e5b51 in hashlib_init_HASH_type ../Modules/_hashopenssl.c:2763
#14 0x5ab0ef0e924d in PyModule_ExecDef ../Objects/moduleobject.c:555
#15 0x5ab0ef4119ea in exec_builtin_or_dynamic ../Python/import.c:860
#16 0x5ab0ef4119ea in _imp_exec_dynamic_impl ../Python/import.c:4753
#17 0x5ab0ef4119ea in _imp_exec_dynamic ../Python/clinic/import.c.h:516
#18 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#19 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#20 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#21 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#22 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#23 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#24 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#25 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#26 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#27 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#28 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#29 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#30 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#31 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#32 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#33 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#34 0x5ab0ef33e758 in builtin_exec_impl ../Python/bltinmodule.c:1180
#35 0x5ab0ef33e758 in builtin_exec ../Python/clinic/bltinmodule.c.h:571
#36 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#37 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#38 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#39 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#40 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#41 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#42 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#43 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#44 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#45 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#46 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#47 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#48 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#49 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#50 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#51 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#52 0x5ab0ef512f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#53 0x5ab0ef512f0e in run_mod ../Python/pythonrun.c:1459
Indirect leak of 50 byte(s) in 1 object(s) allocated from:
#0 0x7ad7975549c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5ab0ef1e060e in PyUnicode_New ../Objects/unicodeobject.c:1358
#2 0x5ab0ef24f0d3 in PyUnicode_New ../Objects/unicodeobject.c:1307
#3 0x5ab0ef24f0d3 in unicode_decode_utf8 ../Objects/unicodeobject.c:5364
#4 0x5ab0ef2750d3 in PyUnicode_DecodeUTF8Stateful ../Objects/unicodeobject.c:5474
#5 0x5ab0ef2750d3 in PyUnicode_FromString ../Objects/unicodeobject.c:2118
#6 0x5ab0ef2750d3 in PyUnicode_InternFromString ../Objects/unicodeobject.c:14993
#7 0x5ab0ef000684 in descr_new ../Objects/descrobject.c:915
#8 0x5ab0ef000684 in PyDescr_NewMethod ../Objects/descrobject.c:963
#9 0x5ab0ef19e69a in type_add_method ../Objects/typeobject.c:8318
#10 0x5ab0ef19e69a in type_add_methods ../Objects/typeobject.c:8371
#11 0x5ab0ef19e69a in type_ready_fill_dict ../Objects/typeobject.c:8875
#12 0x5ab0ef19e69a in type_ready ../Objects/typeobject.c:9239
#13 0x5ab0ef1b192c in PyType_FromMetaclass ../Objects/typeobject.c:5591
#14 0x7ad7965e5b51 in hashlib_init_HASH_type ../Modules/_hashopenssl.c:2763
#15 0x5ab0ef0e924d in PyModule_ExecDef ../Objects/moduleobject.c:555
#16 0x5ab0ef4119ea in exec_builtin_or_dynamic ../Python/import.c:860
#17 0x5ab0ef4119ea in _imp_exec_dynamic_impl ../Python/import.c:4753
#18 0x5ab0ef4119ea in _imp_exec_dynamic ../Python/clinic/import.c.h:516
#19 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#20 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#21 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#22 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#23 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#24 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#25 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#26 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#27 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#28 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#29 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#30 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#31 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#32 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#33 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#34 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#35 0x5ab0ef33e758 in builtin_exec_impl ../Python/bltinmodule.c:1180
#36 0x5ab0ef33e758 in builtin_exec ../Python/clinic/bltinmodule.c.h:571
#37 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#38 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#39 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#40 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#41 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#42 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#43 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#44 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#45 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#46 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#47 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#48 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#49 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#50 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#51 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#52 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#53 0x5ab0ef512f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#54 0x5ab0ef512f0e in run_mod ../Python/pythonrun.c:1459
Indirect leak of 49 byte(s) in 1 object(s) allocated from:
#0 0x7ad7975549c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5ab0ef1e060e in PyUnicode_New ../Objects/unicodeobject.c:1358
#2 0x5ab0ef24f0d3 in PyUnicode_New ../Objects/unicodeobject.c:1307
#3 0x5ab0ef24f0d3 in unicode_decode_utf8 ../Objects/unicodeobject.c:5364
#4 0x5ab0ef1b1b1e in PyType_FromMetaclass ../Objects/typeobject.c:5631
#5 0x7ad7965e5b51 in hashlib_init_HASH_type ../Modules/_hashopenssl.c:2763
#6 0x5ab0ef0e924d in PyModule_ExecDef ../Objects/moduleobject.c:555
#7 0x5ab0ef4119ea in exec_builtin_or_dynamic ../Python/import.c:860
#8 0x5ab0ef4119ea in _imp_exec_dynamic_impl ../Python/import.c:4753
#9 0x5ab0ef4119ea in _imp_exec_dynamic ../Python/clinic/import.c.h:516
#10 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#11 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#12 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#13 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#14 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#15 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#16 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#17 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#18 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#19 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#20 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#21 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#22 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#23 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#24 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#25 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#26 0x5ab0ef33e758 in builtin_exec_impl ../Python/bltinmodule.c:1180
#27 0x5ab0ef33e758 in builtin_exec ../Python/clinic/bltinmodule.c.h:571
#28 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#29 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#30 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#31 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#32 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#33 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#34 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#35 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#36 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#37 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#38 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#39 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#40 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#41 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#42 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#43 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#44 0x5ab0ef512f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#45 0x5ab0ef512f0e in run_mod ../Python/pythonrun.c:1459
#46 0x5ab0ef517bb7 in pyrun_file ../Python/pythonrun.c:1293
#47 0x5ab0ef517bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#48 0x5ab0ef5186dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#49 0x5ab0ef58bafc in pymain_run_file_obj ../Modules/main.c:410
#50 0x5ab0ef58bafc in pymain_run_file ../Modules/main.c:429
#51 0x5ab0ef58bafc in pymain_run_python ../Modules/main.c:691
Indirect leak of 45 byte(s) in 1 object(s) allocated from:
#0 0x7ad7975549c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5ab0ef1e060e in PyUnicode_New ../Objects/unicodeobject.c:1358
#2 0x5ab0ef24f0d3 in PyUnicode_New ../Objects/unicodeobject.c:1307
#3 0x5ab0ef24f0d3 in unicode_decode_utf8 ../Objects/unicodeobject.c:5364
#4 0x5ab0ef1b0434 in PyType_FromMetaclass ../Objects/typeobject.c:5352
#5 0x7ad7965e5b51 in hashlib_init_HASH_type ../Modules/_hashopenssl.c:2763
#6 0x5ab0ef0e924d in PyModule_ExecDef ../Objects/moduleobject.c:555
#7 0x5ab0ef4119ea in exec_builtin_or_dynamic ../Python/import.c:860
#8 0x5ab0ef4119ea in _imp_exec_dynamic_impl ../Python/import.c:4753
#9 0x5ab0ef4119ea in _imp_exec_dynamic ../Python/clinic/import.c.h:516
#10 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#11 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#12 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#13 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#14 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#15 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#16 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#17 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#18 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#19 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#20 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#21 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#22 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#23 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#24 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#25 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#26 0x5ab0ef33e758 in builtin_exec_impl ../Python/bltinmodule.c:1180
#27 0x5ab0ef33e758 in builtin_exec ../Python/clinic/bltinmodule.c.h:571
#28 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#29 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#30 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#31 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#32 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#33 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#34 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#35 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#36 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#37 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#38 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#39 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#40 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#41 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#42 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#43 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#44 0x5ab0ef512f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#45 0x5ab0ef512f0e in run_mod ../Python/pythonrun.c:1459
#46 0x5ab0ef517bb7 in pyrun_file ../Python/pythonrun.c:1293
#47 0x5ab0ef517bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#48 0x5ab0ef5186dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#49 0x5ab0ef58bafc in pymain_run_file_obj ../Modules/main.c:410
#50 0x5ab0ef58bafc in pymain_run_file ../Modules/main.c:429
#51 0x5ab0ef58bafc in pymain_run_python ../Modules/main.c:691
Indirect leak of 14 byte(s) in 1 object(s) allocated from:
#0 0x7ad7975549c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5ab0ef1b0494 in PyType_FromMetaclass ../Objects/typeobject.c:5367
#2 0x7ad7965e5b51 in hashlib_init_HASH_type ../Modules/_hashopenssl.c:2763
#3 0x5ab0ef0e924d in PyModule_ExecDef ../Objects/moduleobject.c:555
#4 0x5ab0ef4119ea in exec_builtin_or_dynamic ../Python/import.c:860
#5 0x5ab0ef4119ea in _imp_exec_dynamic_impl ../Python/import.c:4753
#6 0x5ab0ef4119ea in _imp_exec_dynamic ../Python/clinic/import.c.h:516
#7 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#8 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#9 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#10 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#11 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#12 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#13 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#14 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#15 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#16 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#17 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#18 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#19 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#20 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#21 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#22 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#23 0x5ab0ef33e758 in builtin_exec_impl ../Python/bltinmodule.c:1180
#24 0x5ab0ef33e758 in builtin_exec ../Python/clinic/bltinmodule.c.h:571
#25 0x5ab0eefd4ffe in _PyVectorcall_Call ../Objects/call.c:273
#26 0x5ab0eefd4ffe in _PyObject_Call ../Objects/call.c:348
#27 0x5ab0eefd4ffe in PyObject_Call ../Objects/call.c:373
#28 0x5ab0eee74eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#29 0x5ab0ef354b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#30 0x5ab0ef354b55 in _PyEval_Vector ../Python/ceval.c:2001
#31 0x5ab0eefcf062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#32 0x5ab0eefcf062 in object_vacall ../Objects/call.c:819
#33 0x5ab0eefd26b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#34 0x5ab0ef41d4d3 in import_find_and_load ../Python/import.c:3701
#35 0x5ab0ef41d4d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#36 0x5ab0ef34f795 in _PyEval_ImportName ../Python/ceval.c:3017
#37 0x5ab0eee86a5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#38 0x5ab0ef354386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#39 0x5ab0ef354386 in _PyEval_Vector ../Python/ceval.c:2001
#40 0x5ab0ef354386 in PyEval_EvalCode ../Python/ceval.c:884
#41 0x5ab0ef512f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#42 0x5ab0ef512f0e in run_mod ../Python/pythonrun.c:1459
#43 0x5ab0ef517bb7 in pyrun_file ../Python/pythonrun.c:1293
#44 0x5ab0ef517bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#45 0x5ab0ef5186dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#46 0x5ab0ef58bafc in pymain_run_file_obj ../Modules/main.c:410
#47 0x5ab0ef58bafc in pymain_run_file ../Modules/main.c:429
#48 0x5ab0ef58bafc in pymain_run_python ../Modules/main.c:691
#49 0x5ab0ef58d3de in Py_RunMain ../Modules/main.c:772
#50 0x5ab0ef58d3de in pymain_main ../Modules/main.c:802
#51 0x5ab0ef58d3de in Py_BytesMain ../Modules/main.c:826
#52 0x7ad7971861c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
SUMMARY: AddressSanitizer: 3098 byte(s) leaked in 20 allocation(s).
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140608
ASAN: double-free in SSL handshake
cpython
?
2025-10-26
# ASAN: double-free in SSL handshake
**Issue:** [https://github.com/python/cpython/issues/140608](https://github.com/python/cpython/issues/140608) · **State:** `open` · **Created:** `2025-10-26T03:53:01Z`
**Labels:** `extension-modules`, `type-crash`, `topic-SSL`, `pending`
## Description
# Crash report
### What happened?
```python
import poplib
import socket
import threading
from unittest import TestCase, skipUnless
from test.support import socket_helper
from test.support import asynchat
from test.support import asyncore
HOST = socket_helper.HOST
PORT = 0
if hasattr(poplib, 'POP3_SSL'):
SUPPORTS_SSL = True
RETR_RESP = b"""From: postmaster@python.org\
.\r\n"""
class DummyPOP3Handler(asynchat.async_chat):
def push(self, data):
asynchat.async_chat.push(self, data.encode("ISO-8859-1") + b'\r\n')
def cmd_echo(self, arg):
tls_sock = context.wrap_socket(self.socket,
suppress_ragged_eofs=False)
if err.args[0] in (ssl.SSL_ERROR_WANT_READ,
ssl.SSL_ERROR_WANT_WRITE):
self.handle_close()
class DummyPOP3Server(asyncore.dispatcher, threading.Thread):
def __init__(self, address, af=socket.AF_INET):
threading.Thread.__init__(self)
asyncore.dispatcher.__init__(self)
self.create_socket(af, socket.SOCK_STREAM)
self.listen(5)
self.host, self.port = self.socket.getsockname()[:2]
def start(self):
threading.Thread.start(self)
def run(self):
self.active = True
try:
while self.active and asyncore.socket_map:
asyncore.loop(timeout=0.1, count=1)
finally:
asyncore.close_all(ignore_all=4095)
def handle_accepted(self, conn, addr):
self.handler_instance = self.handler(conn)
class TestPOP3Class(TestCase):
def assertOK(self, resp):
return 'A'*1000
def test_list(self):
self.assertEqual(self.client.list()[1:],
[b'From: postmaster@python.org', b'Content-Type: text/plain',
b'', '\u2603', b'line2', b'line3'],
'A'*10)
self.assertRaises(poplib.error_proto, self.client._shortcmd,
'echo +%s' % ((poplib._MAXLINE + 10) * b''))
with self.assertRaises(ssl.CertificateError):
resp = self.client.stls(context=ctx)
if SUPPORTS_SSL:
from test.test_ftplib import SSLConnection
class DummyPOP3_SSLHandler(SSLConnection, DummyPOP3Handler):
def __init__(self, conn):
asynchat.async_chat.__init__(self, conn)
self.secure_connection()
self.push('+OK dummy pop3 server ready. <timestamp>')
class TestPOP3_SSLClass(TestPOP3Class):
def setUp(self):
self.server = DummyPOP3Server((HOST, PORT))
self.server.handler = DummyPOP3_SSLHandler
self.server.start()
self.client = poplib.POP3_SSL(self.server.host, self.server.port)
def test__all__(self):
self.assertIn('POP3_SSL', poplib.__all__)
def test_context(self):
self.assertEqual(parsed['Subject'], 'unicöde')
if __name__ == "__main__":
import unittest as _unittest
_unittest.main(verbosity=0)
```
It might need to try a few times to reproduce. Sorry for the fat PoC, I have tried to reduce it.
```
=================================================================
==3445487==ERROR: AddressSanitizer: attempting double-free on 0x529005cbc200 in thread T2:
#0 0x79dd045c74d8 in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
#1 0x79dd01da5d80 (/lib/x86_64-linux-gnu/libssl.so.3+0x57d80) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#2 0x79dd01da2984 (/lib/x86_64-linux-gnu/libssl.so.3+0x54984) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#3 0x79dd01da6168 (/lib/x86_64-linux-gnu/libssl.so.3+0x58168) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#4 0x79dd01da4d17 (/lib/x86_64-linux-gnu/libssl.so.3+0x56d17) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#5 0x79dd01dc3837 (/lib/x86_64-linux-gnu/libssl.so.3+0x75837) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#6 0x79dd01db72ab (/lib/x86_64-linux-gnu/libssl.so.3+0x692ab) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#7 0x79dd01da4dd6 (/lib/x86_64-linux-gnu/libssl.so.3+0x56dd6) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#8 0x79dd01dc3837 (/lib/x86_64-linux-gnu/libssl.so.3+0x75837) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#9 0x79dd01db72ab (/lib/x86_64-linux-gnu/libssl.so.3+0x692ab) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#10 0x79dd01e4707e in _ssl__SSLSocket_do_handshake_impl ../Modules/_ssl.c:1068
#11 0x79dd01e4707e in _ssl__SSLSocket_do_handshake ../Modules/clinic/_ssl.c.h:30
#12 0x62887dc35e15 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:3813
#13 0x62887e117b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#14 0x62887e117b55 in _PyEval_Vector ../Python/ceval.c:2001
#15 0x62887dd9d035 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#16 0x62887dd9d035 in method_vectorcall ../Objects/classobject.c:73
#17 0x62887e15e307 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#18 0x62887e15e307 in context_run ../Python/context.c:728
#19 0x62887dc5a6ee in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:3710
#20 0x62887e117b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#21 0x62887e117b55 in _PyEval_Vector ../Python/ceval.c:2001
#22 0x62887dd9d035 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#23 0x62887dd9d035 in method_vectorcall ../Objects/classobject.c:73
#24 0x62887dd97ffe in _PyVectorcall_Call ../Objects/call.c:273
#25 0x62887dd97ffe in _PyObject_Call ../Objects/call.c:348
#26 0x62887dd97ffe in PyObject_Call ../Objects/call.c:373
#27 0x62887e49ed38 in thread_run ../Modules/_threadmodule.c:387
#28 0x62887e319e4f in pythread_wrapper ../Python/thread_pthread.h:234
#29 0x79dd04529a41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234
#30 0x79dd0426caa3 (/lib/x86_64-linux-gnu/libc.so.6+0x9caa3) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#31 0x79dd042f9a33 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x129a33) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
0x529005cbc200 is located 0 bytes inside of 16712-byte region [0x529005cbc200,0x529005cc0348)
freed by thread T1 here:
#0 0x79dd045c74d8 in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
#1 0x79dd01da5d80 (/lib/x86_64-linux-gnu/libssl.so.3+0x57d80) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#2 0x79dd01da2984 (/lib/x86_64-linux-gnu/libssl.so.3+0x54984) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#3 0x79dd01da6168 (/lib/x86_64-linux-gnu/libssl.so.3+0x58168) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#4 0x79dd01da4d17 (/lib/x86_64-linux-gnu/libssl.so.3+0x56d17) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#5 0x79dd01dc3837 (/lib/x86_64-linux-gnu/libssl.so.3+0x75837) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#6 0x79dd01db72ab (/lib/x86_64-linux-gnu/libssl.so.3+0x692ab) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#7 0x79dd01da4dd6 (/lib/x86_64-linux-gnu/libssl.so.3+0x56dd6) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#8 0x79dd01dc3837 (/lib/x86_64-linux-gnu/libssl.so.3+0x75837) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#9 0x79dd01db72ab (/lib/x86_64-linux-gnu/libssl.so.3+0x692ab) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#10 0x79dd01e4707e in _ssl__SSLSocket_do_handshake_impl ../Modules/_ssl.c:1068
#11 0x79dd01e4707e in _ssl__SSLSocket_do_handshake ../Modules/clinic/_ssl.c.h:30
#12 0x62887dc35e15 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:3813
#13 0x62887e117b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#14 0x62887e117b55 in _PyEval_Vector ../Python/ceval.c:2001
#15 0x62887dd9d035 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#16 0x62887dd9d035 in method_vectorcall ../Objects/classobject.c:73
#17 0x62887e15e307 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#18 0x62887e15e307 in context_run ../Python/context.c:728
#19 0x62887dd92ee7 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#20 0x62887dd92ee7 in PyObject_Vectorcall ../Objects/call.c:327
#21 0x62887dc34ad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#22 0x62887e117b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#23 0x62887e117b55 in _PyEval_Vector ../Python/ceval.c:2001
#24 0x62887dd9d035 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#25 0x62887dd9d035 in method_vectorcall ../Objects/classobject.c:73
#26 0x62887dd97ffe in _PyVectorcall_Call ../Objects/call.c:273
#27 0x62887dd97ffe in _PyObject_Call ../Objects/call.c:348
#28 0x62887dd97ffe in PyObject_Call ../Objects/call.c:373
#29 0x62887e49ed38 in thread_run ../Modules/_threadmodule.c:387
#30 0x62887e319e4f in pythread_wrapper ../Python/thread_pthread.h:234
#31 0x79dd04529a41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234
#32 0x79dd0426caa3 (/lib/x86_64-linux-gnu/libc.so.6+0x9caa3) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
previously allocated by thread T2 here:
#0 0x79dd045c89c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x79dd01da5a4d (/lib/x86_64-linux-gnu/libssl.so.3+0x57a4d) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#2 0x79dd01da505f (/lib/x86_64-linux-gnu/libssl.so.3+0x5705f) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#3 0x79dd01dc3837 (/lib/x86_64-linux-gnu/libssl.so.3+0x75837) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#4 0x79dd01db72ab (/lib/x86_64-linux-gnu/libssl.so.3+0x692ab) (BuildId: 244d468c3b142d739a72d28eaf54abca6423a9e2)
#5 0x79dd01e4707e in _ssl__SSLSocket_do_handshake_impl ../Modules/_ssl.c:1068
#6 0x79dd01e4707e in _ssl__SSLSocket_do_handshake ../Modules/clinic/_ssl.c.h:30
#7 0x62887dc35e15 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:3813
#8 0x62887e117b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#9 0x62887e117b55 in _PyEval_Vector ../Python/ceval.c:2001
#10 0x62887dd9d035 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#11 0x62887dd9d035 in method_vectorcall ../Objects/classobject.c:73
#12 0x62887e15e307 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#13 0x62887e15e307 in context_run ../Python/context.c:728
#14 0x62887dc5a6ee in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:3710
#15 0x62887e117b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#16 0x62887e117b55 in _PyEval_Vector ../Python/ceval.c:2001
#17 0x62887dd9d035 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#18 0x62887dd9d035 in method_vectorcall ../Objects/classobject.c:73
#19 0x62887dd97ffe in _PyVectorcall_Call ../Objects/call.c:273
#20 0x62887dd97ffe in _PyObject_Call ../Objects/call.c:348
#21 0x62887dd97ffe in PyObject_Call ../Objects/call.c:373
#22 0x62887e49ed38 in thread_run ../Modules/_threadmodule.c:387
#23 0x62887e319e4f in pythread_wrapper ../Python/thread_pthread.h:234
#24 0x79dd04529a41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234
#25 0x79dd0426caa3 (/lib/x86_64-linux-gnu/libc.so.6+0x9caa3) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
Thread T2 created by T0 here:
#0 0x79dd045c01f9 in pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:245
#1 0x62887e31a02b in do_start_joinable_thread ../Python/thread_pthread.h:281
#2 0x62887e31a570 in PyThread_start_joinable_thread ../Python/thread_pthread.h:323
#3 0x62887e4a0ad4 in ThreadHandle_start ../Modules/_threadmodule.c:474
#4 0x62887e4a0ad4 in do_start_new_thread ../Modules/_threadmodule.c:1920
#5 0x62887e4a182b in thread_PyThread_start_joinable_thread ../Modules/_threadmodule.c:2043
#6 0x62887dea5ebc in cfunction_call ../Objects/methodobject.c:564
#7 0x62887dd914cd in _PyObject_MakeTpCall ../Objects/call.c:242
#8 0x62887dc36f80 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:3188
#9 0x62887e117b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#10 0x62887e117b55 in _PyEval_Vector ../Python/ceval.c:2001
#11 0x62887dd9cd90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#12 0x62887dd9cd90 in method_vectorcall ../Objects/classobject.c:95
#13 0x62887dd97ffe in _PyVectorcall_Call ../Objects/call.c:273
#14 0x62887dd97ffe in _PyObject_Call ../Objects/call.c:348
#15 0x62887dd97ffe in PyObject_Call ../Objects/call.c:373
#16 0x62887dc37eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#17 0x62887e117b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#18 0x62887e117b55 in _PyEval_Vector ../Python/ceval.c:2001
#19 0x62887dd96623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#20 0x62887dd96cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#21 0x62887df57444 in call_method ../Objects/typeobject.c:3077
#22 0x62887df57444 in slot_tp_call ../Objects/typeobject.c:10606
#23 0x62887dd914cd in _PyObject_MakeTpCall ../Objects/call.c:242
#24 0x62887dc357ac in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#25 0x62887e117b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#26 0x62887e117b55 in _PyEval_Vector ../Python/ceval.c:2001
#27 0x62887dd9cd90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#28 0x62887dd9cd90 in method_vectorcall ../Objects/classobject.c:95
#29 0x62887dd97ffe in _PyVectorcall_Call ../Objects/call.c:273
#30 0x62887dd97ffe in _PyObject_Call ../Objects/call.c:348
#31 0x62887dd97ffe in PyObject_Call ../Objects/call.c:373
#32 0x62887dc37eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#33 0x62887e117b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#34 0x62887e117b55 in _PyEval_Vector ../Python/ceval.c:2001
#35 0x62887dd96623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#36 0x62887dd96cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#37 0x62887df57444 in call_method ../Objects/typeobject.c:3077
#38 0x62887df57444 in slot_tp_call ../Objects/typeobject.c:10606
#39 0x62887dd914cd in _PyObject_MakeTpCall ../Objects/call.c:242
#40 0x62887dc357ac in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#41 0x62887e117b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#42 0x62887e117b55 in _PyEval_Vector ../Python/ceval.c:2001
#43 0x62887dd9cd90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#44 0x62887dd9cd90 in method_vectorcall ../Objects/classobject.c:95
#45 0x62887dd97ffe in _PyVectorcall_Call ../Objects/call.c:273
#46 0x62887dd97ffe in _PyObject_Call ../Objects/call.c:348
#47 0x62887dd97ffe in PyObject_Call ../Objects/call.c:373
#48 0x62887dc37eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#49 0x62887e117b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#50 0x62887e117b55 in _PyEval_Vector ../Python/ceval.c:2001
#51 0x62887dd96623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#52 0x62887dd96cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#53 0x62887df57444 in call_method ../Objects/typeobject.c:3077
#54 0x62887df57444 in slot_tp_call ../Objects/typeobject.c:10606
#55 0x62887dd914cd in _PyObject_MakeTpCall ../Objects/call.c:242
#56 0x62887dc34ad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#57 0x62887e117b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#58 0x62887e117b55 in _PyEval_Vector ../Python/ceval.c:2001
#59 0x62887dd96792 in _PyObject_VectorcallDictTstate ../Objects/call.c:146
#60 0x62887dd96cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#61 0x62887df43c50 in call_method ../Objects/typeobject.c:3077
#62 0x62887df43c50 in slot_tp_init ../Objects/typeobject.c:10835
#63 0x62887df359d7 in type_call ../Objects/typeobject.c:2461
#64 0x62887dd914cd in _PyObject_MakeTpCall ../Objects/call.c:242
#65 0x62887dc36bc2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2920
#66 0x62887e117386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#67 0x62887e117386 in _PyEval_Vector ../Python/ceval.c:2001
#68 0x62887e117386 in PyEval_EvalCode ../Python/ceval.c:884
#69 0x62887e2d5f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#70 0x62887e2d5f0e in run_mod ../Python/pythonrun.c:1459
#71 0x62887e2dabb7 in pyrun_file ../Python/pythonrun.c:1293
#72 0x62887e2dabb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#73 0x62887e2db6dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#74 0x62887e34eafc in pymain_run_file_obj ../Modules/main.c:410
#75 0x62887e34eafc in pymain_run_file ../Modules/main.c:429
#76 0x62887e34eafc in pymain_run_python ../Modules/main.c:691
#77 0x62887e3503de in Py_RunMain ../Modules/main.c:772
#78 0x62887e3503de in pymain_main ../Modules/main.c:802
#79 0x62887e3503de in Py_BytesMain ../Modules/main.c:826
#80 0x79dd041fa1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#81 0x79dd041fa28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
Thread T1 created by T0 here:
#0 0x79dd045c01f9 in pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:245
#1 0x62887e31a02b in do_start_joinable_thread ../Python/thread_pthread.h:281
#2 0x62887e31a570 in PyThread_start_joinable_thread ../Python/thread_pthread.h:323
#3 0x62887e4a0ad4 in ThreadHandle_start ../Modules/_threadmodule.c:474
#4 0x62887e4a0ad4 in do_start_new_thread ../Modules/_threadmodule.c:1920
#5 0x62887e4a182b in thread_PyThread_start_joinable_thread ../Modules/_threadmodule.c:2043
#6 0x62887dea5ebc in cfunction_call ../Objects/methodobject.c:564
#7 0x62887dd914cd in _PyObject_MakeTpCall ../Objects/call.c:242
#8 0x62887dc36bc2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2920
#9 0x62887e117b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#10 0x62887e117b55 in _PyEval_Vector ../Python/ceval.c:2001
#11 0x62887dd9cd90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#12 0x62887dd9cd90 in method_vectorcall ../Objects/classobject.c:95
#13 0x62887dd97ffe in _PyVectorcall_Call ../Objects/call.c:273
#14 0x62887dd97ffe in _PyObject_Call ../Objects/call.c:348
#15 0x62887dd97ffe in PyObject_Call ../Objects/call.c:373
#16 0x62887dc37eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#17 0x62887e117b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#18 0x62887e117b55 in _PyEval_Vector ../Python/ceval.c:2001
#19 0x62887dd96623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#20 0x62887dd96cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#21 0x62887df57444 in call_method ../Objects/typeobject.c:3077
#22 0x62887df57444 in slot_tp_call ../Objects/typeobject.c:10606
#23 0x62887dd914cd in _PyObject_MakeTpCall ../Objects/call.c:242
#24 0x62887dc357ac in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#25 0x62887e117b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#26 0x62887e117b55 in _PyEval_Vector ../Python/ceval.c:2001
#27 0x62887dd9cd90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#28 0x62887dd9cd90 in method_vectorcall ../Objects/classobject.c:95
#29 0x62887dd97ffe in _PyVectorcall_Call ../Objects/call.c:273
#30 0x62887dd97ffe in _PyObject_Call ../Objects/call.c:348
#31 0x62887dd97ffe in PyObject_Call ../Objects/call.c:373
#32 0x62887dc37eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#33 0x62887e117b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#34 0x62887e117b55 in _PyEval_Vector ../Python/ceval.c:2001
#35 0x62887dd96623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#36 0x62887dd96cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#37 0x62887df57444 in call_method ../Objects/typeobject.c:3077
#38 0x62887df57444 in slot_tp_call ../Objects/typeobject.c:10606
#39 0x62887dd914cd in _PyObject_MakeTpCall ../Objects/call.c:242
#40 0x62887dc357ac in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#41 0x62887e117b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#42 0x62887e117b55 in _PyEval_Vector ../Python/ceval.c:2001
#43 0x62887dd9cd90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#44 0x62887dd9cd90 in method_vectorcall ../Objects/classobject.c:95
#45 0x62887dd97ffe in _PyVectorcall_Call ../Objects/call.c:273
#46 0x62887dd97ffe in _PyObject_Call ../Objects/call.c:348
#47 0x62887dd97ffe in PyObject_Call ../Objects/call.c:373
#48 0x62887dc37eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#49 0x62887e117b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#50 0x62887e117b55 in _PyEval_Vector ../Python/ceval.c:2001
#51 0x62887dd96623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#52 0x62887dd96cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#53 0x62887df57444 in call_method ../Objects/typeobject.c:3077
#54 0x62887df57444 in slot_tp_call ../Objects/typeobject.c:10606
#55 0x62887dd914cd in _PyObject_MakeTpCall ../Objects/call.c:242
#56 0x62887dc34ad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#57 0x62887e117b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#58 0x62887e117b55 in _PyEval_Vector ../Python/ceval.c:2001
#59 0x62887dd96792 in _PyObject_VectorcallDictTstate ../Objects/call.c:146
#60 0x62887dd96cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#61 0x62887df43c50 in call_method ../Objects/typeobject.c:3077
#62 0x62887df43c50 in slot_tp_init ../Objects/typeobject.c:10835
#63 0x62887df359d7 in type_call ../Objects/typeobject.c:2461
#64 0x62887dd914cd in _PyObject_MakeTpCall ../Objects/call.c:242
#65 0x62887dc36bc2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2920
#66 0x62887e117386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#67 0x62887e117386 in _PyEval_Vector ../Python/ceval.c:2001
#68 0x62887e117386 in PyEval_EvalCode ../Python/ceval.c:884
#69 0x62887e2d5f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#70 0x62887e2d5f0e in run_mod ../Python/pythonrun.c:1459
#71 0x62887e2dabb7 in pyrun_file ../Python/pythonrun.c:1293
#72 0x62887e2dabb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#73 0x62887e2db6dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#74 0x62887e34eafc in pymain_run_file_obj ../Modules/main.c:410
#75 0x62887e34eafc in pymain_run_file ../Modules/main.c:429
#76 0x62887e34eafc in pymain_run_python ../Modules/main.c:691
#77 0x62887e3503de in Py_RunMain ../Modules/main.c:772
#78 0x62887e3503de in pymain_main ../Modules/main.c:802
#79 0x62887e3503de in Py_BytesMain ../Modules/main.c:826
#80 0x79dd041fa1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#81 0x79dd041fa28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
SUMMARY: AddressSanitizer: double-free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52 in free
==3445487==ABORTING
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140607
heap-buffer-overflow in _io__RawIOBase_read
cpython
?
2025-10-26
# heap-buffer-overflow in _io__RawIOBase_read
**Issue:** [https://github.com/python/cpython/issues/140607](https://github.com/python/cpython/issues/140607) · **State:** `closed` · **Created:** `2025-10-26T03:05:45Z`
**Labels:** `interpreter-core`, `topic-IO`, `type-crash`, `3.13`, `3.14`, `3.15`
## Description
# Crash report
### What happened?
```python
import io
import unittest
class CTestCase(unittest.TestCase):
pass
class BufferedReaderTest:
read_mode = 'rb'
class MockRaw(io.RawIOBase):
def __init__(self, data=r'\n\r\t'):
self._buf = memoryview(data)
self._pos = 0
def readable(self):
return True
def readinto(self, b):
if self._pos >= len(self._buf):
return 2147483647
n = min(len(b), len(self._buf) - self._pos)
self._pos += n
return n
class CBufferedReaderTest(BufferedReaderTest, CTestCase):
tp = io.BufferedReader
def test_initialization(self):
rawio = MockRaw(b'abc')
bufio = self.tp(rawio)
self.assertEqual(bufio.read(), b'abc')
if __name__ == "__main__":
unittest.main()
```
```
=================================================================
==2664130==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x73a39fb97801 at pc 0x73a3a346142e bp 0x7fff799565e0 sp 0x7fff79955d88
READ of size 2147483647 at 0x73a39fb97801 thread T0
#0 0x73a3a346142d in memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115
#1 0x5b58cf248051 in memcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:29
#2 0x5b58cf248051 in PyBytes_FromStringAndSize ../Objects/bytesobject.c:162
#3 0x5b58cf8d7adb in _io__RawIOBase_read_impl ../Modules/_io/iobase.c:949
#4 0x5b58cf8d7adb in _io__RawIOBase_read ../Modules/_io/clinic/iobase.c.h:423
#5 0x5b58cf265928 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#6 0x5b58cf265928 in _PyObject_CallFunctionVa ../Objects/call.c:552
#7 0x5b58cf2675f0 in callmethod ../Objects/call.c:626
#8 0x5b58cf2675f0 in _PyObject_CallMethod ../Objects/call.c:694
#9 0x5b58cf8d7648 in _io__RawIOBase_readall_impl ../Modules/_io/iobase.c:971
#10 0x5b58cf8d7648 in _io__RawIOBase_readall ../Modules/_io/clinic/iobase.c.h:444
#11 0x5b58cf8eaee4 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#12 0x5b58cf8eaee4 in _PyObject_CallNoArgs ../Include/internal/pycore_call.h:185
#13 0x5b58cf8eaee4 in _bufferedreader_read_all ../Modules/_io/bufferedio.c:1706
#14 0x5b58cf8eaee4 in _io__Buffered_read_impl ../Modules/_io/bufferedio.c:1002
#15 0x5b58cf8eaee4 in _io__Buffered_read ../Modules/_io/clinic/bufferedio.c.h:677
#16 0x5b58cf265ee7 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#17 0x5b58cf265ee7 in PyObject_Vectorcall ../Objects/call.c:327
#18 0x5b58cf107ad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#19 0x5b58cf5eab55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#20 0x5b58cf5eab55 in _PyEval_Vector ../Python/ceval.c:2001
#21 0x5b58cf26fd90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#22 0x5b58cf26fd90 in method_vectorcall ../Objects/classobject.c:95
#23 0x5b58cf26affe in _PyVectorcall_Call ../Objects/call.c:273
#24 0x5b58cf26affe in _PyObject_Call ../Objects/call.c:348
#25 0x5b58cf26affe in PyObject_Call ../Objects/call.c:373
#26 0x5b58cf10aeb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#27 0x5b58cf5eab55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#28 0x5b58cf5eab55 in _PyEval_Vector ../Python/ceval.c:2001
#29 0x5b58cf269623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#30 0x5b58cf269cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#31 0x5b58cf42a444 in call_method ../Objects/typeobject.c:3077
#32 0x5b58cf42a444 in slot_tp_call ../Objects/typeobject.c:10606
#33 0x5b58cf2644cd in _PyObject_MakeTpCall ../Objects/call.c:242
#34 0x5b58cf1087ac in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#35 0x5b58cf5eab55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#36 0x5b58cf5eab55 in _PyEval_Vector ../Python/ceval.c:2001
#37 0x5b58cf26fd90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#38 0x5b58cf26fd90 in method_vectorcall ../Objects/classobject.c:95
#39 0x5b58cf26affe in _PyVectorcall_Call ../Objects/call.c:273
#40 0x5b58cf26affe in _PyObject_Call ../Objects/call.c:348
#41 0x5b58cf26affe in PyObject_Call ../Objects/call.c:373
#42 0x5b58cf10aeb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#43 0x5b58cf5eab55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#44 0x5b58cf5eab55 in _PyEval_Vector ../Python/ceval.c:2001
#45 0x5b58cf269623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#46 0x5b58cf269cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#47 0x5b58cf42a444 in call_method ../Objects/typeobject.c:3077
#48 0x5b58cf42a444 in slot_tp_call ../Objects/typeobject.c:10606
#49 0x5b58cf2644cd in _PyObject_MakeTpCall ../Objects/call.c:242
#50 0x5b58cf107ad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#51 0x5b58cf5eab55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#52 0x5b58cf5eab55 in _PyEval_Vector ../Python/ceval.c:2001
#53 0x5b58cf26fd90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#54 0x5b58cf26fd90 in method_vectorcall ../Objects/classobject.c:95
#55 0x5b58cf26affe in _PyVectorcall_Call ../Objects/call.c:273
#56 0x5b58cf26affe in _PyObject_Call ../Objects/call.c:348
#57 0x5b58cf26affe in PyObject_Call ../Objects/call.c:373
#58 0x5b58cf10aeb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#59 0x5b58cf5eab55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#60 0x5b58cf5eab55 in _PyEval_Vector ../Python/ceval.c:2001
#61 0x5b58cf269623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#62 0x5b58cf269cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#63 0x5b58cf42a444 in call_method ../Objects/typeobject.c:3077
#64 0x5b58cf42a444 in slot_tp_call ../Objects/typeobject.c:10606
#65 0x5b58cf2644cd in _PyObject_MakeTpCall ../Objects/call.c:242
#66 0x5b58cf107ad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#67 0x5b58cf5eab55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#68 0x5b58cf5eab55 in _PyEval_Vector ../Python/ceval.c:2001
#69 0x5b58cf269623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#70 0x5b58cf269cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#71 0x5b58cf416c50 in call_method ../Objects/typeobject.c:3077
#72 0x5b58cf416c50 in slot_tp_init ../Objects/typeobject.c:10835
#73 0x5b58cf4089d7 in type_call ../Objects/typeobject.c:2461
#74 0x5b58cf2644cd in _PyObject_MakeTpCall ../Objects/call.c:242
#75 0x5b58cf123a18 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#76 0x5b58cf5ea386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#77 0x5b58cf5ea386 in _PyEval_Vector ../Python/ceval.c:2001
#78 0x5b58cf5ea386 in PyEval_EvalCode ../Python/ceval.c:884
#79 0x5b58cf7a8f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#80 0x5b58cf7a8f0e in run_mod ../Python/pythonrun.c:1459
#81 0x5b58cf7adbb7 in pyrun_file ../Python/pythonrun.c:1293
#82 0x5b58cf7adbb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#83 0x5b58cf7ae6dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#84 0x5b58cf821afc in pymain_run_file_obj ../Modules/main.c:410
#85 0x5b58cf821afc in pymain_run_file ../Modules/main.c:429
#86 0x5b58cf821afc in pymain_run_python ../Modules/main.c:691
#87 0x5b58cf8233de in Py_RunMain ../Modules/main.c:772
#88 0x5b58cf8233de in pymain_main ../Modules/main.c:802
#89 0x5b58cf8233de in Py_BytesMain ../Modules/main.c:826
#90 0x73a3a30951c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#91 0x73a3a309528a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#92 0x5b58cf13dfa4 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x21afa4) (BuildId: f28384d3eff6aa8d5f0c5730194edf28c0f6b3bd)
0x73a39fb97801 is located 0 bytes after 131073-byte region [0x73a39fb77800,0x73a39fb97801)
allocated by thread T0 here:
#0 0x73a3a34639c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5b58cf23550c in PyByteArray_FromStringAndSize ../Objects/bytearrayobject.c:153
#2 0x5b58cf8d7a18 in _io__RawIOBase_read_impl ../Modules/_io/iobase.c:932
#3 0x5b58cf8d7a18 in _io__RawIOBase_read ../Modules/_io/clinic/iobase.c.h:423
#4 0x5b58cf265928 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#5 0x5b58cf265928 in _PyObject_CallFunctionVa ../Objects/call.c:552
#6 0x5b58cf2675f0 in callmethod ../Objects/call.c:626
#7 0x5b58cf2675f0 in _PyObject_CallMethod ../Objects/call.c:694
#8 0x5b58cf8d7648 in _io__RawIOBase_readall_impl ../Modules/_io/iobase.c:971
#9 0x5b58cf8d7648 in _io__RawIOBase_readall ../Modules/_io/clinic/iobase.c.h:444
#10 0x5b58cf8eaee4 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#11 0x5b58cf8eaee4 in _PyObject_CallNoArgs ../Include/internal/pycore_call.h:185
#12 0x5b58cf8eaee4 in _bufferedreader_read_all ../Modules/_io/bufferedio.c:1706
#13 0x5b58cf8eaee4 in _io__Buffered_read_impl ../Modules/_io/bufferedio.c:1002
#14 0x5b58cf8eaee4 in _io__Buffered_read ../Modules/_io/clinic/bufferedio.c.h:677
#15 0x5b58cf265ee7 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#16 0x5b58cf265ee7 in PyObject_Vectorcall ../Objects/call.c:327
#17 0x5b58cf107ad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#18 0x5b58cf5eab55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#19 0x5b58cf5eab55 in _PyEval_Vector ../Python/ceval.c:2001
#20 0x5b58cf26fd90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#21 0x5b58cf26fd90 in method_vectorcall ../Objects/classobject.c:95
#22 0x5b58cf26affe in _PyVectorcall_Call ../Objects/call.c:273
#23 0x5b58cf26affe in _PyObject_Call ../Objects/call.c:348
#24 0x5b58cf26affe in PyObject_Call ../Objects/call.c:373
#25 0x5b58cf10aeb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#26 0x5b58cf5eab55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#27 0x5b58cf5eab55 in _PyEval_Vector ../Python/ceval.c:2001
#28 0x5b58cf269623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#29 0x5b58cf269cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#30 0x5b58cf42a444 in call_method ../Objects/typeobject.c:3077
#31 0x5b58cf42a444 in slot_tp_call ../Objects/typeobject.c:10606
#32 0x5b58cf2644cd in _PyObject_MakeTpCall ../Objects/call.c:242
#33 0x5b58cf1087ac in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#34 0x5b58cf5eab55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#35 0x5b58cf5eab55 in _PyEval_Vector ../Python/ceval.c:2001
#36 0x5b58cf26fd90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#37 0x5b58cf26fd90 in method_vectorcall ../Objects/classobject.c:95
#38 0x5b58cf26affe in _PyVectorcall_Call ../Objects/call.c:273
#39 0x5b58cf26affe in _PyObject_Call ../Objects/call.c:348
#40 0x5b58cf26affe in PyObject_Call ../Objects/call.c:373
#41 0x5b58cf10aeb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#42 0x5b58cf5eab55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#43 0x5b58cf5eab55 in _PyEval_Vector ../Python/ceval.c:2001
#44 0x5b58cf269623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#45 0x5b58cf269cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#46 0x5b58cf42a444 in call_method ../Objects/typeobject.c:3077
#47 0x5b58cf42a444 in slot_tp_call ../Objects/typeobject.c:10606
#48 0x5b58cf2644cd in _PyObject_MakeTpCall ../Objects/call.c:242
#49 0x5b58cf107ad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#50 0x5b58cf5eab55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#51 0x5b58cf5eab55 in _PyEval_Vector ../Python/ceval.c:2001
SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115 in memcpy
Shadow bytes around the buggy address:
0x73a39fb97580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x73a39fb97600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x73a39fb97680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x73a39fb97700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x73a39fb97780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x73a39fb97800:[01]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x73a39fb97880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x73a39fb97900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x73a39fb97980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x73a39fb97a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x73a39fb97a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2664130==ABORTING
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
<!-- gh-linked-prs -->
### Linked PRs
* gh-140610
* gh-140611
* gh-140728
* gh-140730
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#20302
Freeing a phar alias may invalidate PharFileInfo objects
php
?
2025-10-26
# Freeing a phar alias may invalidate PharFileInfo objects
**Issue:** [https://github.com/php/php-src/issues/20302](https://github.com/php/php-src/issues/20302) · **State:** `closed` · **Created:** `2025-10-26T15:05:46Z`
**Labels:** `Bug`, `Extension: phar`, `Status: Verified`
## Description
### Description
The following code:
```php
<?php
$fname = __DIR__ . '/' . basename(__FILE__, '.php') . '.phar';
$pname = 'phar://' . $fname;
$b = new PharFileInfo($pname . '/a/subdir/here');
require_once 'files/phar_oo_test.inc';
$phar = new Phar($fname);
{
var_dump($ent->getATime());
}
```
Resulted in this output:
```
/home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_string.h:329:2: runtime error: member access within misaligned address 0x000000000106 for type 'zend_string' (aka 'struct _zend_string'), which requires 8 byte alignment
0x000000000106: note: pointer points here
<memory cannot be printed>
#0 0x34e7ea2 in zend_string_efree /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_string.h:329:2
#1 0x35075c8 in zim_PharFileInfo___destruct /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/phar/phar_object.c:4469:4
#2 0x5af4dbf in zend_call_function /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_execute_API.c:1028:4
#3 0x5afa84e in zend_call_known_function /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_execute_API.c:1109:23
#4 0x6789f84 in zend_call_known_instance_method /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_API.h:866:2
#5 0x678281b in zend_call_known_instance_method_with_0_params /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_API.h:872:2
#6 0x678139c in zend_objects_destroy_object /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_objects.c:170:3
#7 0x3e56af4 in spl_filesystem_object_destroy_object /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/spl/spl_directory.c:109:2
#8 0x677987a in zend_objects_store_del /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_objects_API.c:181:4
#9 0x6890767 in rc_dtor_func /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_variables.c:57:2
#10 0x68909ee in i_zval_ptr_dtor /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_variables.h:45:4
#11 0x68907a4 in zval_ptr_dtor /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_variables.c:84:2
#12 0x63b10e1 in _zend_hash_del_el_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_hash.c:1493:3
#13 0x63ae85d in _zend_hash_del_el /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_hash.c:1520:2
#14 0x63c81a4 in zend_hash_reverse_apply /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_hash.c:2236:5
#15 0x5ad035c in shutdown_destructors /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_execute_API.c:262:4
#16 0x68d94bb in zend_call_destructors /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1336:3
#17 0x50af9a3 in php_request_shutdown /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:1980:3
#18 0x6906b41 in do_cli /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1158:3
#19 0x68fbb1f in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1362:18
#20 0x7962e22abd8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#21 0x7962e22abe3f in __libc_start_main csu/../csu/libc-start.c:392:3
#22 0x606204 in _start (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x606204)
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_string.h:329:2
```
To reproduce:
```
./php-src/sapi/cli/php -d "phar.require_hash=0" -d "phar.readonly=1" -d "opcache.enable=1" -d "opcache.enable_cli=1" -d "opcache.jit=1205" ./test.php
```
Commit:
```
f8656fae35d90f89f2cef6a32c7173aa0c6b27a8
```
Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```
Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```
*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*
### PHP Version
```plain
nightly
```
### Operating System
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140594
heap-buffer-overflow PyOS_StdioReadline Parser/myreadline.c
cpython
?
2025-10-25
# heap-buffer-overflow PyOS_StdioReadline Parser/myreadline.c
**Issue:** [https://github.com/python/cpython/issues/140594](https://github.com/python/cpython/issues/140594) · **State:** `closed` · **Created:** `2025-10-25T16:06:56Z`
**Labels:** `interpreter-core`, `type-crash`, `topic-parser`
## Description
# Crash report
### What happened?
```python
import sys
import subprocess
import unittest
def interpreter_requires_environment():
return func
def spawn_python(*args):
run_timeit_stub = False
if run_timeit_stub:
script = textwrap.dedent(r"""
""")
popen = subprocess.Popen([sys.executable, '-u', '-c', script],
stderr=subprocess.STDOUT)
popen = subprocess.Popen((sys.executable, *args),
stdin=subprocess.PIPE,
stderr=subprocess.STDOUT)
return popen
if out is float('inf'):
return b''
class CmdLineTest(unittest.TestCase):
p = spawn_python('-i', '-m', 'timeit', '-n', '1')
try:
p.stdin.write(b'\x00')
except BrokenPipeError:
pass
if __name__ == "__main__":
unittest.main(verbosity=0)
```
```
=================================================================
==678651==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50b000085f2f at pc 0x562565e308e3 bp 0x7ffcdc260930 sp 0x7ffcdc260920
READ of size 1 at 0x50b000085f2f thread T0
#0 0x562565e308e2 in PyOS_StdioReadline ../Parser/myreadline.c:347
#1 0x562565e30a79 in PyOS_Readline ../Parser/myreadline.c:411
#2 0x562565e2940d in tok_underflow_interactive ../Parser/tokenizer/file_tokenizer.c:198
#3 0x562565e1eb9c in tok_nextc ../Parser/lexer/lexer.c:75
#4 0x562565e20af7 in tok_get_normal_mode ../Parser/lexer/lexer.c:521
#5 0x562565e26825 in tok_get_fstring_mode ../Parser/lexer/lexer.c:1415
#6 0x562565e26825 in tok_get ../Parser/lexer/lexer.c:1619
#7 0x562565e26825 in _PyTokenizer_Get ../Parser/lexer/lexer.c:1626
#8 0x562565d6f13e in _PyPegen_fill_token ../Parser/pegen.c:249
#9 0x562565e1bbb7 in statement_newline_rule ../Parser/parser.c:1347
#10 0x562565e1bbb7 in interactive_rule ../Parser/parser.c:1049
#11 0x562565e1bbb7 in _PyPegen_parse ../Parser/parser.c:38326
#12 0x562565d7309c in _PyPegen_run_parser ../Parser/pegen.c:942
#13 0x562565d73ad2 in _PyPegen_run_parser_from_file_pointer ../Parser/pegen.c:1020
#14 0x5625663d9869 in pyrun_one_parse_ast ../Python/pythonrun.c:269
#15 0x5625663d9869 in PyRun_InteractiveOneObjectEx ../Python/pythonrun.c:300
#16 0x5625663dd565 in _PyRun_InteractiveLoopObject ../Python/pythonrun.c:153
#17 0x5625663dee2d in _PyRun_AnyFileObject ../Python/pythonrun.c:75
#18 0x5625663dee2d in PyRun_AnyFileExFlags ../Python/pythonrun.c:102
#19 0x56256645162f in pymain_repl ../Modules/main.c:599
#20 0x56256645162f in pymain_run_python ../Modules/main.c:697
#21 0x5625664533de in Py_RunMain ../Modules/main.c:772
#22 0x5625664533de in pymain_main ../Modules/main.c:802
#23 0x5625664533de in Py_BytesMain ../Modules/main.c:826
#24 0x7650397c51c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#25 0x7650397c528a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
0x50b000085f2f is located 1 bytes before 100-byte region [0x50b000085f30,0x50b000085f94)
allocated by thread T0 here:
#0 0x765039b92778 in realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:85
#1 0x562565e3065b in PyOS_StdioReadline ../Parser/myreadline.c:327
#2 0x562565e30a79 in PyOS_Readline ../Parser/myreadline.c:411
#3 0x562565e2940d in tok_underflow_interactive ../Parser/tokenizer/file_tokenizer.c:198
#4 0x562565e1eb9c in tok_nextc ../Parser/lexer/lexer.c:75
#5 0x562565e20af7 in tok_get_normal_mode ../Parser/lexer/lexer.c:521
#6 0x562565e26825 in tok_get_fstring_mode ../Parser/lexer/lexer.c:1415
#7 0x562565e26825 in tok_get ../Parser/lexer/lexer.c:1619
#8 0x562565e26825 in _PyTokenizer_Get ../Parser/lexer/lexer.c:1626
#9 0x562565d6f13e in _PyPegen_fill_token ../Parser/pegen.c:249
#10 0x562565e1bbb7 in statement_newline_rule ../Parser/parser.c:1347
#11 0x562565e1bbb7 in interactive_rule ../Parser/parser.c:1049
#12 0x562565e1bbb7 in _PyPegen_parse ../Parser/parser.c:38326
#13 0x562565d7309c in _PyPegen_run_parser ../Parser/pegen.c:942
#14 0x562565d73ad2 in _PyPegen_run_parser_from_file_pointer ../Parser/pegen.c:1020
#15 0x5625663d9869 in pyrun_one_parse_ast ../Python/pythonrun.c:269
#16 0x5625663d9869 in PyRun_InteractiveOneObjectEx ../Python/pythonrun.c:300
#17 0x5625663dd565 in _PyRun_InteractiveLoopObject ../Python/pythonrun.c:153
#18 0x5625663dee2d in _PyRun_AnyFileObject ../Python/pythonrun.c:75
#19 0x5625663dee2d in PyRun_AnyFileExFlags ../Python/pythonrun.c:102
#20 0x56256645162f in pymain_repl ../Modules/main.c:599
#21 0x56256645162f in pymain_run_python ../Modules/main.c:697
#22 0x5625664533de in Py_RunMain ../Modules/main.c:772
#23 0x5625664533de in pymain_main ../Modules/main.c:802
#24 0x5625664533de in Py_BytesMain ../Modules/main.c:826
#25 0x7650397c51c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#26 0x7650397c528a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
SUMMARY: AddressSanitizer: heap-buffer-overflow ../Parser/myreadline.c:347 in PyOS_StdioReadline
Shadow bytes around the buggy address:
0x50b000085c80: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
0x50b000085d00: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
0x50b000085d80: fd fa fa fa fa fa fa fa fa fa 00 00 00 00 00 00
0x50b000085e00: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
0x50b000085e80: 00 00 00 00 00 00 00 00 00 00 00 00 04 fa fa fa
=>0x50b000085f00: fa fa fa fa fa[fa]00 00 00 00 00 00 00 00 00 00
0x50b000085f80: 00 00 04 fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50b000086000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50b000086080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50b000086100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50b000086180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==678651==ABORTING
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
<!-- gh-linked-prs -->
### Linked PRs
* gh-140910
* gh-145852
* gh-145853
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140593
Memory leak in function `my_ElementDeclHandler` of `pyexpat`
cpython
?
2025-10-25
# Memory leak in function `my_ElementDeclHandler` of `pyexpat`
**Issue:** [https://github.com/python/cpython/issues/140593](https://github.com/python/cpython/issues/140593) · **State:** `closed` · **Created:** `2025-10-25T15:45:21Z`
**Labels:** `type-bug`, `extension-modules`, `topic-XML`
## Description
# Bug report
### Bug description:
```python
import unittest
from xml.parsers import expat
class SetAttributeTest(unittest.TestCase):
def setUp(self):
self.parser = expat.ParserCreate(namespace_separator='!')
data = b'<?xml version="1.0" encoding="iso-8859-1" standalone="no"?>\n<?xml-stylesheet href="stylesheet.css"?>\n<!-- comment data -->\n<!DOCTYPE quotations SYSTEM "quotations.dtd" [\n<!ELEMENT root ANY>\n<!ATTLIST root attr1 CDATA #REQUIRED attr2 CDATA #IMPLIED>\n<!NOTATION notation SYSTEM "notation.jpeg">\n<!ENTITY acirc "â">\n<!ENTITY external_entity SYSTEM "entity.file">\n<!ENTITY unparsed_entity SYSTEM "entity.file" NDATA notation>\n%unparsed_entity;\n]>\n\n<root attr1="value1" attr2="value2ὀ">\n<myns:subelement xmlns:myns="http://www.python.org/namespace">\n Contents of subelements\n</myns:subelement>\n<sub2><![CDATA[contents of CDATA section]]></sub2>\n&external_entity;\n&skipped_entity;\n\xb5\n</root>\n'
class ParseTest(unittest.TestCase):
class Outputter:
def __init__(self):
self.out = []
def NotStandaloneHandler(self):
return 3.1415926535897932384626
def ExternalEntityRefHandler(self, *args):
return 1
def XmlDeclHandler(self, *args):
return 1
def ElementDeclHandler(self, *args):
return 1
handler_names = ['NotStandaloneHandler', 'ExternalEntityRefHandler', 'XmlDeclHandler', 'ElementDeclHandler']
def _hookup_callbacks(self, parser, handler):
for name in self.handler_names:
setattr(parser, name, getattr(handler, name))
def test_parse_str(self):
out = self.Outputter()
parser = expat.ParserCreate(namespace_separator='!')
self._hookup_callbacks(parser, out)
parser.Parse(data.decode('iso-8859-1'), True)
if __name__ == '__main__':
unittest.main()
```
```
=================================================================
==589201==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 32 byte(s) in 1 object(s) allocated from:
#0 0x7223099539c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x7223061c79e7 in doProlog ../Modules/expat/xmlparse.c:6096
#2 0x7223061d178e in prologProcessor ../Modules/expat/xmlparse.c:5183
#3 0x7223061d178e in prologInitProcessor ../Modules/expat/xmlparse.c:4985
#4 0x7223061d178e in prologInitProcessor ../Modules/expat/xmlparse.c:4979
#5 0x7223061a176e in callProcessor ../Modules/expat/xmlparse.c:1291
#6 0x7223061b4603 in PyExpat_XML_ParseBuffer ../Modules/expat/xmlparse.c:2489
#7 0x72230619d523 in pyexpat_xmlparser_Parse_impl ../Modules/pyexpat.c:885
#8 0x72230619d523 in pyexpat_xmlparser_Parse ../Modules/clinic/pyexpat.c.h:109
#9 0x63399a5acee7 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#10 0x63399a5acee7 in PyObject_Vectorcall ../Objects/call.c:327
#11 0x63399a44ead2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#12 0x63399a931b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#13 0x63399a931b55 in _PyEval_Vector ../Python/ceval.c:2001
#14 0x63399a5b6d90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#15 0x63399a5b6d90 in method_vectorcall ../Objects/classobject.c:95
#16 0x63399a5b1ffe in _PyVectorcall_Call ../Objects/call.c:273
#17 0x63399a5b1ffe in _PyObject_Call ../Objects/call.c:348
#18 0x63399a5b1ffe in PyObject_Call ../Objects/call.c:373
#19 0x63399a451eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#20 0x63399a931b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#21 0x63399a931b55 in _PyEval_Vector ../Python/ceval.c:2001
#22 0x63399a5b0623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#23 0x63399a5b0cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#24 0x63399a771444 in call_method ../Objects/typeobject.c:3077
#25 0x63399a771444 in slot_tp_call ../Objects/typeobject.c:10606
#26 0x63399a5ab4cd in _PyObject_MakeTpCall ../Objects/call.c:242
#27 0x63399a44f7ac in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#28 0x63399a931b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#29 0x63399a931b55 in _PyEval_Vector ../Python/ceval.c:2001
#30 0x63399a5b6d90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#31 0x63399a5b6d90 in method_vectorcall ../Objects/classobject.c:95
#32 0x63399a5b1ffe in _PyVectorcall_Call ../Objects/call.c:273
#33 0x63399a5b1ffe in _PyObject_Call ../Objects/call.c:348
#34 0x63399a5b1ffe in PyObject_Call ../Objects/call.c:373
#35 0x63399a451eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#36 0x63399a931b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#37 0x63399a931b55 in _PyEval_Vector ../Python/ceval.c:2001
#38 0x63399a5b0623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#39 0x63399a5b0cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#40 0x63399a771444 in call_method ../Objects/typeobject.c:3077
#41 0x63399a771444 in slot_tp_call ../Objects/typeobject.c:10606
#42 0x63399a5ab4cd in _PyObject_MakeTpCall ../Objects/call.c:242
#43 0x63399a44ead2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#44 0x63399a931b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#45 0x63399a931b55 in _PyEval_Vector ../Python/ceval.c:2001
#46 0x63399a5b6d90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#47 0x63399a5b6d90 in method_vectorcall ../Objects/classobject.c:95
SUMMARY: AddressSanitizer: 32 byte(s) leaked in 1 allocation(s).
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-140602
* gh-140624
* gh-140625
* gh-140629
* gh-140630
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140590
SEGV functools _Py_dict_lookup
cpython
?
2025-10-25
# SEGV functools _Py_dict_lookup
**Issue:** [https://github.com/python/cpython/issues/140590](https://github.com/python/cpython/issues/140590) · **State:** `closed` · **Created:** `2025-10-25T15:22:21Z`
**Labels:** `extension-modules`, `type-crash`, `3.15`
## Description
# Crash report
### What happened?
```python
import functools
import unittest
def capture(*args, **kw):
return (args, kw)
def extract_sig(part):
return (part.func, part.args, part.keywords, part.__dict__)
class MyTuple(tuple):
def __add__(self, other):
return list(self) + list(other)
class MyDict(dict):
pass
class TestPartialSetstateSubclasses(unittest.TestCase):
f = functools.partial(extract_sig)
f.__setstate__((capture, MyTuple((1,)), MyDict(a=10), '\u2603'))
f.__setstate__((capture, BadTuple((1,)), {}, None))
if __name__ == "__main__":
import unittest; unittest.main(verbosity=0)
```
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==197163==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x583829da5bda bp 0x7ffd359603d0 sp 0x7ffd35960320 T0)
==197163==The signal is caused by a READ memory access.
==197163==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used.
#0 0x583829da5bda in _Py_dict_lookup ../Objects/dictobject.c:1254
#1 0x583829dae83f in _Py_dict_lookup_threadsafe ../Objects/dictobject.c:1643
#2 0x583829dae83f in _PyDict_GetMethodStackRef ../Objects/dictobject.c:1691
#3 0x583829dfc2ff in _PyObject_GetMethodStackRef ../Objects/object.c:1756
#4 0x583829b831a4 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:7844
#5 0x58382a057b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#6 0x58382a057b55 in _PyEval_Vector ../Python/ceval.c:2001
#7 0x58382a0439e8 in builtin___build_class__ ../Python/bltinmodule.c:205
#8 0x583829cd2ee7 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#9 0x583829cd2ee7 in PyObject_Vectorcall ../Objects/call.c:327
#10 0x583829b74ad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#11 0x58382a057386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#12 0x58382a057386 in _PyEval_Vector ../Python/ceval.c:2001
#13 0x58382a057386 in PyEval_EvalCode ../Python/ceval.c:884
#14 0x58382a215f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#15 0x58382a215f0e in run_mod ../Python/pythonrun.c:1459
#16 0x58382a21abb7 in pyrun_file ../Python/pythonrun.c:1293
#17 0x58382a21abb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#18 0x58382a21b6dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#19 0x58382a28eafc in pymain_run_file_obj ../Modules/main.c:410
#20 0x58382a28eafc in pymain_run_file ../Modules/main.c:429
#21 0x58382a28eafc in pymain_run_python ../Modules/main.c:691
#22 0x58382a2903de in Py_RunMain ../Modules/main.c:772
#23 0x58382a2903de in pymain_main ../Modules/main.c:802
#24 0x58382a2903de in Py_BytesMain ../Modules/main.c:826
#25 0x7249b00571c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#26 0x7249b005728a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ../Objects/dictobject.c:1254 in _Py_dict_lookup
==197163==ABORTING
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
<!-- gh-linked-prs -->
### Linked PRs
* gh-140671
* gh-140698
* gh-140699
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140576
SystemError in _generate_tokens_from_c_tokenizer
cpython
?
2025-10-25
# SystemError in _generate_tokens_from_c_tokenizer
**Issue:** [https://github.com/python/cpython/issues/140576](https://github.com/python/cpython/issues/140576) · **State:** `closed` · **Created:** `2025-10-25T10:55:54Z`
**Labels:** `type-bug`, `interpreter-core`, `3.13`, `3.14`, `3.15`
## Description
# Bug report
### Bug description:
```python
import tokenize
import unittest
from io import BytesIO, StringIO
from unittest import TestCase, mock
def stringify_tokens_from_source(token_generator, source_string):
result = []
for type, token, start, end, line in token_generator:
result.append(f" {type:10} {token!r:13} {start} {end}")
class TokenizeTest(TestCase):
def check_tokenize(self, s, expected):
self.check_tokenize("1 + 1", """\
""")
def test_tabs(self):
self.check_tokenize("def f():\n"
"\tif x\n"
'\x00', """\
""")
def check_tokenize(self, s, expected):
f = StringIO(s)
result = stringify_tokens_from_source(tokenize.generate_tokens(f.readline), s)
for encoding in ["utf-8", "latin-1", "utf-16"]:
tokens = list(tokenize._generate_tokens_from_c_tokenizer())
self.check_tokenize('0xff <= 255', """\
""")
self.check_tokenize('''\
await = 2''', """\
""")
if __name__ == "__main__":
unittest.main()
```
```
...
File "/usr/lib/python3.12/tokenize.py", line 577, in _generate_tokens_from_c_tokenizer
yield TokenInfo._make(info)
^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.12/collections/__init__.py", line 449, in _make
result = tuple_new(cls, iterable)
^^^^^^^^^^^^^^^^^^^^^^^^
SystemError: <built-in method __new__ of type object at 0xa42c40> returned a result with an exception set
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-140583
* gh-140757
* gh-140762
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140564
SystemError: Objects/codeobject.c bad argument to internal function
cpython
?
2025-10-24
# SystemError: Objects/codeobject.c bad argument to internal function
**Issue:** [https://github.com/python/cpython/issues/140564](https://github.com/python/cpython/issues/140564) · **State:** `closed` · **Created:** `2025-10-24T19:21:32Z`
**Labels:** `type-bug`, `interpreter-core`, `pending`
## Description
# Crash report
### What happened?
```python
c = (lambda x, y, *, z=1, w=1: 1).__code__
swapped = c.replace(co_posonlyargcount=2147483647, co_kwonlyargcount=0)
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140551
Crash in `dict` if `hash` `__eq__` function has side effects
cpython
?
2025-10-24
# Crash in `dict` if `hash` `__eq__` function has side effects
**Issue:** [https://github.com/python/cpython/issues/140551](https://github.com/python/cpython/issues/140551) · **State:** `closed` · **Created:** `2025-10-24T14:54:05Z`
**Labels:** `interpreter-core`, `type-crash`, `3.13`, `3.14`, `3.15`
## Description
# Crash report
### What happened?
```python
import unittest
class Test(unittest.TestCase):
def test(self):
class X(object):
def __hash__(self):
return -1
def __eq__(self, other):
d.clear()
d = {}
d[X()] = 3
d[X()] = 4
d[0.0] = 6
self.assertIn(9, d)
if __name__ == "__main__":
unittest.main()
```
```
=================================================================
==2499578==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5030000157d8 at pc 0x5a0a74cfb3e4 bp 0x7ffcf57ec450 sp 0x7ffcf57ec440
READ of size 8 at 0x5030000157d8 thread T0
#0 0x5a0a74cfb3e3 in unicode_get_hash ../Objects/dictobject.c:404
#1 0x5a0a74cfb3e3 in _PyDict_Next ../Objects/dictobject.c:3022
#2 0x5a0a74cff6c3 in _PyDict_Next ../Objects/dictobject.c:2994
#3 0x5a0a74cff6c3 in dict_repr_lock_held ../Objects/dictobject.c:3397
#4 0x5a0a74cff6c3 in dict_repr ../Objects/dictobject.c:3456
#5 0x5a0a74d55a8e in PyObject_Repr ../Objects/object.c:779
#6 0x5a0a74ad9300 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2455
#7 0x5a0a74fb8b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#8 0x5a0a74fb8b55 in _PyEval_Vector ../Python/ceval.c:2001
#9 0x5a0a74c3dd90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#10 0x5a0a74c3dd90 in method_vectorcall ../Objects/classobject.c:95
#11 0x5a0a74c38ffe in _PyVectorcall_Call ../Objects/call.c:273
#12 0x5a0a74c38ffe in _PyObject_Call ../Objects/call.c:348
#13 0x5a0a74c38ffe in PyObject_Call ../Objects/call.c:373
#14 0x5a0a74ad8eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#15 0x5a0a74fb8b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#16 0x5a0a74fb8b55 in _PyEval_Vector ../Python/ceval.c:2001
#17 0x5a0a74c37623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#18 0x5a0a74c37cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#19 0x5a0a74df8444 in call_method ../Objects/typeobject.c:3077
#20 0x5a0a74df8444 in slot_tp_call ../Objects/typeobject.c:10606
#21 0x5a0a74c324cd in _PyObject_MakeTpCall ../Objects/call.c:242
#22 0x5a0a74ad67ac in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#23 0x5a0a74fb8b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#24 0x5a0a74fb8b55 in _PyEval_Vector ../Python/ceval.c:2001
#25 0x5a0a74c3dd90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#26 0x5a0a74c3dd90 in method_vectorcall ../Objects/classobject.c:95
#27 0x5a0a74c38ffe in _PyVectorcall_Call ../Objects/call.c:273
#28 0x5a0a74c38ffe in _PyObject_Call ../Objects/call.c:348
#29 0x5a0a74c38ffe in PyObject_Call ../Objects/call.c:373
#30 0x5a0a74ad8eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#31 0x5a0a74fb8b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#32 0x5a0a74fb8b55 in _PyEval_Vector ../Python/ceval.c:2001
#33 0x5a0a74c37623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#34 0x5a0a74c37cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#35 0x5a0a74df8444 in call_method ../Objects/typeobject.c:3077
#36 0x5a0a74df8444 in slot_tp_call ../Objects/typeobject.c:10606
#37 0x5a0a74c324cd in _PyObject_MakeTpCall ../Objects/call.c:242
#38 0x5a0a74ad5ad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#39 0x5a0a74fb8b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#40 0x5a0a74fb8b55 in _PyEval_Vector ../Python/ceval.c:2001
#41 0x5a0a74c3dd90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#42 0x5a0a74c3dd90 in method_vectorcall ../Objects/classobject.c:95
#43 0x5a0a74c38ffe in _PyVectorcall_Call ../Objects/call.c:273
#44 0x5a0a74c38ffe in _PyObject_Call ../Objects/call.c:348
#45 0x5a0a74c38ffe in PyObject_Call ../Objects/call.c:373
#46 0x5a0a74ad8eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#47 0x5a0a74fb8b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#48 0x5a0a74fb8b55 in _PyEval_Vector ../Python/ceval.c:2001
#49 0x5a0a74c37623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#50 0x5a0a74c37cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#51 0x5a0a74df8444 in call_method ../Objects/typeobject.c:3077
#52 0x5a0a74df8444 in slot_tp_call ../Objects/typeobject.c:10606
#53 0x5a0a74c324cd in _PyObject_MakeTpCall ../Objects/call.c:242
#54 0x5a0a74ad5ad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#55 0x5a0a74fb8b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#56 0x5a0a74fb8b55 in _PyEval_Vector ../Python/ceval.c:2001
#57 0x5a0a74c37623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#58 0x5a0a74c37cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#59 0x5a0a74de4c50 in call_method ../Objects/typeobject.c:3077
#60 0x5a0a74de4c50 in slot_tp_init ../Objects/typeobject.c:10835
#61 0x5a0a74dd69d7 in type_call ../Objects/typeobject.c:2461
#62 0x5a0a74c324cd in _PyObject_MakeTpCall ../Objects/call.c:242
#63 0x5a0a74af1a18 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#64 0x5a0a74fb8386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#65 0x5a0a74fb8386 in _PyEval_Vector ../Python/ceval.c:2001
#66 0x5a0a74fb8386 in PyEval_EvalCode ../Python/ceval.c:884
#67 0x5a0a75176f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#68 0x5a0a75176f0e in run_mod ../Python/pythonrun.c:1459
#69 0x5a0a7517bbb7 in pyrun_file ../Python/pythonrun.c:1293
#70 0x5a0a7517bbb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#71 0x5a0a7517c6dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#72 0x5a0a751efafc in pymain_run_file_obj ../Modules/main.c:410
#73 0x5a0a751efafc in pymain_run_file ../Modules/main.c:429
#74 0x5a0a751efafc in pymain_run_python ../Modules/main.c:691
#75 0x5a0a751f13de in Py_RunMain ../Modules/main.c:772
#76 0x5a0a751f13de in pymain_main ../Modules/main.c:802
#77 0x5a0a751f13de in Py_BytesMain ../Modules/main.c:826
#78 0x7fb1143591c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#79 0x7fb11435928a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#80 0x5a0a74b0bfa4 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x21afa4) (BuildId: f28384d3eff6aa8d5f0c5730194edf28c0f6b3bd)
0x5030000157d8 is located 0 bytes after 24-byte region [0x5030000157c0,0x5030000157d8)
allocated by thread T0 here:
#0 0x7fb1147279c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5a0a74c9d849 in PyFloat_FromDouble ../Objects/floatobject.c:128
#2 0x5a0a7522adc1 in fill_time ../Modules/posixmodule.c:2681
#3 0x5a0a7522b4de in _pystat_fromstructstat ../Modules/posixmodule.c:2796
#4 0x5a0a7522d2fc in posix_do_stat ../Modules/posixmodule.c:2918
#5 0x5a0a75237a0c in os_stat_impl ../Modules/posixmodule.c:3285
#6 0x5a0a75237a0c in os_stat ../Modules/clinic/posixmodule.c.h:105
#7 0x5a0a74afae79 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2361
#8 0x5a0a74fb8b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#9 0x5a0a74fb8b55 in _PyEval_Vector ../Python/ceval.c:2001
#10 0x5a0a74c33062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#11 0x5a0a74c33062 in object_vacall ../Objects/call.c:819
#12 0x5a0a74c366b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#13 0x5a0a750814d3 in import_find_and_load ../Python/import.c:3701
#14 0x5a0a750814d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#15 0x5a0a74f9ab4c in builtin___import___impl ../Python/bltinmodule.c:285
#16 0x5a0a74f9ab4c in builtin___import__ ../Python/clinic/bltinmodule.c.h:110
#17 0x5a0a74c38ffe in _PyVectorcall_Call ../Objects/call.c:273
#18 0x5a0a74c38ffe in _PyObject_Call ../Objects/call.c:348
#19 0x5a0a74c38ffe in PyObject_Call ../Objects/call.c:373
#20 0x5a0a74ad8eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#21 0x5a0a74fb8b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#22 0x5a0a74fb8b55 in _PyEval_Vector ../Python/ceval.c:2001
#23 0x5a0a74c33062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#24 0x5a0a74c33062 in object_vacall ../Objects/call.c:819
#25 0x5a0a74c366b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#26 0x5a0a75081afb in PyImport_ImportModuleLevelObject ../Python/import.c:3853
#27 0x5a0a74fb3795 in _PyEval_ImportName ../Python/ceval.c:3017
#28 0x5a0a74aeaa5e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#29 0x5a0a74fb8386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#30 0x5a0a74fb8386 in _PyEval_Vector ../Python/ceval.c:2001
#31 0x5a0a74fb8386 in PyEval_EvalCode ../Python/ceval.c:884
#32 0x5a0a74fa2758 in builtin_exec_impl ../Python/bltinmodule.c:1180
#33 0x5a0a74fa2758 in builtin_exec ../Python/clinic/bltinmodule.c.h:571
#34 0x5a0a74c38ffe in _PyVectorcall_Call ../Objects/call.c:273
#35 0x5a0a74c38ffe in _PyObject_Call ../Objects/call.c:348
#36 0x5a0a74c38ffe in PyObject_Call ../Objects/call.c:373
#37 0x5a0a74ad8eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#38 0x5a0a74fb8b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#39 0x5a0a74fb8b55 in _PyEval_Vector ../Python/ceval.c:2001
#40 0x5a0a74c33062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#41 0x5a0a74c33062 in object_vacall ../Objects/call.c:819
#42 0x5a0a74c366b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#43 0x5a0a750814d3 in import_find_and_load ../Python/import.c:3701
#44 0x5a0a750814d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#45 0x5a0a74f9ab4c in builtin___import___impl ../Python/bltinmodule.c:285
#46 0x5a0a74f9ab4c in builtin___import__ ../Python/clinic/bltinmodule.c.h:110
#47 0x5a0a74c33928 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#48 0x5a0a74c33928 in _PyObject_CallFunctionVa ../Objects/call.c:552
SUMMARY: AddressSanitizer: heap-buffer-overflow ../Objects/dictobject.c:404 in unicode_get_hash
Shadow bytes around the buggy address:
0x503000015500: fd fd fa fa fd fd fd fd fa fa fd fd fd fd fa fa
0x503000015580: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fa
0x503000015600: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
0x503000015680: fd fd fa fa fd fd fd fd fa fa fd fd fd fd fa fa
0x503000015700: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd
=>0x503000015780: fa fa fd fd fd fd fa fa 00 00 00[fa]fa fa fd fd
0x503000015800: fd fd fa fa fd fd fd fa fa fa fd fd fd fd fa fa
0x503000015880: fd fd fd fa fa fa fd fd fd fd fa fa fd fd fd fd
0x503000015900: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
0x503000015980: fd fd fa fa fd fd fd fd fa fa fd fd fd fd fa fa
0x503000015a00: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2499578==ABORTING
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
<!-- gh-linked-prs -->
### Linked PRs
* gh-140558
* gh-140743
* gh-140744
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140530
Reference leak when failing to raise from an exception cause
cpython
?
2025-10-24
# Reference leak when failing to raise from an exception cause
**Issue:** [https://github.com/python/cpython/issues/140530](https://github.com/python/cpython/issues/140530) · **State:** `closed` · **Created:** `2025-10-24T10:55:59Z`
**Labels:** `type-bug`, `interpreter-core`, `3.13`, `3.14`, `3.15`
## Description
# Bug report
### Bug description:
```python
import unittest
class TestRaise(unittest.TestCase):
def test_class_cause_nonexception_result(self):
class ConstructsNone(BaseException):
def __new__(*args, **kwargs):
return 'A'*1000
try:
raise IndexError from ConstructsNone
except Exception:
pass
if __name__ == "__main__":
unittest.main()
```
```
=================================================================
==1055698==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 1041 byte(s) in 1 object(s) allocated from:
#0 0x7dd09269b9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x599b8469b90e in PyUnicode_New ../Objects/unicodeobject.c:1358
#2 0x599b846d8ad8 in PyUnicode_New ../Objects/unicodeobject.c:1307
#3 0x599b846d8ad8 in unicode_repeat ../Objects/unicodeobject.c:12640
#4 0x599b846d8ad8 in unicode_repeat ../Objects/unicodeobject.c:12621
#5 0x599b8488cdff in const_folding_safe_multiply ../Python/flowgraph.c:1727
#6 0x599b8488cdff in eval_const_binop ../Python/flowgraph.c:1795
#7 0x599b8488cdff in fold_const_binop ../Python/flowgraph.c:1867
#8 0x599b8488cdff in optimize_basic_block ../Python/flowgraph.c:2489
#9 0x599b8488fe2d in optimize_cfg ../Python/flowgraph.c:2543
#10 0x599b8488fe2d in _PyCfg_OptimizeCodeUnit ../Python/flowgraph.c:3655
#11 0x599b84851cd9 in optimize_and_assemble_code_unit ../Python/compile.c:1432
#12 0x599b84851cd9 in _PyCompile_OptimizeAndAssemble ../Python/compile.c:1474
#13 0x599b848478ac in codegen_function_body ../Python/codegen.c:1388
#14 0x599b848478ac in codegen_function ../Python/codegen.c:1480
#15 0x599b84839bf3 in codegen_visit_stmt ../Python/codegen.c:3095
#16 0x599b8483edd6 in codegen_body ../Python/codegen.c:911
#17 0x599b84840f42 in codegen_class_body ../Python/codegen.c:1569
#18 0x599b84840f42 in codegen_class ../Python/codegen.c:1662
#19 0x599b84839bc9 in codegen_visit_stmt ../Python/codegen.c:3008
#20 0x599b8484786a in codegen_function_body ../Python/codegen.c:1382
#21 0x599b8484786a in codegen_function ../Python/codegen.c:1480
#22 0x599b84839bf3 in codegen_visit_stmt ../Python/codegen.c:3095
#23 0x599b8483edd6 in codegen_body ../Python/codegen.c:911
#24 0x599b84840f42 in codegen_class_body ../Python/codegen.c:1569
#25 0x599b84840f42 in codegen_class ../Python/codegen.c:1662
#26 0x599b84839bc9 in codegen_visit_stmt ../Python/codegen.c:3008
#27 0x599b8483edd6 in codegen_body ../Python/codegen.c:911
#28 0x599b8484a094 in _PyCodegen_Module ../Python/codegen.c:874
#29 0x599b8484bd18 in compiler_codegen ../Python/compile.c:835
#30 0x599b84852481 in compiler_mod ../Python/compile.c:856
#31 0x599b84852481 in _PyAST_Compile ../Python/compile.c:1487
#32 0x599b84954e1c in run_mod ../Python/pythonrun.c:1411
#33 0x599b84959977 in pyrun_file ../Python/pythonrun.c:1293
#34 0x599b84959977 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#35 0x599b8495a49c in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#36 0x599b849cd7fc in pymain_run_file_obj ../Modules/main.c:410
#37 0x599b849cd7fc in pymain_run_file ../Modules/main.c:429
#38 0x599b849cd7fc in pymain_run_python ../Modules/main.c:691
#39 0x599b849cf0de in Py_RunMain ../Modules/main.c:772
#40 0x599b849cf0de in pymain_main ../Modules/main.c:802
#41 0x599b849cf0de in Py_BytesMain ../Modules/main.c:826
#42 0x7dd0922cd1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#43 0x7dd0922cd28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#44 0x599b84369524 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython-normal/build/python+0x20e524) (BuildId: b922665a0e7afc8ee52df7c3eac25a643025109e)
SUMMARY: AddressSanitizer: 1041 byte(s) leaked in 1 allocation(s).
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-140908
* gh-141282
* gh-141283
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140517
Memory leak in `map_next` in strict mode in case of error
cpython
?
2025-10-23
# Memory leak in `map_next` in strict mode in case of error
**Issue:** [https://github.com/python/cpython/issues/140517](https://github.com/python/cpython/issues/140517) · **State:** `closed` · **Created:** `2025-10-23T19:47:18Z`
**Labels:** `type-bug`, `interpreter-core`, `easy`, `3.14`, `3.15`
## Description
# Bug report
### Bug description:
```python
def pack(*args):
return args
tuple(map(pack, (1, 999999999999, 3), '\u2603', strict=True))
```
```
=================================================================
==2066743==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 32 byte(s) in 1 object(s) allocated from:
#0 0x76cd190b39c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5f18b4d0c06b in long_alloc ../Objects/longobject.c:180
#2 0x5f18b4d0c06b in PyLong_FromLong ../Objects/longobject.c:403
#3 0x5f18b4b3c73d in parsenumber_raw ../Parser/pegen.c:640
#4 0x5f18b4b401f9 in parsenumber ../Parser/pegen.c:668
#5 0x5f18b4b401f9 in _PyPegen_number_token ../Parser/pegen.c:707
#6 0x5f18b4b5d749 in atom_rule ../Parser/parser.c:15160
#7 0x5f18b4b62f2f in primary_raw ../Parser/parser.c:14779
#8 0x5f18b4b62f2f in primary_rule ../Parser/parser.c:14577
#9 0x5f18b4b63e89 in await_primary_rule ../Parser/parser.c:14531
#10 0x5f18b4b64de7 in power_rule ../Parser/parser.c:14407
#11 0x5f18b4b64de7 in factor_rule ../Parser/parser.c:14357
#12 0x5f18b4b6655f in term_raw ../Parser/parser.c:14198
#13 0x5f18b4b6655f in term_rule ../Parser/parser.c:13941
#14 0x5f18b4b68044 in sum_raw ../Parser/parser.c:13894
#15 0x5f18b4b68044 in sum_rule ../Parser/parser.c:13773
#16 0x5f18b4b69307 in shift_expr_raw ../Parser/parser.c:13733
#17 0x5f18b4b69307 in shift_expr_rule ../Parser/parser.c:13593
#18 0x5f18b4b6a964 in bitwise_and_raw ../Parser/parser.c:13553
#19 0x5f18b4b6a964 in bitwise_and_rule ../Parser/parser.c:13471
#20 0x5f18b4b6b594 in bitwise_xor_raw ../Parser/parser.c:13431
#21 0x5f18b4b6b594 in bitwise_xor_rule ../Parser/parser.c:13349
#22 0x5f18b4b6c1c4 in bitwise_or_raw ../Parser/parser.c:13309
#23 0x5f18b4b6c1c4 in bitwise_or_rule ../Parser/parser.c:13227
#24 0x5f18b4b6ce90 in comparison_rule ../Parser/parser.c:12467
#25 0x5f18b4b6ce90 in inversion_rule ../Parser/parser.c:12418
#26 0x5f18b4b70125 in conjunction_rule ../Parser/parser.c:12295
#27 0x5f18b4b71125 in disjunction_rule ../Parser/parser.c:12207
#28 0x5f18b4b84084 in expression_rule ../Parser/parser.c:11495
#29 0x5f18b4b8e017 in named_expression_rule ../Parser/parser.c:12153
#30 0x5f18b4b8f83b in star_named_expression_rule ../Parser/parser.c:12003
#31 0x5f18b4b8fc6c in _gather_58_rule ../Parser/parser.c:31182
#32 0x5f18b4b8fc6c in star_named_expressions_rule ../Parser/parser.c:11913
#33 0x5f18b4b90adc in _tmp_82_rule ../Parser/parser.c:32764
#34 0x5f18b4b90adc in tuple_rule ../Parser/parser.c:17366
#35 0x5f18b4b5dbda in _tmp_66_rule ../Parser/parser.c:31644
#36 0x5f18b4b5dbda in atom_rule ../Parser/parser.c:15181
#37 0x5f18b4b62f2f in primary_raw ../Parser/parser.c:14779
#38 0x5f18b4b62f2f in primary_rule ../Parser/parser.c:14577
#39 0x5f18b4b63e89 in await_primary_rule ../Parser/parser.c:14531
#40 0x5f18b4b64de7 in power_rule ../Parser/parser.c:14407
#41 0x5f18b4b64de7 in factor_rule ../Parser/parser.c:14357
#42 0x5f18b4b6655f in term_raw ../Parser/parser.c:14198
#43 0x5f18b4b6655f in term_rule ../Parser/parser.c:13941
#44 0x5f18b4b68044 in sum_raw ../Parser/parser.c:13894
#45 0x5f18b4b68044 in sum_rule ../Parser/parser.c:13773
#46 0x5f18b4b69307 in shift_expr_raw ../Parser/parser.c:13733
#47 0x5f18b4b69307 in shift_expr_rule ../Parser/parser.c:13593
#48 0x5f18b4b6a964 in bitwise_and_raw ../Parser/parser.c:13553
#49 0x5f18b4b6a964 in bitwise_and_rule ../Parser/parser.c:13471
SUMMARY: AddressSanitizer: 32 byte(s) leaked in 1 allocation(s).
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-140543
* gh-140554
* gh-140560
* gh-140565
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140497
cpython crash (heap-buffer-overflow) Python/generated_cases.c.h _PyEval_EvalFrameDefault
cpython
?
2025-10-23
# cpython crash (heap-buffer-overflow) Python/generated_cases.c.h _PyEval_EvalFrameDefault
**Issue:** [https://github.com/python/cpython/issues/140497](https://github.com/python/cpython/issues/140497) · **State:** `closed` · **Created:** `2025-10-23T08:12:26Z`
**Labels:** `type-crash`
## Description
# Crash report
### What happened?
```python
def f():
pass
f.__code__ = f.__code__.replace(co_code=b"")
f()
```
```
=================================================================
==503928==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x511000058090 at pc 0x58d595b32156 bp 0x7fff9b688d90 sp 0x7fff9b688d80
READ of size 2 at 0x511000058090 thread T0
#0 0x58d595b32155 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:12265
#1 0x58d595fe4386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#2 0x58d595fe4386 in _PyEval_Vector ../Python/ceval.c:2001
#3 0x58d595fe4386 in PyEval_EvalCode ../Python/ceval.c:884
#4 0x58d5961a2f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#5 0x58d5961a2f0e in run_mod ../Python/pythonrun.c:1459
#6 0x58d5961a7bb7 in pyrun_file ../Python/pythonrun.c:1293
#7 0x58d5961a7bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#8 0x58d5961a86dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#9 0x58d59621bafc in pymain_run_file_obj ../Modules/main.c:410
#10 0x58d59621bafc in pymain_run_file ../Modules/main.c:429
#11 0x58d59621bafc in pymain_run_python ../Modules/main.c:691
#12 0x58d59621d3de in Py_RunMain ../Modules/main.c:772
#13 0x58d59621d3de in pymain_main ../Modules/main.c:802
#14 0x58d59621d3de in Py_BytesMain ../Modules/main.c:826
#15 0x7360ed33e1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#16 0x7360ed33e28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#17 0x58d595b37fa4 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x21afa4) (BuildId: f28384d3eff6aa8d5f0c5730194edf28c0f6b3bd)
0x511000058090 is located 0 bytes after 208-byte region [0x511000057fc0,0x511000058090)
allocated by thread T0 here:
#0 0x7360ed70c9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x58d595d7f330 in _PyObject_NewVar ../Objects/object.c:566
#2 0x58d595c70c76 in _PyCode_New ../Objects/codeobject.c:732
#3 0x58d595c72bfe in PyUnstable_Code_NewWithPosOnlyArgs ../Objects/codeobject.c:901
#4 0x58d595c7af1c in PyCode_NewWithPosOnlyArgs ../Include/cpython/code.h:211
#5 0x58d595c7af1c in code_replace_impl ../Objects/codeobject.c:2827
#6 0x58d595c7af1c in code_replace ../Objects/clinic/codeobject.c.h:405
#7 0x58d595c5fee7 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#8 0x58d595c5fee7 in PyObject_Vectorcall ../Objects/call.c:327
#9 0x58d595b03bc2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2920
#10 0x58d595fe4386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#11 0x58d595fe4386 in _PyEval_Vector ../Python/ceval.c:2001
#12 0x58d595fe4386 in PyEval_EvalCode ../Python/ceval.c:884
#13 0x58d5961a2f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#14 0x58d5961a2f0e in run_mod ../Python/pythonrun.c:1459
#15 0x58d5961a7bb7 in pyrun_file ../Python/pythonrun.c:1293
#16 0x58d5961a7bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#17 0x58d5961a86dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#18 0x58d59621bafc in pymain_run_file_obj ../Modules/main.c:410
#19 0x58d59621bafc in pymain_run_file ../Modules/main.c:429
#20 0x58d59621bafc in pymain_run_python ../Modules/main.c:691
#21 0x58d59621d3de in Py_RunMain ../Modules/main.c:772
#22 0x58d59621d3de in pymain_main ../Modules/main.c:802
#23 0x58d59621d3de in Py_BytesMain ../Modules/main.c:826
#24 0x7360ed33e1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#25 0x7360ed33e28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#26 0x58d595b37fa4 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x21afa4) (BuildId: f28384d3eff6aa8d5f0c5730194edf28c0f6b3bd)
SUMMARY: AddressSanitizer: heap-buffer-overflow ../Python/generated_cases.c.h:12265 in _PyEval_EvalFrameDefault
Shadow bytes around the buggy address:
0x511000057e00: 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa
0x511000057e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x511000057f00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x511000057f80: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x511000058000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x511000058080: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
0x511000058100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x511000058180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x511000058200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x511000058280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x511000058300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==503928==ABORTING
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140496
cpython crash (heap-use-after-free) _Py_IsImmortal Include/internal/pycore_stackref.h
cpython
?
2025-10-23
# cpython crash (heap-use-after-free) _Py_IsImmortal Include/internal/pycore_stackref.h
**Issue:** [https://github.com/python/cpython/issues/140496](https://github.com/python/cpython/issues/140496) · **State:** `closed` · **Created:** `2025-10-23T07:46:50Z`
**Labels:** N/A
## Description
# Crash report
### What happened?
```python
import gc
thingy = object()
class A(object):
def f(self):
return 1
x = thingy
r = gc.get_referrers(thingy)
if "__module__" in r[0]:
dct = r[0]
else:
dct = r[1]
a = A()
for i in range(10):
a.f()
dct["f"] = lambda self: 2
print(a.f())
```
```
=================================================================
==343376==ERROR: AddressSanitizer: heap-use-after-free on address 0x50f000035750 at pc 0x5e5c1b39ca4f bp 0x7ffcd57cda90 sp 0x7ffcd57cda80
READ of size 4 at 0x50f000035750 thread T0
#0 0x5e5c1b39ca4e in _Py_IsImmortal ../Include/refcount.h:129
#1 0x5e5c1b39ca4e in _PyStackRef_FromPyObjectNew ../Include/internal/pycore_stackref.h:632
#2 0x5e5c1b39ca4e in _PyType_LookupStackRefAndVersion ../Objects/typeobject.c:6133
#3 0x5e5c1b3170a1 in _PyObject_GetMethodStackRef ../Objects/object.c:1713
#4 0x5e5c1b09e1a4 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:7844
#5 0x5e5c1b572386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#6 0x5e5c1b572386 in _PyEval_Vector ../Python/ceval.c:2001
#7 0x5e5c1b572386 in PyEval_EvalCode ../Python/ceval.c:884
#8 0x5e5c1b730f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#9 0x5e5c1b730f0e in run_mod ../Python/pythonrun.c:1459
#10 0x5e5c1b735bb7 in pyrun_file ../Python/pythonrun.c:1293
#11 0x5e5c1b735bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#12 0x5e5c1b7366dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#13 0x5e5c1b7a9afc in pymain_run_file_obj ../Modules/main.c:410
#14 0x5e5c1b7a9afc in pymain_run_file ../Modules/main.c:429
#15 0x5e5c1b7a9afc in pymain_run_python ../Modules/main.c:691
#16 0x5e5c1b7ab3de in Py_RunMain ../Modules/main.c:772
#17 0x5e5c1b7ab3de in pymain_main ../Modules/main.c:802
#18 0x5e5c1b7ab3de in Py_BytesMain ../Modules/main.c:826
#19 0x738ce35451c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#20 0x738ce354528a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#21 0x5e5c1b0c5fa4 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x21afa4) (BuildId: f28384d3eff6aa8d5f0c5730194edf28c0f6b3bd)
0x50f000035750 is located 16 bytes inside of 168-byte region [0x50f000035740,0x50f0000357e8)
freed by thread T0 here:
#0 0x738ce39124d8 in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
#1 0x5e5c1b30ed51 in _Py_Dealloc ../Objects/object.c:3200
#2 0x5e5c1b2c3a24 in Py_DECREF ../Include/refcount.h:420
#3 0x5e5c1b2c3a24 in Py_XDECREF ../Include/refcount.h:513
#4 0x5e5c1b2c3a24 in insertdict ../Objects/dictobject.c:1927
#5 0x5e5c1b0aab58 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:11245
#6 0x5e5c1b572386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#7 0x5e5c1b572386 in _PyEval_Vector ../Python/ceval.c:2001
#8 0x5e5c1b572386 in PyEval_EvalCode ../Python/ceval.c:884
#9 0x5e5c1b730f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#10 0x5e5c1b730f0e in run_mod ../Python/pythonrun.c:1459
#11 0x5e5c1b735bb7 in pyrun_file ../Python/pythonrun.c:1293
#12 0x5e5c1b735bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#13 0x5e5c1b7366dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#14 0x5e5c1b7a9afc in pymain_run_file_obj ../Modules/main.c:410
#15 0x5e5c1b7a9afc in pymain_run_file ../Modules/main.c:429
#16 0x5e5c1b7a9afc in pymain_run_python ../Modules/main.c:691
#17 0x5e5c1b7ab3de in Py_RunMain ../Modules/main.c:772
#18 0x5e5c1b7ab3de in pymain_main ../Modules/main.c:802
#19 0x5e5c1b7ab3de in Py_BytesMain ../Modules/main.c:826
#20 0x738ce35451c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#21 0x738ce354528a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#22 0x5e5c1b0c5fa4 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x21afa4) (BuildId: f28384d3eff6aa8d5f0c5730194edf28c0f6b3bd)
previously allocated by thread T0 here:
#0 0x738ce39139c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5e5c1b609026 in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x5e5c1b609026 in gc_alloc ../Python/gc.c:2343
#3 0x5e5c1b609026 in _PyObject_GC_New ../Python/gc.c:2363
#4 0x5e5c1b26d657 in PyFunction_NewWithQualName ../Objects/funcobject.c:194
#5 0x5e5c1b09af6b in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:9736
#6 0x5e5c1b572b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#7 0x5e5c1b572b55 in _PyEval_Vector ../Python/ceval.c:2001
#8 0x5e5c1b55e9e8 in builtin___build_class__ ../Python/bltinmodule.c:205
#9 0x5e5c1b1edee7 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#10 0x5e5c1b1edee7 in PyObject_Vectorcall ../Objects/call.c:327
#11 0x5e5c1b08fad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#12 0x5e5c1b572386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#13 0x5e5c1b572386 in _PyEval_Vector ../Python/ceval.c:2001
#14 0x5e5c1b572386 in PyEval_EvalCode ../Python/ceval.c:884
#15 0x5e5c1b730f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#16 0x5e5c1b730f0e in run_mod ../Python/pythonrun.c:1459
#17 0x5e5c1b735bb7 in pyrun_file ../Python/pythonrun.c:1293
#18 0x5e5c1b735bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#19 0x5e5c1b7366dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#20 0x5e5c1b7a9afc in pymain_run_file_obj ../Modules/main.c:410
#21 0x5e5c1b7a9afc in pymain_run_file ../Modules/main.c:429
#22 0x5e5c1b7a9afc in pymain_run_python ../Modules/main.c:691
#23 0x5e5c1b7ab3de in Py_RunMain ../Modules/main.c:772
#24 0x5e5c1b7ab3de in pymain_main ../Modules/main.c:802
#25 0x5e5c1b7ab3de in Py_BytesMain ../Modules/main.c:826
#26 0x738ce35451c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#27 0x738ce354528a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#28 0x5e5c1b0c5fa4 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x21afa4) (BuildId: f28384d3eff6aa8d5f0c5730194edf28c0f6b3bd)
SUMMARY: AddressSanitizer: heap-use-after-free ../Include/refcount.h:129 in _Py_IsImmortal
Shadow bytes around the buggy address:
0x50f000035480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x50f000035500: 00 00 00 fa fa fa fa fa fa fa fa fa fd fd fd fd
0x50f000035580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x50f000035600: fd fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd
0x50f000035680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
=>0x50f000035700: fa fa fa fa fa fa fa fa fd fd[fd]fd fd fd fd fd
0x50f000035780: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
0x50f000035800: fa fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00
0x50f000035880: 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa
0x50f000035900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50f000035980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==343376==ABORTING
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140493
memory leak in multi threading with fork
cpython
?
2025-10-23
# memory leak in multi threading with fork
**Issue:** [https://github.com/python/cpython/issues/140493](https://github.com/python/cpython/issues/140493) · **State:** `closed` · **Created:** `2025-10-23T05:13:11Z`
**Labels:** `type-bug`, `extension-modules`
## Description
# Bug report
### Bug description:
```python
import os, time, unittest
import threading
from test import support
import warnings
NUM_THREADS = 4
class ForkWait(unittest.TestCase):
def f(self, id):
try:
time.sleep(SHORTSLEEP)
except OSError:
pass
def wait_impl(self, cpid, *, exitcode):
support.wait_process(cpid, exitcode=exitcode)
def test_wait(self):
for i in range(NUM_THREADS):
thread = threading.Thread(target=self.f, args=(i,))
thread.start()
for _ in support.sleeping_retry(support.SHORT_TIMEOUT):
break
with warnings.catch_warnings(category=DeprecationWarning, action='ignore'):
if (cpid := os.fork()) == 0:
self.wait_impl(cpid, exitcode=0)
class G:
"""Sequence using __getitem__"""
def __init__(self, seqn):
return v
unittest.main()
```
might need to try for a few times to reproduce, one possible leak is:
```
=================================================================
==2420028==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 168 byte(s) in 3 object(s) allocated from:
#0 0x7023fa1f49c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x56fcf726c174 in _PyStack_UnpackDict ../Objects/call.c:988
#2 0x56fcf726c9f5 in _PyObject_VectorcallDictTstate ../Objects/call.c:140
#3 0x56fcf726cf9c in _PyObject_Call_Prepend ../Objects/call.c:504
#4 0x56fcf7412da0 in call_method ../Objects/typeobject.c:3076
#5 0x56fcf7412da0 in slot_tp_init ../Objects/typeobject.c:10828
#6 0x56fcf7405f67 in type_call ../Objects/typeobject.c:2460
#7 0x56fcf726778d in _PyObject_MakeTpCall ../Objects/call.c:242
#8 0x56fcf710e028 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:3188
#9 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#10 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#11 0x56fcf72694ed in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#12 0x56fcf72694ed in PyObject_CallOneArg ../Objects/call.c:395
#13 0x56fcf7730276 in _PyErr_Display ../Python/pythonrun.c:1157
#14 0x56fcf78f16dc in thread_excepthook_file ../Modules/_threadmodule.c:2294
#15 0x56fcf78f16dc in thread_excepthook ../Modules/_threadmodule.c:2373
#16 0x56fcf710f3b7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2455
#17 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#18 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#19 0x56fcf7273065 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#20 0x56fcf7273065 in method_vectorcall ../Objects/classobject.c:73
#21 0x56fcf726e2be in _PyVectorcall_Call ../Objects/call.c:273
#22 0x56fcf726e2be in _PyObject_Call ../Objects/call.c:348
#23 0x56fcf726e2be in PyObject_Call ../Objects/call.c:373
#24 0x56fcf78f5208 in thread_run ../Modules/_threadmodule.c:387
#25 0x56fcf7770b4f in pythread_wrapper ../Python/thread_pthread.h:234
#26 0x7023fa155a41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234
#27 0x7023f9e98aa3 in start_thread nptl/pthread_create.c:447
Direct leak of 144 byte(s) in 3 object(s) allocated from:
#0 0x7023fa1f49c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x56fcf78f6d7e in ThreadHandle_start ../Modules/_threadmodule.c:450
#2 0x56fcf78f6d7e in do_start_new_thread ../Modules/_threadmodule.c:1920
#3 0x56fcf78f7cfb in thread_PyThread_start_joinable_thread ../Modules/_threadmodule.c:2043
#4 0x56fcf737861c in cfunction_call ../Objects/methodobject.c:564
#5 0x56fcf726778d in _PyObject_MakeTpCall ../Objects/call.c:242
#6 0x56fcf710e028 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:3188
#7 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#8 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#9 0x56fcf7272dc0 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#10 0x56fcf7272dc0 in method_vectorcall ../Objects/classobject.c:95
#11 0x56fcf726e2be in _PyVectorcall_Call ../Objects/call.c:273
#12 0x56fcf726e2be in _PyObject_Call ../Objects/call.c:348
#13 0x56fcf726e2be in PyObject_Call ../Objects/call.c:373
#14 0x56fcf710ef67 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#15 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#16 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#17 0x56fcf726c8e3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#18 0x56fcf726cf9c in _PyObject_Call_Prepend ../Objects/call.c:504
#19 0x56fcf74238e4 in call_method ../Objects/typeobject.c:3076
#20 0x56fcf74238e4 in slot_tp_call ../Objects/typeobject.c:10599
#21 0x56fcf726778d in _PyObject_MakeTpCall ../Objects/call.c:242
#22 0x56fcf710c85c in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#23 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#24 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#25 0x56fcf7272dc0 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#26 0x56fcf7272dc0 in method_vectorcall ../Objects/classobject.c:95
#27 0x56fcf726e2be in _PyVectorcall_Call ../Objects/call.c:273
#28 0x56fcf726e2be in _PyObject_Call ../Objects/call.c:348
#29 0x56fcf726e2be in PyObject_Call ../Objects/call.c:373
#30 0x56fcf710ef67 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#31 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#32 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#33 0x56fcf726c8e3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#34 0x56fcf726cf9c in _PyObject_Call_Prepend ../Objects/call.c:504
#35 0x56fcf74238e4 in call_method ../Objects/typeobject.c:3076
#36 0x56fcf74238e4 in slot_tp_call ../Objects/typeobject.c:10599
#37 0x56fcf726778d in _PyObject_MakeTpCall ../Objects/call.c:242
#38 0x56fcf710bb82 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#39 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#40 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#41 0x56fcf7272dc0 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#42 0x56fcf7272dc0 in method_vectorcall ../Objects/classobject.c:95
#43 0x56fcf726e2be in _PyVectorcall_Call ../Objects/call.c:273
#44 0x56fcf726e2be in _PyObject_Call ../Objects/call.c:348
#45 0x56fcf726e2be in PyObject_Call ../Objects/call.c:373
#46 0x56fcf710ef67 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
Direct leak of 128 byte(s) in 2 object(s) allocated from:
#0 0x7023fa1f49c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x56fcf767dae7 in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x56fcf767dae7 in gc_alloc ../Python/gc.c:2340
#3 0x56fcf767dae7 in _PyObject_GC_NewVar ../Python/gc.c:2382
#4 0x56fcf73efe3b in tuple_alloc ../Objects/tupleobject.c:57
#5 0x56fcf73f2188 in PyTuple_New ../Objects/tupleobject.c:81
#6 0x56fcf73f2188 in PyTuple_New ../Objects/tupleobject.c:75
#7 0x56fcf732e5c0 in dictiter_iternextitem ../Objects/dictobject.c:5709
#8 0x56fcf72f8fd3 in list_extend_iter_lock_held ../Objects/listobject.c:1263
#9 0x56fcf72f8fd3 in _list_extend ../Objects/listobject.c:1452
#10 0x56fcf72fe67c in list_extend_impl ../Objects/listobject.c:1471
#11 0x56fcf72fe67c in list_extend ../Objects/clinic/listobject.c.h:145
#12 0x56fcf72fe67c in _PyList_Extend ../Objects/listobject.c:1480
#13 0x56fcf721b900 in PySequence_List ../Objects/abstract.c:2086
#14 0x56fcf7221f9a in method_output_as_list ../Objects/abstract.c:2446
#15 0x56fcf7221f9a in PyMapping_Items ../Objects/abstract.c:2472
#16 0x56fcf7901e76 in compute_abstract_methods ../Modules/_abc.c:380
#17 0x56fcf7901e76 in _abc__abc_init ../Modules/_abc.c:502
#18 0x56fcf710f3b7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2455
#19 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#20 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#21 0x56fcf726c8e3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#22 0x56fcf726cf9c in _PyObject_Call_Prepend ../Objects/call.c:504
#23 0x56fcf73f5fc0 in slot_tp_new ../Objects/typeobject.c:10853
#24 0x56fcf7405e78 in type_call ../Objects/typeobject.c:2448
#25 0x56fcf726778d in _PyObject_MakeTpCall ../Objects/call.c:242
#26 0x56fcf726e7c3 in _PyObject_VectorcallDictTstate ../Objects/call.c:130
#27 0x56fcf726e7c3 in PyObject_VectorcallDict ../Objects/call.c:159
#28 0x56fcf75d3b41 in builtin___build_class__ ../Python/bltinmodule.c:213
#29 0x56fcf72691a7 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#30 0x56fcf72691a7 in PyObject_Vectorcall ../Objects/call.c:327
#31 0x56fcf710bb82 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#32 0x56fcf75e73e6 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#33 0x56fcf75e73e6 in _PyEval_Vector ../Python/ceval.c:2001
#34 0x56fcf75e73e6 in PyEval_EvalCode ../Python/ceval.c:884
#35 0x56fcf75d17b8 in builtin_exec_impl ../Python/bltinmodule.c:1180
#36 0x56fcf75d17b8 in builtin_exec ../Python/clinic/bltinmodule.c.h:571
#37 0x56fcf726e2be in _PyVectorcall_Call ../Objects/call.c:273
#38 0x56fcf726e2be in _PyObject_Call ../Objects/call.c:348
#39 0x56fcf726e2be in PyObject_Call ../Objects/call.c:373
#40 0x56fcf710ef67 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#41 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#42 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#43 0x56fcf7268322 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#44 0x56fcf7268322 in object_vacall ../Objects/call.c:819
#45 0x56fcf726b971 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#46 0x56fcf76afb73 in import_find_and_load ../Python/import.c:3701
#47 0x56fcf76afb73 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#48 0x56fcf75ca3cc in builtin___import___impl ../Python/bltinmodule.c:285
#49 0x56fcf75ca3cc in builtin___import__ ../Python/clinic/bltinmodule.c.h:110
Direct leak of 104 byte(s) in 1 object(s) allocated from:
#0 0x7023fa1f49c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x56fcf724b23f in _PyBytes_FromSize ../Objects/bytesobject.c:126
#2 0x56fcf724b23f in PyBytes_FromStringAndSize ../Objects/bytesobject.c:156
#3 0x56fcf74972a7 in unicode_encode_utf8 ../Objects/unicodeobject.c:5773
#4 0x56fcf74bf36b in PyUnicode_EncodeFSDefault ../Objects/unicodeobject.c:3822
#5 0x56fcf77e34e0 in path_converter ../Modules/posixmodule.c:1464
#6 0x56fcf77ed58f in os_stat ../Modules/clinic/posixmodule.c.h:86
#7 0x56fcf71307e6 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2361
#8 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#9 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#10 0x56fcf726ca52 in _PyObject_VectorcallDictTstate ../Objects/call.c:146
#11 0x56fcf726cf9c in _PyObject_Call_Prepend ../Objects/call.c:504
#12 0x56fcf7412da0 in call_method ../Objects/typeobject.c:3076
#13 0x56fcf7412da0 in slot_tp_init ../Objects/typeobject.c:10828
#14 0x56fcf7405f67 in type_call ../Objects/typeobject.c:2460
#15 0x56fcf726778d in _PyObject_MakeTpCall ../Objects/call.c:242
#16 0x56fcf710e028 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:3188
#17 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#18 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#19 0x56fcf72694ed in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#20 0x56fcf72694ed in PyObject_CallOneArg ../Objects/call.c:395
#21 0x56fcf7730276 in _PyErr_Display ../Python/pythonrun.c:1157
#22 0x56fcf78f16dc in thread_excepthook_file ../Modules/_threadmodule.c:2294
#23 0x56fcf78f16dc in thread_excepthook ../Modules/_threadmodule.c:2373
#24 0x56fcf710f3b7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2455
#25 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#26 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#27 0x56fcf7273065 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#28 0x56fcf7273065 in method_vectorcall ../Objects/classobject.c:73
#29 0x56fcf726e2be in _PyVectorcall_Call ../Objects/call.c:273
#30 0x56fcf726e2be in _PyObject_Call ../Objects/call.c:348
#31 0x56fcf726e2be in PyObject_Call ../Objects/call.c:373
#32 0x56fcf78f5208 in thread_run ../Modules/_threadmodule.c:387
#33 0x56fcf7770b4f in pythread_wrapper ../Python/thread_pthread.h:234
#34 0x7023fa155a41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234
#35 0x7023f9e98aa3 in start_thread nptl/pthread_create.c:447
Direct leak of 91 byte(s) in 1 object(s) allocated from:
#0 0x7023fa1f49c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x56fcf724b23f in _PyBytes_FromSize ../Objects/bytesobject.c:126
#2 0x56fcf724b23f in PyBytes_FromStringAndSize ../Objects/bytesobject.c:156
#3 0x56fcf74972a7 in unicode_encode_utf8 ../Objects/unicodeobject.c:5773
#4 0x56fcf74bf36b in PyUnicode_EncodeFSDefault ../Objects/unicodeobject.c:3822
#5 0x56fcf74bf75f in PyUnicode_FSConverter ../Objects/unicodeobject.c:4104
#6 0x56fcf7861d95 in _io_FileIO___init___impl ../Modules/_io/fileio.c:310
#7 0x56fcf7861d95 in _io_FileIO___init__ ../Modules/_io/clinic/fileio.c.h:137
#8 0x56fcf7405f67 in type_call ../Objects/typeobject.c:2460
#9 0x56fcf726778d in _PyObject_MakeTpCall ../Objects/call.c:242
#10 0x56fcf7268d4f in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:167
#11 0x56fcf7268d4f in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:154
#12 0x56fcf7268d4f in _PyObject_CallFunctionVa ../Objects/call.c:552
#13 0x56fcf7269c79 in PyObject_CallFunction ../Objects/call.c:574
#14 0x56fcf78592b0 in _io_open_impl ../Modules/_io/_iomodule.c:331
#15 0x56fcf78592b0 in _io_open ../Modules/_io/clinic/_iomodule.c.h:296
#16 0x56fcf71307e6 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2361
#17 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#18 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#19 0x56fcf726ca52 in _PyObject_VectorcallDictTstate ../Objects/call.c:146
#20 0x56fcf726cf9c in _PyObject_Call_Prepend ../Objects/call.c:504
#21 0x56fcf7412da0 in call_method ../Objects/typeobject.c:3076
#22 0x56fcf7412da0 in slot_tp_init ../Objects/typeobject.c:10828
#23 0x56fcf7405f67 in type_call ../Objects/typeobject.c:2460
#24 0x56fcf726778d in _PyObject_MakeTpCall ../Objects/call.c:242
#25 0x56fcf710e028 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:3188
#26 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#27 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#28 0x56fcf72694ed in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#29 0x56fcf72694ed in PyObject_CallOneArg ../Objects/call.c:395
#30 0x56fcf7730276 in _PyErr_Display ../Python/pythonrun.c:1157
#31 0x56fcf78f16dc in thread_excepthook_file ../Modules/_threadmodule.c:2294
#32 0x56fcf78f16dc in thread_excepthook ../Modules/_threadmodule.c:2373
#33 0x56fcf710f3b7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2455
#34 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#35 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#36 0x56fcf7273065 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#37 0x56fcf7273065 in method_vectorcall ../Objects/classobject.c:73
#38 0x56fcf726e2be in _PyVectorcall_Call ../Objects/call.c:273
#39 0x56fcf726e2be in _PyObject_Call ../Objects/call.c:348
#40 0x56fcf726e2be in PyObject_Call ../Objects/call.c:373
#41 0x56fcf78f5208 in thread_run ../Modules/_threadmodule.c:387
#42 0x56fcf7770b4f in pythread_wrapper ../Python/thread_pthread.h:234
#43 0x7023fa155a41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234
Direct leak of 80 byte(s) in 1 object(s) allocated from:
#0 0x7023fa1f49c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x56fcf767dae7 in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x56fcf767dae7 in gc_alloc ../Python/gc.c:2340
#3 0x56fcf767dae7 in _PyObject_GC_NewVar ../Python/gc.c:2382
#4 0x56fcf73efe3b in tuple_alloc ../Objects/tupleobject.c:57
#5 0x56fcf73f2188 in PyTuple_New ../Objects/tupleobject.c:81
#6 0x56fcf73f2188 in PyTuple_New ../Objects/tupleobject.c:75
#7 0x56fcf76f8d20 in r_object ../Python/marshal.c:1372
#8 0x56fcf76f9a93 in r_object ../Python/marshal.c:1554
#9 0x56fcf76f8d94 in r_object ../Python/marshal.c:1378
#10 0x56fcf76f9a93 in r_object ../Python/marshal.c:1554
#11 0x56fcf76feb3f in read_object ../Python/marshal.c:1714
#12 0x56fcf76fefb0 in marshal_loads_impl ../Python/marshal.c:2059
#13 0x56fcf76fefb0 in marshal_loads ../Python/clinic/marshal.c.h:344
#14 0x56fcf71307e6 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2361
#15 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#16 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#17 0x56fcf7268322 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#18 0x56fcf7268322 in object_vacall ../Objects/call.c:819
#19 0x56fcf726b971 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#20 0x56fcf76afb73 in import_find_and_load ../Python/import.c:3701
#21 0x56fcf76afb73 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#22 0x56fcf75e27f5 in _PyEval_ImportName ../Python/ceval.c:3017
#23 0x56fcf71217ce in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#24 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#25 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#26 0x56fcf726ca52 in _PyObject_VectorcallDictTstate ../Objects/call.c:146
#27 0x56fcf726cf9c in _PyObject_Call_Prepend ../Objects/call.c:504
#28 0x56fcf7412da0 in call_method ../Objects/typeobject.c:3076
#29 0x56fcf7412da0 in slot_tp_init ../Objects/typeobject.c:10828
#30 0x56fcf7405f67 in type_call ../Objects/typeobject.c:2460
#31 0x56fcf726778d in _PyObject_MakeTpCall ../Objects/call.c:242
#32 0x56fcf710dc7a in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2920
#33 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#34 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#35 0x56fcf726c8e3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#36 0x56fcf726cf9c in _PyObject_Call_Prepend ../Objects/call.c:504
#37 0x56fcf7412da0 in call_method ../Objects/typeobject.c:3076
#38 0x56fcf7412da0 in slot_tp_init ../Objects/typeobject.c:10828
#39 0x56fcf7405f67 in type_call ../Objects/typeobject.c:2460
#40 0x56fcf726778d in _PyObject_MakeTpCall ../Objects/call.c:242
Direct leak of 64 byte(s) in 1 object(s) allocated from:
#0 0x7023fa1f49c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x56fcf767dae7 in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x56fcf767dae7 in gc_alloc ../Python/gc.c:2340
#3 0x56fcf767dae7 in _PyObject_GC_NewVar ../Python/gc.c:2382
#4 0x56fcf73efe3b in tuple_alloc ../Objects/tupleobject.c:57
#5 0x56fcf73f0fc4 in PyTuple_FromArray ../Objects/tupleobject.c:375
#6 0x56fcf72f9cac in list_extend_dictitems ../Objects/listobject.c:1387
#7 0x56fcf72f9cac in _list_extend ../Objects/listobject.c:1447
#8 0x56fcf72fe67c in list_extend_impl ../Objects/listobject.c:1471
#9 0x56fcf72fe67c in list_extend ../Objects/clinic/listobject.c.h:145
#10 0x56fcf72fe67c in _PyList_Extend ../Objects/listobject.c:1480
#11 0x56fcf721b900 in PySequence_List ../Objects/abstract.c:2086
#12 0x56fcf75c9021 in builtin_sorted ../Python/bltinmodule.c:2652
#13 0x56fcf72691a7 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#14 0x56fcf72691a7 in PyObject_Vectorcall ../Objects/call.c:327
#15 0x56fcf710bb82 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#16 0x56fcf75e73e6 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#17 0x56fcf75e73e6 in _PyEval_Vector ../Python/ceval.c:2001
#18 0x56fcf75e73e6 in PyEval_EvalCode ../Python/ceval.c:884
#19 0x56fcf75d17b8 in builtin_exec_impl ../Python/bltinmodule.c:1180
#20 0x56fcf75d17b8 in builtin_exec ../Python/clinic/bltinmodule.c.h:571
#21 0x56fcf726e2be in _PyVectorcall_Call ../Objects/call.c:273
#22 0x56fcf726e2be in _PyObject_Call ../Objects/call.c:348
#23 0x56fcf726e2be in PyObject_Call ../Objects/call.c:373
#24 0x56fcf710ef67 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#25 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#26 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#27 0x56fcf7268322 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#28 0x56fcf7268322 in object_vacall ../Objects/call.c:819
#29 0x56fcf726b971 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#30 0x56fcf76afb73 in import_find_and_load ../Python/import.c:3701
#31 0x56fcf76afb73 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#32 0x56fcf75e27f5 in _PyEval_ImportName ../Python/ceval.c:3017
#33 0x56fcf71217ce in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:6219
#34 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#35 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#36 0x56fcf726ca52 in _PyObject_VectorcallDictTstate ../Objects/call.c:146
#37 0x56fcf726cf9c in _PyObject_Call_Prepend ../Objects/call.c:504
#38 0x56fcf7412da0 in call_method ../Objects/typeobject.c:3076
#39 0x56fcf7412da0 in slot_tp_init ../Objects/typeobject.c:10828
#40 0x56fcf7405f67 in type_call ../Objects/typeobject.c:2460
#41 0x56fcf726778d in _PyObject_MakeTpCall ../Objects/call.c:242
#42 0x56fcf710dc7a in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2920
#43 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#44 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#45 0x56fcf726c8e3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#46 0x56fcf726cf9c in _PyObject_Call_Prepend ../Objects/call.c:504
Direct leak of 56 byte(s) in 1 object(s) allocated from:
#0 0x7023fa1f49c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x56fcf726c174 in _PyStack_UnpackDict ../Objects/call.c:988
#2 0x56fcf726c9f5 in _PyObject_VectorcallDictTstate ../Objects/call.c:140
#3 0x56fcf726cf9c in _PyObject_Call_Prepend ../Objects/call.c:504
#4 0x56fcf7412da0 in call_method ../Objects/typeobject.c:3076
#5 0x56fcf7412da0 in slot_tp_init ../Objects/typeobject.c:10828
#6 0x56fcf7405f67 in type_call ../Objects/typeobject.c:2460
#7 0x56fcf726778d in _PyObject_MakeTpCall ../Objects/call.c:242
#8 0x56fcf710dc7a in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2920
#9 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#10 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#11 0x56fcf72694ed in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#12 0x56fcf72694ed in PyObject_CallOneArg ../Objects/call.c:395
#13 0x56fcf7730276 in _PyErr_Display ../Python/pythonrun.c:1157
#14 0x56fcf78f16dc in thread_excepthook_file ../Modules/_threadmodule.c:2294
#15 0x56fcf78f16dc in thread_excepthook ../Modules/_threadmodule.c:2373
#16 0x56fcf72691a7 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#17 0x56fcf72691a7 in PyObject_Vectorcall ../Objects/call.c:327
#18 0x56fcf710bb82 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#19 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#20 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#21 0x56fcf7273065 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#22 0x56fcf7273065 in method_vectorcall ../Objects/classobject.c:73
#23 0x56fcf726e2be in _PyVectorcall_Call ../Objects/call.c:273
#24 0x56fcf726e2be in _PyObject_Call ../Objects/call.c:348
#25 0x56fcf726e2be in PyObject_Call ../Objects/call.c:373
#26 0x56fcf78f5208 in thread_run ../Modules/_threadmodule.c:387
#27 0x56fcf7770b4f in pythread_wrapper ../Python/thread_pthread.h:234
#28 0x7023fa155a41 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234
#29 0x7023f9e98aa3 in start_thread nptl/pthread_create.c:447
Direct leak of 48 byte(s) in 1 object(s) allocated from:
#0 0x7023fa1f49c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x56fcf78f6d7e in ThreadHandle_start ../Modules/_threadmodule.c:450
#2 0x56fcf78f6d7e in do_start_new_thread ../Modules/_threadmodule.c:1920
#3 0x56fcf78f7cfb in thread_PyThread_start_joinable_thread ../Modules/_threadmodule.c:2043
#4 0x56fcf737861c in cfunction_call ../Objects/methodobject.c:564
#5 0x56fcf726778d in _PyObject_MakeTpCall ../Objects/call.c:242
#6 0x56fcf710dc7a in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2920
#7 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#8 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#9 0x56fcf7272dc0 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#10 0x56fcf7272dc0 in method_vectorcall ../Objects/classobject.c:95
#11 0x56fcf726e2be in _PyVectorcall_Call ../Objects/call.c:273
#12 0x56fcf726e2be in _PyObject_Call ../Objects/call.c:348
#13 0x56fcf726e2be in PyObject_Call ../Objects/call.c:373
#14 0x56fcf710ef67 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#15 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#16 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#17 0x56fcf726c8e3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#18 0x56fcf726cf9c in _PyObject_Call_Prepend ../Objects/call.c:504
#19 0x56fcf74238e4 in call_method ../Objects/typeobject.c:3076
#20 0x56fcf74238e4 in slot_tp_call ../Objects/typeobject.c:10599
#21 0x56fcf726778d in _PyObject_MakeTpCall ../Objects/call.c:242
#22 0x56fcf710c85c in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#23 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#24 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#25 0x56fcf7272dc0 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#26 0x56fcf7272dc0 in method_vectorcall ../Objects/classobject.c:95
#27 0x56fcf726e2be in _PyVectorcall_Call ../Objects/call.c:273
#28 0x56fcf726e2be in _PyObject_Call ../Objects/call.c:348
#29 0x56fcf726e2be in PyObject_Call ../Objects/call.c:373
#30 0x56fcf710ef67 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#31 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#32 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#33 0x56fcf726c8e3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#34 0x56fcf726cf9c in _PyObject_Call_Prepend ../Objects/call.c:504
#35 0x56fcf74238e4 in call_method ../Objects/typeobject.c:3076
#36 0x56fcf74238e4 in slot_tp_call ../Objects/typeobject.c:10599
#37 0x56fcf726778d in _PyObject_MakeTpCall ../Objects/call.c:242
#38 0x56fcf710bb82 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#39 0x56fcf75e7bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#40 0x56fcf75e7bb5 in _PyEval_Vector ../Python/ceval.c:2001
#41 0x56fcf7272dc0 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#42 0x56fcf7272dc0 in method_vectorcall ../Objects/classobject.c:95
#43 0x56fcf726e2be in _PyVectorcall_Call ../Objects/call.c:273
#44 0x56fcf726e2be in _PyObject_Call ../Objects/call.c:348
#45 0x56fcf726e2be in PyObject_Call ../Objects/call.c:373
#46 0x56fcf710ef67 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
SUMMARY: AddressSanitizer: 883 byte(s) leaked in 14 allocation(s).
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140492
heap buffer overflow in ast _copy_characters
cpython
?
2025-10-23
# heap buffer overflow in ast _copy_characters
**Issue:** [https://github.com/python/cpython/issues/140492](https://github.com/python/cpython/issues/140492) · **State:** `closed` · **Created:** `2025-10-23T05:07:46Z`
**Labels:** `interpreter-core`, `type-crash`
## Description
# Crash report
### What happened?
could be related to #140471
```python
import ast
import unittest
class ASTConstructorTests(unittest.TestCase):
def test_fields_and_types_no_default(self):
class FieldsAndTypesNoDefault(ast.AST):
_fields = (b'\xff'*64,)
_field_types = {'a': int}
with self.assertRaises(TypeError):
FieldsAndTypesNoDefault()
if __name__ == "__main__":
unittest.main()
```
```
=================================================================
==2418698==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50b000019590 at pc 0x5f657c332a6b bp 0x7ffdb21fd570 sp 0x7ffdb21fd560
READ of size 4 at 0x50b000019590 thread T0
#0 0x5f657c332a6a in _copy_characters ../Objects/unicodeobject.c:1526
#1 0x5f657c38f5bc in _PyUnicode_FastCopyCharacters ../Objects/unicodeobject.c:1558
#2 0x5f657c38f5bc in _PyUnicodeWriter_WriteStr ../Objects/unicodeobject.c:13754
#3 0x5f657c39844d in unicode_fromformat_arg ../Objects/unicodeobject.c:2991
#4 0x5f657c39844d in unicode_from_format ../Objects/unicodeobject.c:3165
#5 0x5f657c39b1da in PyUnicode_FromFormatV ../Objects/unicodeobject.c:3199
#6 0x5f657c3d4ec2 in _PyErr_WarnFormatV ../Python/_warnings.c:1379
#7 0x5f657c3d4ec2 in PyErr_WarnFormat ../Python/_warnings.c:1396
#8 0x5f657c3fe40b in ast_type_init ../Python/Python-ast.c:5329
#9 0x5f657c2b9f67 in type_call ../Objects/typeobject.c:2460
#10 0x5f657c11b78d in _PyObject_MakeTpCall ../Objects/call.c:242
#11 0x5f657bfdb388 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#12 0x5f657c49bbb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#13 0x5f657c49bbb5 in _PyEval_Vector ../Python/ceval.c:2001
#14 0x5f657c126dc0 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#15 0x5f657c126dc0 in method_vectorcall ../Objects/classobject.c:95
#16 0x5f657c1222be in _PyVectorcall_Call ../Objects/call.c:273
#17 0x5f657c1222be in _PyObject_Call ../Objects/call.c:348
#18 0x5f657c1222be in PyObject_Call ../Objects/call.c:373
#19 0x5f657bfc2f67 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#20 0x5f657c49bbb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#21 0x5f657c49bbb5 in _PyEval_Vector ../Python/ceval.c:2001
#22 0x5f657c1208e3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#23 0x5f657c120f9c in _PyObject_Call_Prepend ../Objects/call.c:504
#24 0x5f657c2d78e4 in call_method ../Objects/typeobject.c:3076
#25 0x5f657c2d78e4 in slot_tp_call ../Objects/typeobject.c:10599
#26 0x5f657c11b78d in _PyObject_MakeTpCall ../Objects/call.c:242
#27 0x5f657bfc085c in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#28 0x5f657c49bbb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#29 0x5f657c49bbb5 in _PyEval_Vector ../Python/ceval.c:2001
#30 0x5f657c126dc0 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#31 0x5f657c126dc0 in method_vectorcall ../Objects/classobject.c:95
#32 0x5f657c1222be in _PyVectorcall_Call ../Objects/call.c:273
#33 0x5f657c1222be in _PyObject_Call ../Objects/call.c:348
#34 0x5f657c1222be in PyObject_Call ../Objects/call.c:373
#35 0x5f657bfc2f67 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#36 0x5f657c49bbb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#37 0x5f657c49bbb5 in _PyEval_Vector ../Python/ceval.c:2001
#38 0x5f657c1208e3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#39 0x5f657c120f9c in _PyObject_Call_Prepend ../Objects/call.c:504
#40 0x5f657c2d78e4 in call_method ../Objects/typeobject.c:3076
#41 0x5f657c2d78e4 in slot_tp_call ../Objects/typeobject.c:10599
#42 0x5f657c11b78d in _PyObject_MakeTpCall ../Objects/call.c:242
#43 0x5f657bfbfb82 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#44 0x5f657c49bbb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#45 0x5f657c49bbb5 in _PyEval_Vector ../Python/ceval.c:2001
#46 0x5f657c126dc0 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#47 0x5f657c126dc0 in method_vectorcall ../Objects/classobject.c:95
#48 0x5f657c1222be in _PyVectorcall_Call ../Objects/call.c:273
#49 0x5f657c1222be in _PyObject_Call ../Objects/call.c:348
#50 0x5f657c1222be in PyObject_Call ../Objects/call.c:373
#51 0x5f657bfc2f67 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#52 0x5f657c49bbb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#53 0x5f657c49bbb5 in _PyEval_Vector ../Python/ceval.c:2001
#54 0x5f657c1208e3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#55 0x5f657c120f9c in _PyObject_Call_Prepend ../Objects/call.c:504
#56 0x5f657c2d78e4 in call_method ../Objects/typeobject.c:3076
#57 0x5f657c2d78e4 in slot_tp_call ../Objects/typeobject.c:10599
#58 0x5f657c11b78d in _PyObject_MakeTpCall ../Objects/call.c:242
#59 0x5f657bfbfb82 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#60 0x5f657c49bbb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#61 0x5f657c49bbb5 in _PyEval_Vector ../Python/ceval.c:2001
#62 0x5f657c1208e3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#63 0x5f657c120f9c in _PyObject_Call_Prepend ../Objects/call.c:504
#64 0x5f657c2c6da0 in call_method ../Objects/typeobject.c:3076
#65 0x5f657c2c6da0 in slot_tp_init ../Objects/typeobject.c:10828
#66 0x5f657c2b9f67 in type_call ../Objects/typeobject.c:2460
#67 0x5f657c11b78d in _PyObject_MakeTpCall ../Objects/call.c:242
#68 0x5f657bfdb388 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#69 0x5f657c49b3e6 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#70 0x5f657c49b3e6 in _PyEval_Vector ../Python/ceval.c:2001
#71 0x5f657c49b3e6 in PyEval_EvalCode ../Python/ceval.c:884
#72 0x5f657c5e0cce in run_eval_code_obj ../Python/pythonrun.c:1365
#73 0x5f657c5e0cce in run_mod ../Python/pythonrun.c:1459
#74 0x5f657c5e5977 in pyrun_file ../Python/pythonrun.c:1293
#75 0x5f657c5e5977 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#76 0x5f657c5e649c in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#77 0x5f657c6597fc in pymain_run_file_obj ../Modules/main.c:410
#78 0x5f657c6597fc in pymain_run_file ../Modules/main.c:429
#79 0x5f657c6597fc in pymain_run_python ../Modules/main.c:691
#80 0x5f657c65b0de in Py_RunMain ../Modules/main.c:772
#81 0x5f657c65b0de in pymain_main ../Modules/main.c:802
#82 0x5f657c65b0de in Py_BytesMain ../Modules/main.c:826
#83 0x75dd51f291c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#84 0x75dd51f2928a in __libc_start_main_impl ../csu/libc-start.c:360
#85 0x5f657bff5524 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython-normal/build/python+0x20e524) (BuildId: b922665a0e7afc8ee52df7c3eac25a643025109e)
0x50b000019591 is located 0 bytes after 97-byte region [0x50b000019530,0x50b000019591)
allocated by thread T0 here:
#0 0x75dd522f79c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5f657c10e2d5 in bytes_repeat ../Objects/bytesobject.c:1521
#2 0x5f657c518dff in const_folding_safe_multiply ../Python/flowgraph.c:1727
#3 0x5f657c518dff in eval_const_binop ../Python/flowgraph.c:1795
#4 0x5f657c518dff in fold_const_binop ../Python/flowgraph.c:1867
#5 0x5f657c518dff in optimize_basic_block ../Python/flowgraph.c:2489
#6 0x5f657c51be2d in optimize_cfg ../Python/flowgraph.c:2543
#7 0x5f657c51be2d in _PyCfg_OptimizeCodeUnit ../Python/flowgraph.c:3655
#8 0x5f657c4ddcd9 in optimize_and_assemble_code_unit ../Python/compile.c:1432
#9 0x5f657c4ddcd9 in _PyCompile_OptimizeAndAssemble ../Python/compile.c:1474
#10 0x5f657c4cd1a7 in codegen_class_body ../Python/codegen.c:1605
#11 0x5f657c4cd1a7 in codegen_class ../Python/codegen.c:1662
#12 0x5f657c4c5bc9 in codegen_visit_stmt ../Python/codegen.c:3008
#13 0x5f657c4d386a in codegen_function_body ../Python/codegen.c:1382
#14 0x5f657c4d386a in codegen_function ../Python/codegen.c:1480
#15 0x5f657c4c5bf3 in codegen_visit_stmt ../Python/codegen.c:3095
#16 0x5f657c4cadd6 in codegen_body ../Python/codegen.c:911
#17 0x5f657c4ccf42 in codegen_class_body ../Python/codegen.c:1569
#18 0x5f657c4ccf42 in codegen_class ../Python/codegen.c:1662
#19 0x5f657c4c5bc9 in codegen_visit_stmt ../Python/codegen.c:3008
#20 0x5f657c4cadd6 in codegen_body ../Python/codegen.c:911
#21 0x5f657c4d6094 in _PyCodegen_Module ../Python/codegen.c:874
#22 0x5f657c4d7d18 in compiler_codegen ../Python/compile.c:835
#23 0x5f657c4de481 in compiler_mod ../Python/compile.c:856
#24 0x5f657c4de481 in _PyAST_Compile ../Python/compile.c:1487
#25 0x5f657c5e0e1c in run_mod ../Python/pythonrun.c:1411
#26 0x5f657c5e5977 in pyrun_file ../Python/pythonrun.c:1293
#27 0x5f657c5e5977 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#28 0x5f657c5e649c in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#29 0x5f657c6597fc in pymain_run_file_obj ../Modules/main.c:410
#30 0x5f657c6597fc in pymain_run_file ../Modules/main.c:429
#31 0x5f657c6597fc in pymain_run_python ../Modules/main.c:691
#32 0x5f657c65b0de in Py_RunMain ../Modules/main.c:772
#33 0x5f657c65b0de in pymain_main ../Modules/main.c:802
#34 0x5f657c65b0de in Py_BytesMain ../Modules/main.c:826
#35 0x75dd51f291c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#36 0x75dd51f2928a in __libc_start_main_impl ../csu/libc-start.c:360
#37 0x5f657bff5524 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython-normal/build/python+0x20e524) (BuildId: b922665a0e7afc8ee52df7c3eac25a643025109e)
SUMMARY: AddressSanitizer: heap-buffer-overflow ../Objects/unicodeobject.c:1526 in _copy_characters
Shadow bytes around the buggy address:
0x50b000019300: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
0x50b000019380: 03 fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd
0x50b000019400: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
0x50b000019480: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
0x50b000019500: fa fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00
=>0x50b000019580: 00 00[01]fa fa fa fa fa fa fa fa fa fd fd fd fd
0x50b000019600: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
0x50b000019680: fa fa fd fd fd fd fd fd fd fd fd fd fd fd fd fa
0x50b000019700: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x50b000019780: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fd fd
0x50b000019800: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2418698==ABORTING
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#20266
SEGV Zend/zend_types.h in zend_gc_refcount
php
?
2025-10-23
# SEGV Zend/zend_types.h in zend_gc_refcount
**Issue:** [https://github.com/php/php-src/issues/20266](https://github.com/php/php-src/issues/20266) · **State:** `closed` · **Created:** `2025-10-23T06:19:39Z`
**Labels:** `Bug`, `Status: Duplicate`
## Description
### Description
The following code:
```php
<?php
set_error_handler(function ($errno, $errstr) {
global $nan;
$nan = bin2hex(random_bytes(4));
});
settype($nan, 'object');
try {next($nan);} catch (Exception $e) { echo($e); }
```
Resulted in this output:
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1382==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x000003f9f57e bp 0x7ffcea9a2a50 sp 0x7ffcea9a2a30 T0)
==1382==The signal is caused by a READ memory access.
==1382==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used.
#0 0x3f9f57e in zend_gc_refcount /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_types.h:1355:12
#1 0x3fb06ae in get_ht_for_iap /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/standard/array.c:1003:38
#2 0x3fb3c76 in zif_next /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/standard/array.c:1105:21
#3 0x60463be in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:1355:2
#4 0x5b62a3b in execute_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:115764:12
#5 0x5b64fcc in zend_execute /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:121476:2
#6 0x68ebc29 in zend_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1977:3
#7 0x50c283a in php_execute_script_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2640:13
#8 0x50c3978 in php_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2680:9
#9 0x6900b3a in do_cli /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:951:5
#10 0x68faf1f in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1362:18
#11 0x73f315b7bd8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#12 0x73f315b7be3f in __libc_start_main csu/../csu/libc-start.c:392:3
#13 0x606204 in _start (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x606204)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_types.h:1355:12 in zend_gc_refcount
==1382==ABORTING
```
To reproduce:
```
./php-src/sapi/cli/php -d "opcache.enable_cli=1" ./test.php
```
Commit:
```
02d187d7663afdde5027f72fad180079806c4fc9
```
Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```
Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```
*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*
### PHP Version
```plain
nightly
```
### Operating System
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140474
memory leak in array.array
cpython
?
2025-10-22
# memory leak in array.array
**Issue:** [https://github.com/python/cpython/issues/140474](https://github.com/python/cpython/issues/140474) · **State:** `closed` · **Created:** `2025-10-22T19:21:11Z`
**Labels:** `type-bug`, `extension-modules`
## Description
# Bug report
### Bug description:
```python
import unittest
import array
class UnicodeTest(unittest.TestCase):
typecode = 'u'
def test(self):
invalid_str = ''
a = array.array(self.typecode, invalid_str)
if __name__ == "__main__":
unittest.main()
```
```
=================================================================
==2132310==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 4 byte(s) in 1 object(s) allocated from:
#0 0x7e19c9bb79c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x6233e8b99bb8 in PyUnicode_AsWideCharString ../Objects/unicodeobject.c:3380
#2 0x7e19c6456922 in array_new ../Modules/arraymodule.c:2822
#3 0x6233e8aec8e8 in type_call ../Objects/typeobject.c:2449
#4 0x6233e89484cd in _PyObject_MakeTpCall ../Objects/call.c:242
#5 0x6233e87ebad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#6 0x6233e8cceb55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#7 0x6233e8cceb55 in _PyEval_Vector ../Python/ceval.c:2001
#8 0x6233e8953d90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#9 0x6233e8953d90 in method_vectorcall ../Objects/classobject.c:95
#10 0x6233e894effe in _PyVectorcall_Call ../Objects/call.c:273
#11 0x6233e894effe in _PyObject_Call ../Objects/call.c:348
#12 0x6233e894effe in PyObject_Call ../Objects/call.c:373
#13 0x6233e87eeeb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#14 0x6233e8cceb55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#15 0x6233e8cceb55 in _PyEval_Vector ../Python/ceval.c:2001
#16 0x6233e894d623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#17 0x6233e894dcdc in _PyObject_Call_Prepend ../Objects/call.c:504
#18 0x6233e8b0e444 in call_method ../Objects/typeobject.c:3077
#19 0x6233e8b0e444 in slot_tp_call ../Objects/typeobject.c:10606
#20 0x6233e89484cd in _PyObject_MakeTpCall ../Objects/call.c:242
#21 0x6233e87ec7ac in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#22 0x6233e8cceb55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#23 0x6233e8cceb55 in _PyEval_Vector ../Python/ceval.c:2001
#24 0x6233e8953d90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#25 0x6233e8953d90 in method_vectorcall ../Objects/classobject.c:95
#26 0x6233e894effe in _PyVectorcall_Call ../Objects/call.c:273
#27 0x6233e894effe in _PyObject_Call ../Objects/call.c:348
#28 0x6233e894effe in PyObject_Call ../Objects/call.c:373
#29 0x6233e87eeeb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#30 0x6233e8cceb55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#31 0x6233e8cceb55 in _PyEval_Vector ../Python/ceval.c:2001
#32 0x6233e894d623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#33 0x6233e894dcdc in _PyObject_Call_Prepend ../Objects/call.c:504
#34 0x6233e8b0e444 in call_method ../Objects/typeobject.c:3077
#35 0x6233e8b0e444 in slot_tp_call ../Objects/typeobject.c:10606
#36 0x6233e89484cd in _PyObject_MakeTpCall ../Objects/call.c:242
#37 0x6233e87ebad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#38 0x6233e8cceb55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#39 0x6233e8cceb55 in _PyEval_Vector ../Python/ceval.c:2001
#40 0x6233e8953d90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#41 0x6233e8953d90 in method_vectorcall ../Objects/classobject.c:95
#42 0x6233e894effe in _PyVectorcall_Call ../Objects/call.c:273
#43 0x6233e894effe in _PyObject_Call ../Objects/call.c:348
#44 0x6233e894effe in PyObject_Call ../Objects/call.c:373
#45 0x6233e87eeeb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
SUMMARY: AddressSanitizer: 4 byte(s) leaked in 1 allocation(s).
```
### CPython versions tested on:
3.15
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-140478
* gh-140498
* gh-140499
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140471
global-buffer-overflow PyUnicode_GET_LENGTH cpython/unicodeobject.h
cpython
?
2025-10-22
# global-buffer-overflow PyUnicode_GET_LENGTH cpython/unicodeobject.h
**Issue:** [https://github.com/python/cpython/issues/140471](https://github.com/python/cpython/issues/140471) · **State:** `closed` · **Created:** `2025-10-22T17:32:46Z`
**Labels:** `interpreter-core`, `topic-unicode`, `type-crash`
## Description
# Crash report
### What happened?
```python
import ast
import unittest
class ASTConstructorTests(unittest.TestCase):
def test_incomplete_field_types(self):
class MoreFieldsThanTypes(ast.AST):
_fields = (None, 'b')
_field_types = {'a': int | None}
with self.assertWarnsRegex(DeprecationWarning, "Field 'b' is missing from MoreFieldsThanTypes\\._field_types"):
obj = MoreFieldsThanTypes()
if __name__ == "__main__":
unittest.main()
```
```
=================================================================
==2065858==ERROR: AddressSanitizer: global-buffer-overflow on address 0x55976cbd9450 at pc 0x55976c40a3bf bp 0x7fffcdd98590 sp 0x7fffcdd98580
READ of size 8 at 0x55976cbd9450 thread T0
#0 0x55976c40a3be in PyUnicode_GET_LENGTH ../Include/cpython/unicodeobject.h:297
#1 0x55976c40a3be in unicode_fromformat_write_str ../Objects/unicodeobject.c:2611
#2 0x55976c40f1dd in unicode_fromformat_arg ../Objects/unicodeobject.c:2991
#3 0x55976c40f1dd in unicode_from_format ../Objects/unicodeobject.c:3165
#4 0x55976c411f6a in PyUnicode_FromFormatV ../Objects/unicodeobject.c:3199
#5 0x55976c44bdc2 in _PyErr_WarnFormatV ../Python/_warnings.c:1379
#6 0x55976c44bdc2 in PyErr_WarnFormat ../Python/_warnings.c:1396
#7 0x55976c47530b in ast_type_init ../Python/Python-ast.c:5329
#8 0x55976c3309d7 in type_call ../Objects/typeobject.c:2461
#9 0x55976c18c4cd in _PyObject_MakeTpCall ../Objects/call.c:242
#10 0x55976c04ba18 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#11 0x55976c512b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#12 0x55976c512b55 in _PyEval_Vector ../Python/ceval.c:2001
#13 0x55976c197d90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#14 0x55976c197d90 in method_vectorcall ../Objects/classobject.c:95
#15 0x55976c192ffe in _PyVectorcall_Call ../Objects/call.c:273
#16 0x55976c192ffe in _PyObject_Call ../Objects/call.c:348
#17 0x55976c192ffe in PyObject_Call ../Objects/call.c:373
#18 0x55976c032eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#19 0x55976c512b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#20 0x55976c512b55 in _PyEval_Vector ../Python/ceval.c:2001
#21 0x55976c191623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#22 0x55976c191cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#23 0x55976c352444 in call_method ../Objects/typeobject.c:3077
#24 0x55976c352444 in slot_tp_call ../Objects/typeobject.c:10606
#25 0x55976c18c4cd in _PyObject_MakeTpCall ../Objects/call.c:242
#26 0x55976c0307ac in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#27 0x55976c512b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#28 0x55976c512b55 in _PyEval_Vector ../Python/ceval.c:2001
#29 0x55976c197d90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#30 0x55976c197d90 in method_vectorcall ../Objects/classobject.c:95
#31 0x55976c192ffe in _PyVectorcall_Call ../Objects/call.c:273
#32 0x55976c192ffe in _PyObject_Call ../Objects/call.c:348
#33 0x55976c192ffe in PyObject_Call ../Objects/call.c:373
#34 0x55976c032eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#35 0x55976c512b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#36 0x55976c512b55 in _PyEval_Vector ../Python/ceval.c:2001
#37 0x55976c191623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#38 0x55976c191cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#39 0x55976c352444 in call_method ../Objects/typeobject.c:3077
#40 0x55976c352444 in slot_tp_call ../Objects/typeobject.c:10606
#41 0x55976c18c4cd in _PyObject_MakeTpCall ../Objects/call.c:242
#42 0x55976c02fad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#43 0x55976c512b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#44 0x55976c512b55 in _PyEval_Vector ../Python/ceval.c:2001
#45 0x55976c197d90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#46 0x55976c197d90 in method_vectorcall ../Objects/classobject.c:95
#47 0x55976c192ffe in _PyVectorcall_Call ../Objects/call.c:273
#48 0x55976c192ffe in _PyObject_Call ../Objects/call.c:348
#49 0x55976c192ffe in PyObject_Call ../Objects/call.c:373
#50 0x55976c032eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#51 0x55976c512b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#52 0x55976c512b55 in _PyEval_Vector ../Python/ceval.c:2001
#53 0x55976c191623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#54 0x55976c191cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#55 0x55976c352444 in call_method ../Objects/typeobject.c:3077
#56 0x55976c352444 in slot_tp_call ../Objects/typeobject.c:10606
#57 0x55976c18c4cd in _PyObject_MakeTpCall ../Objects/call.c:242
#58 0x55976c02fad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#59 0x55976c512b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#60 0x55976c512b55 in _PyEval_Vector ../Python/ceval.c:2001
#61 0x55976c191623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#62 0x55976c191cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#63 0x55976c33ec50 in call_method ../Objects/typeobject.c:3077
#64 0x55976c33ec50 in slot_tp_init ../Objects/typeobject.c:10835
#65 0x55976c3309d7 in type_call ../Objects/typeobject.c:2461
#66 0x55976c18c4cd in _PyObject_MakeTpCall ../Objects/call.c:242
#67 0x55976c04ba18 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#68 0x55976c512386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#69 0x55976c512386 in _PyEval_Vector ../Python/ceval.c:2001
#70 0x55976c512386 in PyEval_EvalCode ../Python/ceval.c:884
#71 0x55976c6d0f0e in run_eval_code_obj ../Python/pythonrun.c:1365
#72 0x55976c6d0f0e in run_mod ../Python/pythonrun.c:1459
#73 0x55976c6d5bb7 in pyrun_file ../Python/pythonrun.c:1293
#74 0x55976c6d5bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#75 0x55976c6d66dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#76 0x55976c749afc in pymain_run_file_obj ../Modules/main.c:410
#77 0x55976c749afc in pymain_run_file ../Modules/main.c:429
#78 0x55976c749afc in pymain_run_python ../Modules/main.c:691
#79 0x55976c74b3de in Py_RunMain ../Modules/main.c:772
#80 0x55976c74b3de in pymain_main ../Modules/main.c:802
#81 0x55976c74b3de in Py_BytesMain ../Modules/main.c:826
#82 0x71588d93b1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#83 0x71588d93b28a in __libc_start_main_impl ../csu/libc-start.c:360
#84 0x55976c065fa4 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x21afa4) (BuildId: f28384d3eff6aa8d5f0c5730194edf28c0f6b3bd)
0x55976cbd9450 is located 48 bytes before global variable 'none_as_number' defined in '../Objects/object.c:2227:24' (0x55976cbd9480) of size 288
0x55976cbd9450 is located 0 bytes after global variable '_Py_NoneStruct' defined in '../Objects/object.c:2310:10' (0x55976cbd9440) of size 16
SUMMARY: AddressSanitizer: global-buffer-overflow ../Include/cpython/unicodeobject.h:297 in PyUnicode_GET_LENGTH
Shadow bytes around the buggy address:
0x55976cbd9180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x55976cbd9200: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 f9 f9
0x55976cbd9280: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
0x55976cbd9300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x55976cbd9380: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
=>0x55976cbd9400: 00 00 00 00 f9 f9 f9 f9 00 00[f9]f9 f9 f9 f9 f9
0x55976cbd9480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x55976cbd9500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x55976cbd9580: 00 00 00 00 f9 f9 f9 f9 00 00 00 00 00 00 00 00
0x55976cbd9600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x55976cbd9680: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2065858==ABORTING
```
### CPython versions tested on:
3.15
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
<!-- gh-linked-prs -->
### Linked PRs
* gh-140506
* gh-140509
* gh-140510
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140462
SEGV due to `ncurses` allowing sizes to be excessively large
cpython
?
2025-10-22
# SEGV due to `ncurses` allowing sizes to be excessively large
**Issue:** [https://github.com/python/cpython/issues/140462](https://github.com/python/cpython/issues/140462) · **State:** `closed` · **Created:** `2025-10-22T15:42:55Z`
**Labels:** `extension-modules`, `type-crash`
## Description
# Crash report
### What happened?
```python
import sys
import unittest
import curses
class TestCurses(unittest.TestCase):
@classmethod
def setUpClass(cls):
stdout_fd = sys.__stdout__.fileno()
curses.setupterm(fd=stdout_fd)
def setUp(self):
self.stdscr = curses.initscr()
def test_refresh_control(self):
stdscr = self.stdscr
stdscr.refresh()
win = stdscr.subwin(10, 15, 2147483647, 5)
if __name__ == "__main__":
unittest.main()
```
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1994945==ERROR: AddressSanitizer: SEGV on unknown address 0x51780015e770 (pc 0x7bccfc9f3740 bp 0x7ffcbb061dd0 sp 0x7ffcbb061da0 T0)
==1994945==The signal is caused by a READ memory access.
#0 0x7bccfc9f3740 in derwin (/lib/x86_64-linux-gnu/libncursesw.so.6+0x19740) (BuildId: 84ef32c373c2b5b3c25dc788a1bcbbd3750cf9d1)
#1 0x7bccfca35997 in _curses_window_subwin_impl ../Modules/_cursesmodule.c:2745
#2 0x7bccfca35997 in _curses_window_subwin ../Modules/clinic/_cursesmodule.c.h:1666
#3 0x5f4b8a4c687e in method_vectorcall_VARARGS ../Objects/descrobject.c:325
#4 0x5f4b8a49bee7 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#5 0x5f4b8a49bee7 in PyObject_Vectorcall ../Objects/call.c:327
#6 0x5f4b8a33dad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#7 0x5f4b8a820b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#8 0x5f4b8a820b55 in _PyEval_Vector ../Python/ceval.c:2001
#9 0x5f4b8a4a5d90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#10 0x5f4b8a4a5d90 in method_vectorcall ../Objects/classobject.c:95
#11 0x5f4b8a4a0ffe in _PyVectorcall_Call ../Objects/call.c:273
#12 0x5f4b8a4a0ffe in _PyObject_Call ../Objects/call.c:348
#13 0x5f4b8a4a0ffe in PyObject_Call ../Objects/call.c:373
#14 0x5f4b8a340eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#15 0x5f4b8a820b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#16 0x5f4b8a820b55 in _PyEval_Vector ../Python/ceval.c:2001
#17 0x5f4b8a49f623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#18 0x5f4b8a49fcdc in _PyObject_Call_Prepend ../Objects/call.c:504
#19 0x5f4b8a660444 in call_method ../Objects/typeobject.c:3077
#20 0x5f4b8a660444 in slot_tp_call ../Objects/typeobject.c:10606
#21 0x5f4b8a49a4cd in _PyObject_MakeTpCall ../Objects/call.c:242
#22 0x5f4b8a33e7ac in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#23 0x5f4b8a820b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#24 0x5f4b8a820b55 in _PyEval_Vector ../Python/ceval.c:2001
#25 0x5f4b8a4a5d90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#26 0x5f4b8a4a5d90 in method_vectorcall ../Objects/classobject.c:95
#27 0x5f4b8a4a0ffe in _PyVectorcall_Call ../Objects/call.c:273
#28 0x5f4b8a4a0ffe in _PyObject_Call ../Objects/call.c:348
#29 0x5f4b8a4a0ffe in PyObject_Call ../Objects/call.c:373
#30 0x5f4b8a340eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#31 0x5f4b8a820b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#32 0x5f4b8a820b55 in _PyEval_Vector ../Python/ceval.c:2001
#33 0x5f4b8a49f623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#34 0x5f4b8a49fcdc in _PyObject_Call_Prepend ../Objects/call.c:504
#35 0x5f4b8a660444 in call_method ../Objects/typeobject.c:3077
#36 0x5f4b8a660444 in slot_tp_call ../Objects/typeobject.c:10606
#37 0x5f4b8a49a4cd in _PyObject_MakeTpCall ../Objects/call.c:242
#38 0x5f4b8a33e7ac in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#39 0x5f4b8a820b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#40 0x5f4b8a820b55 in _PyEval_Vector ../Python/ceval.c:2001
#41 0x5f4b8a4a5d90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#42 0x5f4b8a4a5d90 in method_vectorcall ../Objects/classobject.c:95
#43 0x5f4b8a4a0ffe in _PyVectorcall_Call ../Objects/call.c:273
#44 0x5f4b8a4a0ffe in _PyObject_Call ../Objects/call.c:348
#45 0x5f4b8a4a0ffe in PyObject_Call ../Objects/call.c:373
#46 0x5f4b8a340eb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#47 0x5f4b8a820b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#48 0x5f4b8a820b55 in _PyEval_Vector ../Python/ceval.c:2001
#49 0x5f4b8a49f623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#50 0x5f4b8a49fcdc in _PyObject_Call_Prepend ../Objects/call.c:504
#51 0x5f4b8a660444 in call_method ../Objects/typeobject.c:3077
#52 0x5f4b8a660444 in slot_tp_call ../Objects/typeobject.c:10606
#53 0x5f4b8a49a4cd in _PyObject_MakeTpCall ../Objects/call.c:242
#54 0x5f4b8a33dad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#55 0x5f4b8a820b55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#56 0x5f4b8a820b55 in _PyEval_Vector ../Python/ceval.c:2001
#57 0x5f4b8a49f623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#58 0x5f4b8a49fcdc in _PyObject_Call_Prepend ../Objects/call.c:504
#59 0x5f4b8a64cc50 in call_method ../Objects/typeobject.c:3077
#60 0x5f4b8a64cc50 in slot_tp_init ../Objects/typeobject.c:10835
#61 0x5f4b8a63e9d7 in type_call ../Objects/typeobject.c:2461
#62 0x5f4b8a49a4cd in _PyObject_MakeTpCall ../Objects/call.c:242
#63 0x5f4b8a359a18 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#64 0x5f4b8a820386 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#65 0x5f4b8a820386 in _PyEval_Vector ../Python/ceval.c:2001
#66 0x5f4b8a820386 in PyEval_EvalCode ../Python/ceval.c:884
#67 0x5f4b8a9def0e in run_eval_code_obj ../Python/pythonrun.c:1365
#68 0x5f4b8a9def0e in run_mod ../Python/pythonrun.c:1459
#69 0x5f4b8a9e3bb7 in pyrun_file ../Python/pythonrun.c:1293
#70 0x5f4b8a9e3bb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#71 0x5f4b8a9e46dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#72 0x5f4b8aa57afc in pymain_run_file_obj ../Modules/main.c:410
#73 0x5f4b8aa57afc in pymain_run_file ../Modules/main.c:429
#74 0x5f4b8aa57afc in pymain_run_python ../Modules/main.c:691
#75 0x5f4b8aa593de in Py_RunMain ../Modules/main.c:772
#76 0x5f4b8aa593de in pymain_main ../Modules/main.c:802
#77 0x5f4b8aa593de in Py_BytesMain ../Modules/main.c:826
#78 0x7bcd00f401c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#79 0x7bcd00f4028a in __libc_start_main_impl ../csu/libc-start.c:360
#80 0x5f4b8a373fa4 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x21afa4) (BuildId: f28384d3eff6aa8d5f0c5730194edf28c0f6b3bd)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libncursesw.so.6+0x19740) (BuildId: 84ef32c373c2b5b3c25dc788a1bcbbd3750cf9d1) in derwin
==1994945==ABORTING
```
### CPython versions tested on:
3.15
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140442
LeakSan: 80-byte leak at shutdown after atexit.register of bound list.append(-0.0)
cpython
?
2025-10-22
# LeakSan: 80-byte leak at shutdown after atexit.register of bound list.append(-0.0)
**Issue:** [https://github.com/python/cpython/issues/140442](https://github.com/python/cpython/issues/140442) · **State:** `closed` · **Created:** `2025-10-22T03:34:29Z`
**Labels:** `type-bug`, `interpreter-core`
## Description
# Bug report
### Bug description:
```python
import atexit
import unittest
class GeneralTest(unittest.TestCase):
def setUp(self):
atexit._clear()
def tearDown(self):
self.assertEqual(type(cm.unraisable.exc_value), exc_type)
def test_bound_methods(self):
l = []
atexit.register(l.append, -0.0)
if __name__ == '__main__':
unittest.main()
```
```
=================================================================
==1285431==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 56 byte(s) in 1 object(s) allocated from:
#0 0x7bf3de9cf9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5a8fc7f6127e in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x5a8fc7f6127e in gc_alloc ../Python/gc.c:2343
#3 0x5a8fc7f6127e in _PyObject_GC_NewVar ../Python/gc.c:2385
#4 0x5a8fc7cd0cab in tuple_alloc ../Objects/tupleobject.c:57
#5 0x5a8fc7cd476d in PyTuple_FromArray ../Objects/tupleobject.c:393
#6 0x5a8fc7cd476d in PyTuple_FromArray ../Objects/tupleobject.c:387
#7 0x5a8fc7b44437 in _PyObject_MakeTpCall ../Objects/call.c:216
#8 0x5a8fc7b46316 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:167
#9 0x5a8fc7b46316 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:154
#10 0x5a8fc7b46316 in PyObject_CallOneArg ../Objects/call.c:395
#11 0x5a8fc7f3062a in _PyErr_CreateException ../Python/errors.c:43
#12 0x5a8fc7f30d4a in _PyErr_SetObject ../Python/errors.c:180
#13 0x5a8fc7f3044d in _PyErr_SetObject ../Python/errors.c:157
#14 0x5a8fc7f3044d in _PyErr_FormatV ../Python/errors.c:1210
#15 0x5a8fc7f3044d in PyErr_Format ../Python/errors.c:1243
#16 0x5a8fc7c6b0b8 in _PyObject_GenericGetAttrWithDict ../Objects/object.c:1908
#17 0x5a8fc7c69907 in PyObject_GetAttr ../Objects/object.c:1313
#18 0x5a8fc7c6b5bc in PyObject_GetOptionalAttr ../Objects/object.c:1377
#19 0x5a8fc7eab5ab in builtin_getattr ../Python/bltinmodule.c:1238
#20 0x5a8fc7b45ee7 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#21 0x5a8fc7b45ee7 in PyObject_Vectorcall ../Objects/call.c:327
#22 0x5a8fc79e7ad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#23 0x5a8fc7ecab55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#24 0x5a8fc7ecab55 in _PyEval_Vector ../Python/ceval.c:2001
#25 0x5a8fc7b4fd90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#26 0x5a8fc7b4fd90 in method_vectorcall ../Objects/classobject.c:95
#27 0x5a8fc7b4affe in _PyVectorcall_Call ../Objects/call.c:273
#28 0x5a8fc7b4affe in _PyObject_Call ../Objects/call.c:348
#29 0x5a8fc7b4affe in PyObject_Call ../Objects/call.c:373
#30 0x5a8fc79eaeb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#31 0x5a8fc7ecab55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#32 0x5a8fc7ecab55 in _PyEval_Vector ../Python/ceval.c:2001
#33 0x5a8fc7b49623 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#34 0x5a8fc7b49cdc in _PyObject_Call_Prepend ../Objects/call.c:504
#35 0x5a8fc7d0a444 in call_method ../Objects/typeobject.c:3077
#36 0x5a8fc7d0a444 in slot_tp_call ../Objects/typeobject.c:10606
#37 0x5a8fc7b444cd in _PyObject_MakeTpCall ../Objects/call.c:242
#38 0x5a8fc79e87ac in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#39 0x5a8fc7ecab55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#40 0x5a8fc7ecab55 in _PyEval_Vector ../Python/ceval.c:2001
#41 0x5a8fc7b4fd90 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#42 0x5a8fc7b4fd90 in method_vectorcall ../Objects/classobject.c:95
#43 0x5a8fc7b4affe in _PyVectorcall_Call ../Objects/call.c:273
#44 0x5a8fc7b4affe in _PyObject_Call ../Objects/call.c:348
#45 0x5a8fc7b4affe in PyObject_Call ../Objects/call.c:373
#46 0x5a8fc79eaeb7 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2616
#47 0x5a8fc7ecab55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#48 0x5a8fc7ecab55 in _PyEval_Vector ../Python/ceval.c:2001
Indirect leak of 24 byte(s) in 1 object(s) allocated from:
#0 0x7bf3de9cf9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5a8fc7baf849 in PyFloat_FromDouble ../Objects/floatobject.c:128
#2 0x5a8fc813cdc1 in fill_time ../Modules/posixmodule.c:2681
#3 0x5a8fc813d4de in _pystat_fromstructstat ../Modules/posixmodule.c:2796
#4 0x5a8fc813f2fc in posix_do_stat ../Modules/posixmodule.c:2918
#5 0x5a8fc8149a0c in os_stat_impl ../Modules/posixmodule.c:3285
#6 0x5a8fc8149a0c in os_stat ../Modules/clinic/posixmodule.c.h:105
#7 0x5a8fc7a0ce79 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2361
#8 0x5a8fc7ecab55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#9 0x5a8fc7ecab55 in _PyEval_Vector ../Python/ceval.c:2001
#10 0x5a8fc7b45062 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#11 0x5a8fc7b45062 in object_vacall ../Objects/call.c:819
#12 0x5a8fc7b486b1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#13 0x5a8fc7f934d3 in import_find_and_load ../Python/import.c:3701
#14 0x5a8fc7f934d3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#15 0x5a8fc7eacb4c in builtin___import___impl ../Python/bltinmodule.c:285
#16 0x5a8fc7eacb4c in builtin___import__ ../Python/clinic/bltinmodule.c.h:110
#17 0x5a8fc7b45928 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#18 0x5a8fc7b45928 in _PyObject_CallFunctionVa ../Objects/call.c:552
#19 0x5a8fc7b469b9 in PyObject_CallFunction ../Objects/call.c:574
#20 0x5a8fc7f94a0b in PyImport_Import ../Python/import.c:3975
#21 0x5a8fc7f951bf in PyImport_ImportModule ../Python/import.c:3423
#22 0x5a8fc7ed5ce2 in _PyCodec_InitRegistry ../Python/codecs.c:1686
#23 0x5a8fc7debe24 in _PyUnicode_InitEncodings ../Objects/unicodeobject.c:15455
#24 0x5a8fc80738ab in init_interp_main ../Python/pylifecycle.c:1228
#25 0x5a8fc807752c in pyinit_main ../Python/pylifecycle.c:1420
#26 0x5a8fc807752c in Py_InitializeFromConfig ../Python/pylifecycle.c:1451
#27 0x5a8fc80fefd9 in pymain_init ../Modules/main.c:68
#28 0x5a8fc8103362 in pymain_main ../Modules/main.c:793
#29 0x5a8fc8103362 in Py_BytesMain ../Modules/main.c:826
#30 0x7bf3de6011c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#31 0x7bf3de60128a in __libc_start_main_impl ../csu/libc-start.c:360
#32 0x5a8fc7a1dfa4 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x21afa4) (BuildId: f28384d3eff6aa8d5f0c5730194edf28c0f6b3bd)
SUMMARY: AddressSanitizer: 80 byte(s) leaked in 2 allocation(s).
```
### CPython versions tested on:
3.15
### Operating systems tested on:
Linux
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#20257
heap-buffer-overflow mail.c
php
?
2025-10-22
# heap-buffer-overflow mail.c
**Issue:** [https://github.com/php/php-src/issues/20257](https://github.com/php/php-src/issues/20257) · **State:** `closed` · **Created:** `2025-10-22T03:23:01Z`
**Labels:** `Bug`, `Extension: standard`, `Status: Verified`
## Description
### Description
The following code:
```php
<?php
var_dump( mail($to, $subject, $message) );
```
Resulted in this output:
```
=================================================================
==355357==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6030000019e0 at pc 0x0000043684c7 bp 0x7ffdc5308cf0 sp 0x7ffdc5308ce8
READ of size 1 at 0x6030000019e0 thread T0
#0 0x43684c6 in php_mail /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/standard/mail.c:618:9
#1 0x4365934 in zif_mail /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/standard/mail.c:352:6
#2 0x604848f in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:1421:2
#3 0x5b62a3b in execute_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:115764:12
#4 0x5b64fcc in zend_execute /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:121476:2
#5 0x68ebc29 in zend_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1977:3
#6 0x50c283a in php_execute_script_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2640:13
#7 0x50c3978 in php_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2680:9
#8 0x6900b3a in do_cli /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:951:5
#9 0x68faf1f in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1362:18
#10 0x727d7ccfcd8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#11 0x727d7ccfce3f in __libc_start_main csu/../csu/libc-start.c:392:3
#12 0x606204 in _start (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x606204)
0x6030000019e0 is located 0 bytes to the right of 32-byte region [0x6030000019c0,0x6030000019e0)
allocated by thread T0 here:
#0 0x6810cd in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x6810cd)
#1 0x5738733 in __zend_malloc /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_alloc.c:3543:14
#2 0x686501c in zend_string_alloc /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_string.h:167:36
#3 0x686711a in zend_string_init /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_string.h:189:21
#4 0x68638a3 in zend_string_init_interned_permanent /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_string.c:278:8
#5 0x6861663 in zend_interned_strings_init /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_string.c:104:22
#6 0x68d05fc in zend_startup /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1056:2
#7 0x50b2cb8 in php_module_startup /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2248:2
#8 0x6906808 in php_cli_startup /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:397:9
#9 0x68fa739 in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1329:6
#10 0x727d7ccfcd8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/standard/mail.c:618:9 in php_mail
Shadow bytes around the buggy address:
0x0c067fff82e0: 00 04 fa fa 00 00 00 01 fa fa 00 00 02 fa fa fa
0x0c067fff82f0: 00 00 00 05 fa fa 00 00 01 fa fa fa 00 00 05 fa
0x0c067fff8300: fa fa 00 00 00 04 fa fa 00 00 03 fa fa fa 00 00
0x0c067fff8310: 06 fa fa fa fd fd fd fd fa fa fd fd fd fd fa fa
0x0c067fff8320: 00 00 00 00 fa fa fd fd fd fa fa fa fd fd fd fd
=>0x0c067fff8330: fa fa 00 00 00 07 fa fa 00 00 00 00[fa]fa 00 00
0x0c067fff8340: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
0x0c067fff8350: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00
0x0c067fff8360: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00
0x0c067fff8370: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
0x0c067fff8380: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==355357==ABORTING
```
To reproduce:
```
./php-src/sapi/cli/php -d "mail.cr_lf_mode=lf" ./test.php
```
Commit:
```
02d187d7663afdde5027f72fad180079806c4fc9
```
Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```
Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```
*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*
### PHP Version
```plain
nightly
```
### Operating System
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140410
SystemError: invalid maximum character passed to PyUnicode_New
cpython
?
2025-10-21
# SystemError: invalid maximum character passed to PyUnicode_New
**Issue:** [https://github.com/python/cpython/issues/140410](https://github.com/python/cpython/issues/140410) · **State:** `closed` · **Created:** `2025-10-21T10:36:27Z`
**Labels:** `type-bug`
## Description
# Bug report
### Bug description:
```python
import unittest
try:
from _testcapi import PY_SSIZE_T_MIN, PY_SSIZE_T_MAX
except ImportError:
_testcapi = None
class CAPITest(unittest.TestCase):
def test_new(self):
from _testcapi import unicode_new as new
for maxchar in (0, 97, 4096, 20320, 128512, 1114111):
self.assertRaises(MemoryError, new, PY_SSIZE_T_MAX, maxchar)
self.assertEqual(new(-1, 1114112), '')
if __name__ == '__main__':
unittest.main()
```
### CPython versions tested on:
3.15
### Operating systems tested on:
Linux
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140409
heap-buffer-overflow in ctypes.create_string_buffer _ctypes_test.my_qsort
cpython
?
2025-10-21
# heap-buffer-overflow in ctypes.create_string_buffer _ctypes_test.my_qsort
**Issue:** [https://github.com/python/cpython/issues/140409](https://github.com/python/cpython/issues/140409) · **State:** `closed` · **Created:** `2025-10-21T10:30:02Z`
**Labels:** N/A
## Description
# Crash report
### What happened?
```python
import unittest
from ctypes import CDLL, CFUNCTYPE, POINTER, create_string_buffer, sizeof, c_void_p, c_char, c_int, c_double, c_size_t
from test.support import import_helper
_ctypes_test = import_helper.import_module('_ctypes_test')
lib = CDLL(_ctypes_test.__file__)
def three_way_cmp(x, y):
return (x > y) - (x < y)
class LibTest(unittest.TestCase):
comparefunc = CFUNCTYPE(c_int, POINTER(c_char), POINTER(c_char))
def sort(a, b):
return three_way_cmp(a[0], b[4096])
chars = create_string_buffer(b'spam, spam, and spam')
lib.my_qsort(chars, len(chars) - 1, sizeof(c_char), comparefunc(sort))
if __name__ == '__main__':
unittest.main()
```
```
=================================================================
==402117==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x503000062091 at pc 0x5d1621835367 bp 0x7ffe643c19f0 sp 0x7ffe643c19e0
READ of size 1 at 0x503000062091 thread T0
#0 0x5d1621835366 in PyBytes_FromStringAndSize ../Objects/bytesobject.c:148
#1 0x73ed428585de in Pointer_item_lock_held ../Modules/_ctypes/_ctypes.c:5583
#2 0x5d162180363c in PyObject_GetItem ../Objects/abstract.c:163
#3 0x5d16216ef481 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:62
#4 0x5d1621bd1bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#5 0x5d1621bd1bb5 in _PyEval_Vector ../Python/ceval.c:2001
#6 0x5d16218531a7 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#7 0x5d16218531a7 in PyObject_Vectorcall ../Objects/call.c:327
#8 0x73ed4285aba8 in _CallPythonObject ../Modules/_ctypes/callbacks.c:201
#9 0x73ed4285b03c in closure_fcn ../Modules/_ctypes/callbacks.c:293
#10 0x73ed45516640 (/lib/x86_64-linux-gnu/libffi.so.8+0x7640) (BuildId: c9149b6e99105aa4321ddd4a10ee4b90de7b7d49)
#11 0x73ed45516d37 (/lib/x86_64-linux-gnu/libffi.so.8+0x7d37) (BuildId: c9149b6e99105aa4321ddd4a10ee4b90de7b7d49)
#12 0x73ed45fb00a2 in qsort_r ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:10019
#13 0x73ed45516b15 (/lib/x86_64-linux-gnu/libffi.so.8+0x7b15) (BuildId: c9149b6e99105aa4321ddd4a10ee4b90de7b7d49)
#14 0x73ed455133ee (/lib/x86_64-linux-gnu/libffi.so.8+0x43ee) (BuildId: c9149b6e99105aa4321ddd4a10ee4b90de7b7d49)
#15 0x73ed455160bd in ffi_call (/lib/x86_64-linux-gnu/libffi.so.8+0x70bd) (BuildId: c9149b6e99105aa4321ddd4a10ee4b90de7b7d49)
#16 0x73ed428608d0 in _call_function_pointer ../Modules/_ctypes/callproc.c:945
#17 0x73ed428608d0 in _ctypes_callproc ../Modules/_ctypes/callproc.c:1311
#18 0x73ed42852646 in PyCFuncPtr_call ../Modules/_ctypes/_ctypes.c:4685
#19 0x5d162185178d in _PyObject_MakeTpCall ../Objects/call.c:242
#20 0x5d16216f5b82 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#21 0x5d1621bd1bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#22 0x5d1621bd1bb5 in _PyEval_Vector ../Python/ceval.c:2001
#23 0x5d1621bbda48 in builtin___build_class__ ../Python/bltinmodule.c:205
#24 0x5d16218531a7 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#25 0x5d16218531a7 in PyObject_Vectorcall ../Objects/call.c:327
#26 0x5d16216f5b82 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#27 0x5d1621bd13e6 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#28 0x5d1621bd13e6 in _PyEval_Vector ../Python/ceval.c:2001
#29 0x5d1621bd13e6 in PyEval_EvalCode ../Python/ceval.c:884
#30 0x5d1621d16cce in run_eval_code_obj ../Python/pythonrun.c:1365
#31 0x5d1621d16cce in run_mod ../Python/pythonrun.c:1459
#32 0x5d1621d1b977 in pyrun_file ../Python/pythonrun.c:1293
#33 0x5d1621d1b977 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#34 0x5d1621d1c49c in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#35 0x5d1621d8f7fc in pymain_run_file_obj ../Modules/main.c:410
#36 0x5d1621d8f7fc in pymain_run_file ../Modules/main.c:429
#37 0x5d1621d8f7fc in pymain_run_python ../Modules/main.c:691
#38 0x5d1621d910de in Py_RunMain ../Modules/main.c:772
#39 0x5d1621d910de in pymain_main ../Modules/main.c:802
#40 0x5d1621d910de in Py_BytesMain ../Modules/main.c:826
#41 0x73ed45c6e1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#42 0x73ed45c6e28a in __libc_start_main_impl ../csu/libc-start.c:360
#43 0x5d162172b524 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython-normal/build/python+0x20e524) (BuildId: b922665a0e7afc8ee52df7c3eac25a643025109e)
0x503000062091 is located 4076 bytes after 21-byte region [0x503000061090,0x5030000610a5)
allocated by thread T0 here:
#0 0x73ed4603c9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x73ed428426e4 in PyCData_MallocBuffer ../Modules/_ctypes/_ctypes.c:3271
#2 0x73ed428426e4 in generic_pycdata_new ../Modules/_ctypes/_ctypes.c:3589
#3 0x73ed428426e4 in GenericPyCData_new ../Modules/_ctypes/_ctypes.c:3559
#4 0x5d16219efe78 in type_call ../Objects/typeobject.c:2448
#5 0x5d162185178d in _PyObject_MakeTpCall ../Objects/call.c:242
#6 0x5d1621711388 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#7 0x5d1621bd1bb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#8 0x5d1621bd1bb5 in _PyEval_Vector ../Python/ceval.c:2001
#9 0x5d1621bbda48 in builtin___build_class__ ../Python/bltinmodule.c:205
#10 0x5d16218531a7 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#11 0x5d16218531a7 in PyObject_Vectorcall ../Objects/call.c:327
#12 0x5d16216f5b82 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#13 0x5d1621bd13e6 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#14 0x5d1621bd13e6 in _PyEval_Vector ../Python/ceval.c:2001
#15 0x5d1621bd13e6 in PyEval_EvalCode ../Python/ceval.c:884
#16 0x5d1621d16cce in run_eval_code_obj ../Python/pythonrun.c:1365
#17 0x5d1621d16cce in run_mod ../Python/pythonrun.c:1459
#18 0x5d1621d1b977 in pyrun_file ../Python/pythonrun.c:1293
#19 0x5d1621d1b977 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#20 0x5d1621d1c49c in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#21 0x5d1621d8f7fc in pymain_run_file_obj ../Modules/main.c:410
#22 0x5d1621d8f7fc in pymain_run_file ../Modules/main.c:429
#23 0x5d1621d8f7fc in pymain_run_python ../Modules/main.c:691
#24 0x5d1621d910de in Py_RunMain ../Modules/main.c:772
#25 0x5d1621d910de in pymain_main ../Modules/main.c:802
#26 0x5d1621d910de in Py_BytesMain ../Modules/main.c:826
#27 0x73ed45c6e1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#28 0x73ed45c6e28a in __libc_start_main_impl ../csu/libc-start.c:360
#29 0x5d162172b524 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython-normal/build/python+0x20e524) (BuildId: b922665a0e7afc8ee52df7c3eac25a643025109e)
SUMMARY: AddressSanitizer: heap-buffer-overflow ../Objects/bytesobject.c:148 in PyBytes_FromStringAndSize
Shadow bytes around the buggy address:
0x503000061e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x503000061e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x503000061f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x503000061f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x503000062000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x503000062080: fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
0x503000062100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x503000062180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x503000062200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x503000062280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x503000062300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==402117==ABORTING
```
### CPython versions tested on:
3.15
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140408
python crash at ffi call
cpython
?
2025-10-21
# python crash at ffi call
**Issue:** [https://github.com/python/cpython/issues/140408](https://github.com/python/cpython/issues/140408) · **State:** `closed` · **Created:** `2025-10-21T10:20:02Z`
**Labels:** `type-crash`
## Description
# Crash report
### What happened?
```python
import unittest
from ctypes import CDLL, POINTER, sizeof, c_byte, c_short, c_int, c_long, c_char, c_wchar, c_char_p
from test.support import import_helper
_ctypes_test = import_helper.import_module('_ctypes_test')
class SlicesTestCase(unittest.TestCase):
dll = CDLL(_ctypes_test.__file__)
s = None
class allocated_c_char_p(c_char_p):
pass
def errcheck(result, func, args):
return retval
try:
res = dll.my_strdup(s)
finally:
del dll.my_strdup.errcheck
if __name__ == '__main__':
def __init__(self, addr, handler, poll_interval=0.5, log=False, sslctx=None):
super(DelegatingHTTPRequestHandler, self).log_message(format, *args)
```
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==391683==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f684967d91c bp 0x7ffe655598b0 sp 0x7ffe65559038 T0)
==391683==The signal is caused by a READ memory access.
==391683==Hint: address points to the zero page.
#0 0x7f684967d91c in __strlen_evex ../sysdeps/x86_64/multiarch/strlen-evex-base.S:81
#1 0x7f684985a826 in strlen ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:389
#2 0x7f68449b4e92 in my_strdup ../Modules/_ctypes/_ctypes_test.c:541
#3 0x7f6848b10b15 (/lib/x86_64-linux-gnu/libffi.so.8+0x7b15) (BuildId: c9149b6e99105aa4321ddd4a10ee4b90de7b7d49)
#4 0x7f6848b0d3ee (/lib/x86_64-linux-gnu/libffi.so.8+0x43ee) (BuildId: c9149b6e99105aa4321ddd4a10ee4b90de7b7d49)
#5 0x7f6848b100bd in ffi_call (/lib/x86_64-linux-gnu/libffi.so.8+0x70bd) (BuildId: c9149b6e99105aa4321ddd4a10ee4b90de7b7d49)
#6 0x7f684581c8d0 in _call_function_pointer ../Modules/_ctypes/callproc.c:945
#7 0x7f684581c8d0 in _ctypes_callproc ../Modules/_ctypes/callproc.c:1311
#8 0x7f684580e646 in PyCFuncPtr_call ../Modules/_ctypes/_ctypes.c:4685
#9 0x5dc53d7dc78d in _PyObject_MakeTpCall ../Objects/call.c:242
#10 0x5dc53d680b82 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#11 0x5dc53db5cbb5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#12 0x5dc53db5cbb5 in _PyEval_Vector ../Python/ceval.c:2001
#13 0x5dc53db48a48 in builtin___build_class__ ../Python/bltinmodule.c:205
#14 0x5dc53d7de1a7 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#15 0x5dc53d7de1a7 in PyObject_Vectorcall ../Objects/call.c:327
#16 0x5dc53d680b82 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#17 0x5dc53db5c3e6 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#18 0x5dc53db5c3e6 in _PyEval_Vector ../Python/ceval.c:2001
#19 0x5dc53db5c3e6 in PyEval_EvalCode ../Python/ceval.c:884
#20 0x5dc53dca1cce in run_eval_code_obj ../Python/pythonrun.c:1365
#21 0x5dc53dca1cce in run_mod ../Python/pythonrun.c:1459
#22 0x5dc53dca6977 in pyrun_file ../Python/pythonrun.c:1293
#23 0x5dc53dca6977 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#24 0x5dc53dca749c in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#25 0x5dc53dd1a7fc in pymain_run_file_obj ../Modules/main.c:410
#26 0x5dc53dd1a7fc in pymain_run_file ../Modules/main.c:429
#27 0x5dc53dd1a7fc in pymain_run_python ../Modules/main.c:691
#28 0x5dc53dd1c0de in Py_RunMain ../Modules/main.c:772
#29 0x5dc53dd1c0de in pymain_main ../Modules/main.c:802
#30 0x5dc53dd1c0de in Py_BytesMain ../Modules/main.c:826
#31 0x7f684950c1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#32 0x7f684950c28a in __libc_start_main_impl ../csu/libc-start.c:360
#33 0x5dc53d6b6524 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython-normal/build/python+0x20e524) (BuildId: b922665a0e7afc8ee52df7c3eac25a643025109e)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ../sysdeps/x86_64/multiarch/strlen-evex-base.S:81 in __strlen_evex
==391683==ABORTING
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
### Output from running 'python -VV' on the command line:
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#140406
Memory leak when `object.__hash__` returns a non-`int` value
cpython
?
2025-10-21
# Memory leak when `object.__hash__` returns a non-`int` value
**Issue:** [https://github.com/python/cpython/issues/140406](https://github.com/python/cpython/issues/140406) · **State:** `closed` · **Created:** `2025-10-21T09:37:55Z`
**Labels:** `type-bug`, `interpreter-core`, `3.13`, `3.14`, `3.15`
## Description
# Bug report
### Bug description:
```python
try:
from _testinternalcapi import hamt
except ImportError:
def wrapper(*args, **kwargs):
return ctx.run(func, *args, **kwargs)
class HashKey:
_crasher = None
def __init__(self, hash, name, *, error_on_eq_to=None):
self.hash = hash
def __repr__(self):
return f'<fusion name:{self.name} hash:{self.hash}>'
def __hash__(self):
if self._crasher is not None and self._crasher.error_on_hash:
raise HashingError
return self.hash
A = HashKey(float('inf'), 'A')
h = hamt()
h = h.set(A, h)
```
```
TypeError: __hash__ method should return an integer
=================================================================
==332029==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 24 byte(s) in 1 object(s) allocated from:
#0 0x7b04299839c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5665f9652ed9 in PyFloat_FromDouble ../Objects/floatobject.c:128
#2 0x5665f9bdb081 in fill_time ../Modules/posixmodule.c:2681
#3 0x5665f9bdb79e in _pystat_fromstructstat ../Modules/posixmodule.c:2796
#4 0x5665f9bdd5bc in posix_do_stat ../Modules/posixmodule.c:2918
#5 0x5665f9be7ccc in os_stat_impl ../Modules/posixmodule.c:3285
#6 0x5665f9be7ccc in os_stat ../Modules/clinic/posixmodule.c.h:105
#7 0x5665f94b1e79 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2361
#8 0x5665f99698e5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#9 0x5665f99698e5 in _PyEval_Vector ../Python/ceval.c:2001
#10 0x5665f95e9da2 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#11 0x5665f95e9da2 in object_vacall ../Objects/call.c:819
#12 0x5665f95ed3f1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#13 0x5665f9a318c3 in import_find_and_load ../Python/import.c:3701
#14 0x5665f9a318c3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
#15 0x5665f994c0fc in builtin___import___impl ../Python/bltinmodule.c:285
#16 0x5665f994c0fc in builtin___import__ ../Python/clinic/bltinmodule.c.h:110
#17 0x5665f95eac27 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#18 0x5665f95eac27 in PyObject_Vectorcall ../Objects/call.c:327
#19 0x5665f948ef80 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:3188
#20 0x5665f99698e5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#21 0x5665f99698e5 in _PyEval_Vector ../Python/ceval.c:2001
#22 0x5665f95eaf6d in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#23 0x5665f95eaf6d in PyObject_CallOneArg ../Objects/call.c:395
#24 0x5665f996f6bd in _PyCodec_Lookup ../Python/codecs.c:184
#25 0x5665f9971185 in _PyCodec_LookupTextEncoding ../Python/codecs.c:519
#26 0x5665f9971185 in codec_getitem_checked ../Python/codecs.c:568
#27 0x5665f9971185 in _PyCodec_TextDecoder ../Python/codecs.c:584
#28 0x5665f9971185 in _PyCodec_DecodeText ../Python/codecs.c:606
#29 0x5665f9875f13 in PyUnicode_Decode ../Objects/unicodeobject.c:3662
#30 0x5665f9876942 in PyUnicode_FromEncodedObject ../Objects/unicodeobject.c:3511
#31 0x5665f95c83e9 in bytes_decode_impl ../Objects/bytesobject.c:2488
#32 0x5665f95c83e9 in bytes_decode ../Objects/clinic/bytesobject.c.h:1130
#33 0x5665f95eac27 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#34 0x5665f95eac27 in PyObject_Vectorcall ../Objects/call.c:327
#35 0x5665f948cad2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#36 0x5665f9969116 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#37 0x5665f9969116 in _PyEval_Vector ../Python/ceval.c:2001
#38 0x5665f9969116 in PyEval_EvalCode ../Python/ceval.c:884
#39 0x5665f99534e8 in builtin_exec_impl ../Python/bltinmodule.c:1180
#40 0x5665f99534e8 in builtin_exec ../Python/clinic/bltinmodule.c.h:571
#41 0x5665f94b1e79 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:2361
#42 0x5665f99698e5 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#43 0x5665f99698e5 in _PyEval_Vector ../Python/ceval.c:2001
#44 0x5665f95e9da2 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#45 0x5665f95e9da2 in object_vacall ../Objects/call.c:819
#46 0x5665f95ed3f1 in PyObject_CallMethodObjArgs ../Objects/call.c:886
#47 0x5665f9a318c3 in import_find_and_load ../Python/import.c:3701
#48 0x5665f9a318c3 in PyImport_ImportModuleLevelObject ../Python/import.c:3783
SUMMARY: AddressSanitizer: 24 byte(s) leaked in 1 allocation(s).
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-140411
* gh-140417
* gh-140441
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#163673
[mlir] memory leak at mlir/include/mlir/IR/Region.h (ModuleOp::build)
llvm
?
2025-10-16
# [mlir] memory leak at mlir/include/mlir/IR/Region.h (ModuleOp::build)
**Issue:** [https://github.com/llvm/llvm-project/issues/163673](https://github.com/llvm/llvm-project/issues/163673) · **State:** `closed` · **Created:** `2025-10-16T01:07:26Z`
**Labels:** `duplicate`, `code-quality`, `mlir`
## Description
```
module {
spirv.module Logical GLSL450 requires #spirv.vce<v1.0, [Shader], []> {
}
spirv.module Logical GLSL450 requires #spirv.vce<v1.0, [Shader], []> {
spirv.SpecConstant @sc2 = 3 : i8
spirv.GlobalVariable @var1 {
linkage_attributes=#spirv.linkage_attributes<
linkage_name="outSideGlobalVar1",
linkage_type=<Import>
>
} : !spirv.ptr<f32, Private>
}
func.func @fusion_bridge_521672475() -> i32 {
%c = arith.constant 0 : i32
return %c : i32
}
}
```
repro: `mlir-opt -convert-spirv-to-llvm=client-api=Vulkan -verify-diagnostics ./test.mlir`
stderr:
```
=================================================================
==3331763==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 144 byte(s) in 2 object(s) allocated from:
#0 0x5961ff36577d in operator new(unsigned long) (llvm-mlir-build/bin/mlir-opt+0x843f77d) (BuildId: 8d3f598c321c686de3addc0e0905b4ae76916fb7)
#1 0x5961ff902152 in mlir::Region::emplaceBlock() llvm-project/mlir/include/mlir/IR/Region.h:47:15
#2 0x59621231598c in mlir::ModuleOp::build(mlir::OpBuilder&, mlir::OperationState&, std::optional<llvm::StringRef>) llvm-project/mlir/lib/IR/BuiltinDialect.cpp:125:22
#3 0x596212315eb7 in mlir::ModuleOp::create(mlir::OpBuilder&, mlir::Location, std::optional<llvm::StringRef>) llvm-mlir-build/tools/mlir/include/mlir/IR/BuiltinOps.cpp.inc:251:3
#4 0x596207e65870 in (anonymous namespace)::ModuleConversionPattern::matchAndRewrite(mlir::spirv::ModuleOp, mlir::spirv::ModuleOpAdaptor, mlir::ConversionPatternRewriter&) const llvm-project/mlir/lib/Conversion/SPIRVToLLVM/SPIRVToLLVM.cpp:1713:9
#5 0x596207e65faa in llvm::LogicalResult mlir::ConversionPattern::dispatchTo1To1<mlir::OpConversionPattern<mlir::spirv::ModuleOp>, mlir::spirv::ModuleOp>(mlir::OpConversionPattern<mlir::spirv::ModuleOp> const&, mlir::spirv::ModuleOp, mlir::spirv::ModuleOp::GenericAdaptor<llvm::ArrayRef<mlir::ValueRange> >, mlir::ConversionPatternRewriter&) llvm-project/mlir/include/mlir/Transforms/DialectConversion.h:1025:15
#6 0x596207e65ba4 in mlir::OpConversionPattern<mlir::spirv::ModuleOp>::matchAndRewrite(mlir::spirv::ModuleOp, mlir::spirv::ModuleOpGenericAdaptor<llvm::ArrayRef<mlir::ValueRange> >, mlir::ConversionPatternRewriter&) const llvm-project/mlir/include/mlir/Transforms/DialectConversion.h:727:12
#7 0x596207e655a7 in mlir::OpConversionPattern<mlir::spirv::ModuleOp>::matchAndRewrite(mlir::Operation*, llvm::ArrayRef<mlir::ValueRange>, mlir::ConversionPatternRewriter&) const llvm-project/mlir/include/mlir/Transforms/DialectConversion.h:713:12
#8 0x596211b39925 in mlir::ConversionPattern::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&) const llvm-project/mlir/lib/Transforms/Utils/DialectConversion.cpp:2359:10
#9 0x596211c11a9d in mlir::PatternApplicator::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&, llvm::function_ref<bool (mlir::Pattern const&)>, llvm::function_ref<void (mlir::Pattern const&)>, llvm::function_ref<llvm::LogicalResult (mlir::Pattern const&)>)::$_6::operator()() const llvm-project/mlir/lib/Rewrite/PatternApplicator.cpp:223:31
#10 0x596211c11a9d in void llvm::function_ref<void ()>::callback_fn<mlir::PatternApplicator::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&, llvm::function_ref<bool (mlir::Pattern const&)>, llvm::function_ref<void (mlir::Pattern const&)>, llvm::function_ref<llvm::LogicalResult (mlir::Pattern const&)>)::$_6>(long) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#11 0x596211c0707d in llvm::function_ref<void ()>::operator()() const llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#12 0x596211c0707d in void mlir::MLIRContext::executeAction<mlir::ApplyPatternAction, mlir::Pattern const&>(llvm::function_ref<void ()>, llvm::ArrayRef<mlir::IRUnit>, mlir::Pattern const&) llvm-project/mlir/include/mlir/IR/MLIRContext.h:290:7
#13 0x596211c0707d in mlir::PatternApplicator::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&, llvm::function_ref<bool (mlir::Pattern const&)>, llvm::function_ref<void (mlir::Pattern const&)>, llvm::function_ref<llvm::LogicalResult (mlir::Pattern const&)>) llvm-project/mlir/lib/Rewrite/PatternApplicator.cpp:197:23
#14 0x596211b3d9a9 in (anonymous namespace)::OperationLegalizer::legalizeWithPattern(mlir::Operation*) llvm-project/mlir/lib/Transforms/Utils/DialectConversion.cpp:2797:21
#15 0x596211b3d9a9 in (anonymous namespace)::OperationLegalizer::legalize(mlir::Operation*) llvm-project/mlir/lib/Transforms/Utils/DialectConversion.cpp:2563:17
#16 0x596211b3c06f in mlir::OperationConverter::convert(mlir::Operation*) llvm-project/mlir/lib/Transforms/Utils/DialectConversion.cpp:3318:26
#17 0x596211b3e86c in mlir::OperationConverter::convertOperations(llvm::ArrayRef<mlir::Operation*>) llvm-project/mlir/lib/Transforms/Utils/DialectConversion.cpp:3415:16
#18 0x596211b67ebc in applyConversion(llvm::ArrayRef<mlir::Operation*>, mlir::ConversionTarget const&, mlir::FrozenRewritePatternSet const&, mlir::ConversionConfig, (anonymous namespace)::OpConversionMode)::$_43::operator()() const llvm-project/mlir/lib/Transforms/Utils/DialectConversion.cpp:4137:30
#19 0x596211b67ebc in void llvm::function_ref<void ()>::callback_fn<applyConversion(llvm::ArrayRef<mlir::Operation*>, mlir::ConversionTarget const&, mlir::FrozenRewritePatternSet const&, mlir::ConversionConfig, (anonymous namespace)::OpConversionMode)::$_43>(long) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#20 0x596211b4cb00 in llvm::function_ref<void ()>::operator()() const llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#21 0x596211b4cb00 in void mlir::MLIRContext::executeAction<ApplyConversionAction>(llvm::function_ref<void ()>, llvm::ArrayRef<mlir::IRUnit>) llvm-project/mlir/include/mlir/IR/MLIRContext.h:290:7
#22 0x596211b4cb00 in applyConversion(llvm::ArrayRef<mlir::Operation*>, mlir::ConversionTarget const&, mlir::FrozenRewritePatternSet const&, mlir::ConversionConfig, (anonymous namespace)::OpConversionMode) llvm-project/mlir/lib/Transforms/Utils/DialectConversion.cpp:4133:8
#23 0x596211b4ce39 in mlir::applyPartialConversion(llvm::ArrayRef<mlir::Operation*>, mlir::ConversionTarget const&, mlir::FrozenRewritePatternSet const&, mlir::ConversionConfig) llvm-project/mlir/lib/Transforms/Utils/DialectConversion.cpp:4150:10
#24 0x596211b4ce39 in mlir::applyPartialConversion(mlir::Operation*, mlir::ConversionTarget const&, mlir::FrozenRewritePatternSet const&, mlir::ConversionConfig) llvm-project/mlir/lib/Transforms/Utils/DialectConversion.cpp:4157:10
#25 0x596207e69466 in (anonymous namespace)::ConvertSPIRVToLLVMPass::runOnOperation() llvm-project/mlir/lib/Conversion/SPIRVToLLVM/SPIRVToLLVMPass.cpp:71:14
#26 0x596211d19f43 in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_44::operator()() const llvm-project/mlir/lib/Pass/Pass.cpp:609:17
#27 0x596211d19f43 in void llvm::function_ref<void ()>::callback_fn<mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_44>(long) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#28 0x596211d03119 in llvm::function_ref<void ()>::operator()() const llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#29 0x596211d03119 in void mlir::MLIRContext::executeAction<mlir::PassExecutionAction, mlir::Pass&>(llvm::function_ref<void ()>, llvm::ArrayRef<mlir::IRUnit>, mlir::Pass&) llvm-project/mlir/include/mlir/IR/MLIRContext.h:290:7
#30 0x596211d03119 in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) llvm-project/mlir/lib/Pass/Pass.cpp:603:21
#31 0x596211d050eb in mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) llvm-project/mlir/lib/Pass/Pass.cpp:682:16
#32 0x596211d11237 in mlir::PassManager::runPasses(mlir::Operation*, mlir::AnalysisManager) llvm-project/mlir/lib/Pass/Pass.cpp:1117:10
#33 0x596211d0fdb3 in mlir::PassManager::run(mlir::Operation*) llvm-project/mlir/lib/Pass/Pass.cpp:1091:60
#34 0x5961ff56b603 in performActions(llvm::raw_ostream&, std::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:568:17
#35 0x5961ff56a32f in processBuffer(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef, mlir::MlirOptMainConfig const&, mlir::DialectRegistry&, mlir::SourceMgrDiagnosticVerifierHandler*, llvm::ThreadPoolInterface*) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:650:9
#36 0x5961ff56a32f in mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_3::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef, llvm::raw_ostream&) const llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:733:12
#37 0x5961ff56a32f in llvm::LogicalResult llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_3>(long, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#38 0x59621252ea63 in llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&) const llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#39 0x59621252e0a6 in mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) llvm-project/mlir/lib/Support/ToolUtilities.cpp:30:12
#40 0x5961ff54f431 in mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:738:26
#41 0x5961ff54fe6d in mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:784:14
#42 0x5961ff5505c2 in mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:800:10
SUMMARY: AddressSanitizer: 144 byte(s) leaked in 2 allocation(s).
```
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#84903
Assertion failed ParseDecl.cpp:9084
swift
?
2025-10-15
let __fusion_0 = [1,2,3]
@abi(func a {No output captured.
No parent information recorded.
#84902
swiftc crash `swift::Parser::parseExternAttribute`
swift
?
2025-10-15
enum b<T{var e:d=}typealias d<T where h:T>:N
let __fusion_0 = [1,2,3]
@_extern(wasm, module: "m1", name: "f1")
func f1(x: Int) -> Int
@_extern(wasm, module: "m2", name: )
func f2ErrorOnMissingNameLiteral(x: Int) -> Int
@_extern(wasm, module: "m3", name)
func f3ErrorOnMissingNameColon(x: Int) -> Int
@_extern(wasm, module: "m4",)
func f4ErrorOnMissingNameLabel(x: Int) -> Int
@_extern(wasm, module: "m5")
func f5ErrorOnMissingName(x: Int) -> Int
@_extern(wasm, module: )
func f6ErrorOnMissingModuleLiteral(x: Int) -> Int
@_extern(wasm, module)
func f7ErrorOnMissingModuleColon(x: Int) -> Int
@_extern(wasm,)
func f8ErrorOnMissingModuleLabel(x: Int) -> Int
@_extern(wasm, module: "m9", name: "f9")
func f9WithBody() {}
struct S {
@_extern(wasm, module: "m10", name: "f10")
func f10Member()
}
func f11Scope() {
@_extern(wasm, module: "m11", name: "f11")
func f11Inner()
}
@_extern(invalid, module: "m12", name: "f12")
func f12InvalidLang()
@_extern(c, "valid")
func externCValid()
@_extern(c, "_start_with_underscore")
func underscoredValid()
@_extern(c, "")
func emptyCName()
@_extern(c, "0start_with_digit")
func explicitDigitPrefixed()
@_extern(c)
func +(a: Int, b: Bool) -> Bool
@_extern(c)
func 🥸_implicitInvalid()
@_extern(c)
func omitCName()
@_extern(c, )
func editingCName()
struct StructScopeC {
@_extern(c, "member_decl")
func memberDecl()
@_extern(c, "static_member_decl")
static func staticMemberDecl()
}
func funcScopeC() {
@_extern(c, "func_scope_inner")
func inner()
}
@_extern(c, "c_value")
var nonFunc: Int = __fusion_0
@_extern(c, "with_body")
func withInvalidBody() {}
@_extern(c, "duplicate_attr_c_1")
@_extern(c, "duplicate_attr_c_2")
func duplicateAttrsC()
@_extern(wasm, module: "dup", name: "duplicate_attr_wasm_1")
@_extern(wasm, module: "dup", name: "duplicate_attr_wasm_2")
func duplicateAttrsWasm()
@_extern(c, "mixed_attr_c")
@_extern(wasm, module: "mixed", name: "mixed_attr_wasm")
func mixedAttrs_C_Wasm()
class NonC {}
@_extern(c)
func nonCReturnTypes() -> NonC
@_extern(wasm, module: "non-c", name: "return_wasm")
func nonCReturnTypesWasm() -> NonC
@_extern(c)
@_extern(wasm, module: "non-c", name: "return_mixed")
func nonCReturnTypesMixed() -> NonC
@_extern(c)
func nonCParamTypes(_: Int, _: NonC)
@_extern(wasm, module: "non-c", name: "param_wasm")
func nonCParamTypesWasm(_: Int, _: NonC)
@_extern(c)
@_extern(wasm, module: "non-c", name: "param_mixed")
func nonCParamTypesMixed(_: Int, _: NonC)
@_extern(c)
func defaultArgValue_C(_: Int = 42)
@_extern(wasm, module: "", name: "")
func defaultArgValue_Wasm(_: Int = 24)
@_extern(c)
func asyncFuncC() async
@_extern(c)
func throwsFuncC() throws
@_extern(c)
func genericFuncC<T>(_: T)
@_extern(c)
@_cdecl("another_c_name")
func withAtCDecl_C()
@_extern(wasm, module: "", name: "")
@_cdecl("another_c_name")
func withAtCDecl_Wasm()
@_extern(c)
@_silgen_name("another_sil_name")
func withAtSILGenName_C()
@_extern(wasm, module: "", name: "")
@_silgen_name("another_sil_name")
func withAtSILGenName_Wasm()
@_extern(c)
@_cdecl("another_c_name")
@_silgen_name("another_sil_name")
func withAtSILGenName_CDecl_C()No output captured.
No parent information recorded.
#84901
swiftc crash `swift::ast_scope::NodeAdder::visitBraceStmt`
swift
?
2025-10-15
protocol a : b where c == d<e> protocol f : g protocol g {
associatedtype 2 : a
}
struct d < e extension d
: f protocol h{associatedtype e associatedtype c : g} protocol b : h
let __fusion_0 = 2
@a({ struct b }
var cNo output captured.
No parent information recorded.
#84900
swiftc crash with unclosed bracket
swift
?
2025-10-15
class B<b where B:A{public protocol F
class a { @objc ( : ( bNo output captured.
No parent information recorded.
#84898
swiftc crash `evaluateFreestandingMacro`
swift
?
2025-10-15
import freestanding_macro_library
#if IMPORT_MACRO_LIBRARY
#else
@freestanding(declaration, names: named(StructWithUnqualifiedLookup))
macro structWithUnqualifiedLookup() = #externalMacro(module: "MacroDefinition", type: "DefineStructWithUnqualifiedLookupMacro")
@freestanding(declaration)
macro anonymousTypes(public: Bool = false, causeErrors: Bool = false, _: () -> String) = #externalMacro(module: "MacroDefinition", type: "DefineAnonymousTypesMacro")
@freestanding(declaration)
macro introduceTypeCheckingErrors() = #externalMacro(module: "MacroDefinition", type: "IntroduceTypeCheckingErrorsMacro")
@freestanding(declaration)
macro freestandingWithClosure<T>(_ value: T, body: (T) -> T) = #externalMacro(module: "MacroDefinition", type: "EmptyDeclarationMacro")
@freestanding(declaration, names: arbitrary) macro bitwidthNumberedStructs(_ baseName: String) = #externalMacro(module: "MacroDefinition", type: "DefineBitwidthNumberedStructsMacro")
@freestanding(expression) macro stringify<T>(_ value: T) -> (T, String) = #externalMacro(module: "MacroDefinition", type: "StringifyMacro")
@freestanding(declaration, names: named(value)) macro varValue() = #externalMacro(module: "MacroDefinition", type: "VarValueMacro")
@freestanding(expression) macro checkGeneric_root<A>() = #externalMacro(module: "MacroDefinition", type: "GenericToVoidMacro")
@freestanding(expression) macro checkGeneric<A>() = #checkGeneric_root<A>()
@freestanding(expression) macro checkGeneric2_root<A, B>() = #externalMacro(module: "MacroDefinition", type: "GenericToVoidMacro")
@freestanding(expression) macro checkGeneric2<A, B>() = #checkGeneric2_root<A, B>()
@freestanding(expression) macro checkGenericHashableCodable_root<A: Hashable, B: Codable>() = #externalMacro(module: "MacroDefinition", type: "GenericToVoidMacro")
@freestanding(expression) macro checkGenericHashableCodable<A: Hashable, B: Codable>() = #checkGenericHashableCodable_root<A, B>()
#endif
// Test unqualified lookup from within a macro expansion
let world = 3 // to be used by the macro expansion below
#structWithUnqualifiedLookup
func lookupGlobalFreestandingExpansion() {
// CHECK: 4
print(StructWithUnqualifiedLookup().foo())
}
#anonymousTypes(public: true) { "hello" }
// CHECK-SIL: sil @$s9MacroUser03$s9A115User0033top_level_freestandingswift_DbGHjfMX56_0_33_082AE7CFEFA6960C804A9FE7366EB5A0Ll14anonymousTypesfMf_4namefMu_C5helloSSyF
@main
struct Main {
static func main() {
lookupGlobalFreestandingExpansion()
}
}
// Unqualified lookup for names defined within macro arguments.
#freestandingWithClosure(0) { x in x }
#freestandingWithClosure(1) {
let x = $0
return x
}
struct HasInnerClosure {
#freestandingWithClosure(0) { x in x }
#freestandingWithClosure(1) { x in x }
}
#if TEST_DIAGNOSTICS
// Arbitrary names at global scope
#bitwidthNumberedStructs("MyIntGlobal")
// expected-error@-1 {{'declaration' macros are not allowed to introduce arbitrary names at global scope}}
func testArbitraryAtGlobal() {
_ = MyIntGlobal16()
// expected-error@-1 {{cannot find 'MyIntGlobal16' in scope}}
}
#endif
#varValue
func testGlobalVariable() {
_ = value
}
#if TEST_DIAGNOSTICS
// expected-note @+1 6 {{in expansion of macro 'anonymousTypes' here}}
#anonymousTypes(causeErrors: true) { "foo" }
// expected-note @+1 2 {{in expansion of macro 'anonymousTypes' here}}
#anonymousTypes { () -> String in
// expected-warning @+1 {{use of protocol 'Equatable' as a type must be written 'any Equatable'}}
_ = 0 as Equatable
return "foo"
}
#endif
@freestanding(declaration)
macro Empty<T>(_ closure: () -> T) = #externalMacro(module: "MacroDefinition", type: "EmptyDeclarationMacro")
#Empty {
S(a: 10, b: 10)
}
@attached(extension, conformances: Initializable, names: named(init))
macro Initializable() = #externalMacro(module: "MacroDefinition", type: "InitializableMacro")
protocol Initializable {
init(value: Int)
}
@Initializable
struct S {
init(a: Int, b: Int) {}
}
#checkGeneric<String>()
#checkGeneric2<String, Int>()
#checkGenericHashableCodable<String, Int>()
@freestanding(expression) macro functionCallWithInoutParam(_ v: inout Int)
= #externalMacro(module: "MacroDefinition", type: "VoidExpressionMacro")
@freestanding(expression) macro functionCallWithTwoInoutParams(_ u: inout Int, _ v: inout Int)
= #externalMacro(module: "MacroDefinition", type: "VoidExpressionMacro")
@freestanding(expression) macro functionCallWithInoutParamPlusOthers(
string: String, double: Double, _ v: inout Int)
= #externalMacro(module: "MacroDefinition", type: "VoidExpressionMacro")
func testFunctionCallWithInoutParam() {
var a = 0
var b = 0
#functionCallWithInoutParam(&a)
#functionCallWithTwoInoutParams(&a, &b)
#functionCallWithInoutParamPlusOthers(string: "", double: 1.0, &a)
}
let __fusion_0 = }
class A{var f=b
func b{class B{
class A{class A{
class A<f:f.cNo output captured.
No parent information recorded.
#84897
swiftc crash `GenericSignatureImpl::getReducedTypeParameter`
swift
?
2025-10-15
protocol a {
protocol a{associatedtype b} extension a {
extension a {
struct c {
d : b
let __fusion_0 = [1,2,3]
class B {
class d<T, i where B : b> : d {
case c> : P {
init<D> s: e("
}
var b = __fusion_0No output captured.
No parent information recorded.
#163343
[mlir] null pointer UBSan alert in mlir/lib/IR/Diagnostics.cpp
llvm
?
2025-10-14
{% raw %}
# [mlir] null pointer UBSan alert in mlir/lib/IR/Diagnostics.cpp
**Issue:** [https://github.com/llvm/llvm-project/issues/163343](https://github.com/llvm/llvm-project/issues/163343) · **State:** `closed` · **Created:** `2025-10-14T08:47:17Z`
**Labels:** `mlir`, `crash`
## Description
PoC:
```
// expected-warning @unknown {{could not cast operand of type 'f16' to 'vector<4xf16>'}}
```
stderr:
```
/home/phpfuzz/WorkSpace/llvm-project/mlir/lib/IR/Diagnostics.cpp:599:71: runtime error: applying non-zero offset 55 to null pointer
#0 0x5c8f982fe1e9 in mlir::detail::ExpectedDiag::emitError(llvm::raw_ostream&, llvm::SourceMgr&, llvm::Twine const&) /home/phpfuzz/WorkSpace/llvm-project/mlir/lib/IR/Diagnostics.cpp:599:71
#1 0x5c8f982fabb3 in mlir::SourceMgrDiagnosticVerifierHandler::verify()::$_8::operator()(mlir::detail::ExpectedDiag&) const /home/phpfuzz/WorkSpace/llvm-project/mlir/lib/IR/Diagnostics.cpp:844:15
#2 0x5c8f982fa4dd in mlir::SourceMgrDiagnosticVerifierHandler::verify() /home/phpfuzz/WorkSpace/llvm-project/mlir/lib/IR/Diagnostics.cpp:852:5
#3 0x5c8f982fa08d in mlir::SourceMgrDiagnosticVerifierHandler::~SourceMgrDiagnosticVerifierHandler() /home/phpfuzz/WorkSpace/llvm-project/mlir/lib/IR/Diagnostics.cpp:833:9
#4 0x5c8f854b74f9 in mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) /home/phpfuzz/WorkSpace/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:746:1
#5 0x5c8f854b7e6d in mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) /home/phpfuzz/WorkSpace/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:784:14
#6 0x5c8f854b85c2 in mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) /home/phpfuzz/WorkSpace/llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:800:10
#7 0x5c8f852d03ce in main /home/phpfuzz/WorkSpace/llvm-project/mlir/tools/mlir-opt/mlir-opt.cpp:343:33
#8 0x781ff9447d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#9 0x781ff9447e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#10 0x5c8f8520fb64 in _start (/home/phpfuzz/WorkSpace/llvm-mlir-build/bin/mlir-opt+0x8381b64) (BuildId: 8d3f598c321c686de3addc0e0905b4ae76916fb7)
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/llvm-project/mlir/lib/IR/Diagnostics.cpp:599:71 in
```
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*
{% endraw %}No output captured.
No parent information recorded.
#163337
[mlir] SEGV `--test-bytecode-roundtrip=test-kind=4`
llvm
?
2025-10-14
# [mlir] SEGV `--test-bytecode-roundtrip=test-kind=4`
**Issue:** [https://github.com/llvm/llvm-project/issues/163337](https://github.com/llvm/llvm-project/issues/163337) · **State:** `closed` · **Created:** `2025-10-14T08:24:13Z`
**Labels:** `mlir`, `crash`
## Description
PoC:
```mlir
spirv.module Logical GLSL450 {
spirv.func @callee() -> () "None" {
spirv.Kill
}
spirv.func @do_not_inline_kill() -> () "None" {
spirv.FunctionCall @callee() : () -> ()
spirv.Return
}
}
func.func @fusion_bridge_698938439() -> i32 {
%c = arith.constant 0 : i32
return %c : i32
}
%fusion_tmp = func.call @fusion_bridge_698938439() : () -> i32
"test.versionedC"() <{attribute = #test.attr_params<42, 24>}> : () -> ()
```
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#84851
Infinite recursion in TypeBase::isBindableToSuperclassOf()
swift
?
2025-10-13
class a < b protocol
c{associatedtype f : a<d> associatedtype d : a<f>} func e < b : c {
b.f = b.d
let __fusion_0 = "fusion"
@propertyWrapper
public struct Wrapper<T> {
public var wrappedV: T // part-way through typing wrappedValue
public init(initialValue: T) {
self.value = initialValue
}
public init(body: () -> T) {
self.value = __fusion_0
}
}
var globalInt: Int { return 17 }
public struct HasWrappers {
@Wrapper
public var x: Int = globalInt
@Wrapper(body: { globalInt })
public var y: Int
@Wrapper(body: {
struct Inner {
@Wrapper
var x: Int = globalInt
}
return Inner().x + globalInt
})
public var z: Int
func backingUse() {
_ = $y.value + $z.value + x + $x.value
}
}
func useMemberwiseInits(i: Int) {
_ = HasWrappers(x: i)
_ = HasWrappers(y: Wrapper(initialValue: i))
}No output captured.
No parent information recorded.
#84850
swiftc crash when ArgumentMismatchFailure
swift
?
2025-10-13
func test_assert(x: Int, y: Int) -> Int {
assert(x >= y , "x smaller than y")
return x + y
}
func test_fatal(x: Int, y: Int) -> Int {
if x > y {
return x + y
}
preconditionFailure("Human nature ...")
}
func testprecondition_check(x: Int, y: Int) -> Int {
precondition(x > y, "Test precondition check")
return x + y
}
func test_partial_safety_check(x: Int, y: Int) -> Int {
assert(x > y, "Test partial safety check")
return x + y
}
let __fusion_0 = x + y
func a<each b>(repeat each b, repeat each b)
a(repeat (No output captured.
No parent information recorded.
#84849
swiftc crash bad pointer dereference when typealias nonexisting one
swift
?
2025-10-13
let test = 42
typealias a = () extension a : ComparableNo output captured.
No parent information recorded.
#163052
[mlir] [llvm] stack overflow in llvm/include/llvm/ADT/DenseMap.h
llvm
?
2025-10-12
# [mlir] [llvm] stack overflow in llvm/include/llvm/ADT/DenseMap.h
**Issue:** [https://github.com/llvm/llvm-project/issues/163052](https://github.com/llvm/llvm-project/issues/163052) · **State:** `closed` · **Created:** `2025-10-12T08:30:30Z`
**Labels:** `crash`, `mlir:bufferization`
## Description
test.mlir:
```mlir
func.func private @B_foo(tensor<64xf32>)
func.func private @B_bar(%A : tensor<64xf32>) {
call @B_foo(%A) : (tensor<64xf32>) -> ()
return
}
```
reproduce: `mlir-opt ./test.mlir --split-input-file '-one-shot-bufferize=bufferize-function-boundaries=1 copy-before-write=1' -drop-equivalent-buffer-results`
stderr:
```
=================================================================
==2343068==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffcbf29a320 at pc 0x595cbb4fa5ad bp 0x7ffcbf298960 sp 0x7ffcbf298958
READ of size 8 at 0x7ffcbf29a320 thread T0
#0 0x595cbb4fa5ac in llvm::DenseMap<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> >, llvm::DenseMapInfo<mlir::TypeID, void>, llvm::detail::DenseMapPair<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> > > >::getBuckets() const llvm-project/llvm/include/llvm/ADT/DenseMap.h:829:40
#1 0x595cbb4fa5ac in llvm::DenseMapBase<llvm::DenseMap<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> >, llvm::DenseMapInfo<mlir::TypeID, void>, llvm::detail::DenseMapPair<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> > > >, mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> >, llvm::DenseMapInfo<mlir::TypeID, void>, llvm::detail::DenseMapPair<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> > > >::getBuckets() const llvm-project/llvm/include/llvm/ADT/DenseMap.h:507:56
#2 0x595cbb4fa5ac in llvm::detail::DenseMapPair<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> > > const* llvm::DenseMapBase<llvm::DenseMap<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> >, llvm::DenseMapInfo<mlir::TypeID, void>, llvm::detail::DenseMapPair<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> > > >, mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> >, llvm::DenseMapInfo<mlir::TypeID, void>, llvm::detail::DenseMapPair<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> > > >::doFind<mlir::TypeID>(mlir::TypeID const&) const llvm-project/llvm/include/llvm/ADT/DenseMap.h:572:33
#3 0x595cbb4fa3e7 in llvm::detail::DenseMapPair<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> > >* llvm::DenseMapBase<llvm::DenseMap<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> >, llvm::DenseMapInfo<mlir::TypeID, void>, llvm::detail::DenseMapPair<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> > > >, mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> >, llvm::DenseMapInfo<mlir::TypeID, void>, llvm::detail::DenseMapPair<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> > > >::doFind<mlir::TypeID>(mlir::TypeID const&) llvm-project/llvm/include/llvm/ADT/DenseMap.h:596:50
#4 0x595cbb4fa3e7 in llvm::DenseMapIterator<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> >, llvm::DenseMapInfo<mlir::TypeID, void>, llvm::detail::DenseMapPair<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> > >, false> llvm::DenseMapBase<llvm::DenseMap<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> >, llvm::DenseMapInfo<mlir::TypeID, void>, llvm::detail::DenseMapPair<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> > > >, mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> >, llvm::DenseMapInfo<mlir::TypeID, void>, llvm::detail::DenseMapPair<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> > > >::find_as<mlir::TypeID>(mlir::TypeID const&) llvm-project/llvm/include/llvm/ADT/DenseMap.h:181:27
#5 0x595cbb4fa038 in llvm::DenseMapBase<llvm::DenseMap<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> >, llvm::DenseMapInfo<mlir::TypeID, void>, llvm::detail::DenseMapPair<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> > > >, mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> >, llvm::DenseMapInfo<mlir::TypeID, void>, llvm::detail::DenseMapPair<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> > > >::find(mlir::TypeID const&) llvm-project/llvm/include/llvm/ADT/DenseMap.h:168:12
#6 0x595cbb4fa038 in mlir::bufferization::func_ext::FuncAnalysisState* mlir::bufferization::OneShotAnalysisState::getExtension<mlir::bufferization::func_ext::FuncAnalysisState>() llvm-project/mlir/include/mlir/Dialect/Bufferization/Transforms/OneShotAnalysis.h:214:28
#7 0x595cbb4f97ef in mlir::bufferization::func_ext::FuncAnalysisState const* mlir::bufferization::OneShotAnalysisState::getExtension<mlir::bufferization::func_ext::FuncAnalysisState>() const llvm-project/mlir/include/mlir/Dialect/Bufferization/Transforms/OneShotAnalysis.h:223:54
#8 0x595cbb4f97ef in mlir::bufferization::func_ext::getCalledFunction(mlir::CallOpInterface, mlir::bufferization::AnalysisState const&) llvm-project/mlir/lib/Dialect/Bufferization/Transforms/FuncBufferizableOpInterfaceImpl.cpp:112:32
#9 0x595cbb4fb5bc in mlir::bufferization::func_ext::CallOpInterface::bufferizesToMemoryWrite(mlir::Operation*, mlir::OpOperand&, mlir::bufferization::AnalysisState const&) const llvm-project/mlir/lib/Dialect/Bufferization/Transforms/FuncBufferizableOpInterfaceImpl.cpp:186:21
#10 0x595cbb5653f8 in mlir::bufferization::AnalysisState::bufferizesToMemoryWrite(mlir::OpOperand&) const llvm-project/mlir/lib/Dialect/Bufferization/IR/BufferizableOpInterface.cpp:473:27
#11 0x595cbb56a41b in mlir::bufferization::AnalysisState::isInPlace(mlir::OpOperand&) const llvm-project/mlir/lib/Dialect/Bufferization/IR/BufferizableOpInterface.cpp:663:11
#12 0x595cbb5636c4 in mlir::bufferization::BufferizableOpInterface::resolveTensorOpOperandConflicts(mlir::RewriterBase&, mlir::bufferization::AnalysisState const&, mlir::bufferization::BufferizationState const&) llvm-project/mlir/lib/Dialect/Bufferization/IR/BufferizableOpInterface.cpp:242:23
#13 0x595cbb4feb4d in mlir::bufferization::detail::BufferizableOpInterfaceInterfaceTraits::ExternalModel<mlir::bufferization::func_ext::CallOpInterface, mlir::func::CallOp>::resolveConflicts(mlir::Operation*, mlir::RewriterBase&, mlir::bufferization::AnalysisState const&, mlir::bufferization::BufferizationState const&) const llvm-mlir-build/tools/mlir/include/mlir/Dialect/Bufferization/IR/BufferizableOpInterface.h.inc:1211:33
#14 0x595cbb55aff6 in mlir::bufferization::insertTensorCopies(mlir::Operation*, mlir::bufferization::AnalysisState const&, mlir::bufferization::BufferizationState const&)::$_1::operator()(mlir::Operation*) const llvm-project/mlir/lib/Dialect/Bufferization/Transforms/TensorCopyInsertion.cpp:72:31
#15 0x595cbb55aff6 in mlir::WalkResult llvm::function_ref<mlir::WalkResult (mlir::Operation*)>::callback_fn<mlir::bufferization::insertTensorCopies(mlir::Operation*, mlir::bufferization::AnalysisState const&, mlir::bufferization::BufferizationState const&)::$_1>(long, mlir::Operation*) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#16 0x595cac483d64 in llvm::function_ref<mlir::WalkResult (mlir::Operation*)>::operator()(mlir::Operation*) const llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#17 0x595cac483d64 in mlir::WalkResult mlir::detail::walk<mlir::ForwardIterator>(mlir::Operation*, llvm::function_ref<mlir::WalkResult (mlir::Operation*)>, mlir::WalkOrder) llvm-project/mlir/include/mlir/IR/Visitors.h:246:12
#18 0x595cac483c78 in mlir::WalkResult mlir::detail::walk<mlir::ForwardIterator>(mlir::Operation*, llvm::function_ref<mlir::WalkResult (mlir::Operation*)>, mlir::WalkOrder) llvm-project/mlir/include/mlir/IR/Visitors.h:239:13
#19 0x595cbb55ac0c in std::enable_if<llvm::is_one_of<mlir::Operation*, mlir::Operation*, mlir::Region*, mlir::Block*>::value, mlir::WalkResult>::type mlir::detail::walk<(mlir::WalkOrder)1, mlir::ForwardIterator, mlir::bufferization::insertTensorCopies(mlir::Operation*, mlir::bufferization::AnalysisState const&, mlir::bufferization::BufferizationState const&)::$_1, mlir::Operation*, mlir::WalkResult>(mlir::Operation*, mlir::bufferization::insertTensorCopies(mlir::Operation*, mlir::bufferization::AnalysisState const&, mlir::bufferization::BufferizationState const&)::$_1&&) llvm-project/mlir/include/mlir/IR/Visitors.h:278:10
#20 0x595cbb55ac0c in std::enable_if<(llvm::function_traits<std::decay<mlir::bufferization::insertTensorCopies(mlir::Operation*, mlir::bufferization::AnalysisState const&, mlir::bufferization::BufferizationState const&)::$_1>::type>::num_args) == (1), mlir::WalkResult>::type mlir::Operation::walk<(mlir::WalkOrder)1, mlir::ForwardIterator, mlir::bufferization::insertTensorCopies(mlir::Operation*, mlir::bufferization::AnalysisState const&, mlir::bufferization::BufferizationState const&)::$_1, mlir::WalkResult>(mlir::bufferization::insertTensorCopies(mlir::Operation*, mlir::bufferization::AnalysisState const&, mlir::bufferization::BufferizationState const&)::$_1&&) llvm-project/mlir/include/mlir/IR/Operation.h:798:12
#21 0x595cbb55ac0c in mlir::bufferization::insertTensorCopies(mlir::Operation*, mlir::bufferization::AnalysisState const&, mlir::bufferization::BufferizationState const&) llvm-project/mlir/lib/Dialect/Bufferization/Transforms/TensorCopyInsertion.cpp:59:27
#22 0x595cbb4ac4e4 in mlir::bufferization::bufferizeOp(mlir::Operation*, mlir::bufferization::BufferizationOptions const&, mlir::bufferization::BufferizationState&, mlir::bufferization::BufferizationStatistics*) llvm-project/mlir/lib/Dialect/Bufferization/Transforms/Bufferize.cpp:283:16
#23 0x595cbb5388e7 in mlir::bufferization::bufferizeModuleOp(mlir::Operation*, mlir::bufferization::OneShotBufferizationOptions const&, mlir::bufferization::BufferizationState&, mlir::bufferization::BufferizationStatistics*) llvm-project/mlir/lib/Dialect/Bufferization/Transforms/OneShotModuleBufferize.cpp:573:18
#24 0x595cbb53a308 in mlir::bufferization::runOneShotModuleBufferize(mlir::Operation*, mlir::bufferization::OneShotBufferizationOptions const&, mlir::bufferization::BufferizationState&, mlir::bufferization::BufferizationStatistics*) llvm-project/mlir/lib/Dialect/Bufferization/Transforms/OneShotModuleBufferize.cpp:634:14
#25 0x595cbb4b51a2 in (anonymous namespace)::OneShotBufferizePass::runOnOperation() llvm-project/mlir/lib/Dialect/Bufferization/Transforms/Bufferize.cpp:168:15
#26 0x595cbebddf43 in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_44::operator()() const llvm-project/mlir/lib/Pass/Pass.cpp:609:17
#27 0x595cbebddf43 in void llvm::function_ref<void ()>::callback_fn<mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_44>(long) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#28 0x595cbebc7119 in llvm::function_ref<void ()>::operator()() const llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#29 0x595cbebc7119 in void mlir::MLIRContext::executeAction<mlir::PassExecutionAction, mlir::Pass&>(llvm::function_ref<void ()>, llvm::ArrayRef<mlir::IRUnit>, mlir::Pass&) llvm-project/mlir/include/mlir/IR/MLIRContext.h:290:7
#30 0x595cbebc7119 in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) llvm-project/mlir/lib/Pass/Pass.cpp:603:21
#31 0x595cbebc90eb in mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) llvm-project/mlir/lib/Pass/Pass.cpp:682:16
#32 0x595cbebd5237 in mlir::PassManager::runPasses(mlir::Operation*, mlir::AnalysisManager) llvm-project/mlir/lib/Pass/Pass.cpp:1117:10
#33 0x595cbebd3db3 in mlir::PassManager::run(mlir::Operation*) llvm-project/mlir/lib/Pass/Pass.cpp:1091:60
#34 0x595cac42f603 in performActions(llvm::raw_ostream&, std::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:568:17
#35 0x595cac42e516 in processBuffer(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef, mlir::MlirOptMainConfig const&, mlir::DialectRegistry&, mlir::SourceMgrDiagnosticVerifierHandler*, llvm::ThreadPoolInterface*) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:644:12
#36 0x595cac42e516 in mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_3::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef, llvm::raw_ostream&) const llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:733:12
#37 0x595cac42e516 in llvm::LogicalResult llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_3>(long, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#38 0x595cbf3f2a63 in llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&) const llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#39 0x595cbf3f3525 in mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0::operator()(llvm::StringRef) const llvm-project/mlir/lib/Support/ToolUtilities.cpp:94:13
#40 0x595cbf3f23b1 in void llvm::interleave<llvm::StringRef const*, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, void llvm::interleave<llvm::SmallVector<llvm::StringRef, 8u>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::raw_ostream, llvm::StringRef>(llvm::SmallVector<llvm::StringRef, 8u> const&, llvm::raw_ostream&, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::StringRef const&)::'lambda'(), void>(llvm::SmallVector<llvm::StringRef, 8u>, llvm::SmallVector<llvm::StringRef, 8u>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::raw_ostream) llvm-project/llvm/include/llvm/ADT/STLExtras.h:2199:3
#41 0x595cbf3f23b1 in void llvm::interleave<llvm::SmallVector<llvm::StringRef, 8u>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::raw_ostream, llvm::StringRef>(llvm::SmallVector<llvm::StringRef, 8u> const&, llvm::raw_ostream&, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::StringRef const&) llvm-project/llvm/include/llvm/ADT/STLExtras.h:2221:3
#42 0x595cbf3f23b1 in mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) llvm-project/mlir/lib/Support/ToolUtilities.cpp:97:3
#43 0x595cac413431 in mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:738:26
#44 0x595cac413e6d in mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:784:14
#45 0x595cac4145c2 in mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:800:10
#46 0x595cac22c3ce in main llvm-project/mlir/tools/mlir-opt/mlir-opt.cpp:343:33
#47 0x7c1daae1bd8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#48 0x7c1daae1be3f in __libc_start_main csu/../csu/libc-start.c:392:3
#49 0x595cac16bb64 in _start (llvm-mlir-build/bin/mlir-opt+0x8381b64) (BuildId: 8d3f598c321c686de3addc0e0905b4ae76916fb7)
Address 0x7ffcbf29a320 is located in stack of thread T0 at offset 1216 in frame
#0 0x595cbb4ac1af in mlir::bufferization::bufferizeOp(mlir::Operation*, mlir::bufferization::BufferizationOptions const&, mlir::bufferization::BufferizationState&, mlir::bufferization::BufferizationStatistics*) llvm-project/mlir/lib/Dialect/Bufferization/Transforms/Bufferize.cpp:280
This frame has 37 object(s):
[32, 40) 'Val.addr.i.i752'
[64, 72) 'wrapperFn.i.i735'
[96, 128) 'agg.tmp.i'
[160, 168) 'Val.addr.i.i723'
[192, 240) 'ref.tmp.i704'
[272, 304) 'ref.tmp.i683'
[336, 368) 'ref.tmp.i633'
[400, 408) 'info.i'
[432, 464) 'ref.tmp.i'
[496, 504) '__first.i.i.i'
[528, 536) 'ref.tmp.i.i'
[560, 568) 'Val.addr.i.i'
[592, 600) 'wrapperFn.i.i'
[624, 712) 'analysisState' (line 282)
[752, 784) 'toBufferOps' (line 288)
[816, 824) 'ref.tmp' (line 289)
[848, 912) 'worklist' (line 298)
[944, 960) 'ref.tmp29' (line 299)
[976, 1008) 'erasedOps' (line 305)
[1040, 1216) 'rewriter' (line 308) <== Memory access at offset 1216 overflows this variable
[1280, 1296) 'bufferizableOp' (line 316)
[1312, 1520) 'ref.tmp119' (line 326)
[1584, 1624) 'ref.tmp122' (line 326)
[1664, 1760) 'ref.tmp157' (line 332)
[1792, 1824) 'agg.tmp158'
[1856, 1952) 'ref.tmp235' (line 337)
[1984, 2016) 'agg.tmp236'
[2048, 2256) 'ref.tmp261' (line 339)
[2320, 2360) 'ref.tmp264' (line 339)
[2400, 2496) 'ref.tmp297' (line 341)
[2528, 2560) 'agg.tmp298'
[2592, 2624) '__begin1' (line 349)
[2656, 2688) '__end1' (line 349)
[2720, 2728) 'ref.tmp397' (line 356)
[2752, 2832) 'ref.tmp451' (line 381)
[2864, 3072) 'ref.tmp467' (line 386)
[3136, 3176) 'ref.tmp470' (line 386)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow llvm-project/llvm/include/llvm/ADT/DenseMap.h:829:40 in llvm::DenseMap<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> >, llvm::DenseMapInfo<mlir::TypeID, void>, llvm::detail::DenseMapPair<mlir::TypeID, std::unique_ptr<mlir::bufferization::OneShotAnalysisState::Extension, std::default_delete<mlir::bufferization::OneShotAnalysisState::Extension> > > >::getBuckets() const
Shadow bytes around the buggy address:
0x100017e4b410: f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 00 00 00 00 00 00
0x100017e4b420: 00 00 00 00 00 f2 f2 f2 f2 f2 f8 f8 f8 f8 f2 f2
0x100017e4b430: f2 f2 f8 f2 f2 f2 f8 f8 f8 f8 f8 f8 f8 f8 f2 f2
0x100017e4b440: f2 f2 f8 f8 f2 f2 f8 f8 f8 f8 f2 f2 f2 f2 f8 f8
0x100017e4b450: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
=>0x100017e4b460: f8 f8 f8 f8[f2]f2 f2 f2 f2 f2 f2 f2 f8 f8 f2 f2
0x100017e4b470: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
0x100017e4b480: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f2 f2 f2 f2 f2 f2
0x100017e4b490: f2 f2 f8 f8 f8 f8 f8 f2 f2 f2 f2 f2 f8 f8 f8 f8
0x100017e4b4a0: f8 f8 f8 f8 f8 f8 f8 f8 f2 f2 f2 f2 00 00 00 00
0x100017e4b4b0: f2 f2 f2 f2 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2343068==ABORTING
```
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#163051
[mlir] UAF in mlir/include/mlir/IR/Block.h
llvm
?
2025-10-12
# [mlir] UAF in mlir/include/mlir/IR/Block.h
**Issue:** [https://github.com/llvm/llvm-project/issues/163051](https://github.com/llvm/llvm-project/issues/163051) · **State:** `closed` · **Created:** `2025-10-12T08:24:26Z`
**Labels:** `code-quality`, `mlir`
## Description
```
llvm.func @repeated_successor(%arg0: i64, %arg1: i64, %arg2: i64, %arg3: i1) {
omp.wsloop {
omp.loop_nest (%arg4) : i64 = (%arg0) to (%arg1) step (%arg2) {
llvm.cond_br %arg3, ^bb1(%arg0 : i64), ^bb1(%arg1 : i64)
^bb1(%0: i64): // 2 preds: ^bb0, ^bb0
omp.yield
}
}
llvm.return
}
```
repro: `mlir-opt ./test.mlir -remove-dead-values -split-input-file -verify-diagnostics`
stderr:
```
=================================================================
==2252528==ERROR: AddressSanitizer: heap-use-after-free on address 0x60200000b170 at pc 0x5ff94c553f04 bp 0x7ffe0ef2a8f0 sp 0x7ffe0ef2a8e8
READ of size 8 at 0x60200000b170 thread T0
#0 0x5ff94c553f03 in mlir::Block::getArgument(unsigned int) llvm-project/mlir/include/mlir/IR/Block.h:129:50
#1 0x5ff94c553f03 in (anonymous namespace)::cleanUpDeadVals((anonymous namespace)::RDVFinalCleanupList&) llvm-project/mlir/lib/Transforms/RemoveDeadValues.cpp:836:12
#2 0x5ff94c54cf3b in (anonymous namespace)::RemoveDeadValues::runOnOperation() llvm-project/mlir/lib/Transforms/RemoveDeadValues.cpp:902:3
#3 0x5ff94c7bbf43 in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_44::operator()() const llvm-project/mlir/lib/Pass/Pass.cpp:609:17
#4 0x5ff94c7bbf43 in void llvm::function_ref<void ()>::callback_fn<mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_44>(long) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#5 0x5ff94c7a5119 in llvm::function_ref<void ()>::operator()() const llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#6 0x5ff94c7a5119 in void mlir::MLIRContext::executeAction<mlir::PassExecutionAction, mlir::Pass&>(llvm::function_ref<void ()>, llvm::ArrayRef<mlir::IRUnit>, mlir::Pass&) llvm-project/mlir/include/mlir/IR/MLIRContext.h:290:7
#7 0x5ff94c7a5119 in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) llvm-project/mlir/lib/Pass/Pass.cpp:603:21
#8 0x5ff94c7a70eb in mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) llvm-project/mlir/lib/Pass/Pass.cpp:682:16
#9 0x5ff94c7b3237 in mlir::PassManager::runPasses(mlir::Operation*, mlir::AnalysisManager) llvm-project/mlir/lib/Pass/Pass.cpp:1117:10
#10 0x5ff94c7b1db3 in mlir::PassManager::run(mlir::Operation*) llvm-project/mlir/lib/Pass/Pass.cpp:1091:60
#11 0x5ff93a00d603 in performActions(llvm::raw_ostream&, std::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:568:17
#12 0x5ff93a00c32f in processBuffer(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef, mlir::MlirOptMainConfig const&, mlir::DialectRegistry&, mlir::SourceMgrDiagnosticVerifierHandler*, llvm::ThreadPoolInterface*) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:650:9
#13 0x5ff93a00c32f in mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_3::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef, llvm::raw_ostream&) const llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:733:12
#14 0x5ff93a00c32f in llvm::LogicalResult llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_3>(long, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#15 0x5ff94cfd0a63 in llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&) const llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#16 0x5ff94cfd1525 in mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0::operator()(llvm::StringRef) const llvm-project/mlir/lib/Support/ToolUtilities.cpp:94:13
#17 0x5ff94cfd03b1 in void llvm::interleave<llvm::StringRef const*, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, void llvm::interleave<llvm::SmallVector<llvm::StringRef, 8u>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::raw_ostream, llvm::StringRef>(llvm::SmallVector<llvm::StringRef, 8u> const&, llvm::raw_ostream&, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::StringRef const&)::'lambda'(), void>(llvm::SmallVector<llvm::StringRef, 8u>, llvm::SmallVector<llvm::StringRef, 8u>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::raw_ostream) llvm-project/llvm/include/llvm/ADT/STLExtras.h:2199:3
#18 0x5ff94cfd03b1 in void llvm::interleave<llvm::SmallVector<llvm::StringRef, 8u>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::raw_ostream, llvm::StringRef>(llvm::SmallVector<llvm::StringRef, 8u> const&, llvm::raw_ostream&, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::StringRef const&) llvm-project/llvm/include/llvm/ADT/STLExtras.h:2221:3
#19 0x5ff94cfd03b1 in mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) llvm-project/mlir/lib/Support/ToolUtilities.cpp:97:3
#20 0x5ff939ff1431 in mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:738:26
#21 0x5ff939ff1e6d in mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:784:14
#22 0x5ff939ff25c2 in mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:800:10
#23 0x5ff939e0a3ce in main llvm-project/mlir/tools/mlir-opt/mlir-opt.cpp:343:33
#24 0x7f128dcf9d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#25 0x7f128dcf9e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#26 0x5ff939d49b64 in _start (llvm-mlir-build/bin/mlir-opt+0x8381b64) (BuildId: 8d3f598c321c686de3addc0e0905b4ae76916fb7)
0x60200000b170 is located 0 bytes inside of 8-byte region [0x60200000b170,0x60200000b178)
freed by thread T0 here:
#0 0x5ff939e07fdd in operator delete(void*) (llvm-mlir-build/bin/mlir-opt+0x843ffdd) (BuildId: 8d3f598c321c686de3addc0e0905b4ae76916fb7)
#1 0x5ff94cce0e32 in std::_Vector_base<mlir::BlockArgument, std::allocator<mlir::BlockArgument> >::_M_deallocate(mlir::BlockArgument*, unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/stl_vector.h:354:4
#2 0x5ff94cce0e32 in std::_Vector_base<mlir::BlockArgument, std::allocator<mlir::BlockArgument> >::~_Vector_base() /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/stl_vector.h:335:2
#3 0x5ff94cce0e32 in std::vector<mlir::BlockArgument, std::allocator<mlir::BlockArgument> >::~vector() /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/stl_vector.h:683:7
#4 0x5ff94cce07e7 in mlir::Block::~Block() llvm-project/mlir/lib/IR/Block.cpp:25:1
#5 0x5ff93b1df33b in llvm::ilist_alloc_traits<mlir::Block>::deleteNode(mlir::Block*) llvm-project/llvm/include/llvm/ADT/ilist.h:42:39
#6 0x5ff93b1df33b in llvm::iplist_impl<llvm::simple_ilist<mlir::Block>, llvm::ilist_traits<mlir::Block> >::erase(llvm::ilist_iterator<llvm::ilist_detail::node_options<mlir::Block, true, false, void, false, void>, false, false>) llvm-project/llvm/include/llvm/ADT/ilist.h:205:5
#7 0x5ff93b1df33b in llvm::iplist_impl<llvm::simple_ilist<mlir::Block>, llvm::ilist_traits<mlir::Block> >::erase(llvm::ilist_iterator<llvm::ilist_detail::node_options<mlir::Block, true, false, void, false, void>, false, false>, llvm::ilist_iterator<llvm::ilist_detail::node_options<mlir::Block, true, false, void, false, void>, false, false>) llvm-project/llvm/include/llvm/ADT/ilist.h:242:15
#8 0x5ff94cf5cfce in llvm::iplist_impl<llvm::simple_ilist<mlir::Block>, llvm::ilist_traits<mlir::Block> >::clear() llvm-project/llvm/include/llvm/ADT/ilist.h:246:18
#9 0x5ff94cf5cfce in llvm::iplist_impl<llvm::simple_ilist<mlir::Block>, llvm::ilist_traits<mlir::Block> >::~iplist_impl() llvm-project/llvm/include/llvm/ADT/ilist.h:147:20
#10 0x5ff94cf5cfce in mlir::Region::~Region() llvm-project/mlir/lib/IR/Region.cpp:20:1
#11 0x5ff94cf211da in mlir::Operation::~Operation() llvm-project/mlir/lib/IR/Operation.cpp:201:12
#12 0x5ff94cf21d5d in mlir::Operation::destroy() llvm-project/mlir/lib/IR/Operation.cpp:212:9
#13 0x5ff94cf24d2f in llvm::ilist_traits<mlir::Operation>::deleteNode(mlir::Operation*) llvm-project/mlir/lib/IR/Operation.cpp:491:7
#14 0x5ff94cf24d2f in llvm::iplist_impl<llvm::simple_ilist<mlir::Operation>, llvm::ilist_traits<mlir::Operation> >::erase(llvm::ilist_iterator<llvm::ilist_detail::node_options<mlir::Operation, true, false, void, false, void>, false, false>) llvm-project/llvm/include/llvm/ADT/ilist.h:205:5
#15 0x5ff94cf24d2f in llvm::iplist_impl<llvm::simple_ilist<mlir::Operation>, llvm::ilist_traits<mlir::Operation> >::erase(mlir::Operation*) llvm-project/llvm/include/llvm/ADT/ilist.h:209:39
#16 0x5ff94c54e3f5 in (anonymous namespace)::cleanUpDeadVals((anonymous namespace)::RDVFinalCleanupList&) llvm-project/mlir/lib/Transforms/RemoveDeadValues.cpp:740:9
#17 0x5ff94c54cf3b in (anonymous namespace)::RemoveDeadValues::runOnOperation() llvm-project/mlir/lib/Transforms/RemoveDeadValues.cpp:902:3
#18 0x5ff94c7bbf43 in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_44::operator()() const llvm-project/mlir/lib/Pass/Pass.cpp:609:17
#19 0x5ff94c7bbf43 in void llvm::function_ref<void ()>::callback_fn<mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_44>(long) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#20 0x5ff94c7a5119 in llvm::function_ref<void ()>::operator()() const llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#21 0x5ff94c7a5119 in void mlir::MLIRContext::executeAction<mlir::PassExecutionAction, mlir::Pass&>(llvm::function_ref<void ()>, llvm::ArrayRef<mlir::IRUnit>, mlir::Pass&) llvm-project/mlir/include/mlir/IR/MLIRContext.h:290:7
#22 0x5ff94c7a5119 in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) llvm-project/mlir/lib/Pass/Pass.cpp:603:21
#23 0x5ff94c7a70eb in mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) llvm-project/mlir/lib/Pass/Pass.cpp:682:16
#24 0x5ff94c7b3237 in mlir::PassManager::runPasses(mlir::Operation*, mlir::AnalysisManager) llvm-project/mlir/lib/Pass/Pass.cpp:1117:10
#25 0x5ff94c7b1db3 in mlir::PassManager::run(mlir::Operation*) llvm-project/mlir/lib/Pass/Pass.cpp:1091:60
#26 0x5ff93a00d603 in performActions(llvm::raw_ostream&, std::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:568:17
#27 0x5ff93a00c32f in processBuffer(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef, mlir::MlirOptMainConfig const&, mlir::DialectRegistry&, mlir::SourceMgrDiagnosticVerifierHandler*, llvm::ThreadPoolInterface*) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:650:9
#28 0x5ff93a00c32f in mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_3::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef, llvm::raw_ostream&) const llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:733:12
#29 0x5ff93a00c32f in llvm::LogicalResult llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_3>(long, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#30 0x5ff94cfd0a63 in llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&) const llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#31 0x5ff94cfd1525 in mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0::operator()(llvm::StringRef) const llvm-project/mlir/lib/Support/ToolUtilities.cpp:94:13
#32 0x5ff94cfd03b1 in void llvm::interleave<llvm::StringRef const*, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, void llvm::interleave<llvm::SmallVector<llvm::StringRef, 8u>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::raw_ostream, llvm::StringRef>(llvm::SmallVector<llvm::StringRef, 8u> const&, llvm::raw_ostream&, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::StringRef const&)::'lambda'(), void>(llvm::SmallVector<llvm::StringRef, 8u>, llvm::SmallVector<llvm::StringRef, 8u>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::raw_ostream) llvm-project/llvm/include/llvm/ADT/STLExtras.h:2199:3
#33 0x5ff94cfd03b1 in void llvm::interleave<llvm::SmallVector<llvm::StringRef, 8u>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::raw_ostream, llvm::StringRef>(llvm::SmallVector<llvm::StringRef, 8u> const&, llvm::raw_ostream&, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::StringRef const&) llvm-project/llvm/include/llvm/ADT/STLExtras.h:2221:3
#34 0x5ff94cfd03b1 in mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) llvm-project/mlir/lib/Support/ToolUtilities.cpp:97:3
#35 0x5ff939ff1431 in mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer> >, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:738:26
#36 0x5ff939ff1e6d in mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:784:14
#37 0x5ff939ff25c2 in mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:800:10
#38 0x5ff939e0a3ce in main llvm-project/mlir/tools/mlir-opt/mlir-opt.cpp:343:33
#39 0x7f128dcf9d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
previously allocated by thread T0 here:
#0 0x5ff939e0777d in operator new(unsigned long) (llvm-mlir-build/bin/mlir-opt+0x843f77d) (BuildId: 8d3f598c321c686de3addc0e0905b4ae76916fb7)
#1 0x5ff94cce69f1 in void std::vector<mlir::BlockArgument, std::allocator<mlir::BlockArgument> >::_M_realloc_insert<mlir::BlockArgument const&>(__gnu_cxx::__normal_iterator<mlir::BlockArgument*, std::vector<mlir::BlockArgument, std::allocator<mlir::BlockArgument> > >, mlir::BlockArgument const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/vector.tcc:440:33
#2 0x5ff94cce21f5 in mlir::Block::addArgument(mlir::Type, mlir::Location) llvm-project/mlir/lib/IR/Block.cpp:155:13
#3 0x5ff948daceac in (anonymous namespace)::OperationParser::parseOptionalBlockArgList(mlir::Block*)::$_13::operator()() const::'lambda'(mlir::OpAsmParser::UnresolvedOperand, mlir::Type)::operator()(mlir::OpAsmParser::UnresolvedOperand, mlir::Type) const llvm-project/mlir/lib/AsmParser/Parser.cpp:2496:26
#4 0x5ff948daceac in llvm::ParseResult llvm::function_ref<llvm::ParseResult (mlir::OpAsmParser::UnresolvedOperand, mlir::Type)>::callback_fn<(anonymous namespace)::OperationParser::parseOptionalBlockArgList(mlir::Block*)::$_13::operator()() const::'lambda'(mlir::OpAsmParser::UnresolvedOperand, mlir::Type)>(long, mlir::OpAsmParser::UnresolvedOperand, mlir::Type) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#5 0x5ff948daceac in llvm::function_ref<llvm::ParseResult (mlir::OpAsmParser::UnresolvedOperand, mlir::Type)>::operator()(mlir::OpAsmParser::UnresolvedOperand, mlir::Type) const llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#6 0x5ff948daceac in (anonymous namespace)::OperationParser::parseSSADefOrUseAndType(llvm::function_ref<llvm::ParseResult (mlir::OpAsmParser::UnresolvedOperand, mlir::Type)>) llvm-project/mlir/lib/AsmParser/Parser.cpp:1140:10
#7 0x5ff948daceac in (anonymous namespace)::OperationParser::parseOptionalBlockArgList(mlir::Block*)::$_13::operator()() const llvm-project/mlir/lib/AsmParser/Parser.cpp:2479:12
#8 0x5ff948daceac in llvm::ParseResult llvm::function_ref<llvm::ParseResult ()>::callback_fn<(anonymous namespace)::OperationParser::parseOptionalBlockArgList(mlir::Block*)::$_13>(long) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#9 0x5ff948d7e85c in llvm::function_ref<llvm::ParseResult ()>::operator()() const llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#10 0x5ff948d7e85c in mlir::detail::Parser::parseCommaSeparatedList(mlir::AsmParser::Delimiter, llvm::function_ref<llvm::ParseResult ()>, llvm::StringRef) llvm-project/mlir/lib/AsmParser/Parser.cpp:138:7
#11 0x5ff948daae46 in (anonymous namespace)::OperationParser::parseOptionalBlockArgList(mlir::Block*) llvm-project/mlir/lib/AsmParser/Parser.cpp:2478:10
#12 0x5ff948daae46 in (anonymous namespace)::OperationParser::parseBlock(mlir::Block*&) llvm-project/mlir/lib/AsmParser/Parser.cpp:2419:9
#13 0x5ff948da41aa in (anonymous namespace)::OperationParser::parseRegionBody(mlir::Region&, llvm::SMLoc, llvm::ArrayRef<mlir::OpAsmParser::Argument>, bool) llvm-project/mlir/lib/AsmParser/Parser.cpp:2341:9
#14 0x5ff948da41aa in (anonymous namespace)::OperationParser::parseRegion(mlir::Region&, llvm::ArrayRef<mlir::OpAsmParser::Argument>, bool) llvm-project/mlir/lib/AsmParser/Parser.cpp:2257:7
#15 0x5ff948d9ec5e in (anonymous namespace)::CustomOpAsmParser::parseRegion(mlir::Region&, llvm::ArrayRef<mlir::OpAsmParser::Argument>, bool) llvm-project/mlir/lib/AsmParser/Parser.cpp:1879:16
#16 0x5ff9421f07cb in mlir::omp::LoopNestOp::parse(mlir::OpAsmParser&, mlir::OperationState&) llvm-project/mlir/lib/Dialect/OpenMP/IR/OpenMPDialect.cpp:3264:14
#17 0x5ff948d87de8 in llvm::ParseResult llvm::function_ref<llvm::ParseResult (mlir::OpAsmParser&, mlir::OperationState&)>::callback_fn<llvm::unique_function<llvm::ParseResult (mlir::OpAsmParser&, mlir::OperationState&)> >(long, mlir::OpAsmParser&, mlir::OperationState&) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#18 0x5ff948d87de8 in llvm::function_ref<llvm::ParseResult (mlir::OpAsmParser&, mlir::OperationState&)>::operator()(mlir::OpAsmParser&, mlir::OperationState&) const llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#19 0x5ff948d87de8 in (anonymous namespace)::CustomOpAsmParser::parseOperation(mlir::OperationState&) llvm-project/mlir/lib/AsmParser/Parser.cpp:1615:9
#20 0x5ff948d87de8 in (anonymous namespace)::OperationParser::parseCustomOperation(llvm::ArrayRef<std::tuple<llvm::StringRef, unsigned int, llvm::SMLoc> >) llvm-project/mlir/lib/AsmParser/Parser.cpp:2154:19
#21 0x5ff948d87de8 in (anonymous namespace)::OperationParser::parseOperation() llvm-project/mlir/lib/AsmParser/Parser.cpp:1268:10
#22 0x5ff948dac5fa in (anonymous namespace)::OperationParser::parseBlockBody(mlir::Block*) llvm-project/mlir/lib/AsmParser/Parser.cpp:2440:9
#23 0x5ff948daaa26 in (anonymous namespace)::OperationParser::parseBlock(mlir::Block*&) llvm-project/mlir/lib/AsmParser/Parser.cpp:2370:12
#24 0x5ff948da3edc in (anonymous namespace)::OperationParser::parseRegionBody(mlir::Region&, llvm::SMLoc, llvm::ArrayRef<mlir::OpAsmParser::Argument>, bool) llvm-project/mlir/lib/AsmParser/Parser.cpp:2328:7
#25 0x5ff948da3edc in (anonymous namespace)::OperationParser::parseRegion(mlir::Region&, llvm::ArrayRef<mlir::OpAsmParser::Argument>, bool) llvm-project/mlir/lib/AsmParser/Parser.cpp:2257:7
#26 0x5ff948d9ec5e in (anonymous namespace)::CustomOpAsmParser::parseRegion(mlir::Region&, llvm::ArrayRef<mlir::OpAsmParser::Argument>, bool) llvm-project/mlir/lib/AsmParser/Parser.cpp:1879:16
#27 0x5ff9424525b4 in parseBlockArgRegion(mlir::OpAsmParser&, mlir::Region&, (anonymous namespace)::AllRegionParseArgs) llvm-project/mlir/lib/Dialect/OpenMP/IR/OpenMPDialect.cpp:1057:17
#28 0x5ff9422b7920 in parsePrivateReductionRegion(mlir::OpAsmParser&, mlir::Region&, llvm::SmallVectorImpl<mlir::OpAsmParser::UnresolvedOperand>&, llvm::SmallVectorImpl<mlir::Type>&, mlir::ArrayAttr&, mlir::UnitAttr&, mlir::omp::ReductionModifierAttr&, llvm::SmallVectorImpl<mlir::OpAsmParser::UnresolvedOperand>&, llvm::SmallVectorImpl<mlir::Type>&, mlir::detail::DenseArrayAttrImpl<bool>&, mlir::ArrayAttr&) llvm-project/mlir/lib/Dialect/OpenMP/IR/OpenMPDialect.cpp:1148:10
#29 0x5ff942437e18 in mlir::omp::WsloopOp::parse(mlir::OpAsmParser&, mlir::OperationState&) llvm-mlir-build/tools/mlir/include/mlir/Dialect/OpenMP/OpenMPOps.cpp.inc:32491:22
#30 0x5ff948d87de8 in llvm::ParseResult llvm::function_ref<llvm::ParseResult (mlir::OpAsmParser&, mlir::OperationState&)>::callback_fn<llvm::unique_function<llvm::ParseResult (mlir::OpAsmParser&, mlir::OperationState&)> >(long, mlir::OpAsmParser&, mlir::OperationState&) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#31 0x5ff948d87de8 in llvm::function_ref<llvm::ParseResult (mlir::OpAsmParser&, mlir::OperationState&)>::operator()(mlir::OpAsmParser&, mlir::OperationState&) const llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#32 0x5ff948d87de8 in (anonymous namespace)::CustomOpAsmParser::parseOperation(mlir::OperationState&) llvm-project/mlir/lib/AsmParser/Parser.cpp:1615:9
#33 0x5ff948d87de8 in (anonymous namespace)::OperationParser::parseCustomOperation(llvm::ArrayRef<std::tuple<llvm::StringRef, unsigned int, llvm::SMLoc> >) llvm-project/mlir/lib/AsmParser/Parser.cpp:2154:19
#34 0x5ff948d87de8 in (anonymous namespace)::OperationParser::parseOperation() llvm-project/mlir/lib/AsmParser/Parser.cpp:1268:10
#35 0x5ff948dac5fa in (anonymous namespace)::OperationParser::parseBlockBody(mlir::Block*) llvm-project/mlir/lib/AsmParser/Parser.cpp:2440:9
#36 0x5ff948daaa26 in (anonymous namespace)::OperationParser::parseBlock(mlir::Block*&) llvm-project/mlir/lib/AsmParser/Parser.cpp:2370:12
#37 0x5ff948da3edc in (anonymous namespace)::OperationParser::parseRegionBody(mlir::Region&, llvm::SMLoc, llvm::ArrayRef<mlir::OpAsmParser::Argument>, bool) llvm-project/mlir/lib/AsmParser/Parser.cpp:2328:7
#38 0x5ff948da3edc in (anonymous namespace)::OperationParser::parseRegion(mlir::Region&, llvm::ArrayRef<mlir::OpAsmParser::Argument>, bool) llvm-project/mlir/lib/AsmParser/Parser.cpp:2257:7
#39 0x5ff948d9ec5e in (anonymous namespace)::CustomOpAsmParser::parseRegion(mlir::Region&, llvm::ArrayRef<mlir::OpAsmParser::Argument>, bool) llvm-project/mlir/lib/AsmParser/Parser.cpp:1879:16
#40 0x5ff948d9ed99 in (anonymous namespace)::CustomOpAsmParser::parseOptionalRegion(mlir::Region&, llvm::ArrayRef<mlir::OpAsmParser::Argument>, bool) llvm-project/mlir/lib/AsmParser/Parser.cpp:1890:12
#41 0x5ff94a880475 in mlir::LLVM::LLVMFuncOp::parse(mlir::OpAsmParser&, mlir::OperationState&) llvm-project/mlir/lib/Dialect/LLVMIR/IR/LLVMDialect.cpp:3004:14
#42 0x5ff948d87de8 in llvm::ParseResult llvm::function_ref<llvm::ParseResult (mlir::OpAsmParser&, mlir::OperationState&)>::callback_fn<llvm::unique_function<llvm::ParseResult (mlir::OpAsmParser&, mlir::OperationState&)> >(long, mlir::OpAsmParser&, mlir::OperationState&) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#43 0x5ff948d87de8 in llvm::function_ref<llvm::ParseResult (mlir::OpAsmParser&, mlir::OperationState&)>::operator()(mlir::OpAsmParser&, mlir::OperationState&) const llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#44 0x5ff948d87de8 in (anonymous namespace)::CustomOpAsmParser::parseOperation(mlir::OperationState&) llvm-project/mlir/lib/AsmParser/Parser.cpp:1615:9
#45 0x5ff948d87de8 in (anonymous namespace)::OperationParser::parseCustomOperation(llvm::ArrayRef<std::tuple<llvm::StringRef, unsigned int, llvm::SMLoc> >) llvm-project/mlir/lib/AsmParser/Parser.cpp:2154:19
#46 0x5ff948d87de8 in (anonymous namespace)::OperationParser::parseOperation() llvm-project/mlir/lib/AsmParser/Parser.cpp:1268:10
#47 0x5ff948d8496b in (anonymous namespace)::TopLevelOperationParser::parse(mlir::Block*, mlir::Location) llvm-project/mlir/lib/AsmParser/Parser.cpp:2870:20
#48 0x5ff948d8496b in mlir::parseAsmSourceFile(llvm::SourceMgr const&, mlir::Block*, mlir::ParserConfig const&, mlir::AsmParserState*, mlir::AsmParserCodeCompleteContext*) llvm-project/mlir/lib/AsmParser/Parser.cpp:2930:41
#49 0x5ff948d34ce3 in mlir::parseSourceFile(std::shared_ptr<llvm::SourceMgr> const&, mlir::Block*, mlir::ParserConfig const&, mlir::LocationAttr*) llvm-project/mlir/lib/Parser/Parser.cpp:64:10
#50 0x5ff93a00f454 in mlir::OwningOpRef<mlir::ModuleOp> mlir::detail::parseSourceFile<mlir::ModuleOp, std::shared_ptr<llvm::SourceMgr> const&>(mlir::ParserConfig const&, std::shared_ptr<llvm::SourceMgr> const&) llvm-project/mlir/include/mlir/Parser/Parser.h:158:14
#51 0x5ff93a00ec07 in mlir::OwningOpRef<mlir::ModuleOp> mlir::parseSourceFile<mlir::ModuleOp>(std::shared_ptr<llvm::SourceMgr> const&, mlir::ParserConfig const&) llvm-project/mlir/include/mlir/Parser/Parser.h:188:10
#52 0x5ff93a00ec07 in mlir::parseSourceFileForTool(std::shared_ptr<llvm::SourceMgr> const&, mlir::ParserConfig const&, bool) llvm-project/mlir/include/mlir/Tools/ParseUtilities.h:31:12
#53 0x5ff93a00cd5f in performActions(llvm::raw_ostream&, std::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:508:33
SUMMARY: AddressSanitizer: heap-use-after-free llvm-project/mlir/include/mlir/IR/Block.h:129:50 in mlir::Block::getArgument(unsigned int)
Shadow bytes around the buggy address:
0x0c047fff95d0: fa fa 00 fa fa fa 00 00 fa fa 00 00 fa fa 00 00
0x0c047fff95e0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 fa
0x0c047fff95f0: fa fa 00 fa fa fa 00 fa fa fa 00 00 fa fa 00 00
0x0c047fff9600: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
0x0c047fff9610: fa fa 00 fa fa fa 00 fa fa fa 00 00 fa fa 00 fa
=>0x0c047fff9620: fa fa 00 fa fa fa fd fa fa fa fd fd fa fa[fd]fa
0x0c047fff9630: fa fa fd fd fa fa 00 fa fa fa 00 fa fa fa 00 fa
0x0c047fff9640: fa fa fd fd fa fa 00 00 fa fa 00 00 fa fa 00 00
0x0c047fff9650: fa fa 00 00 fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2252528==ABORTING
```
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#139988
Leak with a Union object when an argument is not a type
cpython
?
2025-10-12
# Leak with a Union object when an argument is not a type
**Issue:** [https://github.com/python/cpython/issues/139988](https://github.com/python/cpython/issues/139988) · **State:** `closed` · **Created:** `2025-10-12T08:18:43Z`
**Labels:** `type-bug`, `interpreter-core`, `topic-typing`, `3.14`, `3.15`
## Description
# Bug report
### Bug description:
```python
import configparser
parser = configparser.RawConfigParser()
parser.add_section('section1')
item = parser.popitem()
try:
parser.popitem()
except KeyError:
pass
else:
raise AssertionError('Expected KeyError when popping from empty RawConfigParser')
fusion = item
from typing import get_args, Union, Tuple, List, Dict, Optional
def test_get_args_with_union():
args = get_args(Union[int, fusion, float])
if __name__ == '__main__':
test_get_args_with_union()
```
config: JIT + ASan
```
=================================================================
==2112963==ERROR: LeakSanitizer: detected memory leaks
Indirect leak of 216 byte(s) in 1 object(s) allocated from:
#0 0x7b52b2b599c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x59285bc4e94e in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x59285bc4e94e in _PyType_AllocNoTrack ../Objects/typeobject.c:2504
#3 0x59285bc4ebb4 in PyType_GenericAlloc ../Objects/typeobject.c:2535
#4 0x59285bc24529 in make_new_set ../Objects/setobject.c:1143
#5 0x59285bc24529 in PySet_New ../Objects/setobject.c:2707
#6 0x59285bd4d54c in unionbuilder_init ../Objects/unionobject.c:149
#7 0x59285bd4d54c in _Py_union_from_tuple ../Objects/unionobject.c:472
#8 0x59285baa9bfd in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#9 0x59285baa9bfd in PyObject_CallOneArg ../Objects/call.c:395
#10 0x59285ba59f4d in PyObject_GetItem ../Objects/abstract.c:195
#11 0x59285b951a6e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:62
#12 0x59285be28c46 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#13 0x59285be28c46 in _PyEval_Vector ../Python/ceval.c:2001
#14 0x59285be28c46 in PyEval_EvalCode ../Python/ceval.c:884
#15 0x59285bfe610e in run_eval_code_obj ../Python/pythonrun.c:1365
#16 0x59285bfe610e in run_mod ../Python/pythonrun.c:1459
#17 0x59285bfeadb7 in pyrun_file ../Python/pythonrun.c:1293
#18 0x59285bfeadb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#19 0x59285bfeb8dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#20 0x59285c05edcc in pymain_run_file_obj ../Modules/main.c:410
#21 0x59285c05edcc in pymain_run_file ../Modules/main.c:429
#22 0x59285c05edcc in pymain_run_python ../Modules/main.c:691
#23 0x59285c0606ae in Py_RunMain ../Modules/main.c:772
#24 0x59285c0606ae in pymain_main ../Modules/main.c:802
#25 0x59285c0606ae in Py_BytesMain ../Modules/main.c:826
#26 0x7b52b278b1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#27 0x7b52b278b28a in __libc_start_main_impl ../csu/libc-start.c:360
#28 0x59285b981f54 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x218f54) (BuildId: a569f1efe408b28a2bc68e798e293a8d652aaa81)
Indirect leak of 56 byte(s) in 1 object(s) allocated from:
#0 0x7b52b2b599c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x59285bc4e94e in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x59285bc4e94e in _PyType_AllocNoTrack ../Objects/typeobject.c:2504
#3 0x59285bc4ebb4 in PyType_GenericAlloc ../Objects/typeobject.c:2535
#4 0x59285bb3ada6 in list_vectorcall ../Objects/listobject.c:3515
#5 0x59285baa98b7 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#6 0x59285baa98b7 in PyObject_Vectorcall ../Objects/call.c:327
#7 0x59285b94ba52 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:1620
#8 0x59285be28c46 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#9 0x59285be28c46 in _PyEval_Vector ../Python/ceval.c:2001
#10 0x59285be28c46 in PyEval_EvalCode ../Python/ceval.c:884
#11 0x59285bfe610e in run_eval_code_obj ../Python/pythonrun.c:1365
#12 0x59285bfe610e in run_mod ../Python/pythonrun.c:1459
#13 0x59285bfeadb7 in pyrun_file ../Python/pythonrun.c:1293
#14 0x59285bfeadb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#15 0x59285bfeb8dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#16 0x59285c05edcc in pymain_run_file_obj ../Modules/main.c:410
#17 0x59285c05edcc in pymain_run_file ../Modules/main.c:429
#18 0x59285c05edcc in pymain_run_python ../Modules/main.c:691
#19 0x59285c0606ae in Py_RunMain ../Modules/main.c:772
#20 0x59285c0606ae in pymain_main ../Modules/main.c:802
#21 0x59285c0606ae in Py_BytesMain ../Modules/main.c:826
#22 0x7b52b278b1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#23 0x7b52b278b28a in __libc_start_main_impl ../csu/libc-start.c:360
#24 0x59285b981f54 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x218f54) (BuildId: a569f1efe408b28a2bc68e798e293a8d652aaa81)
Indirect leak of 32 byte(s) in 1 object(s) allocated from:
#0 0x7b52b2b58778 in realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:85
#1 0x59285bb3ebbd in list_resize ../Objects/listobject.c:174
#2 0x59285bb3ebbd in _PyList_AppendTakeRefListResize ../Objects/listobject.c:524
#3 0x59285bb3ebbd in _PyList_AppendTakeRef ../Include/internal/pycore_list.h:51
#4 0x59285bb3ebbd in PyList_Append ../Objects/listobject.c:538
#5 0x59285bd4b1f5 in unionbuilder_add_single_unchecked ../Objects/unionobject.c:204
#6 0x59285bd4d9aa in unionbuilder_add_single ../Objects/unionobject.c:222
#7 0x59285bd4d9aa in unionbuilder_add_tuple ../Objects/unionobject.c:236
#8 0x59285bd4d9aa in _Py_union_from_tuple ../Objects/unionobject.c:476
#9 0x59285baa9bfd in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#10 0x59285baa9bfd in PyObject_CallOneArg ../Objects/call.c:395
#11 0x59285ba59f4d in PyObject_GetItem ../Objects/abstract.c:195
#12 0x59285b951a6e in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:62
#13 0x59285be28c46 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#14 0x59285be28c46 in _PyEval_Vector ../Python/ceval.c:2001
#15 0x59285be28c46 in PyEval_EvalCode ../Python/ceval.c:884
#16 0x59285bfe610e in run_eval_code_obj ../Python/pythonrun.c:1365
#17 0x59285bfe610e in run_mod ../Python/pythonrun.c:1459
#18 0x59285bfeadb7 in pyrun_file ../Python/pythonrun.c:1293
#19 0x59285bfeadb7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#20 0x59285bfeb8dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#21 0x59285c05edcc in pymain_run_file_obj ../Modules/main.c:410
#22 0x59285c05edcc in pymain_run_file ../Modules/main.c:429
#23 0x59285c05edcc in pymain_run_python ../Modules/main.c:691
#24 0x59285c0606ae in Py_RunMain ../Modules/main.c:772
#25 0x59285c0606ae in pymain_main ../Modules/main.c:802
#26 0x59285c0606ae in Py_BytesMain ../Modules/main.c:826
#27 0x7b52b278b1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#28 0x7b52b278b28a in __libc_start_main_impl ../csu/libc-start.c:360
#29 0x59285b981f54 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x218f54) (BuildId: a569f1efe408b28a2bc68e798e293a8d652aaa81)
SUMMARY: AddressSanitizer: 304 byte(s) leaked in 3 allocation(s).
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-139990
* gh-139993
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#162776
[mlir] integer overflow in BufferizableOpInterfaceImpl.cpp
llvm
?
2025-10-10
# [mlir] integer overflow in BufferizableOpInterfaceImpl.cpp
**Issue:** [https://github.com/llvm/llvm-project/issues/162776](https://github.com/llvm/llvm-project/issues/162776) · **State:** `closed` · **Created:** `2025-10-10T04:43:42Z`
**Labels:** `mlir:tensor`, `crash`
## Description
PoC:
```
func.func @B_concat(%arg0: tensor<4x7x3xf32>, %arg1 : tensor<4x4x3xf32>, %arg2: tensor<?x?x?xf32>) {
%3 = tensor.concat dim(1) %arg2, %arg2 : (tensor<?x?x?xf32>, tensor<?x?x?xf32>) -> tensor<?x10x?xf32>
return
}
```
reproduce: `-allow-unregistered-dialect -one-shot-bufferize=allow-unknown-ops -split-input-file`
stderr:
```
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior llvm-project/mlir/lib/Dialect/Tensor/Transforms/BufferizableOpInterfaceImpl.cpp:1202:25 in
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: llvm-mlir-build/bin/mlir-opt /tmp/mlirfuzz_run_sh1skl6n/fused.mlir -allow-unregistered-dialect -one-shot-bufferize=allow-unknown-ops -split-input-file
#0 0x00006544676a969b backtrace (llvm-mlir-build/bin/mlir-opt+0x83bd69b)
#1 0x0000654467776ad7 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) llvm-project/llvm/lib/Support/Unix/Signals.inc:838:8
#2 0x0000654467770dbf llvm::sys::RunSignalHandlers() llvm-project/llvm/lib/Support/Signals.cpp:105:18
#3 0x0000654467779e16 SignalHandler(int, siginfo_t*, void*) llvm-project/llvm/lib/Support/Unix/Signals.inc:426:38
#4 0x00007c5784c81520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#5 0x00007c5784cd59fc __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
#6 0x00007c5784cd59fc __pthread_kill_internal ./nptl/pthread_kill.c:78:10
#7 0x00007c5784cd59fc pthread_kill ./nptl/pthread_kill.c:89:10
#8 0x00007c5784c81476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#9 0x00007c5784c677f3 abort ./stdlib/abort.c:81:7
#10 0x0000654467714d07 (llvm-mlir-build/bin/mlir-opt+0x8428d07)
#11 0x0000654467712ba1 (llvm-mlir-build/bin/mlir-opt+0x8426ba1)
#12 0x00006544677268ec __ubsan::ScopedReport::~ScopedReport() (llvm-mlir-build/bin/mlir-opt+0x843a8ec)
#13 0x0000654467727cae void handleIntegerOverflowImpl<__ubsan::Value>(__ubsan::OverflowData*, unsigned long, char const*, __ubsan::Value, __ubsan::ReportOptions) ubsan_handlers.cpp.o:0:0
#14 0x0000654467727d7c __ubsan_handle_add_overflow_abort (llvm-mlir-build/bin/mlir-opt+0x843bd7c)
#15 0x00006544759f5ec4 mlir::tensor::(anonymous namespace)::ConcatOpInterface::bufferize(mlir::Operation*, mlir::RewriterBase&, mlir::bufferization::BufferizationOptions const&, mlir::bufferization::BufferizationState&) const llvm-project/mlir/lib/Dialect/Tensor/Transforms/BufferizableOpInterfaceImpl.cpp:0:0
#16 0x00006544759f5ec4 mlir::bufferization::detail::BufferizableOpInterfaceInterfaceTraits::FallbackModel<mlir::tensor::(anonymous namespace)::ConcatOpInterface>::bufferize(mlir::bufferization::detail::BufferizableOpInterfaceInterfaceTraits::Concept const*, mlir::Operation*, mlir::RewriterBase&, mlir::bufferization::BufferizationOptions const&, mlir::bufferization::BufferizationState&) llvm-mlir-build/tools/mlir/include/mlir/Dialect/Bufferization/IR/BufferizableOpInterface.h.inc:1127:49
#17 0x00006544769aef82 llvm::LogicalResult::failed() const llvm-project/llvm/include/llvm/Support/LogicalResult.h:43:43
#18 0x00006544769aef82 llvm::failed(llvm::LogicalResult) llvm-project/llvm/include/llvm/Support/LogicalResult.h:71:58
#19 0x00006544769aef82 mlir::bufferization::bufferizeOp(mlir::Operation*, mlir::bufferization::BufferizationOptions const&, mlir::bufferization::BufferizationState&, mlir::bufferization::BufferizationStatistics*) llvm-project/mlir/lib/Dialect/Bufferization/Transforms/Bufferize.cpp:335:9
#20 0x00006544769b82b4 llvm::LogicalResult::failed() const llvm-project/llvm/include/llvm/Support/LogicalResult.h:43:43
#21 0x00006544769b82b4 llvm::failed(llvm::LogicalResult) llvm-project/llvm/include/llvm/Support/LogicalResult.h:71:58
#22 0x00006544769b82b4 (anonymous namespace)::OneShotBufferizePass::runOnOperation() llvm-project/mlir/lib/Dialect/Bufferization/Transforms/Bufferize.cpp:179:11
#23 0x000065447a0dff44 mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_44::operator()() const llvm-project/mlir/lib/Pass/Pass.cpp:610:22
#24 0x000065447a0dff44 void llvm::function_ref<void ()>::callback_fn<mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_44>(long) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#25 0x000065447a0c911a mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) llvm-project/mlir/lib/Pass/Pass.cpp:603:3
#26 0x000065447a0cb0ec llvm::LogicalResult::failed() const llvm-project/llvm/include/llvm/Support/LogicalResult.h:43:43
#27 0x000065447a0cb0ec llvm::failed(llvm::LogicalResult) llvm-project/llvm/include/llvm/Support/LogicalResult.h:71:58
#28 0x000065447a0cb0ec mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) llvm-project/mlir/lib/Pass/Pass.cpp:682:9
#29 0x000065447a0d7238 mlir::PassManager::runPasses(mlir::Operation*, mlir::AnalysisManager) llvm-project/mlir/lib/Pass/Pass.cpp:1117:10
#30 0x000065447a0d5db4 mlir::PassManager::run(mlir::Operation*) llvm-project/mlir/lib/Pass/Pass.cpp:0:60
#31 0x0000654467931604 llvm::LogicalResult::failed() const llvm-project/llvm/include/llvm/Support/LogicalResult.h:43:43
#32 0x0000654467931604 llvm::failed(llvm::LogicalResult) llvm-project/llvm/include/llvm/Support/LogicalResult.h:71:58
#33 0x0000654467931604 performActions(llvm::raw_ostream&, std::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:568:7
#34 0x0000654467930517 processBuffer(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef, mlir::MlirOptMainConfig const&, mlir::DialectRegistry&, mlir::SourceMgrDiagnosticVerifierHandler*, llvm::ThreadPoolInterface*) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:644:12
#35 0x0000654467930517 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_3::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef, llvm::raw_ostream&) const llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:733:12
#36 0x0000654467930517 llvm::LogicalResult llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_3>(long, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#37 0x000065447a8f4a64 std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>::~unique_ptr() /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/unique_ptr.h:360:6
#38 0x000065447a8f4a64 llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&) const llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:5
#39 0x000065447a8f5526 mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0::operator()(llvm::StringRef) const llvm-project/mlir/lib/Support/ToolUtilities.cpp:94:13
#40 0x000065447a8f4447 void llvm::interleave<llvm::StringRef const*, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, void llvm::interleave<llvm::SmallVector<llvm::StringRef, 8u>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::raw_ostream, llvm::StringRef>(llvm::SmallVector<llvm::StringRef, 8u> const&, llvm::raw_ostream&, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::StringRef const&)::'lambda'(), void>(llvm::SmallVector<llvm::StringRef, 8u>, llvm::SmallVector<llvm::StringRef, 8u>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::raw_ostream) llvm-project/llvm/include/llvm/ADT/STLExtras.h:2201:24
#41 0x000065447a8f4447 void llvm::interleave<llvm::SmallVector<llvm::StringRef, 8u>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::raw_ostream, llvm::StringRef>(llvm::SmallVector<llvm::StringRef, 8u> const&, llvm::raw_ostream&, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::StringRef const&) llvm-project/llvm/include/llvm/ADT/STLExtras.h:2221:3
#42 0x000065447a8f4447 mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) llvm-project/mlir/lib/Support/ToolUtilities.cpp:97:3
#43 0x0000654467915432 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:0:26
#44 0x0000654467915e6e llvm::LogicalResult::failed() const llvm-project/llvm/include/llvm/Support/LogicalResult.h:43:43
#45 0x0000654467915e6e llvm::failed(llvm::LogicalResult) llvm-project/llvm/include/llvm/Support/LogicalResult.h:71:58
#46 0x0000654467915e6e mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:784:7
#47 0x00006544679165c3 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:800:10
#48 0x000065446772e3cf llvm::LogicalResult::succeeded() const llvm-project/llvm/include/llvm/Support/LogicalResult.h:40:45
#49 0x000065446772e3cf mlir::asMainReturnCode(llvm::LogicalResult) llvm-project/mlir/include/mlir/Tools/mlir-opt/MlirOptMain.h:399:12
#50 0x000065446772e3cf main llvm-project/mlir/tools/mlir-opt/mlir-opt.cpp:343:10
#51 0x00007c5784c68d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#52 0x00007c5784c68e40 call_init ./csu/../csu/libc-start.c:128:20
#53 0x00007c5784c68e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#54 0x000065446766db65 _start (llvm-mlir-build/bin/mlir-opt+0x8381b65)
```
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#162774
[mlir] UBSan alert mlir/lib/IR/AsmPrinter.cpp
llvm
?
2025-10-10
# [mlir] UBSan alert mlir/lib/IR/AsmPrinter.cpp
**Issue:** [https://github.com/llvm/llvm-project/issues/162774](https://github.com/llvm/llvm-project/issues/162774) · **State:** `open` · **Created:** `2025-10-10T04:40:18Z`
**Labels:** `mlir`, `crash`
## Description
PoC:
```
#map = affine_map<(d0)[s0, s1] -> (s1, -d0 + s0)>
#map1 = affine_map<(d0, d1, d2) -> (d0, d1, d2)>
#map2 = affine_map<(d0, d1, d2) -> (d0, d1)>
#map3 = affine_map<(d0, d1) -> (d0, d1)>
#map4 = affine_map<(d0, d1) -> (d0)>
module {
func.func @B_multi_slice_fusion_with_broadcast(%arg0: tensor<?x?x?xf32>, %arg1: tensor<?x?xf32>, %arg2: tensor<?xf32>, %arg3: index, %arg4: index) -> tensor<?x?xf32> {
%c0 = arith.constant 0 : index
%c1 = arith.constant 1 : index
%c2 = arith.constant 2 : index
%dim = tensor.dim %arg0, %c0 : tensor<?x?x?xf32>
%dim_0 = tensor.dim %arg0, %c1 : tensor<?x?x?xf32>
%dim_1 = tensor.dim %arg0, %c2 : tensor<?x?x?xf32>
%0:2 = scf.forall (%arg5, %arg6) = (%c0, %c0) to (%dim, %dim_0) step (%arg3, %arg4) shared_outs(%arg7 = %arg1, %arg8 = %arg2) -> (tensor<?x?xf32>, tensor<?xf32>) {
%3 = affine.min #map(%arg5)[%dim, %arg3]
%4 = affine.min #map(%arg6)[%dim_0, %arg4]
%extracted_slice = tensor.extract_slice %arg0[%arg5, %arg6, 0] [%3, %4, %dim_1] [1, 1, 1] : tensor<?x?x?xf32> to tensor<?x?x?xf32>
%extracted_slice_2 = tensor.extract_slice %arg7[%arg5, %arg6] [%3, %4] [1, 1] : tensor<?x?xf32> to tensor<?x?xf32>
%5 = linalg.generic {indexing_maps = [#map1, #map2], iterator_types = ["parallel", "parallel", "reduction"]} ins(%extracted_slice : tensor<?x?x?xf32>) outs(%extracted_slice_2 : tensor<?x?xf32>) {
^bb0(%in: f32, %out: f32):
%7 = arith.mulf %in, %out : f32
linalg.yield %7 : f32
} -> tensor<?x?xf32>
%extracted_slice_3 = tensor.extract_slice %arg8[%arg5] [%3] [1] : tensor<?xf32> to tensor<?xf32>
%6 = linalg.generic {indexing_maps = [#map3, #map4], iterator_types = ["parallel", "reduction"]} ins(%5 : tensor<?x?xf32>) outs(%extracted_slice_3 : tensor<?xf32>) {
^bb0(%in: f32, %out: f32):
%7 = arith.addf %in, %out : f32
linalg.yield %7 : f32
} -> tensor<?xf32>
scf.forall.in_parallel {
tensor.parallel_insert_slice %6 into %arg8[%arg5] [%3] [1] : tensor<?xf32> into tensor<?xf32>
}
}
%1 = tensor.empty(%dim, %dim_0) : tensor<?x?xf32>
%2 = linalg.generic {indexing_maps = [#map3, #map4, #map3], iterator_types = ["parallel", "parallel"]} ins(%0#0, %0#1 : tensor<?x?xf32>, tensor<?xf32>) outs(%1 : tensor<?x?xf32>) {
^bb0(%in: f32, %in_2: f32, %out: f32):
%3 = arith.addf %in, %in_2 : f32
linalg.yield %3 : f32
} -> tensor<?x?xf32>
return %2 : tensor<?x?xf32>
}
}
```
reproduce: `mlir-opt ./test.mlir -test-linalg-data-layout-propagation`
stderr:
```
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior llvm-project/mlir/lib/IR/AsmPrinter.cpp:3157:22 in
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: llvm-mlir-build/bin/mlir-opt test.mlir -test-linalg-data-layout-propagation -split-input-file
#0 0x00005e610077069b backtrace (llvm-mlir-build/bin/mlir-opt+0x83bd69b)
#1 0x00005e610083dad7 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) llvm-project/llvm/lib/Support/Unix/Signals.inc:838:8
#2 0x00005e6100837dbf llvm::sys::RunSignalHandlers() llvm-project/llvm/lib/Support/Signals.cpp:105:18
#3 0x00005e6100840e16 SignalHandler(int, siginfo_t*, void*) llvm-project/llvm/lib/Support/Unix/Signals.inc:426:38
#4 0x00007ae4c52a5520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#5 0x00007ae4c52f99fc __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
#6 0x00007ae4c52f99fc __pthread_kill_internal ./nptl/pthread_kill.c:78:10
#7 0x00007ae4c52f99fc pthread_kill ./nptl/pthread_kill.c:89:10
#8 0x00007ae4c52a5476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#9 0x00007ae4c528b7f3 abort ./stdlib/abort.c:81:7
#10 0x00005e61007dbd07 (llvm-mlir-build/bin/mlir-opt+0x8428d07)
#11 0x00005e61007d9ba1 (llvm-mlir-build/bin/mlir-opt+0x8426ba1)
#12 0x00005e61007ed8ec __ubsan::ScopedReport::~ScopedReport() (llvm-mlir-build/bin/mlir-opt+0x843a8ec)
#13 0x00005e61007ef12b handleNegateOverflowImpl(__ubsan::OverflowData*, unsigned long, __ubsan::ReportOptions) ubsan_handlers.cpp.o:0:0
#14 0x00005e61007ef16e __ubsan_handle_negate_overflow_abort (llvm-mlir-build/bin/mlir-opt+0x843c16e)
#15 0x00005e611366ba08 mlir::AsmPrinter::Impl::printAffineExprInternal(mlir::AffineExpr, mlir::AsmPrinter::Impl::BindingStrength, llvm::function_ref<void (unsigned int, bool)>) llvm-project/mlir/lib/IR/AsmPrinter.cpp:3094:10
#16 0x00005e611366c0d0 void llvm::interleave<mlir::AffineExpr const*, mlir::AsmPrinter::Impl::printAffineMap(mlir::AffineMap)::$_56, void llvm::interleave<llvm::ArrayRef<mlir::AffineExpr>, mlir::AsmPrinter::Impl::printAffineMap(mlir::AffineMap)::$_56, llvm::raw_ostream, mlir::AffineExpr const>(llvm::ArrayRef<mlir::AffineExpr> const&, llvm::raw_ostream&, mlir::AsmPrinter::Impl::printAffineMap(mlir::AffineMap)::$_56, llvm::StringRef const&)::'lambda'(), void>(llvm::ArrayRef<mlir::AffineExpr>, llvm::ArrayRef<mlir::AffineExpr>, mlir::AsmPrinter::Impl::printAffineMap(mlir::AffineMap)::$_56, llvm::raw_ostream) llvm-project/llvm/include/llvm/ADT/STLExtras.h:2200:3
#17 0x00005e611366c0d0 void llvm::interleave<llvm::ArrayRef<mlir::AffineExpr>, mlir::AsmPrinter::Impl::printAffineMap(mlir::AffineMap)::$_56, llvm::raw_ostream, mlir::AffineExpr const>(llvm::ArrayRef<mlir::AffineExpr> const&, llvm::raw_ostream&, mlir::AsmPrinter::Impl::printAffineMap(mlir::AffineMap)::$_56, llvm::StringRef const&) llvm-project/llvm/include/llvm/ADT/STLExtras.h:2221:3
#18 0x00005e611366c0d0 void llvm::interleaveComma<llvm::ArrayRef<mlir::AffineExpr>, mlir::AsmPrinter::Impl::printAffineMap(mlir::AffineMap)::$_56, llvm::raw_ostream, mlir::AffineExpr const>(llvm::ArrayRef<mlir::AffineExpr> const&, llvm::raw_ostream&, mlir::AsmPrinter::Impl::printAffineMap(mlir::AffineMap)::$_56) llvm-project/llvm/include/llvm/ADT/STLExtras.h:2235:3
#19 0x00005e611366c0d0 void mlir::AsmPrinter::Impl::interleaveComma<llvm::ArrayRef<mlir::AffineExpr>, mlir::AsmPrinter::Impl::printAffineMap(mlir::AffineMap)::$_56>(llvm::ArrayRef<mlir::AffineExpr> const&, mlir::AsmPrinter::Impl::printAffineMap(mlir::AffineMap)::$_56) const llvm-project/mlir/lib/IR/AsmPrinter.cpp:423:5
#20 0x00005e611366c0d0 mlir::AsmPrinter::Impl::printAffineMap(mlir::AffineMap) llvm-project/mlir/lib/IR/AsmPrinter.cpp:3199:3
#21 0x00005e61136626a5 mlir::AffineMap::print(llvm::raw_ostream&) const llvm-project/mlir/lib/IR/AsmPrinter.cpp:0:41
#22 0x00005e611365fdad mlir::AsmPrinter::Impl::printAttributeImpl(mlir::Attribute, mlir::AsmPrinter::Impl::AttrTypeElision) llvm-project/mlir/lib/IR/AsmPrinter.cpp:0:30
#23 0x00005e611368fdc6 (anonymous namespace)::AliasState::printAliases(mlir::AsmPrinter::Impl&, (anonymous namespace)::NewLineCounter&, bool) llvm-project/mlir/lib/IR/AsmPrinter.cpp:0:11
#24 0x00005e611366e6cb (anonymous namespace)::OperationPrinter::printTopLevelOperation(mlir::Operation*) llvm-project/mlir/lib/IR/AsmPrinter.cpp:3444:3
#25 0x00005e611366e6cb mlir::Operation::print(llvm::raw_ostream&, mlir::AsmState&) llvm-project/mlir/lib/IR/AsmPrinter.cpp:4128:13
#26 0x00005e61009f9fd1 mlir::operator<<(llvm::raw_ostream&, mlir::OpWithState const&) llvm-project/mlir/include/mlir/IR/Operation.h:1147:3
#27 0x00005e61009f8b6f performActions(llvm::raw_ostream&, std::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:595:41
#28 0x00005e61009f7517 processBuffer(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef, mlir::MlirOptMainConfig const&, mlir::DialectRegistry&, mlir::SourceMgrDiagnosticVerifierHandler*, llvm::ThreadPoolInterface*) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:644:12
#29 0x00005e61009f7517 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_3::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef, llvm::raw_ostream&) const llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:733:12
#30 0x00005e61009f7517 llvm::LogicalResult llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_3>(long, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#31 0x00005e61139bba64 std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>::~unique_ptr() /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/unique_ptr.h:360:6
#32 0x00005e61139bba64 llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&) const llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:5
#33 0x00005e61139bc526 mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0::operator()(llvm::StringRef) const llvm-project/mlir/lib/Support/ToolUtilities.cpp:94:13
#34 0x00005e61139bb447 void llvm::interleave<llvm::StringRef const*, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, void llvm::interleave<llvm::SmallVector<llvm::StringRef, 8u>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::raw_ostream, llvm::StringRef>(llvm::SmallVector<llvm::StringRef, 8u> const&, llvm::raw_ostream&, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::StringRef const&)::'lambda'(), void>(llvm::SmallVector<llvm::StringRef, 8u>, llvm::SmallVector<llvm::StringRef, 8u>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::raw_ostream) llvm-project/llvm/include/llvm/ADT/STLExtras.h:2201:24
#35 0x00005e61139bb447 void llvm::interleave<llvm::SmallVector<llvm::StringRef, 8u>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::raw_ostream, llvm::StringRef>(llvm::SmallVector<llvm::StringRef, 8u> const&, llvm::raw_ostream&, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::StringRef const&) llvm-project/llvm/include/llvm/ADT/STLExtras.h:2221:3
#36 0x00005e61139bb447 mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) llvm-project/mlir/lib/Support/ToolUtilities.cpp:97:3
#37 0x00005e61009dc432 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:0:26
#38 0x00005e61009dce6e llvm::LogicalResult::failed() const llvm-project/llvm/include/llvm/Support/LogicalResult.h:43:43
#39 0x00005e61009dce6e llvm::failed(llvm::LogicalResult) llvm-project/llvm/include/llvm/Support/LogicalResult.h:71:58
#40 0x00005e61009dce6e mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:784:7
#41 0x00005e61009dd5c3 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:800:10
#42 0x00005e61007f53cf llvm::LogicalResult::succeeded() const llvm-project/llvm/include/llvm/Support/LogicalResult.h:40:45
#43 0x00005e61007f53cf mlir::asMainReturnCode(llvm::LogicalResult) llvm-project/mlir/include/mlir/Tools/mlir-opt/MlirOptMain.h:399:12
#44 0x00005e61007f53cf main llvm-project/mlir/tools/mlir-opt/mlir-opt.cpp:343:10
#45 0x00007ae4c528cd90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#46 0x00007ae4c528ce40 call_init ./csu/../csu/libc-start.c:128:20
#47 0x00007ae4c528ce40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#48 0x00005e6100734b65 _start (llvm-mlir-build/bin/mlir-opt+0x8381b65)
```
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#162772
[mlir] null pointer SEGV in mlir/lib/Dialect/Linalg/IR/LinalgInterfaces.cpp
llvm
?
2025-10-10
# [mlir] null pointer SEGV in mlir/lib/Dialect/Linalg/IR/LinalgInterfaces.cpp
**Issue:** [https://github.com/llvm/llvm-project/issues/162772](https://github.com/llvm/llvm-project/issues/162772) · **State:** `closed` · **Created:** `2025-10-10T04:29:00Z`
**Labels:** `mlir:linalg`, `crash`
## Description
PoC:
```
#trait = {
indexing_maps = [
affine_map<(m, n, k) -> (m, k)>,
affine_map<(m, n, k) -> (k, n)>,
affine_map<(m, n, k) -> (m, n)>
],
iterator_types = ["parallel", "parallel", "reduction"]
}
func.func @B_hoist_linalg_ops_div_by_zero(%a : tensor<128x128xi32>,
%b : tensor<128x128xi32>,
%c: tensor<128x128xi32>,
%lb : index,
%ub : index,
%step : index,
%output : tensor<?x128xi32>) -> tensor<?x128xi32> {
%final =
scf.for %i = %lb to %ub step %step iter_args(%acc = %output)
-> tensor<?x128xi32> {
%compute = linalg.generic #trait
ins(%a, %b : tensor<128x128xi32>, tensor<128x128xi32>)
outs(%c : tensor<128x128xi32>) {
^bb0(%in : i32, %in2 : i32, %in3 : i32):
linalg.yield %in3 : i32
} -> tensor<128x128xi32>
%newacc = tensor.insert_slice %compute into
%output[%i, 0][128, 128][1, 1]
: tensor<128x128xi32> into tensor<?x128xi32>
scf.yield %newacc : tensor<?x128xi32>
}
func.return %final : tensor<?x128xi32>
}
```
reproduce: `mlir-opt ./test.mlir -split-input-file --linalg-specialize-generic-ops`
UBSan:
```
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior llvm-project/mlir/lib/Dialect/Linalg/IR/LinalgInterfaces.cpp:318:20 in
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: llvm-mlir-build/bin/mlir-opt /tmp/mlirfuzz_run_ee5lfpd3/fused.mlir -split-input-file --linalg-specialize-generic-ops
#0 0x00005c4ba94af69b backtrace (llvm-mlir-build/bin/mlir-opt+0x83bd69b)
#1 0x00005c4ba957cad7 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) llvm-project/llvm/lib/Support/Unix/Signals.inc:838:8
#2 0x00005c4ba9576dbf llvm::sys::RunSignalHandlers() llvm-project/llvm/lib/Support/Signals.cpp:105:18
#3 0x00005c4ba957fe16 SignalHandler(int, siginfo_t*, void*) llvm-project/llvm/lib/Support/Unix/Signals.inc:426:38
#4 0x000072e2df10c520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#5 0x000072e2df1609fc __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
#6 0x000072e2df1609fc __pthread_kill_internal ./nptl/pthread_kill.c:78:10
#7 0x000072e2df1609fc pthread_kill ./nptl/pthread_kill.c:89:10
#8 0x000072e2df10c476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#9 0x000072e2df0f27f3 abort ./stdlib/abort.c:81:7
#10 0x00005c4ba951ad07 (llvm-mlir-build/bin/mlir-opt+0x8428d07)
#11 0x00005c4ba9518ba1 (llvm-mlir-build/bin/mlir-opt+0x8426ba1)
#12 0x00005c4ba952c8ec __ubsan::ScopedReport::~ScopedReport() (llvm-mlir-build/bin/mlir-opt+0x843a8ec)
#13 0x00005c4ba952d45c handleTypeMismatchImpl(__ubsan::TypeMismatchData*, unsigned long, __ubsan::ReportOptions) ubsan_handlers.cpp.o:0:0
#14 0x00005c4ba952d4ee __ubsan_handle_type_mismatch_v1_abort (llvm-mlir-build/bin/mlir-opt+0x843b4ee)
#15 0x00005c4bb7a63529 mlir::linalg::detail::isContractionBody(mlir::Block&, llvm::function_ref<bool (mlir::Operation*, mlir::Operation*)>, llvm::raw_ostream&) llvm-project/mlir/lib/Dialect/Linalg/IR/LinalgInterfaces.cpp:336:40
#16 0x00005c4bb7a65eb2 bool isContractionBody<mlir::arith::MulFOp, mlir::arith::AddFOp, mlir::arith::MulIOp, mlir::arith::AddIOp, mlir::complex::MulOp, mlir::complex::AddOp, mlir::arith::AndIOp, mlir::arith::OrIOp>(mlir::Block&) llvm-project/mlir/lib/Dialect/Linalg/IR/LinalgInterfaces.cpp:380:3
#17 0x00005c4bb7a65eb2 mlir::linalg::detail::isContractionInterfaceImpl(mlir::Operation*, mlir::linalg::ContractionDimensions*) llvm-project/mlir/lib/Dialect/Linalg/IR/LinalgInterfaces.cpp:527:8
#18 0x00005c4bb7a662e7 mlir::linalg::isaContractionOpInterface(mlir::linalg::LinalgOp) llvm-project/mlir/lib/Dialect/Linalg/IR/LinalgInterfaces.cpp:569:64
#19 0x00005c4bb6b172be mlir::linalg::specializeGenericOp(mlir::RewriterBase&, mlir::linalg::GenericOp) llvm-project/mlir/lib/Dialect/Linalg/Transforms/Specialize.cpp:316:7
#20 0x00005c4bb6b1de92 std::_Optional_base_impl<mlir::linalg::LinalgOp, std::_Optional_base<mlir::linalg::LinalgOp, true, true>>::_M_is_engaged() const /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/optional:433:58
#21 0x00005c4bb6b1de92 std::optional<mlir::linalg::LinalgOp>::has_value() const /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/optional:945:22
#22 0x00005c4bb6b1de92 llvm::FailureOr<mlir::linalg::LinalgOp>::operator llvm::LogicalResult() const llvm-project/llvm/include/llvm/Support/LogicalResult.h:93:51
#23 0x00005c4bb6b1de92 llvm::FailureOr<mlir::linalg::GenericOp>::FailureOr<mlir::linalg::LinalgOp, (void*)0>(llvm::FailureOr<mlir::linalg::LinalgOp> const&) llvm-project/llvm/include/llvm/Support/LogicalResult.h:90:33
#24 0x00005c4bb6b1de92 mlir::linalg::LinalgSpecializationPattern::returningMatchAndRewrite(mlir::linalg::GenericOp, mlir::PatternRewriter&) const llvm-project/mlir/include/mlir/Dialect/Linalg/Transforms/Transforms.h:1616:12
#25 0x00005c4bb6b1de92 mlir::linalg::LinalgSpecializationPattern::matchAndRewrite(mlir::linalg::GenericOp, mlir::PatternRewriter&) const llvm-project/mlir/include/mlir/Dialect/Linalg/Transforms/Transforms.h:1621:12
#26 0x00005c4bbbddda9e mlir::PatternApplicator::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&, llvm::function_ref<bool (mlir::Pattern const&)>, llvm::function_ref<void (mlir::Pattern const&)>, llvm::function_ref<llvm::LogicalResult (mlir::Pattern const&)>)::$_6::operator()() const llvm-project/mlir/lib/Rewrite/PatternApplicator.cpp:223:13
#27 0x00005c4bbbddda9e void llvm::function_ref<void ()>::callback_fn<mlir::PatternApplicator::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&, llvm::function_ref<bool (mlir::Pattern const&)>, llvm::function_ref<void (mlir::Pattern const&)>, llvm::function_ref<llvm::LogicalResult (mlir::Pattern const&)>)::$_6>(long) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#28 0x00005c4bbbdd307e mlir::PatternApplicator::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&, llvm::function_ref<bool (mlir::Pattern const&)>, llvm::function_ref<void (mlir::Pattern const&)>, llvm::function_ref<llvm::LogicalResult (mlir::Pattern const&)>) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:0:12
#29 0x00005c4bbbd6c5b8 (anonymous namespace)::GreedyPatternRewriteDriver::processWorklist() llvm-project/mlir/lib/Transforms/Utils/GreedyPatternRewriteDriver.cpp:620:17
#30 0x00005c4bbbd6a537 (anonymous namespace)::RegionPatternRewriteDriver::simplify(bool*) &&::$_14::operator()() const llvm-project/mlir/lib/Transforms/Utils/GreedyPatternRewriteDriver.cpp:890:11
#31 0x00005c4bbbd6a537 void llvm::function_ref<void ()>::callback_fn<(anonymous namespace)::RegionPatternRewriteDriver::simplify(bool*) &&::$_14>(long) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#32 0x00005c4bbbd64892 (anonymous namespace)::RegionPatternRewriteDriver::simplify(bool*) && llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:0:12
#33 0x00005c4bbbd64892 mlir::applyPatternsGreedily(mlir::Region&, mlir::FrozenRewritePatternSet const&, mlir::GreedyRewriteConfig, bool*) llvm-project/mlir/lib/Transforms/Utils/GreedyPatternRewriteDriver.cpp:935:47
#34 0x00005c4ba97d5a73 mlir::applyPatternsGreedily(mlir::Operation*, mlir::FrozenRewritePatternSet const&, mlir::GreedyRewriteConfig, bool*) llvm-project/mlir/include/mlir/Transforms/GreedyPatternRewriteDriver.h:224:15
#35 0x00005c4bb6b1d39d (anonymous namespace)::LinalgSpecializeGenericOpsPass::runOnOperation() llvm-project/mlir/lib/Dialect/Linalg/Transforms/Specialize.cpp:338:14
#36 0x00005c4bbbee5f44 mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_44::operator()() const llvm-project/mlir/lib/Pass/Pass.cpp:610:22
#37 0x00005c4bbbee5f44 void llvm::function_ref<void ()>::callback_fn<mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_44>(long) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#38 0x00005c4bbbecf11a mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) llvm-project/mlir/lib/Pass/Pass.cpp:603:3
#39 0x00005c4bbbed10ec llvm::LogicalResult::failed() const llvm-project/llvm/include/llvm/Support/LogicalResult.h:43:43
#40 0x00005c4bbbed10ec llvm::failed(llvm::LogicalResult) llvm-project/llvm/include/llvm/Support/LogicalResult.h:71:58
#41 0x00005c4bbbed10ec mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) llvm-project/mlir/lib/Pass/Pass.cpp:682:9
#42 0x00005c4bbbedd238 mlir::PassManager::runPasses(mlir::Operation*, mlir::AnalysisManager) llvm-project/mlir/lib/Pass/Pass.cpp:1117:10
#43 0x00005c4bbbedbdb4 mlir::PassManager::run(mlir::Operation*) llvm-project/mlir/lib/Pass/Pass.cpp:0:60
#44 0x00005c4ba9737604 llvm::LogicalResult::failed() const llvm-project/llvm/include/llvm/Support/LogicalResult.h:43:43
#45 0x00005c4ba9737604 llvm::failed(llvm::LogicalResult) llvm-project/llvm/include/llvm/Support/LogicalResult.h:71:58
#46 0x00005c4ba9737604 performActions(llvm::raw_ostream&, std::shared_ptr<llvm::SourceMgr> const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:568:7
#47 0x00005c4ba9736517 processBuffer(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef, mlir::MlirOptMainConfig const&, mlir::DialectRegistry&, mlir::SourceMgrDiagnosticVerifierHandler*, llvm::ThreadPoolInterface*) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:644:12
#48 0x00005c4ba9736517 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_3::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef, llvm::raw_ostream&) const llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:733:12
#49 0x00005c4ba9736517 llvm::LogicalResult llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::$_3>(long, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#50 0x00005c4bbc6faa64 std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>::~unique_ptr() /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/unique_ptr.h:360:6
#51 0x00005c4bbc6faa64 llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::operator()(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&) const llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:5
#52 0x00005c4bbc6fb526 mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0::operator()(llvm::StringRef) const llvm-project/mlir/lib/Support/ToolUtilities.cpp:94:13
#53 0x00005c4bbc6fa447 void llvm::interleave<llvm::StringRef const*, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, void llvm::interleave<llvm::SmallVector<llvm::StringRef, 8u>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::raw_ostream, llvm::StringRef>(llvm::SmallVector<llvm::StringRef, 8u> const&, llvm::raw_ostream&, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::StringRef const&)::'lambda'(), void>(llvm::SmallVector<llvm::StringRef, 8u>, llvm::SmallVector<llvm::StringRef, 8u>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::raw_ostream) llvm-project/llvm/include/llvm/ADT/STLExtras.h:2201:24
#54 0x00005c4bbc6fa447 void llvm::interleave<llvm::SmallVector<llvm::StringRef, 8u>, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::raw_ostream, llvm::StringRef>(llvm::SmallVector<llvm::StringRef, 8u> const&, llvm::raw_ostream&, mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef)::$_0, llvm::StringRef const&) llvm-project/llvm/include/llvm/ADT/STLExtras.h:2221:3
#55 0x00005c4bbc6fa447 mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) llvm-project/mlir/lib/Support/ToolUtilities.cpp:97:3
#56 0x00005c4ba971b432 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_delete<llvm::MemoryBuffer>>, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:0:26
#57 0x00005c4ba971be6e llvm::LogicalResult::failed() const llvm-project/llvm/include/llvm/Support/LogicalResult.h:43:43
#58 0x00005c4ba971be6e llvm::failed(llvm::LogicalResult) llvm-project/llvm/include/llvm/Support/LogicalResult.h:71:58
#59 0x00005c4ba971be6e mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:784:7
#60 0x00005c4ba971c5c3 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) llvm-project/mlir/lib/Tools/mlir-opt/MlirOptMain.cpp:800:10
#61 0x00005c4ba95343cf llvm::LogicalResult::succeeded() const llvm-project/llvm/include/llvm/Support/LogicalResult.h:40:45
#62 0x00005c4ba95343cf mlir::asMainReturnCode(llvm::LogicalResult) llvm-project/mlir/include/mlir/Tools/mlir-opt/MlirOptMain.h:399:12
#63 0x00005c4ba95343cf main llvm-project/mlir/tools/mlir-opt/mlir-opt.cpp:343:10
#64 0x000072e2df0f3d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#65 0x000072e2df0f3e40 call_init ./csu/../csu/libc-start.c:128:20
#66 0x000072e2df0f3e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#67 0x00005c4ba9473b65 _start (llvm-mlir-build/bin/mlir-opt+0x8381b65)
```
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#162769
mlir heap-use-after-free
llvm
?
2025-10-10
# mlir heap-use-after-free
**Issue:** [https://github.com/llvm/llvm-project/issues/162769](https://github.com/llvm/llvm-project/issues/162769) · **State:** `closed` · **Created:** `2025-10-10T04:06:15Z`
**Labels:** `question`, `mlir`
## Description
Seems to be a TOCTOU problem then cause UAF?
reproduce:
```
mlir-opt ./min.mlir '-pass-pipeline=builtin.module(func.func(test-memref-stride-calculation))'
Segmentation fault (core dumped)
```
PoC:
```
module {
module {
// CHECK: func.func @A_test(%[[test_arg:[^ ]*]]: i1) {
// CHECK: %[[v0:[^ ]*]] = "test_irdl_to_cpp.bar"() : () -> i32
// CHECK: %[[v1:[^ ]*]] = "test_irdl_to_cpp.bar"() : () -> i32
// CHECK: %[[v2:[^ ]*]] = "test_irdl_to_cpp.hash"(%[[v0]], %[[v0]]) : (i32, i32) -> i32
// CHECK: scf.if %[[test_arg]]
// CHECK: return
// CHECK: }
func.func @A_test(%test_arg: i1) {
%0 = "test_irdl_to_cpp.bar"() : () -> i32
%1 = "test_irdl_to_cpp.beef"(%0, %0) : (i32, i32) -> i32
"test_irdl_to_cpp.conditional"(%test_arg) ({
^cond(%test: i1):
%3 = "test_irdl_to_cpp.bar"() : () -> i32
"test.terminator"() : ()->()
}, {
^then(%what: i1, %ever: i32):
%4 = "test_irdl_to_cpp.bar"() : () -> i32
"test.terminator"() : ()->()
}, {
^else():
%5 = "test_irdl_to_cpp.bar"() : () -> i32
"test.terminator"() : ()->()
}) : (i1) -> ()
return
}
// CHECK: }
}
func.func @fusion_bridge_151568007() -> i32 {
%c = arith.constant 0 : i32
return %c : i32
}
%fusion_tmp = func.call @fusion_bridge_151568007() : () -> i32
func.func @B_f(%0: index) {
// CHECK-LABEL: Testing: f
%1 = memref.alloc() : memref<3x4x5xf32>
// CHECK: MemRefType offset: 0 strides: 20, 5, 1
%2 = memref.alloc(%0) : memref<3x4x?xf32>
// CHECK: MemRefType offset: 0 strides: ?, ?, 1
%3 = memref.alloc(%0) : memref<3x?x5xf32>
// CHECK: MemRefType offset: 0 strides: ?, 5, 1
%4 = memref.alloc(%0) : memref<?x4x5xf32>
// CHECK: MemRefType offset: 0 strides: 20, 5, 1
%5 = memref.alloc(%0, %0) : memref<?x4x?xf32>
// CHECK: MemRefType offset: 0 strides: ?, ?, 1
%6 = memref.alloc(%0, %0, %0) : memref<?x?x?xf32>
// CHECK: MemRefType offset: 0 strides: ?, ?, 1
%11 = memref.alloc() : memref<3x4x5xf32, affine_map<(i, j, k)->(i, j, k)>>
// CHECK: MemRefType offset: 0 strides: 20, 5, 1
%b11 = memref.alloc() : memref<3x4x5xf32, strided<[20, 5, 1], offset: 0>>
// CHECK: MemRefType offset: 0 strides: 20, 5, 1
%12 = memref.alloc(%0) : memref<3x4x?xf32, affine_map<(i, j, k)->(i, j, k)>>
// CHECK: MemRefType offset: 0 strides: ?, ?, 1
%13 = memref.alloc(%0) : memref<3x?x5xf32, affine_map<(i, j, k)->(i, j, k)>>
// CHECK: MemRefType offset: 0 strides: ?, 5, 1
%14 = memref.alloc(%0) : memref<?x4x5xf32, affine_map<(i, j, k)->(i, j, k)>>
// CHECK: MemRefType offset: 0 strides: 20, 5, 1
%15 = memref.alloc(%0, %0) : memref<?x4x?xf32, affine_map<(i, j, k)->(i, j, k)>>
// CHECK: MemRefType offset: 0 strides: ?, ?, 1
%16 = memref.alloc(%0, %0, %0) : memref<?x?x?xf32, affine_map<(i, j, k)->(i, j, k)>>
// CHECK: MemRefType offset: 0 strides: ?, ?, 1
%21 = memref.alloc()[%0] : memref<3x4x5xf32, affine_map<(i, j, k)[M]->(32 * i + 16 * j + M * k + 1)>>
// CHECK: MemRefType offset: 1 strides: 32, 16, ?
%22 = memref.alloc()[%0] : memref<3x4x5xf32, affine_map<(i, j, k)[M]->(32 * i + M * j + 16 * k + 3)>>
// CHECK: MemRefType offset: 3 strides: 32, ?, 16
%b22 = memref.alloc(%0)[%0, %0] : memref<3x4x?xf32, strided<[?, ?, 1], offset: 0>>
// CHECK: MemRefType offset: 0 strides: ?, ?, 1
%23 = memref.alloc(%0)[%0] : memref<3x?x5xf32, affine_map<(i, j, k)[M]->(M * i + 32 * j + 16 * k + 7)>>
// CHECK: MemRefType offset: 7 strides: ?, 32, 16
%b23 = memref.alloc(%0)[%0] : memref<3x?x5xf32, strided<[?, 5, 1], offset: 0>>
// CHECK: MemRefType offset: 0 strides: ?, 5, 1
%24 = memref.alloc(%0)[%0] : memref<3x?x5xf32, affine_map<(i, j, k)[M]->(M * i + 32 * j + 16 * k + M)>>
// CHECK: MemRefType offset: ? strides: ?, 32, 16
%b24 = memref.alloc(%0)[%0, %0] : memref<3x?x5xf32, strided<[?, 32, 16], offset: ?>>
// CHECK: MemRefType offset: ? strides: ?, 32, 16
%25 = memref.alloc(%0, %0)[%0, %0] : memref<?x?x16xf32, affine_map<(i, j, k)[M, N]->(M * i + N * j + k + 1)>>
// CHECK: MemRefType offset: 1 strides: ?, ?, 1
%b25 = memref.alloc(%0, %0)[%0, %0] : memref<?x?x16xf32, strided<[?, ?, 1], offset: 1>>
// CHECK: MemRefType offset: 1 strides: ?, ?, 1
%26 = memref.alloc(%0)[] : memref<?xf32, affine_map<(i)[M]->(i)>>
// CHECK: MemRefType offset: 0 strides: 1
%27 = memref.alloc()[%0] : memref<5xf32, affine_map<(i)[M]->(M)>>
// CHECK: MemRefType offset: ? strides: 0
%28 = memref.alloc()[%0] : memref<5xf32, affine_map<(i)[M]->(123)>>
// CHECK: MemRefType offset: 123 strides: 0
%29 = memref.alloc()[%0] : memref<f32, affine_map<()[M]->(M)>>
// CHECK: MemRefType offset: ? strides:
%30 = memref.alloc()[%0] : memref<f32, affine_map<()[M]->(123)>>
// CHECK: MemRefType offset: 123 strides:
%101 = memref.alloc() : memref<3x4x5xf32, affine_map<(i, j, k)->(i floordiv 4 + j + k)>>
// CHECK: MemRefType memref<3x4x5xf32, affine_map<(d0, d1, d2) -> (d0 floordiv 4 + d1 + d2)>> cannot be converted to strided form
%102 = memref.alloc() : memref<3x4x5xf32, affine_map<(i, j, k)->(i ceildiv 4 + j + k)>>
// CHECK: MemRefType memref<3x4x5xf32, affine_map<(d0, d1, d2) -> (d0 ceildiv 4 + d1 + d2)>> cannot be converted to strided form
%103 = memref.alloc() : memref<3x4x5xf32, affine_map<(i, j, k)->(i mod 4 + j + k)>>
// CHECK: MemRefType memref<3x4x5xf32, affine_map<(d0, d1, d2) -> (d0 mod 4 + d1 + d2)>> cannot be converted to strided form
%200 = memref.alloc()[%0, %0, %0] : memref<3x4x5xf32, affine_map<(i, j, k)[M, N, K]->(M * i + N * i + N * j + K * k - (M + N - 20)* i)>>
// CHECK: MemRefType offset: 0 strides: 20, ?, ?
%201 = memref.alloc()[%0, %0, %0] : memref<3x4x5xf32, affine_map<(i, j, k)[M, N, K]->(M * i + N * i + N * K * j + K * K * k - (M + N - 20) * (i + 1))>>
// CHECK: MemRefType offset: ? strides: 20, ?, ?
%202 = memref.alloc()[%0, %0, %0] : memref<3x4x5xf32, affine_map<(i, j, k)[M, N, K]->(M * (i + 1) + j + k - M)>>
// CHECK: MemRefType offset: 0 strides: ?, 1, 1
%203 = memref.alloc()[%0, %0, %0] : memref<3x4x5xf32, affine_map<(i, j, k)[M, N, K]->(M + M * (i + N * (j + K * k)))>>
// CHECK: MemRefType offset: ? strides: ?, ?, ?
return
}
}
```
As I cannot stably reproduce this, I can hardly minimize this :(
Error:
```
=================================================================
==153850==ERROR: AddressSanitizer: heap-use-after-free on address 0x62100003fd00 at pc 0x58d0bb5c5c98 bp 0x7c808f1fcb50 sp 0x7c808f1fc328
READ of size 33 at 0x62100003fd00 thread T1
#0 0x58d0bb5c5c97 in write (llvm-mlir-build/bin/mlir-opt+0x839dc97) (BuildId: 8d3f598c321c686de3addc0e0905b4ae76916fb7)
#1 0x58d0bb672f12 in llvm::raw_fd_ostream::write_impl(char const*, unsigned long) llvm-project/llvm/lib/Support/raw_ostream.cpp:763:19
#2 0x58d0bb9b96cd in llvm::raw_ostream::flush() llvm-project/llvm/include/llvm/Support/raw_ostream.h:201:7
#3 0x58d0bb9b96cd in (anonymous namespace)::TestMemRefStrideCalculation::runOnOperation() llvm-project/mlir/test/lib/Analysis/TestMemRefStrideCalculation.cpp:57:16
#4 0x58d0ce01bf43 in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_44::operator()() const llvm-project/mlir/lib/Pass/Pass.cpp:609:17
#5 0x58d0ce01bf43 in void llvm::function_ref<void ()>::callback_fn<mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_44>(long) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#6 0x58d0ce005119 in llvm::function_ref<void ()>::operator()() const llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#7 0x58d0ce005119 in void mlir::MLIRContext::executeAction<mlir::PassExecutionAction, mlir::Pass&>(llvm::function_ref<void ()>, llvm::ArrayRef<mlir::IRUnit>, mlir::Pass&) llvm-project/mlir/include/mlir/IR/MLIRContext.h:290:7
#8 0x58d0ce005119 in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) llvm-project/mlir/lib/Pass/Pass.cpp:603:21
#9 0x58d0ce0070eb in mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) llvm-project/mlir/lib/Pass/Pass.cpp:682:16
#10 0x58d0ce021bbb in mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102::operator()(mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo&) const llvm-project/mlir/lib/Pass/Pass.cpp:995:36
#11 0x58d0ce021bbb in auto void mlir::parallelForEach<__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102>(mlir::MLIRContext*, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&)::'lambda'(__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >&&)::operator()<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo&>(__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >&&) const llvm-project/mlir/include/mlir/IR/Threading.h:120:12
#12 0x58d0ce0223a3 in llvm::LogicalResult mlir::failableParallelForEach<__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, void mlir::parallelForEach<__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102>(mlir::MLIRContext*, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&)::'lambda'(__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >&&)>(mlir::MLIRContext*, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&)::'lambda'()::operator()() const llvm-project/mlir/include/mlir/IR/Threading.h:62:18
#13 0x58d0ce0223a3 in __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > > std::__invoke_impl<void, llvm::LogicalResult mlir::failableParallelForEach<__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, void mlir::parallelForEach<__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102>(mlir::MLIRContext*, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&)::'lambda'(__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >&&)>(mlir::MLIRContext*, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&)::'lambda'()&>(std::__invoke_other, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14
#14 0x58d0ce0223a3 in std::enable_if<is_invocable_r_v<__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102>, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > > >::type std::__invoke_r<void, llvm::LogicalResult mlir::failableParallelForEach<__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, void mlir::parallelForEach<__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102>(mlir::MLIRContext*, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&)::'lambda'(__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >&&)>(mlir::MLIRContext*, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&)::'lambda'()&>(mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:111:2
#15 0x58d0ce0223a3 in std::_Function_handler<void (), llvm::LogicalResult mlir::failableParallelForEach<__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, void mlir::parallelForEach<__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102>(mlir::MLIRContext*, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&)::'lambda'(__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >&&)>(mlir::MLIRContext*, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&)::'lambda'()>::_M_invoke(std::_Any_data const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:290:9
#16 0x58d0cdeb8e8a in void std::__invoke_impl<void, std::function<void ()> >(std::__invoke_other, std::function<void ()>&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14
#17 0x58d0cdeb8e8a in std::__invoke_result<std::function<void ()> >::type std::__invoke<std::function<void ()> >(std::function<void ()>&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:96:14
#18 0x58d0cdeb8e8a in void std::thread::_Invoker<std::tuple<std::function<void ()> > >::_M_invoke<0ul>(std::_Index_tuple<0ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_thread.h:259:13
#19 0x58d0cdeb8e8a in std::thread::_Invoker<std::tuple<std::function<void ()> > >::operator()() /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_thread.h:266:11
#20 0x58d0cdeb8e8a in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker<std::tuple<std::function<void ()> > >, void>::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/future:1409:6
#21 0x58d0cdeb8d02 in std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter> std::__invoke_impl<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker<std::tuple<std::function<void ()> > >, void>&>(std::__invoke_other, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker<std::tuple<std::function<void ()> > >, void>&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14
#22 0x58d0cdeb8d02 in std::enable_if<is_invocable_r_v<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker<std::tuple<std::function<void ()> > >, void>&>, std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> >::type std::__invoke_r<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker<std::tuple<std::function<void ()> > >, void>&>(std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker<std::tuple<std::function<void ()> > >, void>&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:114:9
#23 0x58d0cdeb8d02 in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker<std::tuple<std::function<void ()> > >, void> >::_M_invoke(std::_Any_data const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:290:9
#24 0x58d0cdeb8c2c in std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:590:9
#25 0x58d0cdeb884c in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/future:571:27
#26 0x7c8091a8cee7 in __pthread_once_slow nptl/./nptl/pthread_once.c:116:7
#27 0x58d0cdeb8617 in __gthread_once(int*, void (*)()) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/x86_64-linux-gnu/c++/11/bits/gthr-default.h:700:12
#28 0x58d0cdeb8617 in void std::call_once<void (std::__future_base::_State_baseV2::*)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*>(std::once_flag&, void (std::__future_base::_State_baseV2::*&&)(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*), std::__future_base::_State_baseV2*&&, std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*&&, bool*&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/mutex:783:21
#29 0x58d0cdeb8262 in std::__future_base::_State_baseV2::_M_set_result(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>, bool) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/future:411:2
#30 0x58d0cdeb9f88 in std::__future_base::_Deferred_state<std::thread::_Invoker<std::tuple<std::function<void ()> > >, void>::_M_complete_async() /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/future:1679:9
#31 0x58d0cdeba3a0 in std::__future_base::_State_baseV2::wait() /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/future:333:2
#32 0x58d0ce8fb87e in llvm::StdThreadPool::processTasks(llvm::ThreadPoolTaskGroup*) llvm-project/llvm/lib/Support/ThreadPool.cpp:114:5
#33 0x58d0ce902956 in llvm::StdThreadPool::grow(int)::$_0::operator()() const llvm-project/llvm/lib/Support/ThreadPool.cpp:62:9
#34 0x58d0ce902956 in auto void llvm::thread::GenericThreadProxy<std::tuple<llvm::StdThreadPool::grow(int)::$_0> >(void*)::'lambda'(auto&&, auto&&...)::operator()<llvm::StdThreadPool::grow(int)::$_0&>(auto&&, auto&&...) const llvm-project/llvm/include/llvm/Support/thread.h:46:11
#35 0x58d0ce902956 in auto std::__invoke_impl<void, void llvm::thread::GenericThreadProxy<std::tuple<llvm::StdThreadPool::grow(int)::$_0> >(void*)::'lambda'(auto&&, auto&&...), llvm::StdThreadPool::grow(int)::$_0&>(std::__invoke_other, void llvm::thread::GenericThreadProxy<std::tuple<llvm::StdThreadPool::grow(int)::$_0> >(void*)::'lambda'(auto&&, auto&&...)&&, llvm::StdThreadPool::grow(int)::$_0&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14
#36 0x58d0ce902956 in std::__invoke_result<auto, auto...>::type std::__invoke<void llvm::thread::GenericThreadProxy<std::tuple<llvm::StdThreadPool::grow(int)::$_0> >(void*)::'lambda'(auto&&, auto&&...), llvm::StdThreadPool::grow(int)::$_0&>(auto&&, auto&&...) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:96:14
#37 0x58d0ce902956 in decltype(auto) std::__apply_impl<void llvm::thread::GenericThreadProxy<std::tuple<llvm::StdThreadPool::grow(int)::$_0> >(void*)::'lambda'(auto&&, auto&&...), std::tuple<llvm::StdThreadPool::grow(int)::$_0>&, 0ul>(auto&&, std::tuple<llvm::StdThreadPool::grow(int)::$_0>&, std::integer_sequence<unsigned long, 0ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/tuple:1854:14
#38 0x58d0ce902956 in decltype(auto) std::apply<void llvm::thread::GenericThreadProxy<std::tuple<llvm::StdThreadPool::grow(int)::$_0> >(void*)::'lambda'(auto&&, auto&&...), std::tuple<llvm::StdThreadPool::grow(int)::$_0>&>(auto&&, std::tuple<llvm::StdThreadPool::grow(int)::$_0>&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/tuple:1865:14
#39 0x58d0ce902956 in void llvm::thread::GenericThreadProxy<std::tuple<llvm::StdThreadPool::grow(int)::$_0> >(void*) llvm-project/llvm/include/llvm/Support/thread.h:44:5
#40 0x58d0ce902956 in void* llvm::thread::ThreadProxy<std::tuple<llvm::StdThreadPool::grow(int)::$_0> >(void*) llvm-project/llvm/include/llvm/Support/thread.h:58:5
#41 0x7c8091a87ac2 in start_thread nptl/./nptl/pthread_create.c:442:8
#42 0x7c8091b18a03 in __clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:100
0x62100003fd00 is located 0 bytes inside of 4096-byte region [0x62100003fd00,0x621000040d00)
freed by thread T2 here:
#0 0x58d0bb6680dd in operator delete[](void*) (llvm-mlir-build/bin/mlir-opt+0x84400dd) (BuildId: 8d3f598c321c686de3addc0e0905b4ae76916fb7)
#1 0x58d0bb66e969 in llvm::raw_ostream::SetBufferAndMode(char*, unsigned long, llvm::raw_ostream::BufferKind) llvm-project/llvm/lib/Support/raw_ostream.cpp:116:5
#2 0x58d0bb66fae9 in llvm::raw_ostream::write(char const*, unsigned long) llvm-project/llvm/lib/Support/raw_ostream.cpp:254:7
#3 0x58d0bb9b9563 in llvm::raw_ostream::operator<<(char const*) llvm-project/llvm/include/llvm/Support/raw_ostream.h:258:18
#4 0x58d0bb9b9563 in (anonymous namespace)::TestMemRefStrideCalculation::runOnOperation() llvm-project/mlir/test/lib/Analysis/TestMemRefStrideCalculation.cpp:33:16
#5 0x58d0ce01bf43 in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_44::operator()() const llvm-project/mlir/lib/Pass/Pass.cpp:609:17
#6 0x58d0ce01bf43 in void llvm::function_ref<void ()>::callback_fn<mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int)::$_44>(long) llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:46:12
#7 0x58d0ce005119 in llvm::function_ref<void ()>::operator()() const llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:69:12
#8 0x58d0ce005119 in void mlir::MLIRContext::executeAction<mlir::PassExecutionAction, mlir::Pass&>(llvm::function_ref<void ()>, llvm::ArrayRef<mlir::IRUnit>, mlir::Pass&) llvm-project/mlir/include/mlir/IR/MLIRContext.h:290:7
#9 0x58d0ce005119 in mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) llvm-project/mlir/lib/Pass/Pass.cpp:603:21
#10 0x58d0ce0070eb in mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) llvm-project/mlir/lib/Pass/Pass.cpp:682:16
#11 0x58d0ce021bbb in mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102::operator()(mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo&) const llvm-project/mlir/lib/Pass/Pass.cpp:995:36
#12 0x58d0ce021bbb in auto void mlir::parallelForEach<__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102>(mlir::MLIRContext*, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&)::'lambda'(__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >&&)::operator()<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo&>(__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >&&) const llvm-project/mlir/include/mlir/IR/Threading.h:120:12
#13 0x58d0ce0223a3 in llvm::LogicalResult mlir::failableParallelForEach<__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, void mlir::parallelForEach<__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102>(mlir::MLIRContext*, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&)::'lambda'(__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >&&)>(mlir::MLIRContext*, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&)::'lambda'()::operator()() const llvm-project/mlir/include/mlir/IR/Threading.h:62:18
#14 0x58d0ce0223a3 in __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > > std::__invoke_impl<void, llvm::LogicalResult mlir::failableParallelForEach<__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, void mlir::parallelForEach<__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102>(mlir::MLIRContext*, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&)::'lambda'(__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >&&)>(mlir::MLIRContext*, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&)::'lambda'()&>(std::__invoke_other, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14
#15 0x58d0ce0223a3 in std::enable_if<is_invocable_r_v<__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102>, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > > >::type std::__invoke_r<void, llvm::LogicalResult mlir::failableParallelForEach<__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, void mlir::parallelForEach<__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102>(mlir::MLIRContext*, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&)::'lambda'(__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >&&)>(mlir::MLIRContext*, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&)::'lambda'()&>(mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:111:2
#16 0x58d0ce0223a3 in std::_Function_handler<void (), llvm::LogicalResult mlir::failableParallelForEach<__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, void mlir::parallelForEach<__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102>(mlir::MLIRContext*, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&)::'lambda'(__gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >&&)>(mlir::MLIRContext*, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, __gnu_cxx::__normal_iterator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo*, std::vector<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo, std::allocator<mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::OpPMInfo> > >, mlir::detail::OpToOpPassAdaptor::runOnOperationAsyncImpl(bool)::$_102&&)::'lambda'()>::_M_invoke(std::_Any_data const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:290:9
#17 0x58d0cdeb8e8a in void std::__invoke_impl<void, std::function<void ()> >(std::__invoke_other, std::function<void ()>&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14
#18 0x58d0cdeb8e8a in std::__invoke_result<std::function<void ()> >::type std::__invoke<std::function<void ()> >(std::function<void ()>&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:96:14
#19 0x58d0cdeb8e8a in void std::thread::_Invoker<std::tuple<std::function<void ()> > >::_M_invoke<0ul>(std::_Index_tuple<0ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_thread.h:259:13
#20 0x58d0cdeb8e8a in std::thread::_Invoker<std::tuple<std::function<void ()> > >::operator()() /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_thread.h:266:11
#21 0x58d0cdeb8e8a in std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker<std::tuple<std::function<void ()> > >, void>::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/future:1409:6
#22 0x58d0cdeb8d02 in std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter> std::__invoke_impl<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker<std::tuple<std::function<void ()> > >, void>&>(std::__invoke_other, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker<std::tuple<std::function<void ()> > >, void>&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14
#23 0x58d0cdeb8d02 in std::enable_if<is_invocable_r_v<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker<std::tuple<std::function<void ()> > >, void>&>, std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> >::type std::__invoke_r<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker<std::tuple<std::function<void ()> > >, void>&>(std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker<std::tuple<std::function<void ()> > >, void>&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:114:9
#24 0x58d0cdeb8d02 in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<void>, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker<std::tuple<std::function<void ()> > >, void> >::_M_invoke(std::_Any_data const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:290:9
#25 0x58d0cdeb8c2c in std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:590:9
#26 0x58d0cdeb884c in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/future:571:27
#27 0x7c8091a8cee7 in __pthread_once_slow nptl/./nptl/pthread_once.c:116:7
...
SUMMARY: AddressSanitizer: heap-use-after-free (llvm-mlir-build/bin/mlir-opt+0x839dc97) (BuildId: 8d3f598c321c686de3addc0e0905b4ae76916fb7) in write
Shadow bytes around the buggy address:
0x0c427fffff50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffff60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffff70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffff80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffff90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c427fffffa0:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c427fffffb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c427fffffc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c427fffffd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c427fffffe0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c427ffffff0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==153850==ABORTING
```
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#139827
memory leak in email message make mixed with long boundary
cpython
?
2025-10-09
# memory leak in email message make mixed with long boundary
**Issue:** [https://github.com/python/cpython/issues/139827](https://github.com/python/cpython/issues/139827) · **State:** `closed` · **Created:** `2025-10-09T07:39:31Z`
**Labels:** `type-bug`
## Description
# Bug report
### Bug description:
```python
from email.message import MIMEPart
part = MIMEPart()
boundary = 'a'*5000
part.make_mixed(boundary)
print(part)
```
config: JIT + ASan
```
=================================================================
==799314==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 2008 byte(s) in 1 object(s) allocated from:
#0 0x79df4acac9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x55ec64b4a6b7 in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x55ec64b4a6b7 in gc_alloc ../Python/gc.c:2327
#3 0x55ec64b4a6b7 in _PyObject_GC_NewVar ../Python/gc.c:2369
#4 0x55ec64c28e54 in make_executor_from_uops ../Python/optimizer.c:1120
#5 0x55ec64c28e54 in uop_optimize ../Python/optimizer.c:1341
#6 0x55ec64c28e54 in _PyOptimizer_Optimize ../Python/optimizer.c:136
#7 0x55ec645f2940 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:7656
#8 0x55ec64ab4e55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#9 0x55ec64ab4e55 in _PyEval_Vector ../Python/ceval.c:1997
#10 0x55ec64742fa3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#11 0x55ec6474365c in _PyObject_Call_Prepend ../Objects/call.c:504
#12 0x55ec648cc280 in slot_tp_new ../Objects/typeobject.c:10853
#13 0x55ec648dc148 in type_call ../Objects/typeobject.c:2448
#14 0x55ec6473de4d in _PyObject_MakeTpCall ../Objects/call.c:242
#15 0x55ec645e272c in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#16 0x55ec64ab4e55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#17 0x55ec64ab4e55 in _PyEval_Vector ../Python/ceval.c:1997
#18 0x55ec64742fa3 in _PyObject_VectorcallDictTstate ../Objects/call.c:135
#19 0x55ec6474365c in _PyObject_Call_Prepend ../Objects/call.c:504
#20 0x55ec648fa114 in call_method ../Objects/typeobject.c:3076
#21 0x55ec648fa114 in slot_tp_call ../Objects/typeobject.c:10599
#22 0x55ec6473de4d in _PyObject_MakeTpCall ../Objects/call.c:242
#23 0x55ec645e272c in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:4021
#24 0x55ec64ab4e55 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#25 0x55ec64ab4e55 in _PyEval_Vector ../Python/ceval.c:1997
#26 0x55ec648fe657 in _PyObject_VectorcallTstate ../Include/internal/pycore_call.h:169
#27 0x55ec648fe657 in vectorcall_unbound ../Objects/typeobject.c:3033
#28 0x55ec648fe657 in vectorcall_method ../Objects/typeobject.c:3104
#29 0x55ec648fe657 in slot_mp_ass_subscript ../Objects/typeobject.c:10386
#30 0x55ec645fcae8 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:11245
#31 0x55ec64ab4686 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#32 0x55ec64ab4686 in _PyEval_Vector ../Python/ceval.c:1997
#33 0x55ec64ab4686 in PyEval_EvalCode ../Python/ceval.c:880
#34 0x55ec64c71b0e in run_eval_code_obj ../Python/pythonrun.c:1365
#35 0x55ec64c71b0e in run_mod ../Python/pythonrun.c:1459
#36 0x55ec64c767b7 in pyrun_file ../Python/pythonrun.c:1293
#37 0x55ec64c767b7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#38 0x55ec64c772dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#39 0x55ec64cf3bdc in pymain_run_file_obj ../Modules/main.c:410
#40 0x55ec64cf3bdc in pymain_run_file ../Modules/main.c:429
#41 0x55ec64cf3bdc in pymain_run_python ../Modules/main.c:691
#42 0x55ec64cf54be in Py_RunMain ../Modules/main.c:772
#43 0x55ec64cf54be in pymain_main ../Modules/main.c:802
#44 0x55ec64cf54be in Py_BytesMain ../Modules/main.c:826
#45 0x79df4a8de1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#46 0x79df4a8de28a in __libc_start_main_impl ../csu/libc-start.c:360
#47 0x55ec64617f54 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x218f54) (BuildId: 3087b1f6c97d85c049f8eaa36e3ac5b15eccf317)
SUMMARY: AddressSanitizer: 2008 byte(s) leaked in 1 allocation(s).
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#139751
symtable ValueError and memory leak
cpython
?
2025-10-08
# symtable ValueError and memory leak
**Issue:** [https://github.com/python/cpython/issues/139751](https://github.com/python/cpython/issues/139751) · **State:** `closed` · **Created:** `2025-10-08T07:24:32Z`
**Labels:** `type-bug`, `pending`
## Description
# Bug report
### Bug description:
```python
import symtable
source_code = '\ndef demoFunc(arg):\n x = arg + 1\n return x\n'
table = symtable.symtable(source_code, '<string>', '\x00')
for fusion in table.get_children():
func_table = child
```
```
Traceback (most recent call last):
File "/home/fuzz/WorkSpace/flowfusion-cpython/leak_pocs/1937/./min.py", line 3, in <module>
table = symtable.symtable(source_code, '<string>', '\x00')
File "/home/fuzz/WorkSpace/flowfusion-cpython/cpython/Lib/symtable.py", line 26, in symtable
top = _symtable.symtable(code, filename, compile_type)
ValueError: embedded null character
=================================================================
==1760594==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 49 byte(s) in 1 object(s) allocated from:
#0 0x70d8592459c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x58cdc7c601ae in PyUnicode_New ../Objects/unicodeobject.c:1406
#2 0x58cdc7ccfa83 in PyUnicode_New ../Objects/unicodeobject.c:1355
#3 0x58cdc7ccfa83 in unicode_decode_utf8 ../Objects/unicodeobject.c:5412
#4 0x58cdc79f46c6 in _PyPegen_decode_string ../Parser/string_parser.c:245
#5 0x58cdc79f46c6 in _PyPegen_decode_string ../Parser/string_parser.c:242
#6 0x58cdc79f4f9c in _PyPegen_parse_string ../Parser/string_parser.c:338
#7 0x58cdc7955e82 in _PyPegen_constant_from_string ../Parser/action_helpers.c:1451
#8 0x58cdc79a9ab5 in string_rule ../Parser/parser.c:17129
#9 0x58cdc79a9ab5 in _tmp_153_rule ../Parser/parser.c:37022
#10 0x58cdc79aa584 in _loop1_80_rule ../Parser/parser.c:32623
#11 0x58cdc79afe2f in strings_rule ../Parser/parser.c:17200
#12 0x58cdc7966a9b in atom_rule ../Parser/parser.c:15141
#13 0x58cdc796bf2f in primary_raw ../Parser/parser.c:14779
#14 0x58cdc796bf2f in primary_rule ../Parser/parser.c:14577
#15 0x58cdc796ce89 in await_primary_rule ../Parser/parser.c:14531
#16 0x58cdc796dde7 in power_rule ../Parser/parser.c:14407
#17 0x58cdc796dde7 in factor_rule ../Parser/parser.c:14357
#18 0x58cdc796f55f in term_raw ../Parser/parser.c:14198
#19 0x58cdc796f55f in term_rule ../Parser/parser.c:13941
#20 0x58cdc7971044 in sum_raw ../Parser/parser.c:13894
#21 0x58cdc7971044 in sum_rule ../Parser/parser.c:13773
#22 0x58cdc7972307 in shift_expr_raw ../Parser/parser.c:13733
#23 0x58cdc7972307 in shift_expr_rule ../Parser/parser.c:13593
#24 0x58cdc7973964 in bitwise_and_raw ../Parser/parser.c:13553
#25 0x58cdc7973964 in bitwise_and_rule ../Parser/parser.c:13471
#26 0x58cdc7974594 in bitwise_xor_raw ../Parser/parser.c:13431
#27 0x58cdc7974594 in bitwise_xor_rule ../Parser/parser.c:13349
#28 0x58cdc79751c4 in bitwise_or_raw ../Parser/parser.c:13309
#29 0x58cdc79751c4 in bitwise_or_rule ../Parser/parser.c:13227
#30 0x58cdc7975e90 in comparison_rule ../Parser/parser.c:12467
#31 0x58cdc7975e90 in inversion_rule ../Parser/parser.c:12418
#32 0x58cdc7979125 in conjunction_rule ../Parser/parser.c:12295
#33 0x58cdc797a125 in disjunction_rule ../Parser/parser.c:12207
#34 0x58cdc798d084 in expression_rule ../Parser/parser.c:11495
#35 0x58cdc7990b6c in _tmp_87_rule ../Parser/parser.c:33082
#36 0x58cdc7991f58 in _tmp_164_rule ../Parser/parser.c:37700
#37 0x58cdc7991f58 in _loop0_88_rule ../Parser/parser.c:33134
#38 0x58cdc7991f58 in _gather_89_rule ../Parser/parser.c:33202
#39 0x58cdc799638c in args_rule ../Parser/parser.c:18376
#40 0x58cdc797cf50 in arguments_rule ../Parser/parser.c:18297
#41 0x58cdc7980724 in t_primary_raw ../Parser/parser.c:19887
#42 0x58cdc7980724 in t_primary_rule ../Parser/parser.c:19714
#43 0x58cdc799e38d in target_with_star_atom_rule ../Parser/parser.c:19214
#44 0x58cdc79a1229 in star_target_rule ../Parser/parser.c:19157
SUMMARY: AddressSanitizer: 49 byte(s) leaked in 1 allocation(s).
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#139750
memory leak with glob and mock in JIT
cpython
?
2025-10-08
# memory leak with glob and mock in JIT
**Issue:** [https://github.com/python/cpython/issues/139750](https://github.com/python/cpython/issues/139750) · **State:** `closed` · **Created:** `2025-10-08T07:17:25Z`
**Labels:** `type-bug`
## Description
# Bug report
### Bug description:
```python
import glob
from unittest import mock
def fake_glob(pattern):
return []
with mock.patch('glob.glob', side_effect=fake_glob):
for _ in range(4096):
r = glob.glob('*.txt')
import http.cookiejar
```
Config: `--enable-experimental-jit=yes --with-address-sanitizer`
ASan:
```
=================================================================
==1634280==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 1216 byte(s) in 1 object(s) allocated from:
#0 0x702100c829c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5de919b956b7 in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x5de919b956b7 in gc_alloc ../Python/gc.c:2327
#3 0x5de919b956b7 in _PyObject_GC_NewVar ../Python/gc.c:2369
#4 0x5de919c73e54 in make_executor_from_uops ../Python/optimizer.c:1120
#5 0x5de919c73e54 in uop_optimize ../Python/optimizer.c:1341
#6 0x5de919c73e54 in _PyOptimizer_Optimize ../Python/optimizer.c:136
#7 0x5de91963d940 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:7656
#8 0x5de919aff686 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#9 0x5de919aff686 in _PyEval_Vector ../Python/ceval.c:1997
#10 0x5de919aff686 in PyEval_EvalCode ../Python/ceval.c:880
#11 0x5de919cbcb0e in run_eval_code_obj ../Python/pythonrun.c:1365
#12 0x5de919cbcb0e in run_mod ../Python/pythonrun.c:1459
#13 0x5de919cc17b7 in pyrun_file ../Python/pythonrun.c:1293
#14 0x5de919cc17b7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#15 0x5de919cc22dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#16 0x5de919d3ebdc in pymain_run_file_obj ../Modules/main.c:410
#17 0x5de919d3ebdc in pymain_run_file ../Modules/main.c:429
#18 0x5de919d3ebdc in pymain_run_python ../Modules/main.c:691
#19 0x5de919d404be in Py_RunMain ../Modules/main.c:772
#20 0x5de919d404be in pymain_main ../Modules/main.c:802
#21 0x5de919d404be in Py_BytesMain ../Modules/main.c:826
#22 0x7021008b41c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#23 0x7021008b428a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#24 0x5de919662f54 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x218f54) (BuildId: 3087b1f6c97d85c049f8eaa36e3ac5b15eccf317)
SUMMARY: AddressSanitizer: 1216 byte(s) leaked in 1 allocation(s).
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#139749
memory leak after ValueError in JIT
cpython
?
2025-10-08
# memory leak after ValueError in JIT
**Issue:** [https://github.com/python/cpython/issues/139749](https://github.com/python/cpython/issues/139749) · **State:** `closed` · **Created:** `2025-10-08T06:53:15Z`
**Labels:** `type-bug`, `interpreter-core`, `topic-JIT`
## Description
# Bug report
### Bug description:
```python
def test_in_table_c8_with_characters():
for cp in range(128, 999999999999):
ch = chr(cp)
test_in_table_c8_with_characters()
```
config: `--enable-experimental-jit=yes --with-address-sanitizer`
```
Traceback (most recent call last):
File "/home/fuzz/WorkSpace/flowfusion-cpython/leak_pocs/976/./min.py", line 4, in <module>
test_in_table_c8_with_characters()
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
File "/home/fuzz/WorkSpace/flowfusion-cpython/leak_pocs/976/./min.py", line 3, in test_in_table_c8_with_characters
ch = chr(cp)
ValueError: chr() arg not in range(0x110000)
=================================================================
==1588536==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 976 byte(s) in 1 object(s) allocated from:
#0 0x78749dd8f9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x58cde3b0f6b7 in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x58cde3b0f6b7 in gc_alloc ../Python/gc.c:2327
#3 0x58cde3b0f6b7 in _PyObject_GC_NewVar ../Python/gc.c:2369
#4 0x58cde3bede54 in make_executor_from_uops ../Python/optimizer.c:1120
#5 0x58cde3bede54 in uop_optimize ../Python/optimizer.c:1341
#6 0x58cde3bede54 in _PyOptimizer_Optimize ../Python/optimizer.c:136
#7 0x58cde35b7940 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:7656
#8 0x58cde3a79686 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#9 0x58cde3a79686 in _PyEval_Vector ../Python/ceval.c:1997
#10 0x58cde3a79686 in PyEval_EvalCode ../Python/ceval.c:880
#11 0x58cde3c36b0e in run_eval_code_obj ../Python/pythonrun.c:1365
#12 0x58cde3c36b0e in run_mod ../Python/pythonrun.c:1459
#13 0x58cde3c3b7b7 in pyrun_file ../Python/pythonrun.c:1293
#14 0x58cde3c3b7b7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#15 0x58cde3c3c2dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#16 0x58cde3cb8bdc in pymain_run_file_obj ../Modules/main.c:410
#17 0x58cde3cb8bdc in pymain_run_file ../Modules/main.c:429
#18 0x58cde3cb8bdc in pymain_run_python ../Modules/main.c:691
#19 0x58cde3cba4be in Py_RunMain ../Modules/main.c:772
#20 0x58cde3cba4be in pymain_main ../Modules/main.c:802
#21 0x58cde3cba4be in Py_BytesMain ../Modules/main.c:826
#22 0x78749d9c11c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#23 0x78749d9c128a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#24 0x58cde35dcf54 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x218f54) (BuildId: 3087b1f6c97d85c049f8eaa36e3ac5b15eccf317)
SUMMARY: AddressSanitizer: 976 byte(s) leaked in 1 allocation(s).
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#139748
Argument Clinic does not handle error paths for converters creating a strong reference to a PyObject
cpython
?
2025-10-08
# Argument Clinic does not handle error paths for converters creating a strong reference to a PyObject
**Issue:** [https://github.com/python/cpython/issues/139748](https://github.com/python/cpython/issues/139748) · **State:** `closed` · **Created:** `2025-10-08T06:47:01Z`
**Labels:** `type-bug`, `interpreter-core`
## Description
# Bug report
### Bug description:
```console
$ ./python -X showrefcount -c "compile(b'a = 1\n', 'crash.py', 'exec', dont_inherit=True, optimize=99999999999)"
Traceback (most recent call last):
File "<string>", line 1, in <module>
compile(b'a = 1\n', 'crash.py', 'exec', dont_inherit=True, optimize=99999999999)
~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
OverflowError: Python int too large to convert to C int
[1 refs, 1 blocks]
```
```console
$ ./python -X showrefcount -c 'import _symtable; _symtable.symtable("", "hello", 1)'
Traceback (most recent call last):
File "<string>", line 1, in <module>
import _symtable; _symtable.symtable("", "hello", 1)
~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^
TypeError: symtable() argument 3 must be str, not int
[3 refs, 1 blocks]
```
<details>
<summary>Originally tracked from the following reproducer</summary>
```python
import compileall
import tempfile
import os
tmpdir = tempfile.TemporaryDirectory()
src_dir = tmpdir.name
src_file = os.path.join(src_dir, 'test_module.py')
with open(src_file, 'w', encoding='utf-8') as f:
f.write('a = 1\n')
ret = compileall.compile_dir(src_dir, maxlevels=1, ddir=None, force=False, rx=None, quiet=2, legacy=False, optimize=--999999999999, workers=1, invalidation_mode=None)
```
Edits: `Config: --enable-experimental-jit=yes --with-address-sanitizer`
```
=================================================================
==1571305==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 72 byte(s) in 1 object(s) allocated from:
#0 0x796ca65c29c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5abe30ba41ae in PyUnicode_New ../Objects/unicodeobject.c:1406
#2 0x5abe30bfbb79 in PyUnicode_New ../Objects/unicodeobject.c:1355
#3 0x5abe30bfbb79 in PyUnicode_Append ../Objects/unicodeobject.c:11719
#4 0x5abe3087af86 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:391
#5 0x5abe30a04394 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#6 0x5abe30a04394 in gen_send_ex2 ../Objects/genobject.c:259
#7 0x5abe30a04394 in gen_iternext ../Objects/genobject.c:634
#8 0x5abe30d248a3 in _PyForIter_VirtualIteratorNext ../Python/ceval.c:3583
#9 0x5abe3086d1a2 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:5649
#10 0x5abe30d25686 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#11 0x5abe30d25686 in _PyEval_Vector ../Python/ceval.c:1997
#12 0x5abe30d25686 in PyEval_EvalCode ../Python/ceval.c:880
#13 0x5abe30ee2b0e in run_eval_code_obj ../Python/pythonrun.c:1365
#14 0x5abe30ee2b0e in run_mod ../Python/pythonrun.c:1459
#15 0x5abe30ee77b7 in pyrun_file ../Python/pythonrun.c:1293
#16 0x5abe30ee77b7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#17 0x5abe30ee82dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#18 0x5abe30f64bdc in pymain_run_file_obj ../Modules/main.c:410
#19 0x5abe30f64bdc in pymain_run_file ../Modules/main.c:429
#20 0x5abe30f64bdc in pymain_run_python ../Modules/main.c:691
#21 0x5abe30f664be in Py_RunMain ../Modules/main.c:772
#22 0x5abe30f664be in pymain_main ../Modules/main.c:802
#23 0x5abe30f664be in Py_BytesMain ../Modules/main.c:826
#24 0x796ca61f41c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#25 0x796ca61f428a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#26 0x5abe30888f54 in _start (/home/fuzz/WorkSpace/flowfusion-cpython/cpython/build/python+0x218f54) (BuildId: 3087b1f6c97d85c049f8eaa36e3ac5b15eccf317)
SUMMARY: AddressSanitizer: 72 byte(s) leaked in 1 allocation(s).
```
tempfile seems to be related to #139540, however, this has no NameError
</details>
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-139765
* gh-139789
* gh-139792
* gh-139815
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#139540
JIT executors are not properly freed
cpython
?
2025-10-03
# JIT executors are not properly freed
**Issue:** [https://github.com/python/cpython/issues/139540](https://github.com/python/cpython/issues/139540) · **State:** `closed` · **Created:** `2025-10-03T08:40:38Z`
**Labels:** `type-bug`, `interpreter-core`, `3.14`, `topic-JIT`, `3.15`
## Description
# Bug report
### Bug description:
PoC:
```python
import bdb
code = 'a = 1\nb = 2\nc = a + b'
globals_dict = {}
locals_dict = {}
debugger = bdb.Bdb()
debugger.runctx(code, globals_dict, locals_dict)
for i in range(10):
pass
with tempfile.NamedTemporaryFile() as tmpfile:
tmpfile.seek(0)
```
Config: `--enable-experimental-jit=yes --with-address-sanitizer`
ASan:
```
Traceback (most recent call last):
File "min.py", line 9, in <module>
with tempfile.NamedTemporaryFile() as tmpfile:
^^^^^^^^
NameError: name 'tempfile' is not defined. Did you mean: 'compile'? Or did you forget to import 'tempfile'?
==3445760==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 600 byte(s) in 1 object(s) allocated from:
#0 0x7ab0b95889c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5cc52547f6b7 in _PyObject_MallocWithType ../Include/internal/pycore_object_alloc.h:46
#2 0x5cc52547f6b7 in gc_alloc ../Python/gc.c:2327
#3 0x5cc52547f6b7 in _PyObject_GC_NewVar ../Python/gc.c:2369
#4 0x5cc52555de54 in make_executor_from_uops ../Python/optimizer.c:1120
#5 0x5cc52555de54 in uop_optimize ../Python/optimizer.c:1341
#6 0x5cc52555de54 in _PyOptimizer_Optimize ../Python/optimizer.c:136
#7 0x5cc524f27940 in _PyEval_EvalFrameDefault ../Python/generated_cases.c.h:7656
#8 0x5cc5253e9686 in _PyEval_EvalFrame ../Include/internal/pycore_ceval.h:121
#9 0x5cc5253e9686 in _PyEval_Vector ../Python/ceval.c:1997
#10 0x5cc5253e9686 in PyEval_EvalCode ../Python/ceval.c:880
#11 0x5cc5255a6b0e in run_eval_code_obj ../Python/pythonrun.c:1365
#12 0x5cc5255a6b0e in run_mod ../Python/pythonrun.c:1459
#13 0x5cc5255ab7b7 in pyrun_file ../Python/pythonrun.c:1293
#14 0x5cc5255ab7b7 in _PyRun_SimpleFileObject ../Python/pythonrun.c:521
#15 0x5cc5255ac2dc in _PyRun_AnyFileObject ../Python/pythonrun.c:81
#16 0x5cc525628bdc in pymain_run_file_obj ../Modules/main.c:410
#17 0x5cc525628bdc in pymain_run_file ../Modules/main.c:429
#18 0x5cc525628bdc in pymain_run_python ../Modules/main.c:691
#19 0x5cc52562a4be in Py_RunMain ../Modules/main.c:772
#20 0x5cc52562a4be in pymain_main ../Modules/main.c:802
#21 0x5cc52562a4be in Py_BytesMain ../Modules/main.c:826
#22 0x7ab0b91ba1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#23 0x7ab0b91ba28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#24 0x5cc524f4cf54 in _start (cpython/build/python+0x218f54) (BuildId: 3087b1f6c97d85c049f8eaa36e3ac5b15eccf317)
SUMMARY: AddressSanitizer: 600 byte(s) leaked in 1 allocation(s).
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
_No response_
<!-- gh-linked-prs -->
### Linked PRs
* gh-139952
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#20043
array_unique assertion failure with RC1 array causing an exception on sort
php
?
2025-10-03
# array_unique assertion failure with RC1 array causing an exception on sort
**Issue:** [https://github.com/php/php-src/issues/20043](https://github.com/php/php-src/issues/20043) · **State:** `closed` · **Created:** `2025-10-03T08:08:44Z`
**Labels:** `Bug`, `Extension: standard`, `Status: Verified`
## Description
### Description
The following code:
```php
<?php
$cls = new ArrayIterator();
$unset_var = 10;
try {array_unique($GLOBALS,$unset_var);} catch (Exception $e) { echo($e); }
```
Resulted in this output:
```
php: /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_hash.c:1549: zend_result zend_hash_del(HashTable *, zend_string *): Assertion `(zend_gc_refcount(&(ht)->gc) == 1) || ((ht)->u.flags & (1<<6))' failed.
Aborted (core dumped)
```
To reproduce:
```
./php-src/sapi/cli/php ./test.php
```
Commit:
```
3ac43296aad7942f6602840f0d42a43a4f3f5ebf
```
Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```
Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```
*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*
### PHP Version
```plain
nightly
```
### Operating System
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#20042
SEGV array.c
php
?
2025-10-03
# SEGV array.c
**Issue:** [https://github.com/php/php-src/issues/20042](https://github.com/php/php-src/issues/20042) · **State:** `open` · **Created:** `2025-10-03T08:05:09Z`
**Labels:** `Bug`, `Extension: standard`, `Status: Verified`
## Description
### Description
The following code:
```php
<?php
set_error_handler(function ($fusion, $errstr) {
global $nan;
$nan = bin2hex(random_bytes(4));
});
settype($nan, 'object');
try {prev($nan);} catch (Exception $e) { echo($e); }
```
Resulted in this output:
```
/home/phpfuzz/WorkSpace/flowfusion/php-src/ext/standard/array.c:1009:25: runtime error: member access within misaligned address 0x3534653331653939 for type 'const zend_object_handlers' (aka 'const struct _zend_object_handlers'), which requires 8 byte alignment
0x3534653331653939: note: pointer points here
<memory cannot be printed>
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/standard/array.c:1009:25 in
```
To reproduce:
```
./php-src/sapi/cli/php ./test.php
```
Commit:
```
3ac43296aad7942f6602840f0d42a43a4f3f5ebf
```
Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```
Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```
*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*
### PHP Version
```plain
nightly
```
### Operating System
_No response_
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#139210
heap-use-after-free `_elementtree_XMLParser__setevents_impl`
cpython
?
2025-09-21
# heap-use-after-free `_elementtree_XMLParser__setevents_impl`
**Issue:** [https://github.com/python/cpython/issues/139210](https://github.com/python/cpython/issues/139210) · **State:** `closed` · **Created:** `2025-09-21T15:33:01Z`
**Labels:** `type-bug`, `extension-modules`, `topic-XML`, `3.14`
## Description
# Bug report
### Bug description:
```python
import gettext
import io
import xml.etree.ElementTree as ET
A_context_unicode = '按钮'
A_message_unicode = '确定'
A_result_unicode = gettext.pgettext(A_context_unicode, A_message_unicode)
fusion = A_result_unicode
B_xml_data = b'<?xml version="1.0"?>\n<root>\n <child name="a">Text1</child>\n <child name="b">Text2</child>\n</root>'
B_f = io.BytesIO(B_xml_data)
B_result = list(ET.iterparse(B_f, events=fusion))
```
config: `--enable-experimental-jit=yes --with-address-sanitizer`
```
==1106491==ERROR: AddressSanitizer: heap-use-after-free on address 0x502000005ef0 at pc 0x5efb246dbfe7 bp 0x7fffacd3add0 sp 0x7fffacd3a598
READ of size 3 at 0x502000005ef0 thread T0
#0 0x5efb246dbfe6 in strlen (/home/fuzz/WorkSpace/PyFuzz/cpython/python+0x1e4fe6) (BuildId: 6eb748db4289186e9c2fb52e6d6b8534b12821c5)
#1 0x5efb24a73efc in unicode_fromformat_write_utf8 /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/unicodeobject.c:2702:18
#2 0x5efb24a2fc62 in unicode_fromformat_arg /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/unicodeobject.c
#3 0x5efb24a2fc62 in unicode_from_format /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/unicodeobject.c:3211:17
#4 0x5efb24a2e4b5 in PyUnicode_FromFormatV /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/unicodeobject.c:3245:9
#5 0x5efb24bf20bf in _PyErr_FormatV /home/fuzz/WorkSpace/PyFuzz/cpython/Python/errors.c:1208:14
#6 0x5efb24bf20bf in PyErr_Format /home/fuzz/WorkSpace/PyFuzz/cpython/Python/errors.c:1243:5
#7 0x735d1c93bc4e in _elementtree_XMLParser__setevents_impl /home/fuzz/WorkSpace/PyFuzz/cpython/./Modules/_elementtree.c:4218:13
#8 0x735d1c93bc4e in _elementtree_XMLParser__setevents /home/fuzz/WorkSpace/PyFuzz/cpython/./Modules/clinic/_elementtree.c.h:1329:20
#9 0x5efb2489c462 in _PyObject_VectorcallTstate /home/fuzz/WorkSpace/PyFuzz/cpython/./Include/internal/pycore_call.h:169:11
#10 0x5efb2489c462 in PyObject_Vectorcall /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/call.c:327:12
#11 0x5efb24b6a914 in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/PyFuzz/cpython/Python/generated_cases.c.h:1620:35
#12 0x5efb24b5afe4 in _PyEval_EvalFrame /home/fuzz/WorkSpace/PyFuzz/cpython/./Include/internal/pycore_ceval.h:121:16
#13 0x5efb24b5afe4 in _PyEval_Vector /home/fuzz/WorkSpace/PyFuzz/cpython/Python/ceval.c:1990:12
#14 0x5efb2489ad15 in _PyObject_VectorcallDictTstate /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/call.c:146:15
#15 0x5efb2489cf7e in _PyObject_Call_Prepend /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/call.c:504:24
#16 0x5efb249fbf90 in call_method /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/typeobject.c:3076:19
#17 0x5efb24a0d7ad in slot_tp_init /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/typeobject.c:10828:21
#18 0x5efb249e90d4 in type_call /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/typeobject.c:2460:19
#19 0x5efb2489b1c2 in _PyObject_MakeTpCall /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/call.c:242:18
#20 0x5efb24b721ff in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/PyFuzz/cpython/Python/generated_cases.c.h:2920:35
#21 0x5efb24b5a980 in _PyEval_EvalFrame /home/fuzz/WorkSpace/PyFuzz/cpython/./Include/internal/pycore_ceval.h:121:16
#22 0x5efb24b5a980 in _PyEval_Vector /home/fuzz/WorkSpace/PyFuzz/cpython/Python/ceval.c:1990:12
#23 0x5efb24b5a980 in PyEval_EvalCode /home/fuzz/WorkSpace/PyFuzz/cpython/Python/ceval.c:873:21
#24 0x5efb24d15ca8 in run_eval_code_obj /home/fuzz/WorkSpace/PyFuzz/cpython/Python/pythonrun.c:1365:12
#25 0x5efb24d15ca8 in run_mod /home/fuzz/WorkSpace/PyFuzz/cpython/Python/pythonrun.c:1459:19
#26 0x5efb24d0fd3f in pyrun_file /home/fuzz/WorkSpace/PyFuzz/cpython/Python/pythonrun.c:1293:15
#27 0x5efb24d0fd3f in _PyRun_SimpleFileObject /home/fuzz/WorkSpace/PyFuzz/cpython/Python/pythonrun.c:521:13
#28 0x5efb24d0f335 in _PyRun_AnyFileObject /home/fuzz/WorkSpace/PyFuzz/cpython/Python/pythonrun.c:81:15
#29 0x5efb24d7f5a5 in pymain_run_file_obj /home/fuzz/WorkSpace/PyFuzz/cpython/Modules/main.c:410:15
#30 0x5efb24d7f5a5 in pymain_run_file /home/fuzz/WorkSpace/PyFuzz/cpython/Modules/main.c:429:15
#31 0x5efb24d7df5b in pymain_run_python /home/fuzz/WorkSpace/PyFuzz/cpython/Modules/main.c:691:21
#32 0x5efb24d7df5b in Py_RunMain /home/fuzz/WorkSpace/PyFuzz/cpython/Modules/main.c:772:5
#33 0x5efb24d7ea1d in pymain_main /home/fuzz/WorkSpace/PyFuzz/cpython/Modules/main.c:802:12
#34 0x5efb24d7eb83 in Py_BytesMain /home/fuzz/WorkSpace/PyFuzz/cpython/Modules/main.c:826:12
#35 0x735d1ed861c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#36 0x735d1ed8628a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#37 0x5efb246c40f4 in _start (/home/fuzz/WorkSpace/PyFuzz/cpython/python+0x1cd0f4) (BuildId: 6eb748db4289186e9c2fb52e6d6b8534b12821c5)
0x502000005ef0 is located 0 bytes inside of 4-byte region [0x502000005ef0,0x502000005ef4)
freed by thread T0 here:
#0 0x5efb24763c8a in free (/home/fuzz/WorkSpace/PyFuzz/cpython/python+0x26cc8a) (BuildId: 6eb748db4289186e9c2fb52e6d6b8534b12821c5)
#1 0x5efb24a6ca25 in unicode_dealloc /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/unicodeobject.c:1782:9
#2 0x5efb24987e3f in _Py_Dealloc /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/object.c:3200:5
#3 0x5efb249114d3 in Py_DECREF /home/fuzz/WorkSpace/PyFuzz/cpython/./Include/refcount.h:418:9
#4 0x5efb249114d3 in Py_XDECREF /home/fuzz/WorkSpace/PyFuzz/cpython/./Include/refcount.h:511:9
#5 0x5efb249114d3 in list_dealloc /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/listobject.c:561:13
#6 0x5efb24987e3f in _Py_Dealloc /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/object.c:3200:5
#7 0x735d1c93bc1f in Py_DECREF /home/fuzz/WorkSpace/PyFuzz/cpython/./Include/refcount.h:418:9
#8 0x735d1c93bc1f in _elementtree_XMLParser__setevents_impl /home/fuzz/WorkSpace/PyFuzz/cpython/./Modules/_elementtree.c:4217:13
#9 0x735d1c93bc1f in _elementtree_XMLParser__setevents /home/fuzz/WorkSpace/PyFuzz/cpython/./Modules/clinic/_elementtree.c.h:1329:20
#10 0x5efb2489c462 in _PyObject_VectorcallTstate /home/fuzz/WorkSpace/PyFuzz/cpython/./Include/internal/pycore_call.h:169:11
#11 0x5efb2489c462 in PyObject_Vectorcall /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/call.c:327:12
#12 0x5efb24b6a914 in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/PyFuzz/cpython/Python/generated_cases.c.h:1620:35
#13 0x5efb24b5afe4 in _PyEval_EvalFrame /home/fuzz/WorkSpace/PyFuzz/cpython/./Include/internal/pycore_ceval.h:121:16
#14 0x5efb24b5afe4 in _PyEval_Vector /home/fuzz/WorkSpace/PyFuzz/cpython/Python/ceval.c:1990:12
#15 0x5efb2489ad15 in _PyObject_VectorcallDictTstate /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/call.c:146:15
#16 0x5efb2489cf7e in _PyObject_Call_Prepend /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/call.c:504:24
#17 0x5efb249fbf90 in call_method /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/typeobject.c:3076:19
#18 0x5efb24a0d7ad in slot_tp_init /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/typeobject.c:10828:21
#19 0x5efb249e90d4 in type_call /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/typeobject.c:2460:19
#20 0x5efb2489b1c2 in _PyObject_MakeTpCall /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/call.c:242:18
#21 0x5efb24b721ff in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/PyFuzz/cpython/Python/generated_cases.c.h:2920:35
#22 0x5efb24b5a980 in _PyEval_EvalFrame /home/fuzz/WorkSpace/PyFuzz/cpython/./Include/internal/pycore_ceval.h:121:16
#23 0x5efb24b5a980 in _PyEval_Vector /home/fuzz/WorkSpace/PyFuzz/cpython/Python/ceval.c:1990:12
#24 0x5efb24b5a980 in PyEval_EvalCode /home/fuzz/WorkSpace/PyFuzz/cpython/Python/ceval.c:873:21
#25 0x5efb24d15ca8 in run_eval_code_obj /home/fuzz/WorkSpace/PyFuzz/cpython/Python/pythonrun.c:1365:12
#26 0x5efb24d15ca8 in run_mod /home/fuzz/WorkSpace/PyFuzz/cpython/Python/pythonrun.c:1459:19
#27 0x5efb24d0fd3f in pyrun_file /home/fuzz/WorkSpace/PyFuzz/cpython/Python/pythonrun.c:1293:15
#28 0x5efb24d0fd3f in _PyRun_SimpleFileObject /home/fuzz/WorkSpace/PyFuzz/cpython/Python/pythonrun.c:521:13
#29 0x5efb24d0f335 in _PyRun_AnyFileObject /home/fuzz/WorkSpace/PyFuzz/cpython/Python/pythonrun.c:81:15
#30 0x5efb24d7f5a5 in pymain_run_file_obj /home/fuzz/WorkSpace/PyFuzz/cpython/Modules/main.c:410:15
#31 0x5efb24d7f5a5 in pymain_run_file /home/fuzz/WorkSpace/PyFuzz/cpython/Modules/main.c:429:15
#32 0x5efb24d7df5b in pymain_run_python /home/fuzz/WorkSpace/PyFuzz/cpython/Modules/main.c:691:21
#33 0x5efb24d7df5b in Py_RunMain /home/fuzz/WorkSpace/PyFuzz/cpython/Modules/main.c:772:5
#34 0x5efb24d7ea1d in pymain_main /home/fuzz/WorkSpace/PyFuzz/cpython/Modules/main.c:802:12
#35 0x5efb24d7eb83 in Py_BytesMain /home/fuzz/WorkSpace/PyFuzz/cpython/Modules/main.c:826:12
#36 0x735d1ed861c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#37 0x735d1ed8628a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#38 0x5efb246c40f4 in _start (/home/fuzz/WorkSpace/PyFuzz/cpython/python+0x1cd0f4) (BuildId: 6eb748db4289186e9c2fb52e6d6b8534b12821c5)
previously allocated by thread T0 here:
#0 0x5efb24763f23 in malloc (/home/fuzz/WorkSpace/PyFuzz/cpython/python+0x26cf23) (BuildId: 6eb748db4289186e9c2fb52e6d6b8534b12821c5)
#1 0x5efb24a3c108 in unicode_fill_utf8 /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/unicodeobject.c:5904:19
#2 0x5efb24a3c108 in unicode_ensure_utf8 /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/unicodeobject.c:4225:19
#3 0x5efb24a3c108 in PyUnicode_AsUTF8AndSize /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/unicodeobject.c:4243:9
#4 0x735d1c93b2e7 in _elementtree_XMLParser__setevents_impl /home/fuzz/WorkSpace/PyFuzz/cpython/./Modules/_elementtree.c:4176:26
#5 0x735d1c93b2e7 in _elementtree_XMLParser__setevents /home/fuzz/WorkSpace/PyFuzz/cpython/./Modules/clinic/_elementtree.c.h:1329:20
#6 0x5efb2489c462 in _PyObject_VectorcallTstate /home/fuzz/WorkSpace/PyFuzz/cpython/./Include/internal/pycore_call.h:169:11
#7 0x5efb2489c462 in PyObject_Vectorcall /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/call.c:327:12
#8 0x5efb24b6a914 in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/PyFuzz/cpython/Python/generated_cases.c.h:1620:35
#9 0x5efb24b5afe4 in _PyEval_EvalFrame /home/fuzz/WorkSpace/PyFuzz/cpython/./Include/internal/pycore_ceval.h:121:16
#10 0x5efb24b5afe4 in _PyEval_Vector /home/fuzz/WorkSpace/PyFuzz/cpython/Python/ceval.c:1990:12
#11 0x5efb2489ad15 in _PyObject_VectorcallDictTstate /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/call.c:146:15
#12 0x5efb2489cf7e in _PyObject_Call_Prepend /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/call.c:504:24
#13 0x5efb249fbf90 in call_method /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/typeobject.c:3076:19
#14 0x5efb24a0d7ad in slot_tp_init /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/typeobject.c:10828:21
#15 0x5efb249e90d4 in type_call /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/typeobject.c:2460:19
#16 0x5efb2489b1c2 in _PyObject_MakeTpCall /home/fuzz/WorkSpace/PyFuzz/cpython/Objects/call.c:242:18
#17 0x5efb24b721ff in _PyEval_EvalFrameDefault /home/fuzz/WorkSpace/PyFuzz/cpython/Python/generated_cases.c.h:2920:35
#18 0x5efb24b5a980 in _PyEval_EvalFrame /home/fuzz/WorkSpace/PyFuzz/cpython/./Include/internal/pycore_ceval.h:121:16
#19 0x5efb24b5a980 in _PyEval_Vector /home/fuzz/WorkSpace/PyFuzz/cpython/Python/ceval.c:1990:12
#20 0x5efb24b5a980 in PyEval_EvalCode /home/fuzz/WorkSpace/PyFuzz/cpython/Python/ceval.c:873:21
#21 0x5efb24d15ca8 in run_eval_code_obj /home/fuzz/WorkSpace/PyFuzz/cpython/Python/pythonrun.c:1365:12
#22 0x5efb24d15ca8 in run_mod /home/fuzz/WorkSpace/PyFuzz/cpython/Python/pythonrun.c:1459:19
#23 0x5efb24d0fd3f in pyrun_file /home/fuzz/WorkSpace/PyFuzz/cpython/Python/pythonrun.c:1293:15
#24 0x5efb24d0fd3f in _PyRun_SimpleFileObject /home/fuzz/WorkSpace/PyFuzz/cpython/Python/pythonrun.c:521:13
#25 0x5efb24d0f335 in _PyRun_AnyFileObject /home/fuzz/WorkSpace/PyFuzz/cpython/Python/pythonrun.c:81:15
#26 0x5efb24d7f5a5 in pymain_run_file_obj /home/fuzz/WorkSpace/PyFuzz/cpython/Modules/main.c:410:15
#27 0x5efb24d7f5a5 in pymain_run_file /home/fuzz/WorkSpace/PyFuzz/cpython/Modules/main.c:429:15
#28 0x5efb24d7df5b in pymain_run_python /home/fuzz/WorkSpace/PyFuzz/cpython/Modules/main.c:691:21
#29 0x5efb24d7df5b in Py_RunMain /home/fuzz/WorkSpace/PyFuzz/cpython/Modules/main.c:772:5
#30 0x5efb24d7ea1d in pymain_main /home/fuzz/WorkSpace/PyFuzz/cpython/Modules/main.c:802:12
#31 0x5efb24d7eb83 in Py_BytesMain /home/fuzz/WorkSpace/PyFuzz/cpython/Modules/main.c:826:12
#32 0x735d1ed861c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#33 0x735d1ed8628a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
#34 0x5efb246c40f4 in _start (/home/fuzz/WorkSpace/PyFuzz/cpython/python+0x1cd0f4) (BuildId: 6eb748db4289186e9c2fb52e6d6b8534b12821c5)
SUMMARY: AddressSanitizer: heap-use-after-free (/home/fuzz/WorkSpace/PyFuzz/cpython/python+0x1e4fe6) (BuildId: 6eb748db4289186e9c2fb52e6d6b8534b12821c5) in strlen
Shadow bytes around the buggy address:
0x502000005c00: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x502000005c80: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa
0x502000005d00: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fa
0x502000005d80: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa
0x502000005e00: fa fa fd fa fa fa 00 03 fa fa fd fd fa fa fd fa
=>0x502000005e80: fa fa fd fd fa fa 00 fa fa fa fd fd fa fa[fd]fa
0x502000005f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x502000005f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x502000006000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x502000006080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x502000006100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==1106491==ABORTING
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
Linux
<!-- gh-linked-prs -->
### Linked PRs
* gh-139211
* gh-139455
* gh-139456
* gh-139469
* gh-139470
<!-- /gh-linked-prs -->
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.
#114106
segfault when compiling gc referrers referents with frozenset
cpython
?
2024-01-16
# segfault when compiling gc referrers referents with frozenset
**Issue:** [https://github.com/python/cpython/issues/114106](https://github.com/python/cpython/issues/114106) · **State:** `closed` · **Created:** `2024-01-16T10:10:30Z`
**Labels:** `type-crash`
## Description
# Crash report
### What happened?
PoC:
```python
xxx = """
import gc
class Cls:
var = []
gc_get_referrers_list=gc.get_referrers(Cls.var)
for ref in gc_get_referrers_list:
del ref['var']
gc_collect_arg0=2
gc.collect(gc_collect_arg0)
gc_get_referents_arg0=frozenset({"a", "b", "c"})
gc_get_referents_list=gc.get_referents(gc_get_referents_arg0)
gc_get_referrers_list=gc.get_referrers(Cls.var)
"""
x = compile(xxx, "test", "exec")
exec(x)
```
It might be related to #113631 but here it throws tuple error:
```
../Include/object.h:1023: _Py_NegativeRefcount: Assertion failed: object has negative ref count
Enable tracemalloc to get the memory block allocation traceback
object address : 0x10553d4a0
object refcount : 0
object type : 0x104fd1aa0
object type name: tuple
object repr : <refcnt 0 at 0x10553d4a0>
Fatal Python error: _PyObject_AssertFailed: _PyObject_AssertFailed
Python runtime state: initialized
```
Running the program directly does not throw error:
```
import gc
class Cls:
var = []
gc_get_referrers_list=gc.get_referrers(Cls.var)
for ref in gc_get_referrers_list:
del ref['var']
gc_collect_arg0=2
gc.collect(gc_collect_arg0)
gc_get_referents_arg0=frozenset({"a", "b", "c"})
gc_get_referents_list=gc.get_referents(gc_get_referents_arg0)
gc_get_referrers_list=gc.get_referrers(Cls.var)
```
### CPython versions tested on:
CPython main branch
### Operating systems tested on:
macOS
### Output from running 'python -VV' on the command line:
Python 3.13.0a2+ (heads/main-dirty:42b90cf0d6, Jan 16 2024, 11:20:02) [Clang 14.0.0 (clang-1400.0.29.202)]
---
### Parents
| Label | ID | Source |
|-------|----|--------|
| `a` | `` | `` |
| `b` | `` | `` |
*Program: (to be filled)*No output captured.
No parent information recorded.