[MLIR][Vector] Fix crash in foldDenseElementsAttrDestInsertOp on poison index#188508
Merged
Conversation
…on index When a dynamic index of -1 (the kPoisonIndex sentinel) was folded into the static position of a vector.insert op, foldDenseElementsAttrDestInsertOp would proceed to call calculateInsertPosition, which returned -1. The subsequent iterator arithmetic (allValues.begin() + (-1)) was undefined behaviour, causing an assertion in DenseElementsAttr::get. Fix by bailing out early in foldDenseElementsAttrDestInsertOp when any static position equals kPoisonIndex, consistent with how InsertChainFullyInitialized already guards this case. Fixes llvm#188404 Assisted-by: Claude Code
Member
|
@llvm/pr-subscribers-mlir-vector @llvm/pr-subscribers-mlir Author: Mehdi Amini (joker-eph) ChangesWhen a dynamic index of -1 (the kPoisonIndex sentinel) was folded into the static position of a vector.insert op, foldDenseElementsAttrDestInsertOp would proceed to call calculateInsertPosition, which returned -1. The subsequent iterator arithmetic (allValues.begin() + (-1)) was undefined behaviour, causing an assertion in DenseElementsAttr::get. Fix by bailing out early in foldDenseElementsAttrDestInsertOp when any static position equals kPoisonIndex, consistent with how InsertChainFullyInitialized already guards this case. Fixes #188404 Assisted-by: Claude Code Full diff: https://github.com/llvm/llvm-project/pull/188508.diff 2 Files Affected:
diff --git a/mlir/lib/Dialect/Vector/IR/VectorOps.cpp b/mlir/lib/Dialect/Vector/IR/VectorOps.cpp
index 73632875ca9e2..5c8c2417bfaa6 100644
--- a/mlir/lib/Dialect/Vector/IR/VectorOps.cpp
+++ b/mlir/lib/Dialect/Vector/IR/VectorOps.cpp
@@ -3763,6 +3763,11 @@ foldDenseElementsAttrDestInsertOp(InsertOp insertOp, Attribute srcAttr,
!insertOp->hasOneUse())
return {};
+ // Bail out on poison indices (kPoisonIndex = -1) to avoid computing an
+ // invalid (negative) linearized position which would cause UB below.
+ if (is_contained(insertOp.getStaticPosition(), InsertOp::kPoisonIndex))
+ return {};
+
// Calculate the linearized position for inserting elements.
int64_t insertBeginPosition =
calculateInsertPosition(destTy, insertOp.getStaticPosition());
diff --git a/mlir/test/Dialect/Vector/canonicalize.mlir b/mlir/test/Dialect/Vector/canonicalize.mlir
index e2045fc526ec1..341f044b5112f 100644
--- a/mlir/test/Dialect/Vector/canonicalize.mlir
+++ b/mlir/test/Dialect/Vector/canonicalize.mlir
@@ -3807,6 +3807,25 @@ func.func @insert_vector_poison_idx_non_cst(%a: vector<4x5xf32>, %b: vector<5xf3
// -----
+// Similar to the test above, but now the destination is a dense constant.
+// foldDenseElementsAttrDestInsertOp must not crash when the dynamic index
+// constant is -1 (the poison sentinel). Instead it should fold to ub.poison.
+// Regression test for https://github.com/llvm/llvm-project/issues/188404
+
+// CHECK-LABEL: @insert_scalar_poison_idx_dense_dest
+func.func @insert_scalar_poison_idx_dense_dest() -> vector<2xf16> {
+ // CHECK-NEXT: %[[UB:.*]] = ub.poison : vector<2xf16>
+ // CHECK-NOT: vector.insert
+ // CHECK-NEXT: return %[[UB]] : vector<2xf16>
+ %cst = arith.constant dense<0.0> : vector<2xf16>
+ %idx = arith.constant -1 : index
+ %val = arith.constant 2.5 : f16
+ %0 = vector.insert %val, %cst [%idx] : f16 into vector<2xf16>
+ return %0 : vector<2xf16>
+}
+
+// -----
+
// Similar to test above, but now the index is out-of-bounds.
// CHECK-LABEL: @no_fold_insert_scalar_idx_oob
|
banach-space
approved these changes
Mar 27, 2026
banach-space
left a comment
Contributor
There was a problem hiding this comment.
Thank you, LGTM % optional nit
Co-authored-by: Andrzej Warzyński <andrzej.warzynski@gmail.com>
Aadarsh-Keshri
pushed a commit
to Aadarsh-Keshri/llvm-project
that referenced
this pull request
Mar 28, 2026
…on index (llvm#188508) When a dynamic index of -1 (the kPoisonIndex sentinel) was folded into the static position of a vector.insert op, foldDenseElementsAttrDestInsertOp would proceed to call calculateInsertPosition, which returned -1. The subsequent iterator arithmetic (allValues.begin() + (-1)) was undefined behaviour, causing an assertion in DenseElementsAttr::get. Fix by bailing out early in foldDenseElementsAttrDestInsertOp when any static position equals kPoisonIndex, consistent with how InsertChainFullyInitialized already guards this case. Fixes llvm#188404 Assisted-by: Claude Code
fzou1
pushed a commit
to fzou1/llvm-project
that referenced
this pull request
Mar 30, 2026
…on index (llvm#188508) When a dynamic index of -1 (the kPoisonIndex sentinel) was folded into the static position of a vector.insert op, foldDenseElementsAttrDestInsertOp would proceed to call calculateInsertPosition, which returned -1. The subsequent iterator arithmetic (allValues.begin() + (-1)) was undefined behaviour, causing an assertion in DenseElementsAttr::get. Fix by bailing out early in foldDenseElementsAttrDestInsertOp when any static position equals kPoisonIndex, consistent with how InsertChainFullyInitialized already guards this case. Fixes llvm#188404 Assisted-by: Claude Code
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When a dynamic index of -1 (the kPoisonIndex sentinel) was folded into the static position of a vector.insert op, foldDenseElementsAttrDestInsertOp would proceed to call calculateInsertPosition, which returned -1. The subsequent iterator arithmetic (allValues.begin() + (-1)) was undefined behaviour, causing an assertion in DenseElementsAttr::get.
Fix by bailing out early in foldDenseElementsAttrDestInsertOp when any static position equals kPoisonIndex, consistent with how InsertChainFullyInitialized already guards this case.
Fixes #188404
Assisted-by: Claude Code