maxjhandsome
/
llvm-project
forked from OSchip/llvm-project
1
0
Fork 0
Code Issues Pull Requests Packages Releases Wiki Activity

[mlir] Fix undefined behavior in Linalg utils getViewSizes 

The utility function getViewSizes in Linalg has been recently updated to
support a different form of Linalg operations. In doing so, the code looking
like `smallvector.push_back(smallvector[i])` was introduced. Unlike std
vectors, this can lead to undefined behavior if the vector must grow upon
insertion: `smallvector[i]` returns a reference to the element, `push_back`
takes a const reference to the element, and then grows the vector storage
before accessing the referenced value. After the resize, the reference may
become dangling, which leads to undefined behavior detected by ASAN as
use-after-free. Work around the issue by forcing the value to be copied by
putting it into a temporary variable.
This commit is contained in:
Alex Zinenko 2020-07-21 09:53:28 +02:00
parent 05d3160c9c
commit aa84e6e579
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
mlir/include/mlir/Dialect/Linalg/Utils/Utils.h
View File

@ -119,9 +119,12 @@ SmallVector<Value, 8> getViewSizes(OpBuilder &builder, ConcreteOp linalgOp) {
// Append or rewrite the end of the value list that corresponds to the
// values mapping to symbols. Since inside concatinated map symbols are
// repeated we have to repeat the sizes as well.
for (unsigned idx = 0, s = ranks.size(); idx < s; ++idx)
for (unsigned idx2 = 0; idx2 < numSymb; ++idx2)
res.push_back(res[symbolsPos + idx2]);
for (unsigned idx = 0, s = ranks.size(); idx < s; ++idx) {
for (unsigned idx2 = 0; idx2 < numSymb; ++idx2) {
Value viewSize = res[symbolsPos + idx2];
res.push_back(viewSize);
}
}
}
return res;
}