isl crash: segmentation fault

[Michael Kruse]

Hi,

this is a report derived from a crash in Polly:
https://github.com/llvm/llvm-project/issues/187216

$ gcc isltrace.c -I ~/src/isl/include/ ~/src/isl/.libs/libisl.a -lgmp
-o isltrace && ./isltrace
### ISL version : isl-0.27-86-gcf471c16-GMP
### at generation: isl-0.27-86-gcf471c16-IMath-32
Crash expected here:
Segmentation fault (core dumped)

gdb stack trace:

#0 0x00000000084ce14b in isl_tab_extend_cons (tab=0x936c670,
n_new=n_new@entry=2) at isl_tab.c:117
#1 0x00000000084db4ba in context_gbr_add_eq (context=0x936dfb0,
eq=0x8fddf20, check=1, update=1) at isl_tab_pip.c:3159
#2 0x00000000084deb3f in sol_context_add_eq (check=1, update=1,
eq=<optimized out>, sol=0x8904e30) at isl_tab_pip.c:225
#3 find_solutions_main (tab=0x90b4cf0, sol=0x8904e30) at isl_tab_pip.c:4309
#4 basic_map_partial_lexopt_base_sol (bmap=bmap@entry=0x906c140,
dom=<optimized out>, dom@entry=0x8fdd090,
empty=empty@entry=0x7ffffff1dfe0, max=max@entry=1,
init=init@entry=0x84dcc60 <sol_pma_init>) at isl_tab_pip.c:4588
#5 0x00000000084df969 in basic_map_partial_lexopt_base_pw_multi_aff
(max=1, empty=0x7ffffff1dfe0, dom=0x8fdd090, bmap=0x906c140) at
isl_tab_pip.c:5928
#6 basic_map_partial_lexopt_pw_multi_aff (bmap=0x906c140,
dom=dom@entry=0x8fdd090, empty=empty@entry=0x7ffffff1dfe0,
max=max@entry=1) at
/home/meinersbur/src/isl/isl_tab_lexopt_templ.c:217
#7 0x00000000084e04c7 in
basic_map_partial_lexopt_intersected_pw_multi_aff (bmap=<optimized
out>, dom=0x8fdd090, empty=0x7ffffff1dfe0, flags=<optimized out>) at
/home/meinersbur/src/isl/isl_tab_lexopt_templ.c:286
#8 0x00000000084e13e6 in
isl_tab_basic_map_partial_lexopt_pw_multi_aff (bmap=<optimized out>,
dom=<optimized out>, empty=empty@entry=0x7ffffff1dfe0,
flags=flags@entry=1) at
/home/meinersbur/src/isl/isl_tab_lexopt_templ.c:312
#9 0x000000000843c203 in isl_basic_map_partial_lexopt_pw_multi_aff
(flags=1, empty=0x7ffffff1dfe0, dom=<optimized out>, bmap=<optimized
out>) at /home/meinersbur/src/isl/isl_map_lexopt_templ.c:35
#10 basic_map_partial_lexopt_pw_multi_aff (bmap=0x8ec1cd0,
dom=0x8e928a0, empty=0x7ffffff1dfe0, flags=1) at
/home/meinersbur/src/isl/isl_map_lexopt_templ.c:120
#11 0x000000000843ce33 in isl_map_partial_lexopt_aligned_pw_multi_aff
(flags=1, empty=0x7ffffff1dfe0, dom=0x90725a0, map=0x9071460) at
isl_map.c:1476
#12 isl_map_partial_lexopt_aligned (map=0x9071460, dom=0x90725a0,
empty=0x7ffffff1dfe0, flags=1) at isl_map.c:7979
#13 0x00000000083fb4b0 in last_source (acc=acc@entry=0x8ec24e0,
set_C=set_C@entry=0x90725a0, j=j@entry=10, level=level@entry=1,
empty=empty@entry=0x7ffffff1dfe0) at isl_flow.c:652
#14 0x00000000083fc0a9 in compute_val_based_dependences
(acc=0x8ed87e0) at isl_flow.c:1206
#15 access_info_compute_flow_core (acc=acc@entry=0x8ec24e0) at isl_flow.c:1340
#16 0x00000000083ff1cb in compute_single_flow (data=0x7ffffff1e080,
sink=<optimized out>, uf=<optimized out>) at isl_flow.c:3090
#17 compute_flow_schedule (access=0x9123040) at isl_flow.c:3174
#18 isl_union_access_info_compute_flow (access=0x9123040) at isl_flow.c:3225
#19 0x00000000083003d2 in main () at isltrace.c:149905


I think this is due to the max-operations counter exceeding at a point
where a check for a NULL result is missing. I do not have a reduction
strategy for this kind of error yet. Any removal of calls to isl will
change the operations counter where the crash should happen. So please
excuse the very large trace file.

Michael

--
Tardyzentrismus verboten!