Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[mlir] Fix use-after-free bugs in {RankedTensorType|VectorType}::Builder #68969

Merged
merged 6 commits into from
Oct 18, 2023

Commits on Oct 13, 2023

  1. [mlir] Fix use-after-free bugs in {RankedTensorType|VectorType}::Builder

    Previously, these would set their ArrayRef members to reference their
    storage SmallVectors after a copy-on-write operation. This leads to a
    use-after-free if the builder is copied and the original destroyed (as
    the new builder would still reference the old SmallVector).
    
    The VectorType::Builder also set the ArrayRef<bool> scalableDims member
    to a temporary SmallVector when the provided scalableDims are empty.
    This again lead to a use-after-free, and is unnecessary as
    VectorType::get already handles being passed an empty scalableDims
    array.
    
    These bugs were in-part caught by UBSAN, see:
    https://lab.llvm.org/buildbot/#/builders/5/builds/37355
    MacDue committed Oct 13, 2023
    Configuration menu
    Copy the full SHA
    081be10 View commit details
    Browse the repository at this point in the history

Commits on Oct 16, 2023

  1. Configuration menu
    Copy the full SHA
    1ef6ebb View commit details
    Browse the repository at this point in the history
  2. Add a few more tests

    MacDue committed Oct 16, 2023
    Configuration menu
    Copy the full SHA
    6a462fd View commit details
    Browse the repository at this point in the history
  3. Fix some unsafe std::initializer_list list usages in tests

    Easy to mess up 🤦
    MacDue committed Oct 16, 2023
    Configuration menu
    Copy the full SHA
    1fb8e9a View commit details
    Browse the repository at this point in the history

Commits on Oct 17, 2023

  1. Move builder COW pattern to safe CopyOnWriteArrayRef<T> class.

    This is a safer helper class that avoids the issues with the previous
    manual approaches. It also cleans up the builder implementations.
    MacDue committed Oct 17, 2023
    Configuration menu
    Copy the full SHA
    e7ca4a9 View commit details
    Browse the repository at this point in the history

Commits on Oct 18, 2023

  1. Move CopyOnWriteArrayRef to mlir/Support/ADTExtras.h

    + Some minor tweaks
    MacDue committed Oct 18, 2023
    Configuration menu
    Copy the full SHA
    1e6248d View commit details
    Browse the repository at this point in the history