FlattenMemRefPass crashes on memref.global #9258
Description
FlattenMemRefPass crashes deterministically on valid MLIR containing a memref.global without a constant dense initializer. The crash occurs both inside hlstool and when running the pass directly via circt-opt, so the issue is isolated to the pass itself.
Reproducer: pass_pipeline.mlir. It is too big to attach.
circt-opt --version
LLVM (http://llvm.org/):
LLVM version 22.0.0git
Optimized build with assertions.
CIRCT firtool-1.137.0g20251123_7fbb972
circt-opt pass_pipeline.mlir --flatten-memref -o /dev/null
PLEASE submit a bug report to https://github.com/llvm/circt and include the crash backtrace.
Stack dump:
0. Program arguments: /home/roland/circt-nix/result/bin/circt-opt pass_pipeline.mlir --flatten-memref -o /dev/null
#0 0x000056297990008b llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/roland/circt-nix/result/bin/circt-opt+0x11f408b)
#1 0x00005629798fccba SignalHandler(int, siginfo_t*, void*) (/home/roland/circt-nix/result/bin/circt-opt+0x11f0cba)
#2 0x00007fd8288769c0 __restore_rt (/nix/store/daamdpmaz2vjvna55ccrc30qw3qb8h6d-glibc-2.40-66/lib/libc.so.6+0x419c0)
#3 0x000056297b624a4c mlir::DenseElementsAttr::getNumElements() const (/home/roland/circt-nix/result/bin/circt-opt+0x2f18a4c)
#4 0x000056297b585919 (anonymous namespace)::GlobalOpConversion::matchAndRewrite(mlir::memref::GlobalOp, mlir::memref::GlobalOpAdaptor, mlir::ConversionPatternRewriter&) const (/home/roland/circt-nix/result/bin/circt-opt+0x2e79919)
#5 0x000056297b57f434 mlir::OpConversionPatternmlir::memref::GlobalOp::matchAndRewrite(mlir::Operation*, llvm::ArrayRefmlir::ValueRange, mlir::ConversionPatternRewriter&) const (/home/roland/circt-nix/result/bin/circt-opt+0x2e73434)
#6 0x000056297c426bfe mlir::ConversionPattern::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&) const (/home/roland/circt-nix/result/bin/circt-opt+0x3d1abfe)
#7 0x000056297c47d50c mlir::PatternApplicator::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&, llvm::function_ref<bool (mlir::Pattern const&)>, llvm::function_ref<void (mlir::Pattern const&)>, llvm::function_ref<llvm::LogicalResult (mlir::Pattern const&)>)::'lambda'()::operator()() const (/home/roland/circt-nix/result/bin/circt-opt+0x3d7150c)
#8 0x000056297c47eaf1 mlir::PatternApplicator::matchAndRewrite(mlir::Operation*, mlir::PatternRewriter&, llvm::function_ref<bool (mlir::Pattern const&)>, llvm::function_ref<void (mlir::Pattern const&)>, llvm::function_ref<llvm::LogicalResult (mlir::Pattern const&)>) (/home/roland/circt-nix/result/bin/circt-opt+0x3d72af1)
#9 0x000056297c42cb5e (anonymous namespace)::OperationLegalizer::legalize(mlir::Operation*) (/home/roland/circt-nix/result/bin/circt-opt+0x3d20b5e)
#10 0x000056297c42e413 mlir::OperationConverter::convert(mlir::Operation*, bool) (/home/roland/circt-nix/result/bin/circt-opt+0x3d22413)
#11 0x000056297c42e8aa mlir::OperationConverter::convertOperations(llvm::ArrayRefmlir::Operation*) (/home/roland/circt-nix/result/bin/circt-opt+0x3d228aa)
#12 0x000056297c437854 applyConversion(llvm::ArrayRefmlir::Operation*, mlir::ConversionTarget const&, mlir::FrozenRewritePatternSet const&, mlir::ConversionConfig, (anonymous namespace)::OpConversionMode) (/home/roland/circt-nix/result/bin/circt-opt+0x3d2b854)
#13 0x000056297c4379ff mlir::applyPartialConversion(mlir::Operation*, mlir::ConversionTarget const&, mlir::FrozenRewritePatternSet const&, mlir::ConversionConfig) (/home/roland/circt-nix/result/bin/circt-opt+0x3d2b9ff)
#14 0x000056297b584711 (anonymous namespace)::FlattenMemRefPass::runOnOperation() (/home/roland/circt-nix/result/bin/circt-opt+0x2e78711)
#15 0x000056297c5c3948 mlir::detail::OpToOpPassAdaptor::run(mlir::Pass*, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int) (/home/roland/circt-nix/result/bin/circt-opt+0x3eb7948)
#16 0x000056297c5c3efb mlir::detail::OpToOpPassAdaptor::runPipeline(mlir::OpPassManager&, mlir::Operation*, mlir::AnalysisManager, bool, unsigned int, mlir::PassInstrumentor*, mlir::PassInstrumentation::PipelineParentInfo const*) (/home/roland/circt-nix/result/bin/circt-opt+0x3eb7efb)
#17 0x000056297c5c46bd mlir::PassManager::runPasses(mlir::Operation*, mlir::AnalysisManager) (/home/roland/circt-nix/result/bin/circt-opt+0x3eb86bd)
#18 0x000056297c5c5ab5 mlir::PassManager::run(mlir::Operation*) (/home/roland/circt-nix/result/bin/circt-opt+0x3eb9ab5)
#19 0x000056297bc8a3cd performActions(llvm::raw_ostream&, std::shared_ptrllvm::SourceMgr const&, mlir::MLIRContext*, mlir::MlirOptMainConfig const&) (/home/roland/circt-nix/result/bin/circt-opt+0x357e3cd)
#20 0x000056297bc8b42c llvm::LogicalResult llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_deletellvm::MemoryBuffer >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>::callback_fn<mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_deletellvm::MemoryBuffer >, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&)::'lambda'(std::unique_ptr<llvm::MemoryBuffer, std::default_deletellvm::MemoryBuffer >, llvm::MemoryBufferRef, llvm::raw_ostream&)>(long, std::unique_ptr<llvm::MemoryBuffer, std::default_deletellvm::MemoryBuffer >, llvm::MemoryBufferRef const&, llvm::raw_ostream&) (/home/roland/circt-nix/result/bin/circt-opt+0x357f42c)
#21 0x000056297bcc4585 mlir::splitAndProcessBuffer(std::unique_ptr<llvm::MemoryBuffer, std::default_deletellvm::MemoryBuffer >, llvm::function_ref<llvm::LogicalResult (std::unique_ptr<llvm::MemoryBuffer, std::default_deletellvm::MemoryBuffer >, llvm::MemoryBufferRef const&, llvm::raw_ostream&)>, llvm::raw_ostream&, llvm::StringRef, llvm::StringRef) (/home/roland/circt-nix/result/bin/circt-opt+0x35b8585)
#22 0x000056297bc82891 mlir::MlirOptMain(llvm::raw_ostream&, std::unique_ptr<llvm::MemoryBuffer, std::default_deletellvm::MemoryBuffer >, mlir::DialectRegistry&, mlir::MlirOptMainConfig const&) (.part.0) (/home/roland/circt-nix/result/bin/circt-opt+0x3576891)
#23 0x000056297bc8bb04 mlir::MlirOptMain(int, char**, llvm::StringRef, llvm::StringRef, mlir::DialectRegistry&) (/home/roland/circt-nix/result/bin/circt-opt+0x357fb04)
#24 0x000056297bc8bd55 mlir::MlirOptMain(int, char**, llvm::StringRef, mlir::DialectRegistry&) (/home/roland/circt-nix/result/bin/circt-opt+0x357fd55)
#25 0x0000562979852c1c main (/home/roland/circt-nix/result/bin/circt-opt+0x1146c1c)
#26 0x00007fd82885f4d8 __libc_start_call_main (/nix/store/daamdpmaz2vjvna55ccrc30qw3qb8h6d-glibc-2.40-66/lib/libc.so.6+0x2a4d8)
#27 0x00007fd82885f59b __libc_start_main@GLIBC_2.2.5 (/nix/store/daamdpmaz2vjvna55ccrc30qw3qb8h6d-glibc-2.40-66/lib/libc.so.6+0x2a59b)
#28 0x0000562979857aa5 _start (/home/roland/circt-nix/result/bin/circt-opt+0x114baa5)
Segmentation fault (core dumped)