[mlir][TilingInterface] Fix use after free error from D141028.

The `candidateSliceOp` was replaces and used in a subsequent
call. Instead just replace its uses. The op is dead and will be
removed with CSE.

Differential Revision: https://reviews.llvm.org/D141869

diff --git a/mlir/include/mlir/Dialect/SCF/Transforms/TileUsingInterface.h b/mlir/include/mlir/Dialect/SCF/Transforms/TileUsingInterface.h
index 63d3da7..1ed850f 100644 (file)
--- a/mlir/include/mlir/Dialect/SCF/Transforms/TileUsingInterface.h
+++ b/mlir/include/mlir/Dialect/SCF/Transforms/TileUsingInterface.h
@@ -90,7 +90,9 @@ struct SCFTileAndFuseOptions {
 };
 
 /// Fuse the producer of the source of `candidateSliceOp` by computing the
-/// required slice of the producer in-place.
+/// required slice of the producer in-place.  Note that the method
+/// replaces the uses of `candidateSliceOp` with the tiled and fused producer
+/// value but does not delete the slice operation.
 struct SCFFuseProducerOfSliceResult {
   OpResult origProducer;       // Original untiled producer.
   Value tiledAndFusedProducer; // Tile and fused producer value.

diff --git a/mlir/lib/Dialect/SCF/Transforms/TileUsingInterface.cpp b/mlir/lib/Dialect/SCF/Transforms/TileUsingInterface.cpp
index 0c3da3b..cfaac28 100644 (file)
--- a/mlir/lib/Dialect/SCF/Transforms/TileUsingInterface.cpp
+++ b/mlir/lib/Dialect/SCF/Transforms/TileUsingInterface.cpp
@@ -527,7 +527,7 @@ mlir::scf::tileAndFuseProducerOfSlice(RewriterBase &rewriter,
                                                    fusableProducer);
   if (failed(fusedProducerValue))
     return std::nullopt;
-  rewriter.replaceOp(candidateSliceOp, fusedProducerValue.value());
+  rewriter.replaceAllUsesWith(candidateSliceOp, fusedProducerValue.value());
 
   // 3. If the slice is for a destination operand, for example,
   //