`ReduceOp` crashes during verification of the following op:
```mlir
module {
  func.func @main(%arg0: tensor<32xi32>, %arg1: tensor<32xi32>) -> i32 {
      %c0_i32 = arith.constant 0 : i32
      %from_elements = tensor.from_elements %c0_i32 : tensor<i32>
      %reduced = linalg.reduce ins(%arg0, %arg1 : tensor<32xi32>, tensor<32xi32>) outs(%from_elements : tensor<i32>) dimensions = [0] 
        (%in0: i32, %in1: i32, %init: i32) {
          %44 = arith.muli %in0, %in1 : i32
          %5 = arith.addi %44, %init : i32
          linalg.yield %5 : i32
        }
      %ext = tensor.extract %reduced[] : tensor<i32>
      return %ext: i32
  }
}
```
This is at line 1656 here:
https://github.com/llvm/llvm-project/blob/fb87e11e7253656ffe99726f45b679e08343bd5f/mlir/lib/Dialect/Linalg/IR/LinalgOps.cpp#L1652-L1658

It appears the ODS-generated code for getInputs assumes that the variadic operands (inputs and inits here) are the same sizes. When computing the size of the variadic operand, it foordivs 3 by 2 and returns a range with 1 element. On the other hand the code in [here](https://github.com/llvm/llvm-project/blob/c5e417a812d86226b087346cadb05d3aae9fe1d0/mlir/include/mlir/Interfaces/DestinationStyleOpInterface.td#L85-L89) is correct and returns an input count of 2, and an operand range with the two inputs. That's why here we enter the loop, but `getInputs()[1]` crashes.

One fix for the crash would be to use `getDpsInputs` instead of `getInputs` in the verifier. But this should ideally be patched in ODS I suppose. Thanks for reading.


---
Stack trace

```
cinm-opt: /home/clem/Documents/LLVM/llvm-18.1.6/llvm/include/llvm/ADT/STLExtras.h:1281: ReferenceT llvm::detail::indexed_accessor_range_base<mlir::OperandRange, mlir::OpOperand *, mlir::Value, mlir::Value, mlir::Value>::operator[](size_t) const [DerivedT = mlir::OperandRange, BaseT = mlir::OpOperand *, T = mlir::Value, PointerT = mlir::Value, ReferenceT = mlir::Value]: Assertion `Index < size() && "invalid index for value range"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: cinm-opt sandbox/matmul_tiled.mlir
 #0 0x000055eadabe7a4d llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /home/clem/Documents/LLVM/llvm-18.1.6/llvm/lib/Support/Unix/Signals.inc:723:11
 #1 0x000055eadabe803b PrintStackTraceSignalHandler(void*) /home/clem/Documents/LLVM/llvm-18.1.6/llvm/lib/Support/Unix/Signals.inc:798:1
 #2 0x000055eadabe5ce3 llvm::sys::RunSignalHandlers() /home/clem/Documents/LLVM/llvm-18.1.6/llvm/lib/Support/Signals.cpp:105:5
 #3 0x000055eadabe8801 SignalHandler(int) /home/clem/Documents/LLVM/llvm-18.1.6/llvm/lib/Support/Unix/Signals.inc:413:1
 #4 0x00007f5e4b450ae0 (/usr/lib/libc.so.6+0x3cae0)
 #5 0x00007f5e4b4a8e44 (/usr/lib/libc.so.6+0x94e44)
 #6 0x00007f5e4b450a30 raise (/usr/lib/libc.so.6+0x3ca30)
 #7 0x00007f5e4b4384c3 abort (/usr/lib/libc.so.6+0x244c3)
 #8 0x00007f5e4b4383df (/usr/lib/libc.so.6+0x243df)
 #9 0x00007f5e4b448c67 (/usr/lib/libc.so.6+0x34c67)
#10 0x000055ead608a178 llvm::detail::indexed_accessor_range_base<mlir::OperandRange, mlir::OpOperand*, mlir::Value, mlir::Value, mlir::Value>::operator[](unsigned long) const /home/clem/Documents/LLVM/llvm-18.1.6/llvm/include/llvm/ADT/STLExtras.h:0:5
#11 0x000055ead7199ce5 mlir::linalg::ReduceOp::verify() /home/clem/Documents/LLVM/llvm-18.1.6/mlir/lib/Dialect/Linalg/IR/LinalgOps.cpp:1584:32
#12 0x000055ead715bb94 mlir::Op<mlir::linalg::ReduceOp, mlir::OpTrait::OneRegion, mlir::OpTrait::VariadicResults, mlir::OpTrait::ZeroSuccessors, mlir::OpTrait::VariadicOperands, mlir::OpTrait::S
```

MLIR crash in linalg::ReduceOp::verify
This is a GitHub Issue
repo:llvm-project
owner:llvm
Title : MLIR crash in linalg::ReduceOp::verify
Issue date:

--- start body ---
`ReduceOp` crashes during verification of the following op:
```mlir
module {
  func.func @main(%arg0: tensor<32xi32>, %arg1: tensor<32xi32>) -> i32 {
      %c0_i32 = arith.constant 0 : i32
      %from_elements = tensor.from_elements %c0_i32 : tensor<i32>
      %reduced = linalg.reduce ins(%arg0, %arg1 : tensor<32xi32>, tensor<32xi32>) outs(%from_elements : tensor<i32>) dimensions = [0] 
        (%in0: i32, %in1: i32, %init: i32) {
          %44 = arith.muli %in0, %in1 : i32
          %5 = arith.addi %44, %init : i32
          linalg.yield %5 : i32
        }
      %ext = tensor.extract %reduced[] : tensor<i32>
      return %ext: i32
  }
}
```
This is at line 1656 here:
https://github.com/llvm/llvm-project/blob/fb87e11e7253656ffe99726f45b679e08343bd5f/mlir/lib/Dialect/Linalg/IR/LinalgOps.cpp#L1652-L1658

It appears the ODS-generated code for getInputs assumes that the variadic operands (inputs and inits here) are the same sizes. When computing the size of the variadic operand, it foordivs 3 by 2 and returns a range with 1 element. On the other hand the code in [here](https://github.com/llvm/llvm-project/blob/c5e417a812d86226b087346cadb05d3aae9fe1d0/mlir/include/mlir/Interfaces/DestinationStyleOpInterface.td#L85-L89) is correct and returns an input count of 2, and an operand range with the two inputs. That's why here we enter the loop, but `getInputs()[1]` crashes.

One fix for the crash would be to use `getDpsInputs` instead of `getInputs` in the verifier. But this should ideally be patched in ODS I suppose. Thanks for reading.


---
Stack trace

```
cinm-opt: /home/clem/Documents/LLVM/llvm-18.1.6/llvm/include/llvm/ADT/STLExtras.h:1281: ReferenceT llvm::detail::indexed_accessor_range_base<mlir::OperandRange, mlir::OpOperand *, mlir::Value, mlir::Value, mlir::Value>::operator[](size_t) const [DerivedT = mlir::OperandRange, BaseT = mlir::OpOperand *, T = mlir::Value, PointerT = mlir::Value, ReferenceT = mlir::Value]: Assertion `Index < size() && "invalid index for value range"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: cinm-opt sandbox/matmul_tiled.mlir
 #0 0x000055eadabe7a4d llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /home/clem/Documents/LLVM/llvm-18.1.6/llvm/lib/Support/Unix/Signals.inc:723:11
 #1 0x000055eadabe803b PrintStackTraceSignalHandler(void*) /home/clem/Documents/LLVM/llvm-18.1.6/llvm/lib/Support/Unix/Signals.inc:798:1
 #2 0x000055eadabe5ce3 llvm::sys::RunSignalHandlers() /home/clem/Documents/LLVM/llvm-18.1.6/llvm/lib/Support/Signals.cpp:105:5
 #3 0x000055eadabe8801 SignalHandler(int) /home/clem/Documents/LLVM/llvm-18.1.6/llvm/lib/Support/Unix/Signals.inc:413:1
 #4 0x00007f5e4b450ae0 (/usr/lib/libc.so.6+0x3cae0)
 #5 0x00007f5e4b4a8e44 (/usr/lib/libc.so.6+0x94e44)
 #6 0x00007f5e4b450a30 raise (/usr/lib/libc.so.6+0x3ca30)
 #7 0x00007f5e4b4384c3 abort (/usr/lib/libc.so.6+0x244c3)
 #8 0x00007f5e4b4383df (/usr/lib/libc.so.6+0x243df)
 #9 0x00007f5e4b448c67 (/usr/lib/libc.so.6+0x34c67)
#10 0x000055ead608a178 llvm::detail::indexed_accessor_range_base<mlir::OperandRange, mlir::OpOperand*, mlir::Value, mlir::Value, mlir::Value>::operator[](unsigned long) const /home/clem/Documents/LLVM/llvm-18.1.6/llvm/include/llvm/ADT/STLExtras.h:0:5
#11 0x000055ead7199ce5 mlir::linalg::ReduceOp::verify() /home/clem/Documents/LLVM/llvm-18.1.6/mlir/lib/Dialect/Linalg/IR/LinalgOps.cpp:1584:32
#12 0x000055ead715bb94 mlir::Op<mlir::linalg::ReduceOp, mlir::OpTrait::OneRegion, mlir::OpTrait::VariadicResults, mlir::OpTrait::ZeroSuccessors, mlir::OpTrait::VariadicOperands, mlir::OpTrait::S
```

--- end body ---

A crash in the MLIR framework occurs during the verification of the `linalg::ReduceOp` operation due to an assertion failure when accessing variadic operands. This can lead to a Denial of Service (DoS) as the program terminates unexpectedly when invalid indices are accessed. The issue arises from incorrect assumptions in the ODS-generated code regarding the sizes of variadic operands, which can be exploited by providing specially crafted MLIR code that triggers the crash.