Fix NchwcTransformer null deref on node with unresolved schema#29194
Open
tairenpiao wants to merge 1 commit into
Open
Fix NchwcTransformer null deref on node with unresolved schema#29194tairenpiao wants to merge 1 commit into
tairenpiao wants to merge 1 commit into
Conversation
7ef2476 to
4b2b5a3
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes a crash during InferenceSession::Initialize() on x86_64 when NchwcTransformer processes a graph containing nodes whose op schema has not been resolved yet (node.Op() == nullptr). The change hardens a shared graph utility predicate used by transformers to avoid a null dereference, and adds a regression test that loads a minimal repro model.
Changes:
- Add a null-check for
node.Op()ingraph_utils::IsSupportedOptypeVersionAndDomainbefore consultingOpSchema::Deprecated(). - Add a regression test that loads and initializes a minimal
Transpose -> Cast(fp16->fp32) -> MatMulmodel at Level3 optimizations.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| onnxruntime/test/optimizer/nchwc_optimizer_test.cc | Adds a regression smoke test that loads the repro model and asserts session initialization succeeds. |
| onnxruntime/core/graph/graph_utils.cc | Guards node.Op()->Deprecated() with node.Op() != nullptr to prevent a null dereference when schemas are unresolved. |
Comment on lines
399
to
405
| return (node.OpType() == op_type && | ||
| // we don't have op schemas in the minimal build so there's no way to check the deprecated flag | ||
| #if !defined(ORT_MINIMAL_BUILD) | ||
| !node.Op()->Deprecated() && | ||
| // node.Op() can be null for a node whose schema is not yet resolved. | ||
| node.Op() != nullptr && !node.Op()->Deprecated() && | ||
| #endif | ||
| MatchesOpSinceVersion(node, versions) && MatchesOpSetDomain(node, domain)); |
Contributor
Author
There was a problem hiding this comment.
Pulled node.Op() into a local op_schema and reused it. Thanks!
4b2b5a3 to
ce4447a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
On x86_64 with
ORT_ENABLE_ALL,InferenceSessioninitialization crashes (SIGSEGV) insideNchwcTransformerfor a model containing aTranspose → Cast(fp16→fp32) → MatMulchain on a 3D dynamic shape with a singleton dim. Stack bottoms out ingraph_utils::IsSupportedOptypeVersionAndDomain.Root cause
graph_utils::IsSupportedOptypeVersionAndDomaindereferencesnode.Op()->Deprecated()unconditionally.node.Op()can benullptrwhen a node's schema is not resolved (e.g. a node added by an earlier transformer before the graph is re-resolved), so this is a null dereference.Fix
Guard with
node.Op() != nullptrbefore the deref — matching the existing pattern atgraph.cc:3547. A node whose schema is unresolved cannot match a specific op, so returningfalseis correct. Adds a regression test that loads the reporter's minimal model atORT_ENABLE_ALL.Scope
The crash is x86_64-only (NCHWc enabled,
MlasNchwcGetBlockSize() > 1). On other platforms the guard is a no-op and the test is a harmless smoke test.Fixes #28392