IsInitializerWithExpectedValue(int64_t) dereferences a null constant initializer
Maintainers usually reply within 2 days
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 88/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- cpp
- Domain
- machine-learning, performance
Research direction
Start with the int64_t IsInitializerWithExpectedValue overload in onnxruntime/core/optimizer/utils.cc and its call from MatchPositionEmbeddingSubgraphsFromGather in embed_layer_norm_fusion.cc. Run reproduce.py from the ORT-SEM-003 reproducer to confirm the crash and compare the int64 path with the float overload. Done means the invalid initializer is handled without SIGSEGV and the reproducer no longer fails under ORT_ENABLE_ALL.
Written by the indexing model from the issue text.
Description
Affected versions
- Latest stable release tested:
v1.30.0(f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7) - Default-branch build tested:
a11b4e593164c82f7ce95efce3693744103f8176
Summary
ORT_ENABLE_ALL terminates the process with SIGSEGV while EmbedLayerNormFusion inspects the now-runtime Range start value.
The source model loads with optimizations disabled. Enabling graph optimization reproduces the failure on ONNX Runtime 1.30.0. Disabling only EmbedLayerNormFusion removes the failure. A compiled 1.31 development wheel based on a11b4e593164c82f7ce95efce3693744103f8176 reproduced the same root. The relevant implementation remains present at official main 96f73115c95968a3f31f2a110b33c164d847dda4.
Steps to reproduce
-
Clone the public reproducer and enter this case:
git clone https://github.com/Yuhx141/graph-optimizer-issue-reproducers.git cd graph-optimizer-issue-reproducers/onnxruntime/ORT-SEM-003 -
Install the versions in
requirements.txt. -
Run
python reproduce.py.
The standalone script validates the source behavior, reproduces the optimized behavior, and disables the implicated transformer as a positive control. The readable reproducer is at https://github.com/Yuhx141/graph-optimizer-issue-reproducers/tree/main/onnxruntime/ORT-SEM-003.
Expected result
The optimizer must preserve every public value, remaining consumer, graph interface and numerical result of the valid source model, or decline the rewrite.
Actual result
ORT_ENABLE_ALL terminates the process with SIGSEGV while EmbedLayerNormFusion inspects the now-runtime Range start value.
Likely cause and source location
the int64 IsInitializerWithExpectedValue overload receives null from GetConstantInitializer but constructs Initializer from *tensor_proto without the null check present in the float overload.
Relevant source locations:
onnxruntime/core/optimizer/utils.cc: int64_t IsInitializerWithExpectedValueonnxruntime/core/optimizer/embed_layer_norm_fusion.cc: MatchPositionEmbeddingSubgraphsFromGather
Environment
- OS: Ubuntu 24.04.4 LTS, x86-64
- CPU: Intel Core Ultra 5 225
- Python: 3.11.16
- NumPy: 2.4.6
- ONNX: 1.22.0
- ONNX Runtime: 1.30.0 (
f2c39fe2f838cf35ce7da92824f5a5e3ee6e88a7) - Execution provider: CPUExecutionProvider
- Optimization level: ORT_ENABLE_ALL
Duplicate search
PR #27976 validates empty initializer contents. The int64 overload still lacks the float overload's null TensorProto check.
Reproducer files
reproduce.py: standalone self-checksource.txt: readable ONNX graphminimal_model.onnx: exact source modelSHA256SUMS: file hashes
- Dominant language
- C++
- Stars
- 22.2k
- Forks
- 4.4k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 275
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/onnxruntime
-
platform:web
Difficulty 1/5 Under an hour Newbie friendliness 82/100
microsoft/onnxruntime#33570 ·
Maintainers usually reply within 2 days
-
C++ tests fail to compilePossibly taken @winstonwen727 claimed this 6 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
microsoft/onnxruntime#33430 ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
microsoft/onnxruntime#33300 ·
Maintainers usually reply within 2 days
-
LayerNormFusionL2 removes a public duplicate Sub outputPossibly taken @Yuhx141 claimed this 26 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
microsoft/onnxruntime#32953 ·
Maintainers usually reply within 2 days
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
microsoft/onnxruntime#32881 ·
Maintainers usually reply within 2 days
All issues in microsoft/onnxruntime
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 9 days
-
自定义颜色添加为常用颜色Open
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
mg-chao/snow-apps#2227 · 2 comments ·
Maintainers usually reply within 1 day
-
bug introduced: 5.0 cycle P3 XS
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
open-astro/AlpacaBridge#1722 · 1 comment ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
returnoftheshadow/RotS_Live#521 ·
Maintainers usually reply within 1 day
-
crash lld:COFF
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
llvm/llvm-project#235970 · 1 comment ·
Maintainers usually reply within 1 day