Skip to content

[tosa] Fix crash in shape inference for tosa.transpose #74367

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Dec 5, 2023
Merged

[tosa] Fix crash in shape inference for tosa.transpose #74367

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 4 additions & 8 deletions mlir/lib/Dialect/Tosa/IR/TosaOps.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -983,6 +983,10 @@ LogicalResult tosa::TransposeOp::inferReturnTypeComponents(
ShapeAdaptor inputShape(adaptor.getInput1().getType());
ShapeAdaptor permsShape(adaptor.getPerms().getType());

// We cannot infer anything from a rank-0 "permutation" tensor.
if (permsShape.hasRank() && permsShape.getRank() == 0)
return failure();

// If input rank and permutation length is unknown, the output rank is
// unknown.
if (!inputShape.hasRank() || !permsShape.hasRank() ||
Expand All @@ -997,15 +1001,7 @@ LogicalResult tosa::TransposeOp::inferReturnTypeComponents(
return failure();
}

// Without the input dims we cannot determine the output dim sizes but we
// can determine the output rank.
SmallVector<int64_t> outputShape;
if (!inputShape.hasRank()) {
outputShape.resize(permsShape.getDimSize(0), ShapedType::kDynamic);
inferredReturnShapes.push_back(ShapedTypeComponents(outputShape));
return success();
}

// Rank-0 means no permutations matter.
if (inputShape.getRank() == 0) {
inferredReturnShapes.push_back(ShapedTypeComponents(outputShape));
Expand Down
11 changes: 11 additions & 0 deletions mlir/test/Dialect/Tosa/tosa-infer-shapes.mlir
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1310,3 +1310,14 @@ func.func @test_large_constant_permutation() {
return
}

// -----

// CHECK-LABEL: test_rank0_transpose_perms
// Fail to infer the shape but not crash.
func.func @test_rank0_transpose_perms() {
%14 = tensor.empty() : tensor<5x27xi64>
%cst = tensor.empty() : tensor<i32>
// CHECK: tosa.transpose
%72 = tosa.transpose %14, %cst : (tensor<5x27xi64>, tensor<i32>) -> tensor<?x?xi64>
Copy link
Contributor

@sabauma sabauma Dec 4, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Based on the description (in the TOSA Spec) of tosa.transpose it seems like this op should be illegal. The permutation tensor is expected to be a rank-1 tensor with an element count equal to the rank of the input tensor.

Not crashing seems fine, but the verifier for tosa.transpose should probably reject this op.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree, at the moment, transpose doesn't have a verifier so this was just a crash-fix PR but I will add a verifier which checks for those thing in a separate PR.

return
}