apache / apache/tvm

[Bug] Relax ONNX integer Div by zero crashes process with SIGFPE

Open
#19,541 1 comment 0 reactions 0 assignees View on GitHub
needs-triage type: bug
Dominant language
Python
Stars
13.7k
Forks
4k
Avg merge
2d 1h
Merged PRs (30d)
112

Description

### Expected behavior

TVM Relax should not crash the Python process when executing an imported ONNX `Div` model with integer inputs.

For integer division by zero, TVM should either handle the case safely or report a controlled runtime error instead of terminating the process with `SIGFPE`.

### Actual behavior

The model compiles successfully, but calling the Relax VM crashes the subprocess with exit code `-8`:

```
stdout: calling vm[main]

exit : -8
```

This happens when the divisor tensor contains zero values for an `INT32` ONNX `Div` model.

### Environment

TVM: 0.14 environment / Relax ONNX frontend
Python: 3.11
Target: llvm
OS: Linux

### Steps to reproduce

```
import subprocess
import sys
import textwrap

SCRIPT = textwrap.dedent("""\
import numpy as np
import onnx
from onnx import helper, TensorProto
import tvm
from tvm import relax
from tvm.relax.frontend.onnx import from_onnx

node = helper.make_node("Div", ["a", "b"], ["y"])

graph = helper.make_graph(
[node],
"g",
[
helper.make_tensor_value_info("a", TensorProto.INT32, [4]),
helper.make_tensor_value_info("b", TensorProto.INT32, [4]),
],
[helper.make_tensor_value_info("y", TensorProto.INT32, [4])],
)

model = helper.make_model(
graph,
opset_imports=[helper.make_opsetid("", 18)],
)
model.ir_version = 9

mod = from_onnx(model, keep_params_in_input=False)

with tvm.transform.PassContext(opt_level=3):
ex = tvm.compile(mod, target=tvm.target.Target("llvm"))

vm = relax.VirtualMachine(ex, tvm.cpu())

a = np.array([42, 99, -50, 7], dtype=np.int32)
b = np.array([3, 0, 0, 1], dtype=np.int32)

print("calling vm[main]", flush=True)

out = vm["main"](
tvm.runtime.tensor(a, tvm.cpu()),
tvm.runtime.tensor(b, tvm.cpu()),
)

out = out[0] if isinstance(out, (list, tuple)) else out
print("returned:", out.numpy().tolist())
""")

proc = subprocess.run(
[sys.executable, "-c", SCRIPT],
capture_output=True,
text=True,
timeout=60,
)

print("stdout:", proc.stdout)
print("stderr:", proc.stderr)
print("exit :", proc.returncode)
```

### Triage

* needs-triage

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the provided Relax ONNX frontend reproduction for an imported integer Div model, then trace execution through the Relax VM when compiled for the LLVM target. Done means integer division by zero no longer terminates the subprocess with SIGFPE and instead has a safe or controlled runtime outcome.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend, compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.