`tf.experimental.numpy.ones` crashes (segfault/abort) when INT64_MAX is passed as shape

Issue type

Bug

Have you reproduced the bug with TensorFlow Nightly?

No

Source

binary

TensorFlow version

2.20.0

Custom code

Yes

OS platform and distribution

Linux Ubuntu 24.04

Mobile device

No response

Python version

3.12

Bazel version

No response

GCC/compiler version

No response

CUDA/cuDNN version

No response

GPU model and memory

No response

Current behavior?

When calling tf.experimental.numpy.ones with a shape equivalent to INT64_MAX (9223372036854775807), the Python process terminates immediately.

The behavior is unstable and manifests in two ways depending on execution:

• Segmentation Fault (SIGSEGV): Occurs inside gen_array_ops.fill.

• Aborted (Core Dumped): Occurs in the BFC Allocator during deallocation with a Check failed error, indicating heap metadata corruption.

This likely indicates an integer overflow in the size calculation that leads to heap corruption or an unchecked memory access in the C++ backend.

Here is a gist

Standalone code to reproduce the issue

import tensorflow as tf
import numpy as np

print("Tensorflow version:", tf.__version__, flush=True)

large_shape = 9223372036854775807

target_dtype = np.uint16

print(f"Attempting to allocate tf.experimental.numpy.ones with shape: {large_shape}", flush=True)

tf.experimental.numpy.ones(large_shape, dtype=target_dtype)

print("Print this if no crash occurred.", flush=True)

Relevant log output

Tensorflow version: 2.20.0
Attempting to allocate tf.experimental.numpy.ones with shape: 9223372036854775807
WARNING: All log messages before absl::InitializeLog() is called are written to STDERR
I0000 00:00:1769488973.935943  411469 gpu_device.cc:2020] Created device /job:localhost/replica:0/task:0/device:GPU:0 with 21934 MB memory:  -> device: 0, name: NVIDIA GeForce RTX 4090, pci bus id: 0000:01:00.0, compute capability: 8.9
F0000 00:00:1769488974.107249  411469 bfc_allocator.cc:807] Check failed: c->in_use() && (c->bin_num == kInvalidBinNum) 
*** Check failure stack trace: ***
    @     0x7a13a0ea2fe4  absl::lts_20250127::log_internal::LogMessage::SendToLog()
    @     0x7a13a0ea2976  absl::lts_20250127::log_internal::LogMessage::Flush()
    @     0x7a13a0ea3539  absl::lts_20250127::log_internal::LogMessageFatal::~LogMessageFatal()
    @     0x7a13a026247e  tsl::BFCAllocator::DeallocateRawInternal()
    @     0x7a13a0261cf2  tsl::BFCAllocator::DeallocateRaw()
    @     0x7a13a0ace6b4  tensorflow::(anonymous namespace)::Buffer<>::~Buffer()
    @     0x7a13a0ace72e  tensorflow::(anonymous namespace)::Buffer<>::~Buffer()
    @     0x7a13a0ab6a6c  tensorflow::Tensor::~Tensor()
    @     0x7a1392199fa1  std::__detail::__variant::__gen_vtable_impl<>::__visit_invoke()
    @     0x7a1392195f2a  tensorflow::TensorHandle::~TensorHandle()
    @     0x7a13921960de  tensorflow::TensorHandle::~TensorHandle()
    @     0x7a138fa1bf75  TFE_DeleteTensorHandle
    @     0x7a1362d2a01f  EagerTensor_dealloc
    @           0x5abdf9  _PyEval_EvalFrameDefault
Aborted (core dumped)