Skip to content

[Relax][ONNX] Prevent Div divide-by-zero crashes#19566

Open
cchung100m wants to merge 9 commits into
apache:mainfrom
cchung100m:issue-19541
Open

[Relax][ONNX] Prevent Div divide-by-zero crashes#19566
cchung100m wants to merge 9 commits into
apache:mainfrom
cchung100m:issue-19541

Conversation

@cchung100m
Copy link
Copy Markdown
Contributor

@cchung100m cchung100m commented May 14, 2026

Hi Committers,

This PR is trying to fix issues #19541. Any suggestions would be appreciated if you are available.

Root cause:

The ONNX Div path in the Relax frontend did not separate two integer-divisor cases: constant zero divisors and dynamic/unknown divisors. As a result, constant integer zero divisors were not rejected during import, and dynamic integer divisors could reach runtime without a guard. When the divisor became zero at runtime, execution could trigger SIGFPE and terminate the process instead of raising a controlled error.

Solution:

This PR applies a minimal, targeted fix in the ONNX frontend Div conversion path. It introduces: import-time validation for constant integer divisors containing zero, raising ValueError early.

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces division-by-zero checks for integer types in the ONNX frontend. It adds a helper function _const_integer_expr_has_zero to detect zero values in constant expressions and updates the Div operator implementation to either trigger a compile-time error or emit a runtime assertion. A review comment correctly identifies that a ValueError is being returned instead of raised, which would cause the frontend to fail with an unhelpful error message.

Comment thread python/tvm/relax/frontend/onnx/onnx_frontend.py Outdated
@cchung100m
Copy link
Copy Markdown
Contributor Author

/gemini review

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a check for integer division by zero in the ONNX frontend by adding a helper function _const_integer_expr_has_zero and updating the Div implementation. Feedback suggests making the type-checking logic more robust by handling potential AttributeError when accessing struct_info and extending the helper function to support relax.PrimValue for scalar constants.

Comment thread python/tvm/relax/frontend/onnx/onnx_frontend.py Outdated
Comment on lines +81 to +82
if isinstance(expr, relax.Constant):
return bool(_np.any(expr.data.numpy() == 0))
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The helper function _const_integer_expr_has_zero should also handle relax.PrimValue expressions, as they can also represent constant integer divisors in Relax. This ensures that scalar constant zero divisors are also caught during import validation.

Suggested change
if isinstance(expr, relax.Constant):
return bool(_np.any(expr.data.numpy() == 0))
if isinstance(expr, relax.Constant):
return bool(_np.any(expr.data.numpy() == 0))
if isinstance(expr, relax.PrimValue) and isinstance(expr.value, tirx.IntImm):
return int(expr.value.value) == 0

@cchung100m cchung100m marked this pull request as ready for review May 15, 2026 02:15
@mshr-h
Copy link
Copy Markdown
Contributor

mshr-h commented May 15, 2026

Div by zero is more like a runtime behavior so I think it should be handled in runtime instead of frontend. Or maybe relax/tirx passes is fine.

cc @tlopex

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants