[Bug][VM] Segmentation fault triggered if opt level set to 0

[leeexyz]

Compiling any network when opt level is 0 in VM runtime would cause a segmentation fault. The segment occurs at ManifestAlloc Pass (opt_level=0) and the pass requires ToANormalForm Pass (opt_level=1). If there is no Let Scope found will trigger this bug.

Possible fixes

First, we should check if the scopes_ is empty before accessing it.

ICHECK(!scopes_.empty());
LetList& scope = scopes_.back();

tvm/src/relay/transforms/memory_alloc.cc

Line 75 in a713356

LetList& scope = scopes_.back();

tvm/src/relay/transforms/memory_alloc.cc

Line 143 in a713356

LetList& scope = scopes_.back();

Then, modify the opt levels or required relations. The error still exists if only changing the opt_level=0 of ToANormalForm. We also have to update the level of Inline and DeadCodeElimination. Let's suppose these three passes Inline, DeadCodeElimination, ToANormalForm are all 0, this bug is solved.

Expected behavior

Successfully compiled when op level is 0 in VM

Actual behavior

Segmentation fault

Thread 1 "python" received signal SIGSEGV, Segmentation fault.
0x00007fffcccaa9fe in tvm::relay::LetList::Push (this=0xffffffffffffffe0, pv=..., expr=...)
    at ../src/relay/transforms/let_list.h:67
67          ICHECK(!used_);
(gdb) bt
#0  0x00007fffcccaa9fe in tvm::relay::LetList::Push (this=0xffffffffffffffe0, pv=..., expr=...)
    at ../src/relay/transforms/let_list.h:67
#1  0x00007fffccd29108 in tvm::relay::DialectRewriter::EmitShapeFunc (this=0x7fffffffba90, 
    scope=0xffffffffffffffe0, ins=..., attrs=...) at ../src/relay/transforms/memory_alloc.cc:305
#2  0x00007fffccd2a558 in tvm::relay::DialectRewriter::DynamicInvoke (this=0x7fffffffba90, 
    scope=0xffffffffffffffe0, func=..., ins=..., attrs=..., 
    out_types=std::vector of length 1, capacity 1 = {...}, ret_type=..., virtual_device=...)
    at ../src/relay/transforms/memory_alloc.cc:355
#3  0x00007fffccd26e1e in tvm::relay::DialectRewriter::DeviceAwareVisitExpr_ (this=0x7fffffffba90, 
    call_node=0x555556669be0) at ../src/relay/transforms/memory_alloc.cc:180
#4  0x00007fffccc6085a in tvm::relay::transform::DeviceAwareExprMutator::VisitExpr_ (
    this=0x7fffffffba90, call_node=0x555556669be0)
    at ../src/relay/transforms/device_aware_visitors.cc:278
#5  0x00007fffcbbce59d in tvm::relay::ExprFunctor<tvm::RelayExpr (tvm::RelayExpr const&)>::InitVTable()::{lambda(tvm::runtime::ObjectRef const&, tvm::relay::ExprFunctor<tvm::RelayExpr (tvm::RelayExpr const&)>*)#6}::operator()(tvm::runtime::ObjectRef const&, tvm::relay::ExprFunctor<tvm::RelayExpr (tvm::RelayExpr const&)>*) const (__closure=0x0, n=..., self=0x7fffffffba90) at ../include/tvm/relay/expr_functor.h:128
#6  0x00007fffcbbce5f8 in tvm::relay::ExprFunctor<tvm::RelayExpr (tvm::RelayExpr const&)>::InitVTable()::{lambda(tvm::runtime::ObjectRef const&, tvm::relay::ExprFunctor<tvm::RelayExpr (tvm::RelayExpr const&)>*)#6}::_FUN(tvm::runtime::ObjectRef const&, tvm::relay::ExprFunctor<tvm::RelayExpr (tvm::RelayExpr const&)>*) () at ../include/tvm/relay/expr_functor.h:128
#7  0x00007fffcbbcf18e in tvm::NodeFunctor<tvm::RelayExpr (tvm::runtime::ObjectRef const&, tvm::relay::ExprFunctor<tvm::RelayExpr (tvm::RelayExpr const&)>*)>::operator()(tvm::runtime::ObjectRef const&, tvm::relay::ExprFunctor<tvm::RelayExpr (tvm::RelayExpr const&)>*) const (
    this=0x7fffd25ee630 <tvm::relay::ExprFunctor<tvm::RelayExpr (tvm::RelayExpr const&)>::VisitExpr(tvm::RelayExpr const&)::vtable>, n=..., args#0=0x7fffffffba90) at ../include/tvm/node/functor.h:97
#8  0x00007fffcbbcd504 in tvm::relay::ExprFunctor<tvm::RelayExpr (tvm::RelayExpr const&)>::VisitExpr(tvm::RelayExpr const&) (this=0x7fffffffba90, n=...) at ../include/tvm/relay/expr_functor.h:95
#9  0x00007fffccf9d456 in tvm::relay::ExprMutator::VisitExpr (this=0x7fffffffba90, expr=...)
    at ../src/relay/ir/expr_functor.cc:158
#10 0x00007fffccbbcfae in tvm::relay::ExprMutator::Mutate (this=0x7fffffffba90, expr=...)
    at ../include/tvm/relay/expr_functor.h:190
#11 0x00007fffccf9dd42 in tvm::relay::ExprMutator::VisitExpr_ (this=0x7fffffffba90, 
    func_node=0x555556693480) at ../src/relay/ir/expr_functor.cc:204
#12 0x00007fffccc608fe in tvm::relay::transform::DeviceAwareExprMutator::DeviceAwareVisitExpr_ (
    this=0x7fffffffba90, function_node=0x555556693480)
    at ../src/relay/transforms/device_aware_visitors.cc:283
#13 0x00007fffccc600f3 in tvm::relay::transform::DeviceAwareExprMutator::VisitExpr_ (
    this=0x7fffffffba90, function_node=0x555556693480)
    at ../src/relay/transforms/device_aware_visitors.cc:228

Environment

OS: Ubuntu 20.04
LLVM: 11.1.0
TVM: commit a713356

Steps to reproduce

A sample case to reproduce it

import tvm
from tvm import relay


dtype = "float32"
x = relay.var("x", shape=(relay.Any(), relay.Any()), dtype=dtype)
y = relay.var("y", shape=(relay.Any(), relay.Any()), dtype=dtype)
func = relay.Function([x, y], relay.add(x, y))
mod = tvm.IRModule.from_expr(func)

with tvm.transform.PassContext(opt_level=0):
    target = tvm.target.Target("llvm")
    exe = tvm.relay.backend.vm.compile(mod, target)

[leeexyz]

@wrongtest Thanks for your fix! Actually, there are two locations that need to assert the empty, Line 75 and Line 143, as I mentioned in this issue.

But, still, the issue is not solved yet, about the passes' level, what is your suggestion? @masahi