[Bug][Relax] FoldConstant leaks bindings emitted by a legalizer it only tries speculatively: dynamic_strided_slice leaves a call_tir to an undefined shape_func ("There is no definition of Module.shape_func") #20808

Activity

1. YuanchengJiang

   added

   type: bug

   needs-triagePRs or issues that need to be investigated by maintainers to find the right assignees to address itPRs or issues that need to be investigated by maintainers to find the right assignees to address it

   on Oct 22, 2026
2. xgbtxy commented on Oct 22, 2026

   

   xgbtxy

   on Oct 22, 2026

   More actions

   I reproduced this with your module on Windows x64, Python 3.12 and the prebuilt apache-tvm==0.27.0.post1 wheel (generated version metadata identifies commit 7b5acb32b; LLVM is enabled).

   The original module passes well_formed and compiles with tvm.compile(..., target="llvm"). After FoldConstant, only main remains, and both well_formed and compilation fail because shape_func is undefined. This is validation of that wheel build; I have not built current main or executed the compiled VM.

   I also noticed #20488 already changes the speculative FLegalize probe and explicitly discusses dynamic_strided_slice in its data-dependent handling. Its gate may leave this binding-isolation issue separate, but I have not tested that PR. Would maintainers prefer coordinating this regression there, or a separate binding-isolation follow-up after that change? I have not started an overlapping implementation.

   This reproduction and source comparison were assisted by Codex.
3. Yuhx141 commented on Oct 25, 2026

   

   Yuhx141

   on Oct 25, 2026

   More actions

   Independent CPU confirmation on TVM 0.28.dev0, revision 27576ce2d1b2cf5212ad46d5710e594bdcbb5df0, with matching FFI df463f9bd269867fc7f4d578d62d80cc2a11d004 (Ubuntu 24.04.4 x86_64, Python 3.12.3, LLVM 18.1.3).

   A one-dimensional positive-size variant below passes source well-formedness and actually executes on LLVM CPU, returning [1, 2]. After FoldConstant, check_well_formed is false and well_formed raises ValueError: GlobalVar Module.shape_func is not defined. The same mechanism reproduced on three fresh source modules.

   """Standalone LLVM CPU reproducer; no ONNX or GraphOpt dependency."""
   import numpy as np
   import tvm
   from tvm import relax
   from tvm.script import ir as I
   from tvm.script import relax as R
   @I.ir_module
   class Module:
       @R.function
       def main(x: R.Tensor((4,), "float32"), end: R.Tensor((1,), "int64")) -> R.Tensor(dtype="float32", ndim=1):
           with R.dataflow():
               out = R.dynamic_strided_slice(x, R.const([0], "int64"), end, R.const([1], "int64"))
               R.output(out)
           return out
   
   
   assert relax.analysis.check_well_formed(Module, check_ty=True)
   before = Module.script(show_meta=True)
   executable = relax.build(Module, target=tvm.target.Target("llvm", host="llvm"), relax_pipeline="default")
   vm = relax.VirtualMachine(executable, tvm.cpu())
   inputs = [np.array([1, 2, 3, 4], dtype="float32"), np.array([2], dtype="int64")]
   expected = np.array([1, 2], dtype="float32")
   actual = vm["main"](*[tvm.runtime.tensor(x) for x in inputs]).numpy()
   np.testing.assert_array_equal(actual, expected)
   assert Module.script(show_meta=True) == before
   print("TVM:", tvm.__version__, flush=True)
   print("Source LLVM output:", actual.tolist(), flush=True)
   optimized = relax.transform.FoldConstant()(Module)
   print("Target well formed:", bool(relax.analysis.check_well_formed(optimized, check_ty=True)), flush=True)
   relax.analysis.well_formed(optimized, check_ty=True)

   This confirms the same binding/helper leakage reported here; I am not opening a duplicate issue or proposing an overlapping fix. I have not built current main or tested #20488. The source VM execution above also rules out an ONNX importer or snapshot-instrumentation dependency for this variant.

   Report preparation used Codex; this exact script was executed in the stated environment.