[Bug] Segmentation fault during type inference of reduction operators with `axis=[]`

[wzh99]

Type inference of the following Relay function causes a segmentation fault:

def @main(%x: Tensor[(1, 2, 3), float32]) {
  sum(%x, axis=[], keepdims=True, exclude=True)
}

Expected behavior

The type inference pass accepts this function, since the type constraints of the reduction operator sum are not violated.

Actual behavior

Segmentation fault.

Environment

macOS 12.4. Compiled using Clang 13.1.6 with LLVM support. TVM commit df4f4c0b4.

Steps to reproduce

from tvm import relay, ir

x = relay.var('x', shape=(1, 2, 3))
y = relay.sum(x, axis=(), keepdims=True, exclude=True)
mod = ir.IRModule.from_expr(y)
mod = relay.transform.InferType()(mod)

Possible fix

tvm/src/relay/op/tensor/reduce.cc

Lines 72 to 73 in df4f4c0

	ICHECK(in_axes[in_axes.size() - 1] < indim)
	<< "Reduction axis " << in_axes[in_axes.size() - 1] << " exceeds input dimensions " << indim;

 ICHECK(in_axes[in_axes.size() - 1] < indim)
     << "Reduction axis " << in_axes[in_axes.size() - 1] << " exceeds input dimensions " << indim;

When in_axes is empty, accessing it by index in_axes.size() - 1 is invalid. To fix it, I suggest removing this ICHECK because the range of elements in in_axes seems to have been checked already in the previous for-loop.