Anderson2021: DefaultCostModel vector out-of-bounds write.

[mcourteaux]

Description

std::vector operator[] out of bounds:

#5  0x00007fffec24386b in Halide::DefaultCostModel::enqueue (this=0x49af90, ns=1, schedule_feats=0x7fffffff7a10, cost_ptr=0x4a54c8, cost_per_stage_ptr=0x4a54d0)
    at /home/martijn/zec/3rd/halide/src/autoschedulers/anderson2021/DefaultCostModel.cpp:178
178	   cost_per_stage_ptrs[cursor] = cost_per_stage_ptr;

cursor = 0, cost_per_stage_ptrs is an empty vector.

Reproducing case

Compile Halide in debug mode, and run ninja. stl bounds checks on std::vector will trigger on the DefaultCostModel on this step:

gdb --args ./test/autoschedulers/anderson2021/anderson2021_demo.generator -n anderson2021_demo -d 0 -g demo -f anderson2021_demo -e c_header,object,registration -p ./src/autoschedulers/anderson2021/libautoschedule_anderson2021.so -o test/autoschedulers/anderson2021 target=x86-64-linux-cuda-cuda_capability_70-no_runtime autoscheduler=Anderson2021

[mcourteaux]

Gemini says:

An issue with DefaultCostModel::enqueue is that std::vector::clear() is called on cost_per_stage_ptrs inside DefaultCostModel::evaluate_costs(). When the next item is enqueued, cost_per_stage_ptrs[cursor] is accessed (where cursor was reset to 0), causing an out-of-bounds error since the vector is now empty.

Since the arrays costs and cost_ptrs are allocated to batch_size and reused up to cursor without being cleared or re-allocated, cost_per_stage_ptrs should be treated the same way. The cost_per_stage_ptrs vector is already allocated to batch_size during initialization, so we can simply remove the call to .clear().

Here's the fix to resolve the bounds check failure:

diff --git a/src/autoschedulers/anderson2021/DefaultCostModel.cpp b/src/autoschedulers/anderson2021/DefaultCostModel.cpp
index d0991eac5..5ed484859 100644
--- a/src/autoschedulers/anderson2021/DefaultCostModel.cpp
+++ b/src/autoschedulers/anderson2021/DefaultCostModel.cpp
@@ -328,7 +328,6 @@ void DefaultCostModel::evaluate_costs() {
     }
 
     cursor = 0;
-    cost_per_stage_ptrs.clear();
 }
 
 void DefaultCostModel::load_weights() {

Not going to PR this, as I don't know if it's correct, but at least it indeed doesn't crash anymore.

[mcourteaux]

Assigning @aekul as git blame indicates you as the author. Please take a look.