From 6a8e31ebaf9c88b165b92c32250be2f3c7dc14c7 Mon Sep 17 00:00:00 2001 From: Gregory Comer Date: Wed, 18 Mar 2026 09:43:52 -0700 Subject: [PATCH 1/2] Fix weight cache bug Summary: XNNPACK sometimes calls weight cache look_up_or_insert with ptr==nullptr. This is a bit weird - maybe a bug on the XNNPACK side?, but it seems to do this when it's already hit the cache. Just return the cached value for the key without validating contents in this case, since we can't insert anything. Differential Revision: D97006279 --- backends/xnnpack/runtime/XNNWeightsCache.cpp | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/backends/xnnpack/runtime/XNNWeightsCache.cpp b/backends/xnnpack/runtime/XNNWeightsCache.cpp index 54191b72825..397098fc867 100644 --- a/backends/xnnpack/runtime/XNNWeightsCache.cpp +++ b/backends/xnnpack/runtime/XNNWeightsCache.cpp @@ -206,9 +206,17 @@ size_t XNNWeightsCache::look_up_or_insert( size_t size) { size_t offset = context->look_up(context, cache_key); + // XNNPACK can call this with ptr==nullptr when it previously hit the cache + // and skipped packing. We can't validate against the ptr contents in this case, + // so just return the offset. This might actually be a bug in XNNPACK since + // calling look_up_or_insert with ptr==nullptr doesn't really make sense... + if (ptr == nullptr) { + return offset; + } + if (offset != SIZE_MAX) { void* saved_ptr = context->offset_to_addr(context, offset); - if (0 == memcmp(ptr, saved_ptr, size)) { + if (saved_ptr != nullptr && 0 == memcmp(ptr, saved_ptr, size)) { return offset; } // Failure, cache is out of date From bb64d12897a52767028cf33702e52c93c5db38b7 Mon Sep 17 00:00:00 2001 From: Gregory Comer Date: Wed, 18 Mar 2026 09:48:07 -0700 Subject: [PATCH 2/2] Lint --- backends/xnnpack/runtime/XNNWeightsCache.cpp | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/backends/xnnpack/runtime/XNNWeightsCache.cpp b/backends/xnnpack/runtime/XNNWeightsCache.cpp index 397098fc867..7767c65285a 100644 --- a/backends/xnnpack/runtime/XNNWeightsCache.cpp +++ b/backends/xnnpack/runtime/XNNWeightsCache.cpp @@ -207,9 +207,10 @@ size_t XNNWeightsCache::look_up_or_insert( size_t offset = context->look_up(context, cache_key); // XNNPACK can call this with ptr==nullptr when it previously hit the cache - // and skipped packing. We can't validate against the ptr contents in this case, - // so just return the offset. This might actually be a bug in XNNPACK since - // calling look_up_or_insert with ptr==nullptr doesn't really make sense... + // and skipped packing. We can't validate against the ptr contents in this + // case, so just return the offset. This might actually be a bug in XNNPACK + // since calling look_up_or_insert with ptr==nullptr doesn't really make + // sense... if (ptr == nullptr) { return offset; }