Fix #18654: Add safe_numel()

[JiwaniZakir]

Closes #18654

Summary

Adds TensorImpl::safe_numel(), a bounds-checked alternative to numel() that returns a Result<ssize_t> instead of silently overflowing.

The existing numel_ member is computed in the TensorImpl constructor and stored as a plain integer, meaning overflow goes undetected and can lead to heap overflows. Because numel() is called directly in constructors and must remain ABI/BC-compatible with ATen, we cannot change its return type. Instead, safe_numel() is introduced as a new method that callers can opt into when they need overflow safety.

Changes:

• runtime/core/portable_type/tensor_impl.h: Adds the Result<ssize_t> safe_numel() const declaration and includes result.h.
• runtime/core/portable_type/tensor_impl.cpp: Implements safe_numel() by iterating over sizes_ and checking for overflow before each multiply using numel <= std::numeric_limits<ssize_t>::max() / sizes_[i]. Returns InvalidArgument if any dimension is negative or if the product would overflow ssize_t. Includes <limits> for std::numeric_limits.

Test plan

Three new unit tests added in runtime/core/portable_type/test/tensor_impl_test.cpp:

• SafeNumelReturnsCorrectValue: verifies that a {3, 2} tensor returns 6.
• SafeNumelScalar: verifies that a 0-dim tensor (no sizes) returns 1.
• SafeNumelOverflowReturnsError: constructs a tensor with dimensions {INT32_MAX, INT32_MAX, 3}, whose product overflows ssize_t on both 32-bit and 64-bit platforms, and asserts that safe_numel() returns a non-ok Result.

---

This PR was created with AI assistance (Claude). The changes were reviewed by quality gates and a critic model before submission.

[pytorch-bot]

🔗 Helpful Links

🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/18698

• 📄 Preview Python docs built from this PR

Note: Links to docs will display an error until the docs builds have been completed.

❌ 11 Awaiting Approval, 1 New Failure

As of commit 9e8f017 with merge base 6020c29 ():

AWAITING APPROVAL - The following workflows need approval before CI can run:

• Build Cadence (gh)
• Build documentation (gh)
• Build Presets (gh)
• Lint (gh)
• periodic (gh)
• pull (gh)
• Test ARM Backend (gh)
• Test CoreML Backend (gh)
• Test QNN Backend (gh)
• Test Vulkan Backend (gh)
• Test XNNPACK Backend (gh)

NEW FAILURE - The following job has failed:

• Copilot code review / Cleanup artifacts (gh)
  Process completed with exit code 1.

This comment was automatically generated by Dr. CI and updates every 15 minutes.

[Copilot]

Pull request overview

Adds a new TensorImpl::safe_numel() API to compute element counts with explicit overflow/validation checks, returning executorch::runtime::Result<ssize_t> instead of relying on the existing numel_ value (which can overflow).

Changes:

• Introduces TensorImpl::safe_numel() declaration returning Result<ssize_t>.
• Implements safe_numel() with per-dimension validation and pre-multiply overflow checks against std::numeric_limits<ssize_t>::max().
• Adds unit tests covering correct results, scalar behavior, and overflow error reporting.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
runtime/core/portable_type/tensor_impl.h	Declares safe_numel() and includes result.h.
runtime/core/portable_type/tensor_impl.cpp	Implements overflow-checked safe_numel() using sizes_ and std::numeric_limits.
runtime/core/portable_type/test/tensor_impl_test.cpp	Adds tests validating safe_numel() success cases and an overflow error case.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The doc comment for safe_numel() says it errors only on overflow, but the implementation also returns InvalidArgument when any dimension size is negative. Please update the comment to reflect all error conditions (e.g., negative sizes and overflow) so callers know what to expect.

Suggested change

	* Returns the number of elements in the tensor, or an error if the result
	* would overflow ssize_t.
	* Returns the number of elements in the tensor, or an error if any
	* dimension size is negative or if computing the result would overflow
	* ssize_t.

[Copilot]

safe_numel() duplicates much of compute_numel()’s logic (iteration + non-negative size checks). Consider factoring the shared computation into a single helper (e.g., a checked-multiply routine) so future changes to size validation/numel semantics don’t have to be kept in sync in multiple places.

[Copilot]

The overflow failure path logs/returns "Tensor numel overflows ssize_t" without any context (which dimension triggered it, the offending size, or the partial product). Including at least the dimension index and size value (and optionally the partial numel) would make this error actionable when debugging shape issues.

Suggested change

	"Tensor numel overflows ssize_t");
	"Tensor numel overflows ssize_t at dimension %zd: size=%zd, partial_numel=%zd",
	i,
	static_cast<ssize_t>(sizes_[i]),
	numel);

[Copilot]

This test assumes ssize_t is at most 64-bit (so INT32_MAX^2*3 always overflows). On platforms with wider ssize_t (or if the project ever targets such), safe_numel() could legitimately succeed and this test would fail. Consider constructing the shape to overflow based on std::numeric_limits<ssize_t>::max() (e.g., increasing the number of max-sized dimensions until overflow is guaranteed) or guarding the expectation with a static/runtime check of ssize_t width.

[github-actions]

This PR needs a release notes: label

If your change should be included in the release notes (i.e. would users of this library care about this change?), please use a label starting with release notes:. This helps us keep track and include your important work in the next release notes.

To add a label, you can comment to pytorchbot, for example
@pytorchbot label "release notes: none"

For more information, see
https://github.com/pytorch/pytorch/wiki/PyTorch-AutoLabel-Bot#why-categorize-for-release-notes-and-how-does-it-work.