使用pnnx导出Qwen3 会报doule free 错误

[runrunrun1994]

error log | 日志或报错信息 | ログ

使用 pnnx 20250530 的版本转化Qwen3 会报 double free

############# pass_level1
############# pass_level2
############# pass_level3
############# pass_level4
############# pass_level5
free(): double free detected in tcache 2

使用C++版本 + gdb debug 发现是 pass_level5 里面的fuse_slice_to_tensor_split里面报错
#0 0x00007fffe2127a7c in pthread_kill () from /lib/x86_64-linux-gnu/libc.so.6
#1 0x00007fffe20d3476 in raise () from /lib/x86_64-linux-gnu/libc.so.6
#2 0x00007fffe20b97f3 in abort () from /lib/x86_64-linux-gnu/libc.so.6
#3 0x00007fffe211a6f6 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#4 0x00007fffe2131d7c in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#5 0x00007fffe213412b in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#6 0x00007fffe21364d3 in free () from /lib/x86_64-linux-gnu/libc.so.6
#7 0x0000555555612c76 in __gnu_cxx::new_allocator<std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> > >::deallocate(std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> >, unsigned long) ()
#8 0x0000555555611aea in std::allocator_traits<std::allocator<std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> > > >::deallocate(std::allocator<std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> > >&, std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> >, unsigned long) ()
#9 0x000055555560fb33 in std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits, std::allocator >, std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> >, std::less<std::__cxx11::basic_string<char, std::char_traits, std::allocator > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> > >::_M_put_node(std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> >) ()
#10 0x000055555560c03a in std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits, std::allocator >, std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> >, std::less<std::__cxx11::basic_string<char, std::char_traits, std::allocator > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> > >::_M_drop_node(std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> >) ()
#11 0x0000555555607f4a in std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits, std::allocator >, std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> >, std::less<std::__cxx11::basic_string<char, std::char_traits, std::allocator > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> > >::_M_erase(std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> >) ()
#12 0x0000555555607f27 in std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits, std::allocator >, std::pair<std::__cxx11::basic_str--Type for more, q to quit, c to continue without paging--
ing<char, std::char_traits, std::allocator > const, pnnx::Parameter>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> >, std::less<std::__cxx11::basic_string<char, std::char_traits, std::allocator > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> > >::_M_erase(std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> >) ()
#13 0x0000555555607f27 in std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits, std::allocator >, std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> >, std::less<std::__cxx11::basic_string<char, std::char_traits, std::allocator > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> > >::_M_erase(std::_Rb_tree_node<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> >*) ()
#14 0x0000555555604c20 in std::_Rb_tree<std::__cxx11::basic_string<char, std::char_traits, std::allocator >, std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter>, std::_Select1st<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> >, std::less<std::__cxx11::basic_string<char, std::char_traits, std::allocator > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> > >::~_Rb_tree() ()
#15 0x000055555560379e in std::map<std::__cxx11::basic_string<char, std::char_traits, std::allocator >, pnnx::Parameter, std::less<std::__cxx11::basic_string<char, std::char_traits, std::allocator > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits, std::allocator > const, pnnx::Parameter> > >::~map() ()
#16 0x0000555555603d60 in pnnx::Operator::~Operator() ()
#17 0x000055555576b06f in pnnx::fuse_slice_to_tensor_split(pnnx::Graph&) ()
#18 0x0000555555630025 in pnnx::pass_level5(pnnx::Graph&, std::set<std::__cxx11::basic_string<char, std::char_traits, std::allocator >, std::less<std::__cxx11::basic_string<char, std::char_traits, std::allocator > >, std::allocator<std::__cxx11::basic_string<char, std::char_traits, std::allocator > > > const&, std::__cxx11::basic_string<char, std::char_traits, std::allocator > const&) ()
#19 0x00005555555e7511 in main ()

model | 模型 | モデル

1. original model

how to reproduce | 复现步骤 | 再現方法

[dosubot]

Hi @runrunrun1994! I'm Dosu and I’m helping the ncnn team.

你的 double free 错误很可能是 fuse_slice_to_tensor_split 里对 Operator 对象的内存管理出现了问题，尤其是在删除 slice_n_ops 时，可能有重复删除或资源归属不清的情况。近期相关 PR（如#3988、#5253、#4006）已经修正了部分切片融合和内存管理逻辑，但这些代码已包含在你用的 20250530 版本，说明 bug 可能还存在于某些边界场景。

建议你可以尝试：

• 检查 Qwen3 模型的切片操作是否有特殊或复杂的连续切片，可能触发了重复删除。
• 临时绕过 fuse_slice_to_tensor_split 这个 pass，看能否规避问题（比如注释掉 pass_level5.cpp 里的 fuse_slice_to_tensor_split(g);）。
• 如果方便，尝试用更简单的模型或裁剪后的 Qwen3 复现，定位具体触发条件。

目前没有官方文档或 issue 直接讨论这个 double free 问题，建议关注后续 pnnx 的更新，或进一步分析 Operator 删除逻辑是否有浅拷贝或多次归属的问题。相关代码和变更可参考 fuse_slice_to_tensor_split.cpp。

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}