Fix uninitialised _outputNames in ETCoreMLModelProfiler causing crash when debug_buffer_size=0

[notaJiminLee]

Summary

ETCoreMLModelProfiler::initWithModel:configuration:error: does not initialise the _outputNames property, leaving it as nil. This causes an NSRangeException crash when enable_etdump=True with
debug_buffer_size=0.

Root cause:

When _outputNames is nil, set_model_outputs() iterates over nil.count (0) and produces an empty NSMutableArray. This empty array is returned as modelOutputs from profileModelWithInputs. Later,
ETCoreMLModelManager attempts to access modelOutputs[0].shape for dynamic shape resizing, triggering:

NSRangeException: *** -[__NSArrayM objectAtIndexedSubscript:]: index 0 beyond bounds for empty array

This manifests as RuntimeError: Caught an unknown exception! at the Python level.

Why this was not caught earlier:

When debug_buffer_size > 0, kIntermediateOutputs debug level is set, which enables both log_profiling_info and log_intermediate_tensors. In ETCoreMLModelAnalyzer::executeModelWithInputs, the
debugModelWithInputs path runs after profiling and overwrites the empty array with valid outputs, masking the bug.

Fix:

Add _outputNames = model.orderedOutputNames; in the initialiser, consistent with how outputNames is used in profilingInfoForOperationsAtPaths: at line 319.

Test plan

Tested on macOS 15.6 (arm64) with a CoreML model (input: 1x3x640x640, 3 outputs):

from executorch.runtime import Runtime, Verification
import torch

rt = Runtime.get()
prog = rt.load_program("output_coreml.pte",
                        verification=Verification.Minimal,
                        enable_etdump=True,
                        debug_buffer_size=0)
method = prog.load_method("forward")
out = method.execute(torch.randn(1, 3, 640, 640))  # Previously crashed
prog.write_etdump_result_to_file("profile.etdump", "debug.bin")

┌──────────────────────────────────┬────────────────────────┬──────────────────────────────────┐
│             Scenario             │         Before         │              After               │
├──────────────────────────────────┼────────────────────────┼──────────────────────────────────┤
│ debug_buffer_size=0              │ NSRangeException crash │ Success, ETDump with timing data │
├──────────────────────────────────┼────────────────────────┼──────────────────────────────────┤
│ debug_buffer_size>0 (sufficient) │ Success (bug masked)   │ Success                          │
├──────────────────────────────────┼────────────────────────┼──────────────────────────────────┤
│                                  │                        │                                  │
└──────────────────────────────────┴────────────────────────┴──────────────────────────────────┘

cc @kimishpatel @YifanShenSZ @cymbalrush @metascroy

[pytorch-bot]

🔗 Helpful Links

🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/18763

• 📄 Preview Python docs built from this PR

Note: Links to docs will display an error until the docs builds have been completed.

❗ 1 Active SEVs

There are 1 currently active SEVs. If your PR is affected, please view them below:

• Rolling out OSDC (ARC) runners on pull workflow for PyTorch trunk commits

❌ 1 Awaiting Approval, 18 Cancelled Jobs, 2 Unrelated Failures

As of commit e30a7c1 with merge base 4afd7f9 ():

AWAITING APPROVAL - The following workflow needs approval before CI can run:

• periodic (gh)

CANCELLED JOBS - The following jobs were cancelled. Please retry:

• pull / test-eval_llama-wikitext-linux / linux-job (gh)
  ##[error]The operation was canceled.
• pull / test-llama-runner-qnn-linux (fp32, qnn_16a16w, qnn) / linux-job (gh)
  ##[error]The operation was canceled.
• pull / test-lora-linux / linux-job (gh)
  ##[error]The operation was canceled.
• pull / test-lora-multimethod-linux / linux-job (gh)
  ##[error]The operation was canceled.
• pull / test-models-linux (ic4, portable, linux.4xlarge.memory) / linux-job (gh)
  ##[error]The operation was canceled.
• pull / test-models-linux (ic4, xnnpack-quantization-delegation, linux.4xlarge.memory) / linux-job (gh)
  ##[error]The operation was canceled.
• pull / test-models-linux (mobilebert, portable, linux.2xlarge) / linux-job (gh)
  ##[error]The operation was canceled.
• pull / test-models-linux (mobilebert, xnnpack-quantization-delegation, linux.2xlarge) / linux-job (gh)
  ##[error]The operation was canceled.
• pull / test-models-linux (phi_4_mini, portable, linux.4xlarge.memory) / linux-job (gh)
  ##[error]The operation was canceled.
• pull / test-moshi-linux / linux-job (gh)
  ##[error]The operation was canceled.
• pull / test-parakeet-xnnpack-linux / linux-job (gh)
  ##[error]The operation was canceled.
• pull / test-phi-3-mini-runner-linux / linux-job (gh)
  ##[error]The operation was canceled.
• pull / test-sqnr-static-llm-qnn-linux (smollm2_135m) / linux-job (gh)
  ##[error]The operation was canceled.
• pull / test-voxtral-realtime-xnnpack-linux / linux-job (gh)
  ##[error]The operation was canceled.
• pull / test-vulkan-models-linux / linux-job (gh)
  ##[error]The operation was canceled.
• pull / unittest / linux / linux-job (gh)
  ##[error]The operation was canceled.
• pull / unittest-arm-backend-with-no-deps (test_pytest_models_tosa) / linux-job (gh)
  ##[error]The operation was canceled.
• pull / unittest-editable / linux / linux-job (gh)
  ##[error]The operation was canceled.

BROKEN TRUNK - The following jobs failed but were present on the merge base:

👉 Rebase onto the `viable/strict` branch to avoid these failures

• pull / unittest / windows / windows-job (gh) (trunk failure)
  ##[error]The operation was canceled.
• pull / unittest-editable / windows / windows-job (gh) (trunk failure)
  ##[error]The operation was canceled.

This comment was automatically generated by Dr. CI and updates every 15 minutes.

[meta-cla]

Hi @notaJiminLee!

Thank you for your pull request and welcome to our community.

Action Required

In order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you.

Process

In order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA.

Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with CLA signed. The tagging process may take up to 1 hour after signing. Please give it that time before contacting us about it.

If you have received this in error or have any questions, please contact us at cla@meta.com. Thanks!

[pytorch-bot]

Didn't find following labels among repository labels: release notes: bug fix

[notaJiminLee]

@pytorchbot label "release notes: apple"

[meta-cla]

Thank you for signing our Contributor License Agreement. We can now accept your code for this (and any) Meta Open Source project. Thanks!

[pytorch-bot]

To add the ciflow label ciflow/trunk please first approve the workflows that are awaiting approval (scroll to the bottom of this page).

This helps ensure we don't trigger CI on this PR until it is actually authorized to do so. Please ping one of the reviewers if you do not have access to approve and run workflows.

[meta-codesync]

@metascroy has imported this pull request. If you are a Meta employee, you can view this in D100369384.

[metascroy]

@claude review this PR

[metascroy]

Thank you for the fix @notaJiminLee! Let's see what CI says

[claude]

Claude finished @metascroy's task in 2m 4s —— View job

---

Review of PR #18763

• Read the changed file and understand the fix in context
• Check the initialization pattern in related classes (e.g., ETCoreMLModelAnalyzer, ETCoreMLModelDebugger)
• Verify usage of _outputNames in the profiler
• Post review feedback

---

Verdict: This fix is correct and well-targeted.

The change adds a single missing initialization on line 279 of ETCoreMLModelProfiler.mm:

_outputNames = model.orderedOutputNames;

Analysis

The _outputNames ivar backs the outputNames property declared at line 228:

@property (readonly, copy, nonatomic) NSOrderedSet<NSString *> *outputNames;

Without this initialization, self.outputNames is nil. When set_model_outputs() (line 205-218) is called at line 320, it iterates over nil.count (which is 0 in Objective-C), producing an empty NSMutableArray. This empty array is then returned as modelOutputs from profileModelWithInputs at line 115 of ETCoreMLModelAnalyzer.mm, and any downstream code indexing into it will crash with NSRangeException.

Why the fix is correct

1. Consistent with the debugger path. ETCoreMLModelDebugger receives outputNames explicitly via its initializer (line 555 of ETCoreMLModelDebugger.mm: _outputNames = [outputNames copy]), and the caller passes self.model.orderedOutputNames (line 132 of ETCoreMLModelAnalyzer.mm). The profiler already has the model reference, so pulling from model.orderedOutputNames directly is the right approach.

2. Consistent with usage in the same file. self.outputNames is used at line 320 when calling set_model_outputs(outputFeatures, self.outputNames, modelOutputs) — this property must be initialized for the profiler to work correctly.

3. orderedOutputNames on ETCoreMLModel is guaranteed non-nil — it's a readonly, copy property set during the model's own initialization.

4. The PR author's explanation of why this wasn't caught earlier is accurate. When debug_buffer_size > 0, kIntermediateOutputs debug level enables both log_profiling_info and log_intermediate_tensors. Looking at executeModelWithInputs (lines 182-196 of ETCoreMLModelAnalyzer.mm), the debugModelWithInputs call at line 192 runs after profileModelWithInputs and overwrites outputs, masking the empty-array issue.

One minor note

The property is declared copy, but the direct ivar assignment _outputNames = model.orderedOutputNames; does not call copy. This is fine here — all other ivars in the same initializer block (lines 278-284) follow the same pattern of direct assignment without copy, which is standard practice in designated initializers. The copy semantics on the property only apply when using the property setter (dot syntax), not direct ivar access.

No additional changes needed. Clean, minimal fix.