Guard three graph-optimizer passes against unbounded model-supplied indices

[titaiwangms]

Description

Three graph-optimizer passes that run at model load time index into a vector using a
count/axis/index taken directly from the model graph, without validating it against the
bounds of the vector being indexed:

1. GatherSliceToSplitFusion (onnxruntime/core/optimizer/gather_fusion.cc): reads an
   axis from a candidate Gather/Slice consumer and indexes the shared input's shape
   with it (shape->dim(axis)). ONNX's own shape inference for Gather/Slice only range-checks
   axis when it can resolve the shapes of all relevant inputs; if it cannot (e.g. an unresolvable
   indices/axis input shape), that check is skipped, and this fusion pass previously had no
   independent bounds check of its own.

2. Transpose optimizer's HandleTile (onnxruntime/core/optimizer/transpose_optimization/onnx_transpose_optimization.cc):
   assumes a constant Tile repeats initializer has one entry per dimension of the
   preceding Transpose's rank (taken from that node's perm attribute), and indexes it
   accordingly. Similarly, ONNX's own Tile shape inference only validates repeats.size()
   against the input rank when it can resolve the data input's shape; if it cannot, this
   validation is skipped, and there was no independent check before indexing repeats.

3. WhereDummyDq (onnxruntime/core/optimizer/qdq_transformer/where_dummy_dq.cc):
   unconditionally reads DequantizeLinear's 3rd input (x_zero_point, at index 2) to
   fetch its initializer. Per the ONNX spec, x_zero_point is an optional input, so a
   valid DequantizeLinear node can have only 2 inputs (x, x_scale), making this an
   out-of-bounds read on InputDefs().

Fix

Each pass now validates the model-supplied value against the actual bound before using it
to index, and safely skips the optimization (rather than asserting/crashing) when the value
is out of range:

• GatherSliceToSplitFusion: skip fusing this candidate if axis < 0 || axis >= rank.
• HandleTile: return false (leave the node alone) if repeats.size() != rank.
• WhereDummyDq: log a warning and skip inserting a dummy DQ if the DQ node has fewer than
  3 inputs.

Other execution providers

All three passes are execution-provider-agnostic graph transformations that run before EP
partitioning, so no EP-specific (e.g. CUDA) equivalent exists or needs a separate fix.

Testing

Added regression tests, using TestGraphTransformer (which applies the transformer and
inspects the resulting graph without executing the model, since some of the malformed
inputs used to reach these code paths are not valid inputs to actually run):

• graph_transform_test.cc: GatherSliceToSplitFusion_OutOfRangeAxis — a Gather node
  with an out-of-range axis, where the sibling indices input has no static shape so
  ONNX's own inference cannot catch it ahead of time. Verifies the fusion pass leaves the
  graph unchanged.
• transpose_optimizer_test.cc: TestTileRepeatsRankMismatchNoOpt — a Transpose -> Tile -> Transpose pattern where repeats is shorter than the rank implied by the
  Transpose's perm, with the data input's shape left unresolved. Verifies both
  Transposes and the Tile remain untouched.
• qdq_transformer_test.cc: WhereDummyDqTest_DqWithoutZeroPoint — a DequantizeLinear
  with only 2 inputs (no zero-point) feeding a Where node. Verifies no dummy DQ is
  inserted and the graph is otherwise unmodified.

All three new tests were confirmed to fail (or crash) when the corresponding fix was
temporarily reverted, and pass cleanly with the fix in place. The full
GraphTransformationTests, TransposeOptimizerTests, and QDQTransformerTests suites
were also run locally with no regressions.

Motivation

These three passes run by default during CreateSession (default optimization level),
processing whatever graph structure the model declares. Guarding the indexing operations
against out-of-range model-supplied values makes these passes resilient to malformed or
adversarial models without changing behavior for well-formed ones.

[Copilot]

Pull request overview

This PR hardens three model-load-time graph-optimizer passes against out-of-bounds indexing when consuming model-supplied axes/indices (including optional inputs), preventing crashes/asserts on malformed or adversarial models while preserving behavior for valid models.

Changes:

• Add bounds checks in GatherSliceToSplitFusion (axis vs rank), transpose optimizer HandleTile (repeats length vs rank), and WhereDummyDq (optional DQ zero-point input).
• Add regression tests that exercise these previously-unchecked paths using TestGraphTransformer/direct transformer application.
• Minor test wiring to instantiate TransposeOptimizer directly for the new Tile regression test.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
onnxruntime/core/optimizer/gather_fusion.cc	Reject out-of-range axis before indexing into the shared input shape during Gather/Slice→Split fusion.
onnxruntime/core/optimizer/transpose_optimization/onnx_transpose_optimization.cc	Guard Tile handler against repeats.size() != rank before indexing repeats using perm_inv.
onnxruntime/core/optimizer/qdq_transformer/where_dummy_dq.cc	Guard DequantizeLinear optional zero-point input before reading InputDefs()[2], skipping the optimization safely.
onnxruntime/test/optimizer/graph_transform_test.cc	Add regression test for out-of-range Gather axis reaching the fusion pass.
onnxruntime/test/optimizer/transpose_optimizer_test.cc	Add regression test for Tile repeats/rank mismatch reaching transpose optimizer handler without static rank.
onnxruntime/test/optimizer/qdq_transformer_test.cc	Add regression test covering a valid 2-input DequantizeLinear feeding Where, ensuring no dummy DQ insertion.