[错误]: 在 set_shape() 扩展秩后,ROI 张量保留其所有者的步长 — ITensor::copy_to() 读取越界 (生产环境中出现 SIGSEGV)

RoiTensor::get_strides() returns the strides of the tensor it is a view of, but BaseRoiTensor::set_shape() is allowed to expand the ROI's rank with leading ones (added in #22257). After such a set_shape(), the tensor reports a shape of rank N and strides of rank M < N.

ITensor::copy_to() performs that set_shape() itself and then walks shape and strides in lockstep, so a rank-1 ROI used as the destination of a rank-2 copy makes it read dst_strides[1] out of bounds. When the stale value there happens to compare equal, the "find a step" loop never fires, both stride vectors are left empty, and the copy loop evaluates src_strides[src_strides.size() - 1] — that is, src_strides[SIZE_MAX] — which dereferences data() - 8 on an empty vector and faults at 0xFFFFFFFFFFFFFFF8.

This kills the whole model server process. We hit it 9 times across independent runs on a stock image.