cudf::tile computes its output row count with 32-bit signed multiplication (auto out_num_rows = in_num_rows * count; at cpp/src/reshape/tile.cu:44) and has no product guard, so any request whose true output exceeds INT32_MAX rows silently wraps.
Two observed failure modes against libcudf 26.10 nightly (RTX 5060 Ti):
tile(3-row int8 table, count = INT32_MAX): the product 6442450941 wraps to +2147483645; the call returns normally with a table of 2147483645 rows, violating the documented contract output.num_rows() == input.num_rows() * count (include/cudf/reshape.hpp). Silent wrong answer.
tile(2-row int8 table, count = INT32_MAX): the product wraps to -2; the call surfaces as rmm::out_of_memory trying to allocate 18446744073709551614 bytes instead of a clean overflow message.
The sibling API with the same shape already has the repo-standard guard (cpp/src/filling/repeat.cu, also strings/repeat_strings.cu):
CUDF_EXPECTS(input_table.num_rows() <= std::numeric_limits<size_type>::max() / count,
"The resulting table exceeds the column size limit",
std::overflow_error);
Suggested fix: add the same CUDF_EXPECTS after the zero-row early return in tile (there count > 0 and in_num_rows > 0 are guaranteed, so no division-by-zero concern).
cudf::tilecomputes its output row count with 32-bit signed multiplication (auto out_num_rows = in_num_rows * count;atcpp/src/reshape/tile.cu:44) and has no product guard, so any request whose true output exceedsINT32_MAXrows silently wraps.Two observed failure modes against libcudf 26.10 nightly (RTX 5060 Ti):
tile(3-row int8 table, count = INT32_MAX): the product 6442450941 wraps to +2147483645; the call returns normally with a table of 2147483645 rows, violating the documented contractoutput.num_rows() == input.num_rows() * count(include/cudf/reshape.hpp). Silent wrong answer.tile(2-row int8 table, count = INT32_MAX): the product wraps to -2; the call surfaces asrmm::out_of_memorytrying to allocate 18446744073709551614 bytes instead of a clean overflow message.The sibling API with the same shape already has the repo-standard guard (
cpp/src/filling/repeat.cu, alsostrings/repeat_strings.cu):Suggested fix: add the same
CUDF_EXPECTSafter the zero-row early return intile(therecount > 0andin_num_rows > 0are guaranteed, so no division-by-zero concern).