Fix string tensor deserialization in ORT format models (#28133)

### Description

`ConvertInitializersIntoOrtValues()` replaces initializer TensorProtos
with ones pointing to in-memory raw buffers via
`TensorToTensorProto(..., use_tensor_buffer=true)`. For string tensors
exceeding 127 bytes, this stores a pointer to `std::string` C++ objects
as "external data"—but those objects contain heap pointers, not
serializable content. The `string_data` field ends up empty, so ORT
format save loses all string data. On reload: shape says N elements,
`string_data_size()` is 0 → deserialization fails.

Changes:
- **`tensorprotoutils.cc`**: Add `!tensor.IsDataTypeString()` guard in
`TensorToTensorProto` so string tensors always populate `string_data`
rather than taking the external-data-in-memory path
- **`graph.cc`**: Skip string tensors in
`ConvertInitializersIntoOrtValues()` since the raw-buffer optimization
is fundamentally incompatible with string data
- **`graph_test.cc`**: Add regression test creating a 20-element string
initializer, calling `ConvertInitializersIntoOrtValues()`, and verifying
string data survives

### Motivation and Context

Since onnxruntime 1.23.0, loading ORT format models with string tensor
initializers fails with:
```
INVALID_ARGUMENT: Deserialize tensor failed. UnpackTensor: the pre-allocate size does not match the size in proto
```

Reproduction: any model with a string initializer (e.g. Gather over a
string array) saved via `optimized_model_filepath` with `.ort`
extension, then reloaded.

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: tianleiwu <30328909+tianleiwu@users.noreply.github.com>
Co-authored-by: Tianlei Wu <tlwu@microsoft.com>

Author: Copilot

onnxruntime/core/framework/tensorprotoutils.cc

@@ -1934,7 +1934,10 @@ ONNX_NAMESPACE::TensorProto TensorToTensorProto(const Tensor& tensor,
   }
 
   tensor_proto.set_data_type(tensor.GetElementType());
-  if (use_tensor_buffer && tensor.SizeInBytes() > kSmallTensorExternalDataThreshold) {
+  // String tensors cannot use the external data in-memory optimization because their raw buffer
+  // contains std::string objects (with internal pointers), not serializable string content.
+  if (use_tensor_buffer && !tensor.IsDataTypeString() &&
+      tensor.SizeInBytes() > kSmallTensorExternalDataThreshold) {
     // https://github.com/microsoft/onnxruntime/blob/main/onnxruntime/core/graph/graph_flatbuffers_utils.cc#L302
     const auto* raw_data = tensor.DataRaw();
     ORT_ENFORCE(raw_data, "Missing raw data for tensor proto. Invalid tensor.");

onnxruntime/core/graph/graph.cc

@@ -3775,6 +3775,13 @@ Status Graph::ConvertInitializersIntoOrtValues() {
         continue;
       }
 
+      // String tensors cannot use the raw buffer in-memory optimization because their raw data
+      // contains std::string objects (with internal pointers), not serializable content.
+      // They are kept as regular TensorProtos and deserialized normally during inference.
+      if (utils::HasString(tensor_proto)) {
+        continue;
+      }
+
       size_t size_in_bytes = 0;
       ORT_RETURN_IF_ERROR(utils::GetSizeInBytesFromTensorProto<0>(tensor_proto, &size_in_bytes));
       if (size_in_bytes > utils::kSmallTensorExternalDataThreshold) {
@@ -4092,7 +4099,10 @@ Status Graph::InjectExternalInitializedTensors(const InlinedHashMap<std::string,
     OrtValue ort_value;
     TensorProto tensor_proto;
     constexpr const bool use_tensor_buffer_true = true;
-    if (user_tensor.SizeInBytes() > utils::kSmallTensorExternalDataThreshold) {
+    // String tensors cannot use the raw buffer in-memory optimization because their raw data
+    // contains std::string objects (with internal pointers), not serializable content.
+    if (!user_tensor.IsDataTypeString() &&
+        user_tensor.SizeInBytes() > utils::kSmallTensorExternalDataThreshold) {
       if (user_tensor.OwnsBuffer()) {
         // If the user tensor has its own memory, we avoid copying
         tensor_proto = utils::TensorToTensorProto(user_tensor, name, use_tensor_buffer_true);

onnxruntime/test/ir/graph_test.cc

@@ -5,10 +5,14 @@
 #include <fstream>
 #include "core/common/inlined_containers.h"
 #include "core/common/span_utils.h"
+#include "core/flatbuffers/ort_format_version.h"
+#include "core/flatbuffers/schema/ort.fbs.h"
 #include "core/framework/tensorprotoutils.h"
+#include "core/graph/graph_flatbuffers_utils.h"
 #include "core/graph/graph_viewer.h"
 #include "core/graph/model.h"
 #include "core/graph/op.h"
+#include "core/graph/ort_format_load_options.h"
 #include "core/session/inference_session.h"
 #include "core/session/environment.h"
 #include "test/providers/provider_test_utils.h"
@@ -2828,5 +2832,150 @@ TEST_F(GraphTest, ShapeInferenceAfterInitializerExternalization) {
   ASSERT_TRUE(second_resolve.IsOK()) << "Second resolve failed: " << second_resolve.ErrorMessage();
 }
 
+// Targeted test for the TensorToTensorProto defense-in-depth: calling with a string tensor
+// and use_tensor_buffer=true must produce a TensorProto with string_data (not external data).
+TEST_F(GraphTest, TensorToTensorProtoStringTensorDefenseInDepth) {
+  const int num_strings = 20;
+  TensorShape shape({num_strings});
+  Tensor string_tensor(DataTypeImpl::GetType<std::string>(), shape, CPUAllocator::DefaultInstance());
+  auto* data = string_tensor.MutableData<std::string>();
+  for (int i = 0; i < num_strings; ++i) {
+    data[i] = "test_value_" + std::to_string(i);
+  }
+
+  // Verify the tensor is large enough to normally trigger the external data path.
+  ASSERT_GT(string_tensor.SizeInBytes(), utils::kSmallTensorExternalDataThreshold);
+
+  // Call with use_tensor_buffer=true — defense-in-depth should still produce string_data.
+  auto tensor_proto = utils::TensorToTensorProto(string_tensor, "string_test", /*use_tensor_buffer=*/true);
+
+  ASSERT_EQ(tensor_proto.string_data_size(), num_strings)
+      << "TensorToTensorProto should populate string_data for string tensors even with use_tensor_buffer=true";
+  ASSERT_FALSE(utils::HasExternalDataInMemory(tensor_proto))
+      << "String tensor should not use external data in memory";
+
+  for (int i = 0; i < num_strings; ++i) {
+    EXPECT_EQ(tensor_proto.string_data(i), "test_value_" + std::to_string(i));
+  }
+}
+
+// Regression test: ConvertInitializersIntoOrtValues must skip string tensors because their
+// raw buffer contains std::string objects (with internal pointers), not serializable data.
+// Without the fix, string initializer data was lost when the TensorProto was replaced with
+// one using external data in memory, breaking ORT format model serialization.
+TEST_F(GraphTest, ConvertInitializersIntoOrtValuesSkipsStringTensors) {
+  ModelProto model_proto;
+  model_proto.set_ir_version(ONNX_NAMESPACE::Version::IR_VERSION);
+  auto* opset = model_proto.add_opset_import();
+  opset->set_version(17);
+  auto* graph_proto = model_proto.mutable_graph();
+  graph_proto->set_name("test_string_initializer_conversion");
+
+  // Create a string initializer with enough elements to exceed kSmallTensorExternalDataThreshold (127 bytes).
+  // sizeof(std::string) is typically 32 bytes (MSVC/libstdc++) or 24 bytes (libc++), so 20 elements
+  // will exceed 127 bytes on all major platforms (20 * 24 = 480 > 127).
+  const int num_strings = 20;
+  auto* string_initializer = graph_proto->add_initializer();
+  string_initializer->set_name("string_data");
+  string_initializer->set_data_type(ONNX_NAMESPACE::TensorProto_DataType_STRING);
+  string_initializer->add_dims(num_strings);
+  for (int i = 0; i < num_strings; ++i) {
+    string_initializer->add_string_data("value_" + std::to_string(i));
+  }
+
+  // Create a Gather node: Gather(string_data, indices) -> output
+  auto* gather_node = graph_proto->add_node();
+  gather_node->set_op_type("Gather");
+  gather_node->add_input("string_data");
+  gather_node->add_input("indices");
+  gather_node->add_output("output");
+  auto* axis_attr = gather_node->add_attribute();
+  axis_attr->set_name("axis");
+  axis_attr->set_type(ONNX_NAMESPACE::AttributeProto_AttributeType_INT);
+  axis_attr->set_i(0);
+
+  // Add graph input for indices
+  auto* input = graph_proto->add_input();
+  input->set_name("indices");
+  auto* input_type = input->mutable_type()->mutable_tensor_type();
+  input_type->set_elem_type(ONNX_NAMESPACE::TensorProto_DataType_INT64);
+  input_type->mutable_shape()->add_dim()->set_dim_value(1);
+
+  // Add graph output
+  auto* output = graph_proto->add_output();
+  output->set_name("output");
+  auto* output_type = output->mutable_type()->mutable_tensor_type();
+  output_type->set_elem_type(ONNX_NAMESPACE::TensorProto_DataType_STRING);
+  output_type->mutable_shape()->add_dim()->set_dim_value(1);
+
+  // Load and resolve
+  std::shared_ptr<Model> model;
+  ASSERT_STATUS_OK(Model::Load(std::move(model_proto), model, nullptr, *logger_));
+  Graph& graph = model->MainGraph();
+  ASSERT_STATUS_OK(graph.Resolve());
+
+  // Verify string initializer has string_data before conversion
+  const ONNX_NAMESPACE::TensorProto* init_before = nullptr;
+  ASSERT_TRUE(graph.GetInitializedTensor("string_data", init_before));
+  ASSERT_EQ(init_before->string_data_size(), num_strings);
+  ASSERT_FALSE(utils::HasExternalDataInMemory(*init_before));
+
+  // Convert initializers into OrtValues
+  ASSERT_STATUS_OK(graph.ConvertInitializersIntoOrtValues());
+
+  // After conversion, string initializer should still have string_data intact
+  // (i.e., it should NOT have been replaced with external data in memory).
+  const ONNX_NAMESPACE::TensorProto* init_after = nullptr;
+  ASSERT_TRUE(graph.GetInitializedTensor("string_data", init_after));
+  ASSERT_EQ(init_after->string_data_size(), num_strings)
+      << "String initializer data was lost during ConvertInitializersIntoOrtValues";
+  ASSERT_FALSE(utils::HasExternalDataInMemory(*init_after))
+      << "String tensor should not use external data in memory";
+
+  // Verify the string content is preserved
+  for (int i = 0; i < num_strings; ++i) {
+    EXPECT_EQ(init_after->string_data(i), "value_" + std::to_string(i));
+  }
+
+  // End-to-end: save to ORT format and reload, verifying string data survives the round-trip.
+  flatbuffers::FlatBufferBuilder builder;
+  {
+    flatbuffers::Offset<fbs::Model> fbs_model_offset;
+    ASSERT_STATUS_OK(model->SaveToOrtFormat(builder, fbs_model_offset));
+    flatbuffers::Offset<fbs::InferenceSession> fbs_session_offset =
+        fbs::CreateInferenceSessionDirect(builder,
+                                          std::to_string(kOrtModelVersion).c_str(),
+                                          fbs_model_offset,
+                                          0);
+    builder.Finish(fbs_session_offset);
+  }
+
+  // Load back from ORT format buffer
+  {
+    const auto* fbs_buffer = builder.GetBufferPointer();
+    const auto* fbs_session = fbs::GetInferenceSession(fbs_buffer);
+    ASSERT_NE(fbs_session, nullptr);
+    ASSERT_NE(fbs_session->model(), nullptr);
+
+    OrtFormatLoadOptions load_options;
+    std::unique_ptr<Model> loaded_model;
+    ASSERT_STATUS_OK(Model::LoadFromOrtFormat(*fbs_session->model(),
+                                              nullptr,  // local_registries
+                                              load_options,
+                                              *logger_,
+                                              loaded_model));
+
+    // Verify the string initializer survived the ORT format round-trip
+    const auto& loaded_graph = loaded_model->MainGraph();
+    const ONNX_NAMESPACE::TensorProto* loaded_init = nullptr;
+    ASSERT_TRUE(loaded_graph.GetInitializedTensor("string_data", loaded_init));
+    ASSERT_EQ(loaded_init->string_data_size(), num_strings)
+        << "String initializer data was lost during ORT format save/load round-trip";
+    for (int i = 0; i < num_strings; ++i) {
+      EXPECT_EQ(loaded_init->string_data(i), "value_" + std::to_string(i));
+    }
+  }
+}
+
 }  // namespace test
 }  // namespace onnxruntime