Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

optimization_counter_threshold crashes debug JIT for 0,1 #35196

Closed
aartbik opened this issue Nov 16, 2018 · 4 comments

Comments

Projects
None yet
4 participants
@aartbik
Copy link
Contributor

commented Nov 16, 2018

Using value 0 or 1 for optimization_counter_threshold crashes every debug JIT run.
Only values -1 (never) or >=2 (later) work as expected.

This seems to crash for any dart file.

$ dart --optimization_counter_threshold=0 fuzz.dart

../../runtime/vm/thread.cc: 715: error: expected: top_exit_frame_info() == 0
Dumping native stack trace for thread 25490
[0x00005637fc917bbf] dart::Profiler::DumpStackTrace(void*)
[0x00005637fc917bbf] dart::Profiler::DumpStackTrace(void*)
[0x00005637fcb49a92] dart::Assert::Fail(char const*, ...)
[0x00005637fc9ae8c2] Unknown symbol
[0x00005637fc9b163e] dart::ThreadRegistry::VisitObjectPointers(dart::ObjectPointerVisitor*, dart::ValidationPolicy)
[0x00005637fcb0b3aa] dart::Scavenger::IterateRoots(dart::Isolate*, dart::ScavengerVisitor*)
[0x00005637fcb0be29] dart::Scavenger::Scavenge()
[0x00005637fcb00419] dart::Heap::CollectNewSpaceGarbage(dart::Thread*, dart::Heap::GCReason)
[0x00005637fcafef3e] dart::Heap::AllocateNew(long)
[0x00005637fc870e1b] dart::Object::Allocate(long, long, dart::Heap::Space)
[0x00005637fc8dc39c] dart::Instance::New(dart::Class const&, dart::Heap::Space)
[0x00005637fc965eb7] dart::DRT_AllocateObject(dart::NativeArguments)

@rmacnak-google

@aartbik aartbik added the dartfuzz label Nov 16, 2018

@aartbik aartbik changed the title optimization_counter_threshold crashes for 0,1 optimization_counter_threshold crashes debug JIT for 0,1 Nov 16, 2018

@aartbik

This comment has been minimized.

Copy link
Contributor Author

commented Nov 16, 2018

Maybe related to #29440 ?
It often crashes in other ways too, sometimes it actually passes, depending on checkout and build.

dart-bot pushed a commit that referenced this issue Nov 16, 2018

[dart/fuzzer] Add mode to stress test JIT optimization
Rationale:
We get pretty good coverage on unoptimized path for JIT,
but the optimized path depends heavily on whether functions
are called often in the fuzz generated code. This mode
adds coverage of going quicker into the optimized path.

Note:
This mode already exposed an issue with DEBUG JIT.

#35196

Change-Id: Ib32b4ba449cb7b2b777d669ef264742aa44a9ccc
Reviewed-on: https://dart-review.googlesource.com/c/84680
Reviewed-by: Ryan Macnak <rmacnak@google.com>
Commit-Queue: Aart Bik <ajcbik@google.com>

dart-bot pushed a commit that referenced this issue Nov 19, 2018

[dart/fuzzer] Disable jit-opt modes
Rationale:
None of the jit-opt-xxx modes gives any useful
information while the flag is not stable.

#35196

Change-Id: I103931a21a1d9d8293b3044f00e9a73c0f6fe6f5
Reviewed-on: https://dart-review.googlesource.com/c/84827
Reviewed-by: Alexander Thomas <athom@google.com>
Commit-Queue: Aart Bik <ajcbik@google.com>
@aartbik

This comment has been minimized.

Copy link
Contributor Author

commented Nov 26, 2018

A test run on the cluster with debug enabled reveals that the current crashes are in the constant evaluator:

running [/b/s/w/ir/cache/builder/sdk/out/DebugIA32/dart, --optimization_counter_threshold=1, /b/s/w/ir/tmp/t/dart_fuzzDCSHTX/fuzz.dart] yields:
  -6
  ../../runtime/vm/compiler/frontend/constant_evaluator.cc: 48: error: expected: IsAllowedToEvaluate()

With the stack trace:

../../runtime/vm/compiler/frontend/constant_evaluator.cc: 48: error: expected: IsAllowedToEvaluate()
  Dumping native stack trace for thread 4631
    [0x0123be7c] dart::Profiler::DumpStackTrace(void*)
    [0x0123be7c] dart::Profiler::DumpStackTrace(void*)
    [0x014bdae4] Dart_DumpNativeStackTrace
    [0x014bfaeb] dart::Assert::Fail(char const*, ...)
    [0x013f8bfa] dart::kernel::ConstantEvaluator::EvaluateExpression(int, bool)
    [0x01402243] dart::kernel::StreamingFlowGraphBuilder::BuildGraphOfFieldInitializer()
    [0x0140c63d] dart::kernel::StreamingFlowGraphBuilder::BuildGraph()
    [0x014216e4] dart::kernel::FlowGraphBuilder::BuildGraph()
    [0x014509bc] dart::DartCompilationPipeline::BuildFlowGraph(dart::Zone*, dart::ParsedFunction*, dart::ZoneGrowableArray<dart::ICData const*>*, int, bool)
    [0x01453407] dart::CompileParsedFunctionHelper::Compile(dart::CompilationPipeline*)
    [0x0145488b] Unknown symbol
    [0x01455b26] dart::Compiler::CompileOptimizedFunction(dart::Thread*, dart::Function const&, int)
    [0x012a0f30] dart::DRT_OptimizeInvokedFunction(dart::NativeArguments)
    [0xf7100776] Unknown symbol
    [0xf7100abc] Unknown symbol
    [0xf7100b70] Unknown symbol
    [0x010f5913] dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&, dart::Array const&, unsigned int)
    [0x010f54d8] dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&)
    [0x01456fba] dart::Compiler::EvaluateStaticInitializer(dart::Field const&)
    [0x013f9250] dart::kernel::ConstantEvaluator::EvaluateStaticGet()
    [0x013f8a94] dart::kernel::ConstantEvaluator::EvaluateExpression(int, bool)
    [0x013f963e] dart::kernel::ConstantEvaluator::EvaluateMethodInvocation()
    [0x013f8aa1] dart::kernel::ConstantEvaluator::EvaluateExpression(int, bool)
    [0x01402243] dart::kernel::StreamingFlowGraphBuilder::BuildGraphOfFieldInitializer()
    [0x0140c63d] dart::kernel::StreamingFlowGraphBuilder::BuildGraph()
    [0x014216e4] dart::kernel::FlowGraphBuilder::BuildGraph()
    [0x014509bc] dart::DartCompilationPipeline::BuildFlowGraph(dart::Zone*, dart::ParsedFunction*, dart::ZoneGrowableArray<dart::ICData const*>*, int, bool)
    [0x01453407] dart::CompileParsedFunctionHelper::Compile(dart::CompilationPipeline*)
    [0x01456f40] dart::Compiler::EvaluateStaticInitializer(dart::Field const&)
    [0x013f9250] dart::kernel::ConstantEvaluator::EvaluateStaticGet()
    [0x013f8a94] dart::kernel::ConstantEvaluator::EvaluateExpression(int, bool)
    [0x013f963e] dart::kernel::ConstantEvaluator::EvaluateMethodInvocation()
    [0x013f8aa1] dart::kernel::ConstantEvaluator::EvaluateExpression(int, bool)
    [0x01402243] dart::kernel::StreamingFlowGraphBuilder::BuildGraphOfFieldInitializer()
    [0x0140c63d] dart::kernel::StreamingFlowGraphBuilder::BuildGraph()
    [0x014216e4] dart::kernel::FlowGraphBuilder::BuildGraph()
    [0x014509bc] dart::DartCompilationPipeline::BuildFlowGraph(dart::Zone*, dart::ParsedFunction*, dart::ZoneGrowableArray<dart::ICData const*>*, int, bool)
    [0x01453407] dart::CompileParsedFunctionHelper::Compile(dart::CompilationPipeline*)
    [0x01456f40] dart::Compiler::EvaluateStaticInitializer(dart::Field const&)
    [0x013f9250] dart::kernel::ConstantEvaluator::EvaluateStaticGet()
    [0x013f8a94] dart::kernel::ConstantEvaluator::EvaluateExpression(int, bool)
    [0x013f963e] dart::kernel::ConstantEvaluator::EvaluateMethodInvocation()
    [0x013f8aa1] dart::kernel::ConstantEvaluator::EvaluateExpression(int, bool)
    [0x01402243] dart::kernel::StreamingFlowGraphBuilder::BuildGraphOfFieldInitializer()
    [0x0140c63d] dart::kernel::StreamingFlowGraphBuilder::BuildGraph()
    [0x014216e4] dart::kernel::FlowGraphBuilder::BuildGraph()
    [0x014509bc] dart::DartCompilationPipeline::BuildFlowGraph(dart::Zone*, dart::ParsedFunction*, dart::ZoneGrowableArray<dart::ICData const*>*, int, bool)
    [0x01453407] dart::CompileParsedFunctionHelper::Compile(dart::CompilationPipeline*)
    [0x01456f40] dart::Compiler::EvaluateStaticInitializer(dart::Field const&)
    [0x013f9250] dart::kernel::ConstantEvaluator::EvaluateStaticGet()
    [0x013f8a94] dart::kernel::ConstantEvaluator::EvaluateExpression(int, bool)
    [0x0140ee06] dart::kernel::StreamingFlowGraphBuilder::BuildStaticGet(dart::TokenPosition*)
    [0x0140283a] dart::kernel::StreamingFlowGraphBuilder::BuildExpression(dart::TokenPosition*)
    [0x0140f4ed] dart::kernel::StreamingFlowGraphBuilder::BuildMethodInvocation(dart::TokenPosition*)
    [0x014026b1] dart::kernel::StreamingFlowGraphBuilder::BuildExpression(dart::TokenPosition*)
    [0x0140f4ed] dart::kernel::StreamingFlowGraphBuilder::BuildMethodInvocation(dart::TokenPosition*)
    [0x014026b1] dart::kernel::StreamingFlowGraphBuilder::BuildExpression(dart::TokenPosition*)
    [0x0140f4ed] dart::kernel::StreamingFlowGraphBuilder::BuildMethodInvocation(dart::TokenPosition*)
    [0x014026b1] dart::kernel::StreamingFlowGraphBuilder::BuildExpression(dart::TokenPosition*)
    [0x0140f4ed] dart::kernel::StreamingFlowGraphBuilder::BuildMethodInvocation(dart::TokenPosition*)
    [0x014026b1] dart::kernel::StreamingFlowGraphBuilder::BuildExpression(dart::TokenPosition*)
    [0x0140f4ed] dart::kernel::StreamingFlowGraphBuilder::BuildMethodInvocation(dart::TokenPosition*)
    [0x014026b1] dart::kernel::StreamingFlowGraphBuilder::BuildExpression(dart::TokenPosition*)
    [0x0140f4ed] dart::kernel::StreamingFlowGraphBuilder::BuildMethodInvocation(dart::TokenPosition*)
    [0x014026b1] dart::kernel::StreamingFlowGraphBuilder::BuildExpression(dart::TokenPosition*)
    [0x01419abe] dart::kernel::StreamingFlowGraphBuilder::BuildArgumentsFromActualArguments(dart::Array*, bool, bool)
    [0x014042c2] dart::kernel::StreamingFlowGraphBuilder::BuildInitializers(dart::Class const&)
    [0x0140ae27] dart::kernel::StreamingFlowGraphBuilder::BuildFunctionBody(dart::Function const&, dart::LocalVariable*, bool)
    [0x0140bc25] dart::kernel::StreamingFlowGraphBuilder::BuildGraphOfFunction(bool)
    [0x0140c6ef] dart::kernel::StreamingFlowGraphBuilder::BuildGraph()
    [0x014216e4] dart::kernel::FlowGraphBuilder::BuildGraph()
    [0x014509bc] dart::DartCompilationPipeline::BuildFlowGraph(dart::Zone*, dart::ParsedFunction*, dart::ZoneGrowableArray<dart::ICData const*>*, int, bool)
    [0x01453407] dart::CompileParsedFunctionHelper::Compile(dart::CompilationPipeline*)
    [0x0145488b] Unknown symbol
    [0x01454243] dart::Compiler::CompileFunction(dart::Thread*, dart::Function const&)
    [0x010f57cb] dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&, dart::Array const&, unsigned int)
    [0x013fcf2c] dart::kernel::ConstantEvaluator::RunFunction(dart::TokenPosition, dart::Function const&, dart::Array const&, dart::Array const&)
    [0x013fcdb0] dart::kernel::ConstantEvaluator::RunFunction(dart::TokenPosition, dart::Function const&, int, dart::Instance const*, dart::TypeArguments const*)
    [0x013fa103] dart::kernel::ConstantEvaluator::EvaluateConstructorInvocationInternal()
    [0x013f8b0d] dart::kernel::ConstantEvaluator::EvaluateExpression(int, bool)
    [0x01402243] dart::kernel::StreamingFlowGraphBuilder::BuildGraphOfFieldInitializer()
    [0x0140c63d] dart::kernel::StreamingFlowGraphBuilder::BuildGraph()
    [0x014216e4] dart::kernel::FlowGraphBuilder::BuildGraph()
    [0x014509bc] dart::DartCompilationPipeline::BuildFlowGraph(dart::Zone*, dart::ParsedFunction*, dart::ZoneGrowableArray<dart::ICData const*>*, int, bool)
    [0x01453407] dart::CompileParsedFunctionHelper::Compile(dart::CompilationPipeline*)
    [0x01456f40] dart::Compiler::EvaluateStaticInitializer(dart::Field const&)
    [0x013f9250] dart::kernel::ConstantEvaluator::EvaluateStaticGet()
    [0x013f8a94] dart::kernel::ConstantEvaluator::EvaluateExpression(int, bool)
    [0x0140ee06] dart::kernel::StreamingFlowGraphBuilder::BuildStaticGet(dart::TokenPosition*)
    [0x0140283a] dart::kernel::StreamingFlowGraphBuilder::BuildExpression(dart::TokenPosition*)
    [0x01419abe] dart::kernel::StreamingFlowGraphBuilder::BuildArgumentsFromActualArguments(dart::Array*, bool, bool)
    [0x01411161] dart::kernel::StreamingFlowGraphBuilder::BuildStaticInvocation(bool, dart::TokenPosition*)
    [0x01402673] dart::kernel::StreamingFlowGraphBuilder::BuildExpression(dart::TokenPosition*)
    [0x0140effb] dart::kernel::StreamingFlowGraphBuilder::BuildStaticSet(dart::TokenPosition*)
    [0x014025de] dart::kernel::StreamingFlowGraphBuilder::BuildExpression(dart::TokenPosition*)
    [0x014046f7] dart::kernel::StreamingFlowGraphBuilder::BuildStatement()
    [0x01414350] dart::kernel::StreamingFlowGraphBuilder::BuildBlock()
    [0x01404727] dart::kernel::StreamingFlowGraphBuilder::BuildStatement()
    [0x0140aed5] dart::kernel::StreamingFlowGraphBuilder::BuildFunctionBody(dart::Function const&, dart::LocalVariable*, bool)
    [0x0140bc25] dart::kernel::StreamingFlowGraphBuilder::BuildGraphOfFunction(bool)
    [0x0140c6ef] dart::kernel::StreamingFlowGraphBuilder::BuildGraph()
    [0x014216e4] dart::kernel::FlowGraphBuilder::BuildGraph()
    [0x014509bc] dart::DartCompilationPipeline::BuildFlowGraph(dart::Zone*, dart::ParsedFunction*, dart::ZoneGrowableArray<dart::ICData const*>*, int, bool)
    [0x01453407] dart::CompileParsedFunctionHelper::Compile(dart::CompilationPipeline*)
    [0x0145488b] Unknown symbol
    [0x01454243] dart::Compiler::CompileFunction(dart::Thread*, dart::Function const&)
    [0x010f57cb] dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&, dart::Array const&, unsigned int)
    [0x010f54d8] dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&)
    [0x012bdbfc] Unknown symbol
    [0x012bd9da] Unknown symbol
    [0x012ea777] dart::ThreadPool::Worker::Loop()
    [0x012ea307] dart::ThreadPool::Worker::Main(unsigned int)
    [0x0123607d] Unknown symbol
    [0xf7760f72] Unknown symbol
  -- End of DumpStackTrace
@sjindel-google

This comment has been minimized.

Copy link
Contributor

commented Mar 27, 2019

The issue in the constant evaluator is easy to fix by removing the logic in ConstantEvaluator::GetCachedConstant and ConstantEvaluator::CacheConstantValue for implicit static final getters.

However, if we set the optimization counter to 1, we run into an infinite loop with single-stepping in service tests.

The problem is in Compiler::CanOptimizeFunction:

#if !defined(PRODUCT)
  Isolate* isolate = thread->isolate();
  if (isolate->debugger()->IsStepping() ||
      isolate->debugger()->HasBreakpoint(function, thread->zone())) {
    // We cannot set breakpoints and single step in optimized code,
    // so do not optimize the function. Bump usage counter down to avoid
    // repeatedly entering the runtime for an optimization attempt.
    function.SetUsageCounter(0);
    return false;
  }
#endif

If the threshold is 1, we will repeatedly attempt and fail to optimize the target function in an infinite loop, because the unoptimized code refuses to run. I'm not sure how to solve this one -- @rmacnak-google , any ideas?

@sjindel-google

This comment has been minimized.

Copy link
Contributor

commented Apr 5, 2019

dart-bot pushed a commit that referenced this issue Apr 5, 2019

[dart/fuzzer] Re-enable optimization_counter_threshold testing
Rationale:
Underlying issues fixed by Samir.

#35196

Change-Id: I7baaecbe6611f9581050da09ac5375fdf70db319
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/98760
Reviewed-by: Samir Jindel <sjindel@google.com>
Commit-Queue: Aart Bik <ajcbik@google.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.