Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

flow_graph_compiler.cc: 914: error: expected: !is_optimizing() #36587

Closed
aartbik opened this issue Apr 11, 2019 · 5 comments
Closed

flow_graph_compiler.cc: 914: error: expected: !is_optimizing() #36587

aartbik opened this issue Apr 11, 2019 · 5 comments
Assignees
@aartbik
Labels
area-vm Use area-vm for VM related issues, including code coverage, FFI, and the AOT and JIT backends. dartfuzz Found with Dart fuzzing (DartFuzz, libFuzzer, etc.)

Comments

@aartbik
Copy link
Contributor

aartbik commented Apr 11, 2019

Nightly DartFuzz divergence:

Isolate (/b/s/w/itpuZWHB/dart_fuzzBUJXGL) AOT-O3-DebugX64 - JIT-noVFP-O3-DebugSIMARM: !DIVERGENCE! 1.9:988261705 (output=false)

fail1:
../../runtime/vm/compiler/backend/flow_graph_compiler.cc: 914: error: expected: !is_optimizing()
version=2.2.1-edge.bed1bab2cd4b79694db9ace0e5497b8bb9eb1ab8 (Thu Apr 11 02:01:03 2019 +0000) on "linux_x64"
thread=21979, isolate=isolate(0x565334276900)
pc 0x00005653323efcec fp 0x00007fffdb317990 dart::Profiler::DumpStackTrace(void*)
pc 0x00005653326fb6f2 fp 0x00007fffdb317a70 dart::Assert::Fail(char const*, ...)
pc 0x00005653325399e3 fp 0x00007fffdb317bf0 /b/s/w/ir/pkg/vm/tool/../../../out/DebugX64/gen_snapshot+0x7939e3
pc 0x000056533253f471 fp 0x00007fffdb317c50 dart::ThrowErrorSlowPathCode::EmitNativeCode(dart::FlowGraphCompiler*)
pc 0x0000565332538aac fp 0x00007fffdb317c90 dart::FlowGraphCompiler::GenerateDeferredCode()
pc 0x00005653324db152 fp 0x00007fffdb318300 dart::PrecompileParsedFunctionHelper::Compile(dart::CompilationPipeline*)
pc 0x00005653324dd798 fp 0x00007fffdb318d70 /b/s/w/ir/pkg/vm/tool/../../../out/DebugX64/gen_snapshot+0x737798
pc 0x00005653324d7694 fp 0x00007fffdb318e20 dart::Precompiler::CompileFunction(dart::Precompiler*, dart::Thread*, dart::Zone*, dart::Function const&)
pc 0x00005653324d5eeb fp 0x00007fffdb318e90 dart::Precompiler::ProcessFunction(dart::Function const&)
pc 0x00005653324d11f3 fp 0x00007fffdb318ec0 dart::Precompiler::Iterate()
pc 0x00005653324ce2fd fp 0x00007fffdb3198d0 dart::Precompiler::DoCompileAll()
pc 0x00005653324cdde5 fp 0x00007fffdb319cf0 dart::Precompiler::CompileAll()
pc 0x00005653326eed52 fp 0x00007fffdb319db0 Dart_Precompile
pc 0x000056533210ec9a fp 0x00007fffdb319f20 dart::bin::main(int, char**)
-- End of DumpStackTrace
@aartbik aartbik added area-vm Use area-vm for VM related issues, including code coverage, FFI, and the AOT and JIT backends. dartfuzz Found with Dart fuzzing (DartFuzz, libFuzzer, etc.) labels Apr 11, 2019
@aartbik aartbik self-assigned this Apr 11, 2019
@aartbik
Copy link
Contributor Author

aartbik commented Apr 15, 2019

Using dart/sdk/pkg/vm/tool/dart_precompiled_runtime2, DebugX64, we get

$ {MYPRE} fuzz.dart

../../runtime/vm/compiler/backend/flow_graph_compiler.cc: 923: error: expected: !is_optimizing()
version=2.2.1-edge.74f3dd3a3adbbd121a26851e6443a2410251edd1 (Mon Apr 15 10:06:40 2019 -0700) on "linux_x64"
thread=179472, isolate=isolate(0x561023630900)
  pc 0x0000561021d1a81c fp 0x00007fff99662950 dart::Profiler::DumpStackTrace(void*)
  pc 0x00005610220299e2 fp 0x00007fff99662a30 dart::Assert::Fail(char const*, ...)
  pc 0x0000561021e654b3 fp 0x00007fff99662bb0 /usr/local/google/home/ajcbik/drive2/dart/sdk/pkg/vm/tool/../../../out/DebugX64/gen_snapshot+0x7b54b3
  pc 0x0000561021e6af71 fp 0x00007fff99662c10 dart::ThrowErrorSlowPathCode::EmitNativeCode(dart::FlowGraphCompiler*)
  pc 0x0000561021e6458c fp 0x00007fff99662c50 dart::FlowGraphCompiler::GenerateDeferredCode()
  pc 0x0000561021e061a2 fp 0x00007fff996632d0 dart::PrecompileParsedFunctionHelper::Compile(dart::CompilationPipeline*)
  pc 0x0000561021e087e8 fp 0x00007fff99663d40 /usr/local/google/home/ajcbik/drive2/dart/sdk/pkg/vm/tool/../../../out/DebugX64/gen_snapshot+0x7587e8
  pc 0x0000561021e026e4 fp 0x00007fff99663df0 dart::Precompiler::CompileFunction(dart::Precompiler*, dart::Thread*, dart::Zone*, dart::Function const&)
  pc 0x0000561021e00f3b fp 0x00007fff99663e60 dart::Precompiler::ProcessFunction(dart::Function const&)
  pc 0x0000561021dfc243 fp 0x00007fff99663e90 dart::Precompiler::Iterate()
  pc 0x0000561021df934d fp 0x00007fff996648a0 dart::Precompiler::DoCompileAll()
  pc 0x0000561021df8e35 fp 0x00007fff99664cc0 dart::Precompiler::CompileAll()

@aartbik
Copy link
Contributor Author

aartbik commented Apr 15, 2019

Attaching fuzz.dart as txt.
fuzz.dart.txt

@aartbik
Copy link
Contributor Author

aartbik commented Apr 15, 2019

The following shift causes the assert. It has no env().
The shift factor is 1 though.

v56 <- Constant(#1) 
....
v37695 <- ShiftInt64Op(<< [tr], v34418 T{int}, v56) [-9223372036854775808, 9223372036854775807]

@aartbik
Copy link
Contributor Author

aartbik commented Apr 15, 2019 •
edited
Loading

As before, having an env() or not seems something that really needs a serious rework in our IR, since it seems to work more by chance than by design. In this particular case, though, the shift is introduced by BinaryIntegerOpInstr::Canonicalize(), which generates the explicit shift factor 1, but fails to set the shift_range (or an env). Since no range analysis follows, this seems a clear omission.

@aartbik
Copy link
Contributor Author

aartbik commented Apr 15, 2019

The following CL fixes the assert fail, since we see that the shift factor is never out of range (so we don't need a slow path). I would like some careful review on the omission of env(), by design, or by accident?

https://dart-review.googlesource.com/c/sdk/+/99382

dart-bot pushed a commit that referenced this issue Apr 16, 2019
@aartbik
[dart/vm] Inspect shift constant in absence of range analysis
9070d6a 
Rationale:
Queries the constant of a shift operation to determine if it
is in range when range analysis has not run. This seems in general
a good idea, since some optimizations occur *after* range analysis,
and we were missing those cases. In this particular case, it also
avoids an assert fail on a shift by one without env() that was
introduced by a pass that has no subsequent range analysis. In
this case, it is unclear whether not having an env() was an
accident, or on purpose since the shift factor is known to
be well-behaved. Please have a careful look!

#36587

Change-Id: I12b4cb773f31899e17bfce8506bce599ccbef8ba
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/99382
Commit-Queue: Aart Bik <ajcbik@google.com>
Reviewed-by: Alexander Markov <alexmarkov@google.com>
@aartbik aartbik closed this as completed Apr 16, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@aartbik aartbik

Labels
area-vm Use area-vm for VM related issues, including code coverage, FFI, and the AOT and JIT backends. dartfuzz Found with Dart fuzzing (DartFuzz, libFuzzer, etc.)
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@aartbik