Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Split opt insns #11

Open
wants to merge 11 commits into
base: dynamic-opt-insn
from

Conversation

@k0kubun
Copy link
Owner

commented Sep 29, 2018

馃槙

before (JIT)

fps: 59.275610153080606
fps: 62.57991325182623
fps: 64.80736730631057
fps: 65.70862084737462
fps: 65.80598193153838
fps: 67.70693611713655
fps: 68.5746438575452
fps: 68.79088959799846
fps: 69.08889252643253
fps: 69.24137966538876
fps: 69.41290013205305

after (JIT)

fps: 55.52564849102278
fps: 56.13672767536166
fps: 60.99826755553094
fps: 61.836949873341766
fps: 64.06565607814737
fps: 64.19561390678022
fps: 66.16368933574392
fps: 66.40029181686059
fps: 67.35251531981152
fps: 67.73694043310567
fps: 67.85984990274395

@k0kubun k0kubun force-pushed the dynamic-opt-insn branch from 57ab71f to b9fe9c8 Oct 9, 2018

@k0kubun k0kubun force-pushed the dynamic-split-insn branch from 20e6580 to dd1542a Oct 9, 2018

k0kubun pushed a commit that referenced this pull request Oct 20, 2018

fix SEGV in rb_raw_obj_info()
This funcion can be called from inside of rb_ast_new().
Should add appropriate case branches.

(lldb) run
Process 9135 launched: './miniruby' (x86_64)
Process 9135 stopped
* thread #1: tid = 0xdf36b, 0x00000001000ca4f9 miniruby`rb_raw_obj_info(buff="0x000000010205d158 [0    ] T_IMEMO", buff_size=256, obj=4328903000) + 2361 at gc.c:9617, queue = 'com.apple.main-thread', stop reason = EXC_BAD_INSTRUCTION (code=EXC_I386_INVOP, subcode=0x0)
    frame #0: 0x00000001000ca4f9 miniruby`rb_raw_obj_info(buff="0x000000010205d158 [0    ] T_IMEMO", buff_size=256, obj=4328903000) + 2361 at gc.c:9617
   9614                 IMEMO_NAME(iseq);
   9615                 IMEMO_NAME(tmpbuf);
   9616 #undef IMEMO_NAME
-> 9617               default: UNREACHABLE;
   9618             }
   9619             snprintf(buff, buff_size, "%s %s", buff, imemo_name);
   9620
(lldb) bt
* thread #1: tid = 0xdf36b, 0x00000001000ca4f9 miniruby`rb_raw_obj_info(buff="0x000000010205d158 [0    ] T_IMEMO", buff_size=256, obj=4328903000) + 2361 at gc.c:9617, queue = 'com.apple.main-thread', stop reason = EXC_BAD_INSTRUCTION (code=EXC_I386_INVOP, subcode=0x0)
  * frame #0: 0x00000001000ca4f9 miniruby`rb_raw_obj_info(buff="0x000000010205d158 [0    ] T_IMEMO", buff_size=256, obj=4328903000) + 2361 at gc.c:9617
    frame #1: 0x00000001000c433f miniruby`obj_info(obj=4328903000) + 95 at gc.c:9671
    frame #2: 0x00000001000ce2ac miniruby`newobj_init(klass=4302478608, flags=36890, v1=0, v2=0, v3=0, wb_protected=1, objspace=0x0000000101800410, obj=4328903000) + 444 at gc.c:1882
    frame #3: 0x00000001000c0a49 miniruby`newobj_of(klass=4302478608, flags=36890, v1=0, v2=0, v3=0, wb_protected=1) + 217 at gc.c:1968
    frame #4: 0x00000001000c0bcb miniruby`rb_imemo_new(type=imemo_ast, v1=0, v2=0, v3=0, v0=4302478608) + 75 at gc.c:2017
    frame #5: 0x0000000100148f2a miniruby`rb_ast_new + 58 at node.c:1118
    frame #6: 0x000000010018d9e2 miniruby`yycompile(vparser=4328903720, p=0x0000000100729670, fname=4328903160, line=1) + 98 at parse.y:4925
    frame #7: 0x000000010018d66f miniruby`parser_compile_string(vparser=4328903720, fname=4328903160, s=4328904440, line=1) + 143 at parse.y:4995
    frame #8: 0x000000010018d768 miniruby`rb_parser_compile_string_path(vparser=4328903720, f=4328903160, s=4328904440, line=1) + 56 at parse.y:5015
    frame #9: 0x000000010018d71e miniruby`rb_parser_compile_string(vparser=4328903720, f="-e", s=4328904440, line=1) + 62 at parse.y:5008
    frame #10: 0x00000001002130d5 miniruby`process_options(argc=0, argv=0x00007fff5fbfdc08, opt=0x00007fff5fbfd9e8) + 3477 at ruby.c:1754
    frame #11: 0x00000001002122dd miniruby`ruby_process_options(argc=2, argv=0x00007fff5fbfdbf8) + 285 at ruby.c:2332
    frame #12: 0x00000001000aa966 miniruby`ruby_options(argc=2, argv=0x00007fff5fbfdbf8) + 262 at eval.c:118
    frame #13: 0x0000000100000ed4 miniruby`main(argc=2, argv=0x00007fff5fbfdbf8) + 116 at main.c:42
    frame #14: 0x00007fff933845ad libdyld.dylib`start + 1
    frame #15: 0x00007fff933845ad libdyld.dylib`start + 1
(lldb)


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@65148 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

k0kubun pushed a commit that referenced this pull request Apr 29, 2019

avoid buffer overflow in vm_check_canary
ec->cfp->iseq might not exist at the very beginning of a thread.

=================================================================
==82954==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fc86f334810 at pc 0x55ceaf013125 bp 0x7ffe2eddbbf0 sp 0x7ffe2eddbbe8
READ of size 8 at 0x7fc86f334810 thread T0
    #0 0x55ceaf013124 in vm_check_canary vm_insnhelper.c:217:24
    #1 0x55ceaefb4796 in vm_push_frame vm_insnhelper.c:276:5
    #2 0x55ceaf0124bd in th_init vm.c:2661:5
    #3 0x55ceaf00d5eb in ruby_thread_init vm.c:2690:5
    #4 0x55ceaf00d4b1 in rb_thread_alloc vm.c:2703:5
    #5 0x55ceaef0038b in thread_s_new thread.c:872:20
    #6 0x55ceaf04d8c1 in call_cfunc_m1 vm_insnhelper.c:2041:12
    #7 0x55ceaf03118d in vm_call_cfunc_with_frame vm_insnhelper.c:2207:11
    #8 0x55ceaf017985 in vm_call_cfunc vm_insnhelper.c:2225:12
    #9 0x55ceaf01548b in vm_call_method_each_type vm_insnhelper.c:2560:9
    #10 0x55ceaf014c96 in vm_call_method vm_insnhelper.c:2686:13
    #11 0x55ceaefb5de4 in vm_call_general vm_insnhelper.c:2730:12
    #12 0x55ceaf03c868 in vm_sendish vm_insnhelper.c:3623:11
    #13 0x55ceaefc95bb in vm_exec_core insns.def:771:11
    #14 0x55ceaf006700 in rb_vm_exec vm.c:1892:22
    #15 0x55ceaf00acbf in rb_iseq_eval_main vm.c:2151:11
    #16 0x55ceaea250ca in ruby_exec_internal eval.c:262:2
    ruby#17 0x55ceaea2498b in ruby_exec_node eval.c:326:12
    ruby#18 0x55ceaea247d0 in ruby_run_node eval.c:318:25
    ruby#19 0x55ceae88c486 in main main.c:42:9
    #20 0x7fc874330b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    ruby#21 0x55ceae7e5289 in _start (miniruby+0x15f289)

0x7fc86f334810 is located 16 bytes to the right of 1048576-byte region [0x7fc86f234800,0x7fc86f334800)
allocated by thread T0 here:
    #0 0x55ceae85d56d in malloc (miniruby+0x1d756d)
    #1 0x55ceaea71d12 in objspace_xmalloc0 gc.c:9416:5
    #2 0x55ceaea71cd2 in ruby_xmalloc2_body gc.c:9623:12
    #3 0x55ceaea7d09c in ruby_xmalloc2 gc.c:11479:12
    #4 0x55ceaf00c3b7 in rb_thread_recycle_stack vm.c:2462:12
    #5 0x55ceaf012256 in th_init vm.c:2656:29
    #6 0x55ceaf00d5eb in ruby_thread_init vm.c:2690:5
    #7 0x55ceaf00d4b1 in rb_thread_alloc vm.c:2703:5
    #8 0x55ceaef0038b in thread_s_new thread.c:872:20
    #9 0x55ceaf04d8c1 in call_cfunc_m1 vm_insnhelper.c:2041:12
    #10 0x55ceaf03118d in vm_call_cfunc_with_frame vm_insnhelper.c:2207:11
    #11 0x55ceaf017985 in vm_call_cfunc vm_insnhelper.c:2225:12
    #12 0x55ceaf01548b in vm_call_method_each_type vm_insnhelper.c:2560:9
    #13 0x55ceaf014c96 in vm_call_method vm_insnhelper.c:2686:13
    #14 0x55ceaefb5de4 in vm_call_general vm_insnhelper.c:2730:12
    #15 0x55ceaf03c868 in vm_sendish vm_insnhelper.c:3623:11
    #16 0x55ceaefc95bb in vm_exec_core insns.def:771:11
    ruby#17 0x55ceaf006700 in rb_vm_exec vm.c:1892:22
    ruby#18 0x55ceaf00acbf in rb_iseq_eval_main vm.c:2151:11
    ruby#19 0x55ceaea250ca in ruby_exec_internal eval.c:262:2
    #20 0x55ceaea2498b in ruby_exec_node eval.c:326:12
    ruby#21 0x55ceaea247d0 in ruby_run_node eval.c:318:25
    ruby#22 0x55ceae88c486 in main main.c:42:9
    ruby#23 0x7fc874330b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-buffer-overflow vm_insnhelper.c:217:24 in vm_check_canary
Shadow bytes around the buggy address:
  0x0ff98de5e8b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff98de5e8c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff98de5e8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff98de5e8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff98de5e8f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0ff98de5e900: fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==82954==ABORTING

k0kubun pushed a commit that referenced this pull request Apr 29, 2019

eliminate use of freed memory
rb_io_fptr_finalize_internal frees the memory region.

=================================================================
==85264==ERROR: AddressSanitizer: heap-use-after-free on address 0x610000000d8c at pc 0x5608e38077f7 bp 0x7ffee12d5440 sp 0x7ffee12d5438
READ of size 4 at 0x610000000d8c thread T0
    #0 0x5608e38077f6 in rb_io_memsize io.c:4749:24
    #1 0x5608e37a0481 in obj_memsize_of gc.c:3547:14
    #2 0x5608e37a4f30 in check_rvalue_consistency gc.c:1107:2
    #3 0x5608e37a2624 in RVALUE_OLD_P gc.c:1218:5
    #4 0x5608e37a5bae in rb_gc_force_recycle gc.c:6652:18
    #5 0x5608e38191f9 in rb_f_backquote io.c:9021:5
    #6 0x5608e3d8aa14 in call_cfunc_1 vm_insnhelper.c:2058:12
    #7 0x5608e3d6e23d in vm_call_cfunc_with_frame vm_insnhelper.c:2211:11
    #8 0x5608e3d54a35 in vm_call_cfunc vm_insnhelper.c:2229:12
    #9 0x5608e3d5253b in vm_call_method_each_type vm_insnhelper.c:2564:9
    #10 0x5608e3d51f50 in vm_call_method vm_insnhelper.c:2701:13
    #11 0x5608e3cf2de4 in vm_call_general vm_insnhelper.c:2734:12
    #12 0x5608e3d79918 in vm_sendish vm_insnhelper.c:3627:11
    #13 0x5608e3d06cf5 in vm_exec_core insns.def:789:11
    #14 0x5608e3d43700 in rb_vm_exec vm.c:1892:22
    #15 0x5608e3d47cbf in rb_iseq_eval_main vm.c:2151:11
    #16 0x5608e37620ca in ruby_exec_internal eval.c:262:2
    ruby#17 0x5608e376198b in ruby_exec_node eval.c:326:12
    ruby#18 0x5608e37617d0 in ruby_run_node eval.c:318:25
    ruby#19 0x5608e35c9486 in main main.c:42:9
    #20 0x7f62e9421b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    ruby#21 0x5608e3522289 in _start (miniruby+0x15f289)

0x610000000d8c is located 76 bytes inside of 192-byte region [0x610000000d40,0x610000000e00)
freed by thread T0 here:
    #0 0x5608e359a2ed in free (miniruby+0x1d72ed)
    #1 0x5608e37af421 in objspace_xfree gc.c:9591:5
    #2 0x5608e37af3da in ruby_sized_xfree gc.c:9687:2
    #3 0x5608e3799ac8 in ruby_xfree gc.c:9694:5
    #4 0x5608e380746d in rb_io_fptr_finalize_internal io.c:4728:5
    #5 0x5608e38191ed in rb_f_backquote io.c:9020:5
    #6 0x5608e3d8aa14 in call_cfunc_1 vm_insnhelper.c:2058:12
    #7 0x5608e3d6e23d in vm_call_cfunc_with_frame vm_insnhelper.c:2211:11
    #8 0x5608e3d54a35 in vm_call_cfunc vm_insnhelper.c:2229:12
    #9 0x5608e3d5253b in vm_call_method_each_type vm_insnhelper.c:2564:9
    #10 0x5608e3d51f50 in vm_call_method vm_insnhelper.c:2701:13
    #11 0x5608e3cf2de4 in vm_call_general vm_insnhelper.c:2734:12
    #12 0x5608e3d79918 in vm_sendish vm_insnhelper.c:3627:11
    #13 0x5608e3d06cf5 in vm_exec_core insns.def:789:11
    #14 0x5608e3d43700 in rb_vm_exec vm.c:1892:22
    #15 0x5608e3d47cbf in rb_iseq_eval_main vm.c:2151:11
    #16 0x5608e37620ca in ruby_exec_internal eval.c:262:2
    ruby#17 0x5608e376198b in ruby_exec_node eval.c:326:12
    ruby#18 0x5608e37617d0 in ruby_run_node eval.c:318:25
    ruby#19 0x5608e35c9486 in main main.c:42:9
    #20 0x7f62e9421b96 in __libc_start_main
/build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

previously allocated by thread T0 here:
    #0 0x5608e359a56d in malloc (miniruby+0x1d756d)
    #1 0x5608e37aed12 in objspace_xmalloc0 gc.c:9416:5
    #2 0x5608e37aebe7 in ruby_xmalloc0 gc.c:9600:12
    #3 0x5608e37aea8b in ruby_xmalloc_body gc.c:9609:12
    #4 0x5608e37a6d64 in ruby_xmalloc gc.c:11469:12
    #5 0x5608e380e4b4 in rb_io_fptr_new io.c:8040:19
    #6 0x5608e380e446 in rb_io_make_open_file io.c:8077:10
    #7 0x5608e3850ea0 in pipe_open io.c:6707:5
    #8 0x5608e384edb4 in pipe_open_s io.c:6772:12
    #9 0x5608e381910b in rb_f_backquote io.c:9014:12
    #10 0x5608e3d8aa14 in call_cfunc_1 vm_insnhelper.c:2058:12
    #11 0x5608e3d6e23d in vm_call_cfunc_with_frame vm_insnhelper.c:2211:11
    #12 0x5608e3d54a35 in vm_call_cfunc vm_insnhelper.c:2229:12
    #13 0x5608e3d5253b in vm_call_method_each_type vm_insnhelper.c:2564:9
    #14 0x5608e3d51f50 in vm_call_method vm_insnhelper.c:2701:13
    #15 0x5608e3cf2de4 in vm_call_general vm_insnhelper.c:2734:12
    #16 0x5608e3d79918 in vm_sendish vm_insnhelper.c:3627:11
    ruby#17 0x5608e3d06cf5 in vm_exec_core insns.def:789:11
    ruby#18 0x5608e3d43700 in rb_vm_exec vm.c:1892:22
    ruby#19 0x5608e3d47cbf in rb_iseq_eval_main vm.c:2151:11
    #20 0x5608e37620ca in ruby_exec_internal eval.c:262:2
    ruby#21 0x5608e376198b in ruby_exec_node eval.c:326:12
    ruby#22 0x5608e37617d0 in ruby_run_node eval.c:318:25
    ruby#23 0x5608e35c9486 in main main.c:42:9
    ruby#24 0x7f62e9421b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-use-after-free io.c:4749:24 in
rb_io_memsize
Shadow bytes around the buggy address:
  0x0c207fff8160: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c207fff8170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c207fff8180: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c207fff8190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c207fff81a0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c207fff81b0: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c207fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==85264==ABORTING
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
1 participant
You can鈥檛 perform that action at this time.