[amd64] fix tailcall insn size #5483

lewurm · 2017-08-31T16:14:39Z

commit 9a634c1
introduces a regression for https://github.com/mono/coreclr/blob/mono/tests/src/JIT/Methodical/Invoke/25params/25param1c.il

Testing method of 25 parameters, all of int data type, tail.call
mono-sgen(46435,0x7fff9d34b3c0) malloc: *** error for object 0x101045400: incorrect checksum for freed object - object was probably modified after being freed.
*** set a breakpoint in malloc_error_break to debug
Process 46435 stopped
* thread #1, name = 'tid_307', queue = 'com.apple.main-thread', stop reason = breakpoint 1.1
    frame #0: 0x00007fff945c915f libsystem_malloc.dylib`malloc_error_break
libsystem_malloc.dylib`malloc_error_break:
->  0x7fff945c915f <+0>: pushq  %rbp
    0x7fff945c9160 <+1>: movq   %rsp, %rbp
    0x7fff945c9163 <+4>: nop
    0x7fff945c9164 <+5>: nopl   (%rax)
(lldb) mbt
* thread #1
  * frame #0: 0x00007fff945c915f libsystem_malloc.dylib`malloc_error_break
    frame #1: 0x00007fff945c5e81 libsystem_malloc.dylib`szone_error + 406
    frame #2: 0x00007fff945c7925 libsystem_malloc.dylib`small_free_list_remove_ptr_no_clear + 766
    frame #3: 0x00007fff945c7cb2 libsystem_malloc.dylib`free_small + 881
    frame #4: 0x00000001004d2110 mono-sgen`monoeg_g_free(ptr=0x0000000101083c00) at gmem.c:66
    frame #5: 0x0000000100007b64 mono-sgen`mono_codegen(cfg=0x000000010108c800) at mini.c:2300
    frame #6: 0x000000010000aedf mono-sgen`mini_method_compile(method=0x0000000100910310, opts=370239999, domain=0x000000010090ebd0, flags=JIT_FLAG_RUN_CCTORS, parts=0, aot_method_index=-1) at mini.c:3829
    frame #7: 0x000000010000edd0 mono-sgen`mono_jit_compile_method_inner(method=0x0000000100910310, target_domain=0x000000010090ebd0, opt=370239999, error=0x00007fff5fbfe048) at mini.c:4156
    frame #8: 0x000000010001459e mono-sgen`mono_jit_compile_method_with_opt(method=0x0000000100910310, opt=370239999, jit_only=0, error=0x00007fff5fbfe048) at mini-runtime.c:2127
    frame #9: 0x0000000100013e6d mono-sgen`mono_jit_compile_method(method=0x0000000100910310, error=0x00007fff5fbfe048) at mini-runtime.c:2173
    frame #10: 0x0000000100131eea mono-sgen`common_call_trampoline(regs=0x00007fff5fbfe128, code="H\x8bй\x01", m=0x0000000100910310, vt=0x0000000000000000, vtable_slot=0x0000000000000000, error=0x00007fff5fbfe048) at mini-trampolines.c:704
    frame #11: 0x00000001001313b7 mono-sgen`mono_magic_trampoline(regs=0x00007fff5fbfe128, code="H\x8bй\x01", arg=0x0000000100910310, tramp="����\b\x10\x03\x91") at mini-trampolines.c:835

turns out we smashed our code buffer

lewurm · 2017-08-31T16:15:07Z

@akoeplinger can I trigger the acceptance tests for a PR?

lewurm · 2017-08-31T16:16:44Z

I should clarify that 9a634c1 does not introduce a regression, but makes another bug surface

vargaz · 2017-08-31T17:44:00Z

mono/mini/cpu-amd64.md

Does this really need to be increased by a 100 bytes ?

I determined it by printing the size diff between beginning of

mono/mono/mini/mini-amd64.c

Line 4484 in 078463f

case OP_TAILCALL: {

and after emitting it

lewurm · 2017-08-31T19:03:23Z

I don't understand why we set offset here?

mono/mono/mini/mini-amd64.c

Line 4520 in 078463f

offset = code - cfg->native_code;

I think that's the reason why this assert doesn't hit:

mono/mono/mini/mini-amd64.c

Line 6438 in 078463f

if ((code - cfg->native_code - offset) > max_len) {

akoeplinger · 2017-08-31T22:55:01Z

@monojenkins build acceptance tests

lewurm · 2017-09-04T08:49:50Z

if I revert the change and remove the offset = ... line, it crashes indeed with:

wrong maximal instruction length of instruction tailcall (expected 120, got 228)
* Assertion: should not be reached at mini-amd64.c:6441

I've updated the commit and removed it, because it doesn't make sense imho.

@vargaz what do you think?

vargaz · 2017-09-04T08:56:16Z

I think the problem is that OP_TAILCALL has an unlimited size due to the need to copy arguments.

commit mono@9a634c1 introduces a regression for https://github.com/mono/coreclr/blob/mono/tests/src/JIT/Methodical/Invoke/25params/25param1c.il ``` Testing method of 25 parameters, all of int data type, tail.call mono-sgen(46435,0x7fff9d34b3c0) malloc: *** error for object 0x101045400: incorrect checksum for freed object - object was probably modified after being freed. *** set a breakpoint in malloc_error_break to debug Process 46435 stopped * thread #1, name = 'tid_307', queue = 'com.apple.main-thread', stop reason = breakpoint 1.1 frame #0: 0x00007fff945c915f libsystem_malloc.dylib`malloc_error_break libsystem_malloc.dylib`malloc_error_break: -> 0x7fff945c915f <+0>: pushq %rbp 0x7fff945c9160 <+1>: movq %rsp, %rbp 0x7fff945c9163 <+4>: nop 0x7fff945c9164 <+5>: nopl (%rax) (lldb) mbt * thread #1 * frame #0: 0x00007fff945c915f libsystem_malloc.dylib`malloc_error_break frame #1: 0x00007fff945c5e81 libsystem_malloc.dylib`szone_error + 406 frame #2: 0x00007fff945c7925 libsystem_malloc.dylib`small_free_list_remove_ptr_no_clear + 766 frame mono#3: 0x00007fff945c7cb2 libsystem_malloc.dylib`free_small + 881 frame mono#4: 0x00000001004d2110 mono-sgen`monoeg_g_free(ptr=0x0000000101083c00) at gmem.c:66 frame mono#5: 0x0000000100007b64 mono-sgen`mono_codegen(cfg=0x000000010108c800) at mini.c:2300 frame mono#6: 0x000000010000aedf mono-sgen`mini_method_compile(method=0x0000000100910310, opts=370239999, domain=0x000000010090ebd0, flags=JIT_FLAG_RUN_CCTORS, parts=0, aot_method_index=-1) at mini.c:3829 frame mono#7: 0x000000010000edd0 mono-sgen`mono_jit_compile_method_inner(method=0x0000000100910310, target_domain=0x000000010090ebd0, opt=370239999, error=0x00007fff5fbfe048) at mini.c:4156 frame mono#8: 0x000000010001459e mono-sgen`mono_jit_compile_method_with_opt(method=0x0000000100910310, opt=370239999, jit_only=0, error=0x00007fff5fbfe048) at mini-runtime.c:2127 frame mono#9: 0x0000000100013e6d mono-sgen`mono_jit_compile_method(method=0x0000000100910310, error=0x00007fff5fbfe048) at mini-runtime.c:2173 frame mono#10: 0x0000000100131eea mono-sgen`common_call_trampoline(regs=0x00007fff5fbfe128, code="H\x8bй\x01", m=0x0000000100910310, vt=0x0000000000000000, vtable_slot=0x0000000000000000, error=0x00007fff5fbfe048) at mini-trampolines.c:704 frame mono#11: 0x00000001001313b7 mono-sgen`mono_magic_trampoline(regs=0x00007fff5fbfe128, code="H\x8bй\x01", arg=0x0000000100910310, tramp="��\b\x10\x03\x91") at mini-trampolines.c:835 ``` turns out we smashed our code buffer. Also, transform this comparison: ``` if (G_UNLIKELY (offset > (cfg->code_size - max_len - EXTRA_CODE_SPACE))) { if (G_UNLIKELY ((offset + max_len + EXTRA_CODE_SPACE) > cfg->code_size)) { ``` we deal with unsigned values here, and if `max_len` is bigger then `cfg->code_size`, we won't resize the buffer.

lewurm · 2017-09-04T09:24:23Z

@vargaz I see, so I guess we should potentially resize the buffer inside of the tailcall op. I've updated the commit, what do you think now?

lewurm · 2017-09-04T09:24:41Z

@monojenkins build acceptance tests

lewurm · 2017-09-04T11:42:03Z

@monojenkins rebase

monojenkins · 2017-09-04T11:50:59Z

cannot rebase:

"Linux i386" state is "success"
"Linux x64" state is "success"
"OS X i386" state is "success"
"OS X x64" state is "success"
"Windows i386" state is "success"
"Windows x64" state is "failure"

monojenkins · 2017-09-04T12:00:58Z

cannot rebase:

"Linux i386" state is "success"
"Linux x64" state is "success"
"OS X i386" state is "success"
"OS X x64" state is "success"
"Windows i386" state is "success"
"Windows x64" state is "failure"

monojenkins · 2017-09-04T13:40:55Z

cannot rebase:

"Linux i386" state is "success"
"Linux x64" state is "success"
"OS X i386" state is "success"
"OS X x64" state is "success"
"Windows i386" state is "success"
"Windows x64" state is "failure"

monojenkins · 2017-09-04T14:35:54Z

cannot rebase:

"Linux i386" state is "success"
"Linux x64" state is "success"
"OS X i386" state is "success"
"OS X x64" state is "success"
"Windows i386" state is "success"
"Windows x64" state is "failure"

monojenkins · 2017-09-04T16:20:50Z

cannot rebase:

"Linux i386" state is "success"
"Linux x64" state is "success"
"OS X i386" state is "success"
"OS X x64" state is "success"
"Windows i386" state is "success"
"Windows x64" state is "failure"

monojenkins · 2017-09-04T16:35:50Z

cannot rebase:

"Linux i386" state is "success"
"Linux x64" state is "success"
"OS X i386" state is "success"
"OS X x64" state is "success"
"Windows i386" state is "success"
"Windows x64" state is "failure"

monojenkins · 2017-09-05T17:15:31Z

cannot rebase:

"Linux i386" state is "success"
"Linux x64" state is "success"
"OS X i386" state is "success"
"OS X x64" state is "success"
"Windows i386" state is "success"
"Windows x64" state is "failure"

commit mono@9a634c1 introduces a regression for https://github.com/mono/coreclr/blob/mono/tests/src/JIT/Methodical/Invoke/25params/25param1c.il ``` Testing method of 25 parameters, all of int data type, tail.call mono-sgen(46435,0x7fff9d34b3c0) malloc: *** error for object 0x101045400: incorrect checksum for freed object - object was probably modified after being freed. *** set a breakpoint in malloc_error_break to debug Process 46435 stopped * thread mono#1, name = 'tid_307', queue = 'com.apple.main-thread', stop reason = breakpoint 1.1 frame #0: 0x00007fff945c915f libsystem_malloc.dylib`malloc_error_break libsystem_malloc.dylib`malloc_error_break: -> 0x7fff945c915f <+0>: pushq %rbp 0x7fff945c9160 <+1>: movq %rsp, %rbp 0x7fff945c9163 <+4>: nop 0x7fff945c9164 <+5>: nopl (%rax) (lldb) mbt * thread mono#1 * frame #0: 0x00007fff945c915f libsystem_malloc.dylib`malloc_error_break frame mono#1: 0x00007fff945c5e81 libsystem_malloc.dylib`szone_error + 406 frame mono#2: 0x00007fff945c7925 libsystem_malloc.dylib`small_free_list_remove_ptr_no_clear + 766 frame mono#3: 0x00007fff945c7cb2 libsystem_malloc.dylib`free_small + 881 frame mono#4: 0x00000001004d2110 mono-sgen`monoeg_g_free(ptr=0x0000000101083c00) at gmem.c:66 frame mono#5: 0x0000000100007b64 mono-sgen`mono_codegen(cfg=0x000000010108c800) at mini.c:2300 frame mono#6: 0x000000010000aedf mono-sgen`mini_method_compile(method=0x0000000100910310, opts=370239999, domain=0x000000010090ebd0, flags=JIT_FLAG_RUN_CCTORS, parts=0, aot_method_index=-1) at mini.c:3829 frame mono#7: 0x000000010000edd0 mono-sgen`mono_jit_compile_method_inner(method=0x0000000100910310, target_domain=0x000000010090ebd0, opt=370239999, error=0x00007fff5fbfe048) at mini.c:4156 frame mono#8: 0x000000010001459e mono-sgen`mono_jit_compile_method_with_opt(method=0x0000000100910310, opt=370239999, jit_only=0, error=0x00007fff5fbfe048) at mini-runtime.c:2127 frame mono#9: 0x0000000100013e6d mono-sgen`mono_jit_compile_method(method=0x0000000100910310, error=0x00007fff5fbfe048) at mini-runtime.c:2173 frame mono#10: 0x0000000100131eea mono-sgen`common_call_trampoline(regs=0x00007fff5fbfe128, code="H\x8bй\x01", m=0x0000000100910310, vt=0x0000000000000000, vtable_slot=0x0000000000000000, error=0x00007fff5fbfe048) at mini-trampolines.c:704 frame mono#11: 0x00000001001313b7 mono-sgen`mono_magic_trampoline(regs=0x00007fff5fbfe128, code="H\x8bй\x01", arg=0x0000000100910310, tramp="��\b\x10\x03\x91") at mini-trampolines.c:835 ``` turns out we smashed our code buffer. Also, transform this comparison: ``` if (G_UNLIKELY (offset > (cfg->code_size - max_len - EXTRA_CODE_SPACE))) { if (G_UNLIKELY ((offset + max_len + EXTRA_CODE_SPACE) > cfg->code_size)) { ``` we deal with unsigned values here, and if `max_len` is bigger then `cfg->code_size`, we won't resize the buffer.

commit https://github.com/mono/mono/commit/mono/mono@9a634c1810aad46d30a674f3a97ab263dcd4272e introduces a regression for https://github.com/mono/coreclr/blob/mono/tests/src/JIT/Methodical/Invoke/25params/25param1c.il ``` Testing method of 25 parameters, all of int data type, tail.call mono-sgen(46435,0x7fff9d34b3c0) malloc: *** error for object 0x101045400: incorrect checksum for freed object - object was probably modified after being freed. *** set a breakpoint in malloc_error_break to debug Process 46435 stopped * thread mono/mono#1, name = 'tid_307', queue = 'com.apple.main-thread', stop reason = breakpoint 1.1 frame mono/mono#0: 0x00007fff945c915f libsystem_malloc.dylib`malloc_error_break libsystem_malloc.dylib`malloc_error_break: -> 0x7fff945c915f <+0>: pushq %rbp 0x7fff945c9160 <+1>: movq %rsp, %rbp 0x7fff945c9163 <+4>: nop 0x7fff945c9164 <+5>: nopl (%rax) (lldb) mbt * thread mono/mono#1 * frame mono/mono#0: 0x00007fff945c915f libsystem_malloc.dylib`malloc_error_break frame mono/mono#1: 0x00007fff945c5e81 libsystem_malloc.dylib`szone_error + 406 frame mono/mono#2: 0x00007fff945c7925 libsystem_malloc.dylib`small_free_list_remove_ptr_no_clear + 766 frame mono/mono#3: 0x00007fff945c7cb2 libsystem_malloc.dylib`free_small + 881 frame mono/mono#4: 0x00000001004d2110 mono-sgen`monoeg_g_free(ptr=0x0000000101083c00) at gmem.c:66 frame mono/mono#5: 0x0000000100007b64 mono-sgen`mono_codegen(cfg=0x000000010108c800) at mini.c:2300 frame mono/mono#6: 0x000000010000aedf mono-sgen`mini_method_compile(method=0x0000000100910310, opts=370239999, domain=0x000000010090ebd0, flags=JIT_FLAG_RUN_CCTORS, parts=0, aot_method_index=-1) at mini.c:3829 frame mono/mono#7: 0x000000010000edd0 mono-sgen`mono_jit_compile_method_inner(method=0x0000000100910310, target_domain=0x000000010090ebd0, opt=370239999, error=0x00007fff5fbfe048) at mini.c:4156 frame mono/mono#8: 0x000000010001459e mono-sgen`mono_jit_compile_method_with_opt(method=0x0000000100910310, opt=370239999, jit_only=0, error=0x00007fff5fbfe048) at mini-runtime.c:2127 frame mono/mono#9: 0x0000000100013e6d mono-sgen`mono_jit_compile_method(method=0x0000000100910310, error=0x00007fff5fbfe048) at mini-runtime.c:2173 frame mono/mono#10: 0x0000000100131eea mono-sgen`common_call_trampoline(regs=0x00007fff5fbfe128, code="H\x8bй\x01", m=0x0000000100910310, vt=0x0000000000000000, vtable_slot=0x0000000000000000, error=0x00007fff5fbfe048) at mini-trampolines.c:704 frame mono/mono#11: 0x00000001001313b7 mono-sgen`mono_magic_trampoline(regs=0x00007fff5fbfe128, code="H\x8bй\x01", arg=0x0000000100910310, tramp="��\b\x10\x03\x91") at mini-trampolines.c:835 ``` turns out we smashed our code buffer. Also, transform this comparison: ``` if (G_UNLIKELY (offset > (cfg->code_size - max_len - EXTRA_CODE_SPACE))) { if (G_UNLIKELY ((offset + max_len + EXTRA_CODE_SPACE) > cfg->code_size)) { ``` we deal with unsigned values here, and if `max_len` is bigger then `cfg->code_size`, we won't resize the buffer. Commit migrated from mono/mono@79e94c4

lewurm requested a review from vargaz August 31, 2017 16:14

lewurm requested a review from kumpera as a code owner August 31, 2017 16:14

dnfclas added the cla-already-signed label Aug 31, 2017

vargaz reviewed Aug 31, 2017

View reviewed changes

lewurm force-pushed the amd64-tailcall-insn-size branch from 9a858cf to 3da9d3a Compare September 4, 2017 08:49

lewurm force-pushed the amd64-tailcall-insn-size branch from 3da9d3a to b3bf5e9 Compare September 4, 2017 09:23

lewurm closed this Sep 4, 2017

lewurm reopened this Sep 4, 2017

dnfclas added the cla-already-signed label Sep 4, 2017

vargaz approved these changes Sep 4, 2017

View reviewed changes

lewurm merged commit 79e94c4 into mono:master Sep 6, 2017

[amd64] fix tailcall insn size #5483

[amd64] fix tailcall insn size #5483

Uh oh!

Conversation

lewurm commented Aug 31, 2017

Uh oh!

lewurm commented Aug 31, 2017

Uh oh!

lewurm commented Aug 31, 2017

Uh oh!

vargaz Aug 31, 2017

Choose a reason for hiding this comment

Uh oh!

lewurm Aug 31, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lewurm commented Aug 31, 2017

Uh oh!

akoeplinger commented Aug 31, 2017

Uh oh!

lewurm commented Sep 4, 2017

Uh oh!

vargaz commented Sep 4, 2017

Uh oh!

lewurm commented Sep 4, 2017

Uh oh!

lewurm commented Sep 4, 2017

Uh oh!

lewurm commented Sep 4, 2017

Uh oh!

monojenkins commented Sep 4, 2017

Uh oh!

monojenkins commented Sep 4, 2017

Uh oh!

monojenkins commented Sep 4, 2017

Uh oh!

monojenkins commented Sep 4, 2017

Uh oh!

monojenkins commented Sep 4, 2017

Uh oh!

monojenkins commented Sep 4, 2017

Uh oh!

monojenkins commented Sep 5, 2017

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

lewurm Aug 31, 2017 •

edited

Loading