From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 1769B5057E4; Thu, 29 Jun 2023 11:59:14 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 1769B5057E4 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1688029154; bh=4nDyhkMp98nLZI9PUsR3MqbrIeOhIgF8sdNknKcLtyw=; h=Date:To:References:In-Reply-To:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=y2dJ0dbtEX+nW7TSBUWxELbdtOciCiEvM+CL7n38aNQNfi9gspVaWXVJ+04cC1mac 31cFBcVec/cAuNl+DRv5PAjc/D4z4MjIXo0YCuzJtdqLEQ07MX1kjA0Fo3mqTQWXBT TPW56BXyiRVLiV0IRiHfXZe56wuJJ4AxK6Griqk4= Received: from smtp57.i.mail.ru (smtp57.i.mail.ru [95.163.41.95]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 54F6D5057D1 for ; Thu, 29 Jun 2023 11:59:13 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 54F6D5057D1 Received: by smtp57.i.mail.ru with esmtpa (envelope-from ) id 1qEnUe-007AoJ-Bb; Thu, 29 Jun 2023 11:59:12 +0300 Date: Thu, 29 Jun 2023 11:54:55 +0300 To: Maxim Kokryashkin Message-ID: References: <20230607122557.510692-1-m.kokryashkin@tarantool.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20230607122557.510692-1-m.kokryashkin@tarantool.org> X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: 78E4E2B564C1792B X-77F55803: 4F1203BC0FB41BD9666F0A09DBE8C389C4FA057173C2AE676EA675A1589C173A182A05F53808504034AB1A264C769E6ED426A9178C35A2793A4D1C42E067FA87C3419A3D35A2E108 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7C985AD5EA6085CF5C2099A533E45F2D0395957E7521B51C2CFCAF695D4D8E9FCEA1F7E6F0F101C6778DA827A17800CE7711EC8ACFEA21396EA1F7E6F0F101C6723150C8DA25C47586E58E00D9D99D84E1BDDB23E98D2D38BE5CCB53A13BC8DBA7D3FE1AA36E7F687C0B1F070BDAB91DDCC7F00164DA146DAFE8445B8C89999728AA50765F790063783E00425F71A4181389733CBF5DBD5E9C8A9BA7A39EFB766F5D81C698A659EA7CC7F00164DA146DA9985D098DBDEAEC8893991AD1F2BFC6AF6B57BC7E6449061A352F6E88A58FB86F5D81C698A659EA73AA81AA40904B5D9A18204E546F3947CA09ADEE969FA4D8BBA3038C0950A5D36C8A9BA7A39EFB766EC990983EF5C0329BA3038C0950A5D36D5E8D9A59859A8B6A5DF9383870C0FED3AA81AA40904B5D99C9F4D5AE37F343AD1F44FA8B9022EA23BBE47FD9DD3FB595F5C1EE8F4F765FC2EE5AD8F952D28FBE2021AF6380DFAD18AA50765F790063735872C767BF85DA227C277FBC8AE2E8BDAE3FA6833AEA0C275ECD9A6C639B01B4E70A05D1297E1BBCB5012B2E24CD356 X-C1DE0DAB: 0D63561A33F958A59104B116D0BEB9163D81F1E5410B6BFBFEB04EBED122903BF87CCE6106E1FC07E67D4AC08A07B9B06A1CB4668A9CA5FACB5012B2E24CD356 X-C8649E89: 1C3962B70DF3F0ADE00A9FD3E00BEEDF3FED46C3ACD6F73ED3581295AF09D3DF87807E0823442EA2ED31085941D9CD0AF7F820E7B07EA4CFF65FAF0609ED3301BE98F97170EA74A55FF9A27520836654B20E2B2B487367B7284AB208DE0D1BB100E7A357E1073374E34CE26A6281114CDDB81C61005590ECA74DFFEFA5DC0E7F02C26D483E81D6BE5EF9655DD6DEA7D65774BB76CC95456EEC5B5AD62611EEC62B5AFB4261A09AF0 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojD2/8pXBAXbJpTsu4Grj+ug== X-Mailru-Sender: 11C2EC085EDE56FAC07928AF2646A769A0F7BD301FD4CD14D426A9178C35A2797CF96F699FB25259DEDBA653FF35249392D99EB8CC7091A70E183A470755BFD208F19895AA18418972D6B4FCE48DF648AE208404248635DF X-Mras: Ok Subject: Re: [Tarantool-patches] [PATCH luajit v2] sysprof: fix crash during FFUNC stream X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" Hi, Maxim! Thanks for the patch! Please consider my comments below. On 07.06.23, Maxim Kokryashkin wrote: > Sometimes, the Lua stack can be inconsistent during > the FFUNC execution, which may lead to a sysprof > crash during the stack unwinding. > > This patch replaces the `top_frame` property of `global_State` > with `lj_sysprof_topframe` structure, which contains `top_frame` > and `ffid` properties. `ffid` property makes sense only when the > LuaJIT VM state is set to `FFUNC`. That property is set to the > ffid of the fast function that VM is about to execute. > In the same time, `top_frame` property is not updated now, so > the top frame of the Lua stack can be streamed based on the ffid, > and the rest of the Lua stack can be streamed as usual. > > Resolves tarantool/tarantool#8594 > --- > Changes in v2: > - Sysprof binary data is now dumped into `/dev/null` to avoid cluttering > of the test runner drive > > Branch: https://github.com/tarantool/luajit/tree/fckxorg/gh-8594-sysprof-ffunc-crash > PR: https://github.com/tarantool/tarantool/pull/8737 > > src/lj_obj.h | 7 +++- > src/lj_sysprof.c | 26 ++++++++++++--- > src/vm_x64.dasc | 21 ++++++++++-- > src/vm_x86.dasc | 22 ++++++++++--- > .../gh-8594-sysprof-ffunc-crash.test.lua | 33 +++++++++++++++++++ > 5 files changed, 96 insertions(+), 13 deletions(-) > create mode 100644 test/tarantool-tests/gh-8594-sysprof-ffunc-crash.test.lua > > diff --git a/src/lj_obj.h b/src/lj_obj.h > index 45507e0d..186433a3 100644 > --- a/src/lj_obj.h > +++ b/src/lj_obj.h > @@ -598,6 +598,11 @@ enum { > GCSmax > }; > > +struct lj_sysprof_topframe { > + TValue *top_frame; /* Top frame for sysprof. */ > + uint8_t ffid; /* FFID of the fast function VM is about to execute. */ > +}; I concerned a bit that the structure isn't well alligned. Maybe we should place ffid on the top, to make a "hole" in the structure, but it will be 64-bit alligned. > + > typedef struct GCState { > GCSize total; /* Memory currently allocated. */ > GCSize threshold; /* Memory threshold. */ > @@ -675,7 +680,7 @@ typedef struct global_State { > MRef ctype_state; /* Pointer to C type state. */ > GCRef gcroot[GCROOT_MAX]; /* GC roots. */ > #ifdef LJ_HASSYSPROF > - TValue *top_frame; /* Top frame for sysprof. */ > + struct lj_sysprof_topframe top_frame_info; /* Top frame info for sysprof. */ > #endif > } global_State; > > diff --git a/src/lj_sysprof.c b/src/lj_sysprof.c > index 2e9ed9b3..0a341e16 100644 > --- a/src/lj_sysprof.c > +++ b/src/lj_sysprof.c > diff --git a/src/vm_x64.dasc b/src/vm_x64.dasc > index 7b04b928..3a35b9f7 100644 > --- a/src/vm_x64.dasc > +++ b/src/vm_x64.dasc > @@ -353,14 +353,29 @@ > |// it syncs with the BASE register only when the control is passed to > |// user code. So we need to sync the BASE on each vmstate change to > |// keep it consistent. > +|// The only execption are FFUNCs because sometimes even internal BASE Typo: s/execption/exception/ > +|// stash is inconsistent for them. To address that issue, their ffid > +|// is stashed instead, so the corresponding frame can be streamed > +|// manually. > +|.macro set_vmstate_ffunc > +|.if LJ_HASSYSPROF > +| set_vmstate INTERP > +| mov TMPR, [BASE - 16] > +| cleartp LFUNC:TMPR I suppose that this line is excess: we don't work with TMPR as LFUNC any again after this chunk. > +| mov r10b, LFUNC:TMPR->ffid // r10b is the byte-sized part of TMPR So, maybe its better to define a macro instead, like `TMPRb`. > +| mov byte [DISPATCH+DISPATCH_GL(top_frame_info.ffid)], r10b > +|.endif > +| set_vmstate FFUNC > +|.endmacro > +| > |// Uses TMPRd (r10d). > |.macro save_vmstate > |.if not WIN > @@ -376,7 +391,7 @@ > diff --git a/src/vm_x86.dasc b/src/vm_x86.dasc > index bd1e940e..fabeec9f 100644 > --- a/src/vm_x86.dasc > +++ b/src/vm_x86.dasc > @@ -451,14 +451,28 @@ > |// it syncs with the BASE register only when the control is passed to > |// user code. So we need to sync the BASE on each vmstate change to > |// keep it consistent. > +|// The only execption are FFUNCs because sometimes even internal BASE Typo: s/execption/exception/ > +|// stash is inconsistent for them. To address that issue, their ffid > +|// is stashed instead, so the corresponding frame can be streamed > +|// manually. > | > +|.macro set_vmstate_ffunc > +|.if LJ_HASSYSPROF > +| set_vmstate INTERP > +| mov LFUNC:XCHGd, [BASE - 8] What about the x86 arch -- XCHGd isn't defined for it, so I'm very surprised that the VM is even built :)... We should spill ECX here too, I suppose. | >>> src/luajit -e 'print(jit.arch)' | x86 | >>> cd test/tarantool-tests/ | >>> LUA_PATH="./?.lua;../../src/?.lua;;" ../../src/luajit gh-8594-sysprof-ffunc-crash.test.lua | TAP version 13 | 1..1 | Segmentation fault Build like the following: | make -j CC="gcc -m32" CCDEBUG=" -g -ggdb3" CFLAGS=" -O0" XCFLAGS=" -DLUA_USE_APICHECK -DLUA_USE_ASSERT " -f Makefile.original Side note: I'm really dissapointed that we still don't have some flags to do it from cmake, so it will be available in the our exotic build testing. > +| mov r11b, LFUNC:XCHGd->ffid // r11b is the byte-sized part of XCHGd So, maybe its better to define a macro instead, like `XCHGb`. > +| mov byte [DISPATCH+DISPATCH_GL(top_frame_info.ffid)], r11b > +|.endif > +| set_vmstate FFUNC > +|.endmacro > +| > |// Uses spilled ecx on x86 or XCHGd (r11d) on x64. > |.macro save_vmstate > |.if not WIN > @@ -485,7 +499,7 @@ > diff --git a/test/tarantool-tests/gh-8594-sysprof-ffunc-crash.test.lua b/test/tarantool-tests/gh-8594-sysprof-ffunc-crash.test.lua > new file mode 100644 > index 00000000..027eed74 > --- /dev/null > +++ b/test/tarantool-tests/gh-8594-sysprof-ffunc-crash.test.lua > @@ -0,0 +1,33 @@ > +local tap = require('tap') > +local test = tap.test('gh-8594-sysprof-ffunc-crash'):skipcond({ > + ['Sysprof is implemented for x86_64 only'] = jit.arch ~= 'x86' and > + jit.arch ~= 'x64', > + ['Sysprof is implemented for Linux only'] = jit.os ~= "Linux", Nit: Typo: s/"Linux"/'Linux'/ > +}) > -- > 2.40.1 > -- Best regards, Sergey Kaplun