M-Labs/artiq-zynq
10
1
Fork 19
Code Issues 12 Pull Requests Releases Wiki Activity

crash when kernel returns complex value #42

New Issue
Closed
opened 2020-07-07 17:59:39 +08:00 by sb10q · 2 comments
sb10q commented 2020-07-07 17:59:39 +08:00
Owner
Copy Link
import numpy

from artiq.experiment import *

class CrashNumpy(EnvExperiment):
    def build(self):
        self.setattr_device("core")

    def run(self):
        print(self.numpy_things())

    @kernel
    def numpy_things(self):
        return (numpy.int32(10), numpy.int64(20), numpy.array([42,]))

Running this reproducibly crashes with:

[    43.158032s]  INFO(runtime::kernel): kernel starting
panic at /home/sb/.cargo/git/checkouts/zc706-3f7b226143889a61/e67efe4/libsupport_zynq/src/ram.rs:54:5: alloc_error
Backtrace: 
0x11c668
0x10d3d8
0x10d3ac
0x115bdc
0x10aa90
0x10a9c4
0x10a90c
0x1228c0
0x122b54
0x122c8c
0x118ca0
0x1703c8
0x1174d4
0x115f74
0x115f4c
0x115cdc
End backtrace

Decoded backtrace:

> armv7-unknown-linux-gnueabihf-addr2line  -ipfC -e /home/sb/artiq-zynq/build/firmware/armv7-none-eabihf/release/runtime 0x11c668 0x10d3d8 0x10d3ac 0x115bdc 0x10aa90 0x10a9c4 0x10a90c 0x1228c0 0x122b54 0x122c8c 0x118ca0 0x1703c8 0x1174d4 0x115f74 0x115f4c 0x115cdc
unwind::backtrace::backtrace at /home/sb/artiq-zynq/src/libunwind/backtrace.rs:35
 (inlined by) rust_begin_unwind at /home/sb/artiq-zynq/src/runtime/src/panic.rs:18
core::panic::PanicInfo::internal_constructor at /nix/store/702z0r414f4yb30pip0cf7p9pm5mfsyh-rust-94d3463/src/libcore/panic.rs:53
 (inlined by) core::panicking::panic_fmt at /nix/store/702z0r414f4yb30pip0cf7p9pm5mfsyh-rust-94d3463/src/libcore/panicking.rs:109
core::fmt::Arguments::new_v1 at /nix/store/702z0r414f4yb30pip0cf7p9pm5mfsyh-rust-94d3463/src/libcore/fmt/mod.rs:328
 (inlined by) core::panicking::panic at /nix/store/702z0r414f4yb30pip0cf7p9pm5mfsyh-rust-94d3463/src/libcore/panicking.rs:54
rust_oom at /home/sb/.cargo/git/checkouts/zc706-3f7b226143889a61/e67efe4/libsupport_zynq/src/ram.rs:54
alloc::alloc::handle_alloc_error at /nix/store/702z0r414f4yb30pip0cf7p9pm5mfsyh-rust-94d3463/src/liballoc/alloc.rs:302
alloc::raw_vec::RawVec<T,A>::reserve at /nix/store/702z0r414f4yb30pip0cf7p9pm5mfsyh-rust-94d3463/src/liballoc/raw_vec.rs:344
 (inlined by) alloc::vec::Vec<T>::reserve at /nix/store/702z0r414f4yb30pip0cf7p9pm5mfsyh-rust-94d3463/src/liballoc/vec.rs:500
<alloc::vec::Vec<T> as alloc::vec::SpecExtend<&T,core::slice::Iter<T>>>::spec_extend at /nix/store/702z0r414f4yb30pip0cf7p9pm5mfsyh-rust-94d3463/src/liballoc/vec.rs:2174
alloc::vec::Vec<T>::extend_from_slice at /nix/store/702z0r414f4yb30pip0cf7p9pm5mfsyh-rust-94d3463/src/liballoc/vec.rs:1586
 (inlined by) core_io::io::impls::<impl core_io::io::Write for alloc::vec::Vec<u8>>::write_all at /home/sb/artiq-zynq/src/libcoreio/src/io/impls.rs:309
 (inlined by) <T as runtime::proto_core_io::ProtoWrite>::write_all at /home/sb/artiq-zynq/src/runtime/src/proto_core_io.rs:156
 (inlined by) runtime::proto_core_io::ProtoWrite::write_u32 at /home/sb/artiq-zynq/src/runtime/src/proto_core_io.rs:103
runtime::rpc::send_value at /home/sb/artiq-zynq/src/runtime/src/rpc.rs:151
runtime::rpc::send_value at /home/sb/artiq-zynq/src/runtime/src/rpc.rs:140
runtime::rpc::send_args at /home/sb/artiq-zynq/src/runtime/src/rpc.rs:196
 (inlined by) runtime::kernel::rpc_send_common at /home/sb/artiq-zynq/src/runtime/src/kernel.rs:84
__heap_start at compiler_builtins.a14h0ch8-cgu.99:?
main_core1 at /home/sb/artiq-zynq/src/runtime/src/kernel.rs:367
libcortex_a9::asm::dsb at /home/sb/.cargo/git/checkouts/zc706-3f7b226143889a61/e67efe4/libcortex_a9/src/asm.rs:28
 (inlined by) libsupport_zynq::boot::boot_core1::{{closure}} at /home/sb/.cargo/git/checkouts/zc706-3f7b226143889a61/e67efe4/libsupport_zynq/src/boot.rs:80
libcortex_a9::asm::isb at /home/sb/.cargo/git/checkouts/zc706-3f7b226143889a61/e67efe4/libcortex_a9/src/asm.rs:34
 (inlined by) libcortex_a9::mmu::with_mmu at /home/sb/.cargo/git/checkouts/zc706-3f7b226143889a61/e67efe4/libcortex_a9/src/mmu.rs:420
libsupport_zynq::boot::boot_core1 at /home/sb/.cargo/git/checkouts/zc706-3f7b226143889a61/e67efe4/libsupport_zynq/src/boot.rs:73
``` import numpy from artiq.experiment import * class CrashNumpy(EnvExperiment): def build(self): self.setattr_device("core") def run(self): print(self.numpy_things()) @kernel def numpy_things(self): return (numpy.int32(10), numpy.int64(20), numpy.array([42,])) ``` Running this reproducibly crashes with: ```text [ 43.158032s] INFO(runtime::kernel): kernel starting panic at /home/sb/.cargo/git/checkouts/zc706-3f7b226143889a61/e67efe4/libsupport_zynq/src/ram.rs:54:5: alloc_error Backtrace: 0x11c668 0x10d3d8 0x10d3ac 0x115bdc 0x10aa90 0x10a9c4 0x10a90c 0x1228c0 0x122b54 0x122c8c 0x118ca0 0x1703c8 0x1174d4 0x115f74 0x115f4c 0x115cdc End backtrace ``` Decoded backtrace: ```text > armv7-unknown-linux-gnueabihf-addr2line -ipfC -e /home/sb/artiq-zynq/build/firmware/armv7-none-eabihf/release/runtime 0x11c668 0x10d3d8 0x10d3ac 0x115bdc 0x10aa90 0x10a9c4 0x10a90c 0x1228c0 0x122b54 0x122c8c 0x118ca0 0x1703c8 0x1174d4 0x115f74 0x115f4c 0x115cdc unwind::backtrace::backtrace at /home/sb/artiq-zynq/src/libunwind/backtrace.rs:35 (inlined by) rust_begin_unwind at /home/sb/artiq-zynq/src/runtime/src/panic.rs:18 core::panic::PanicInfo::internal_constructor at /nix/store/702z0r414f4yb30pip0cf7p9pm5mfsyh-rust-94d3463/src/libcore/panic.rs:53 (inlined by) core::panicking::panic_fmt at /nix/store/702z0r414f4yb30pip0cf7p9pm5mfsyh-rust-94d3463/src/libcore/panicking.rs:109 core::fmt::Arguments::new_v1 at /nix/store/702z0r414f4yb30pip0cf7p9pm5mfsyh-rust-94d3463/src/libcore/fmt/mod.rs:328 (inlined by) core::panicking::panic at /nix/store/702z0r414f4yb30pip0cf7p9pm5mfsyh-rust-94d3463/src/libcore/panicking.rs:54 rust_oom at /home/sb/.cargo/git/checkouts/zc706-3f7b226143889a61/e67efe4/libsupport_zynq/src/ram.rs:54 alloc::alloc::handle_alloc_error at /nix/store/702z0r414f4yb30pip0cf7p9pm5mfsyh-rust-94d3463/src/liballoc/alloc.rs:302 alloc::raw_vec::RawVec<T,A>::reserve at /nix/store/702z0r414f4yb30pip0cf7p9pm5mfsyh-rust-94d3463/src/liballoc/raw_vec.rs:344 (inlined by) alloc::vec::Vec<T>::reserve at /nix/store/702z0r414f4yb30pip0cf7p9pm5mfsyh-rust-94d3463/src/liballoc/vec.rs:500 <alloc::vec::Vec<T> as alloc::vec::SpecExtend<&T,core::slice::Iter<T>>>::spec_extend at /nix/store/702z0r414f4yb30pip0cf7p9pm5mfsyh-rust-94d3463/src/liballoc/vec.rs:2174 alloc::vec::Vec<T>::extend_from_slice at /nix/store/702z0r414f4yb30pip0cf7p9pm5mfsyh-rust-94d3463/src/liballoc/vec.rs:1586 (inlined by) core_io::io::impls::<impl core_io::io::Write for alloc::vec::Vec<u8>>::write_all at /home/sb/artiq-zynq/src/libcoreio/src/io/impls.rs:309 (inlined by) <T as runtime::proto_core_io::ProtoWrite>::write_all at /home/sb/artiq-zynq/src/runtime/src/proto_core_io.rs:156 (inlined by) runtime::proto_core_io::ProtoWrite::write_u32 at /home/sb/artiq-zynq/src/runtime/src/proto_core_io.rs:103 runtime::rpc::send_value at /home/sb/artiq-zynq/src/runtime/src/rpc.rs:151 runtime::rpc::send_value at /home/sb/artiq-zynq/src/runtime/src/rpc.rs:140 runtime::rpc::send_args at /home/sb/artiq-zynq/src/runtime/src/rpc.rs:196 (inlined by) runtime::kernel::rpc_send_common at /home/sb/artiq-zynq/src/runtime/src/kernel.rs:84 __heap_start at compiler_builtins.a14h0ch8-cgu.99:? main_core1 at /home/sb/artiq-zynq/src/runtime/src/kernel.rs:367 libcortex_a9::asm::dsb at /home/sb/.cargo/git/checkouts/zc706-3f7b226143889a61/e67efe4/libcortex_a9/src/asm.rs:28 (inlined by) libsupport_zynq::boot::boot_core1::{{closure}} at /home/sb/.cargo/git/checkouts/zc706-3f7b226143889a61/e67efe4/libsupport_zynq/src/boot.rs:80 libcortex_a9::asm::isb at /home/sb/.cargo/git/checkouts/zc706-3f7b226143889a61/e67efe4/libcortex_a9/src/asm.rs:34 (inlined by) libcortex_a9::mmu::with_mmu at /home/sb/.cargo/git/checkouts/zc706-3f7b226143889a61/e67efe4/libcortex_a9/src/mmu.rs:420 libsupport_zynq::boot::boot_core1 at /home/sb/.cargo/git/checkouts/zc706-3f7b226143889a61/e67efe4/libsupport_zynq/src/boot.rs:73 ```
👀 1
sb10q added the
priority:critical
 label 2020-07-15 18:04:31 +08:00
pca006132 commented 2020-07-16 11:34:19 +08:00
Contributor
Copy Link

Seems buffer corrupted.

import numpy

from artiq.experiment import *

class CrashNumpy(EnvExperiment):
    def build(self):
        self.setattr_device("core")

    def run(self):
        print(self.numpy_things())

    @kernel
    def numpy_things(self):
        return (numpy.int32(10), numpy.int64(20))

This prints

(10, 85900490216)
Seems buffer corrupted. ```python import numpy from artiq.experiment import * class CrashNumpy(EnvExperiment): def build(self): self.setattr_device("core") def run(self): print(self.numpy_things()) @kernel def numpy_things(self): return (numpy.int32(10), numpy.int64(20)) ``` This prints ``` (10, 85900490216) ```
pca006132 commented 2020-07-16 13:13:08 +08:00
Contributor
Copy Link

It seems that int32 is somehow padded. With the following fix, the two test cases could run correctly:

diff --git a/src/runtime/src/rpc.rs b/src/runtime/src/rpc.rs
index 36fb791..b248f78 100644
--- a/src/runtime/src/rpc.rs
+++ b/src/runtime/src/rpc.rs
@@ -120,9 +120,12 @@ unsafe fn send_value<W>(writer: &mut W, tag: Tag, data: &mut *const ())
         Tag::Bool =>
             consume_value!(u8, |ptr|
                 writer.write_u8(*ptr)),
-        Tag::Int32 =>
-            consume_value!(u32, |ptr|
-                writer.write_u32(*ptr)),
+        Tag::Int32 => {
+            let v = consume_value!(u32, |ptr|
+                writer.write_u32(*ptr));
+            consume_value!(u32, |ptr| ());
+            v
+        }
         Tag::Int64 | Tag::Float64 =>
             consume_value!(u64, |ptr|
                 writer.write_u64(*ptr)),
@@ -142,6 +145,7 @@ unsafe fn send_value<W>(writer: &mut W, tag: Tag, data: &mut *const ())
             Ok(())
         }
         Tag::List(it) | Tag::Array(it) => {
+            #[repr(C)]
             struct List { elements: *const (), length: u32 };
             consume_value!(List, |ptr| {
                 writer.write_u32((*ptr).length)?;
It seems that `int32` is somehow padded. With the following *fix*, the two test cases could run correctly: ```diff diff --git a/src/runtime/src/rpc.rs b/src/runtime/src/rpc.rs index 36fb791..b248f78 100644 --- a/src/runtime/src/rpc.rs +++ b/src/runtime/src/rpc.rs @@ -120,9 +120,12 @@ unsafe fn send_value<W>(writer: &mut W, tag: Tag, data: &mut *const ()) Tag::Bool => consume_value!(u8, |ptr| writer.write_u8(*ptr)), - Tag::Int32 => - consume_value!(u32, |ptr| - writer.write_u32(*ptr)), + Tag::Int32 => { + let v = consume_value!(u32, |ptr| + writer.write_u32(*ptr)); + consume_value!(u32, |ptr| ()); + v + } Tag::Int64 | Tag::Float64 => consume_value!(u64, |ptr| writer.write_u64(*ptr)), @@ -142,6 +145,7 @@ unsafe fn send_value<W>(writer: &mut W, tag: Tag, data: &mut *const ()) Ok(()) } Tag::List(it) | Tag::Array(it) => { + #[repr(C)] struct List { elements: *const (), length: u32 }; consume_value!(List, |ptr| { writer.write_u32((*ptr).length)?; ```
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
priority:critical

   
priority:high

   
priority:low

   
priority:medium
No Label
priority:critical
priority:high
priority:low
priority:medium
Milestone
Clear milestone
No items
No Milestone
Assignees
Clear assignees
No Assignees
2 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: M-Labs/artiq-zynq#42
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?