Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Assert failure: !CREATE_CHECK_STRING(pMT && pMT->Validate()) #90602

Closed
BruceForstall opened this issue Aug 15, 2023 · 2 comments · Fixed by #90694
Closed

Assert failure: !CREATE_CHECK_STRING(pMT && pMT->Validate()) #90602

BruceForstall opened this issue Aug 15, 2023 · 2 comments · Fixed by #90694
Assignees
@jakobbotsch
Labels
arch-arm32 area-CodeGen-coreclr CLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI JitStress CLR JIT issues involving JIT internal stress modes os-linux Linux OS (any supported distro)
Milestone
8.0.0

Comments

@BruceForstall
Copy link
Member

net8.0-linux-Release-arm-CoreCLR_checked-jitstress2_jitstressregs0x10
System.Memory.Tests

https://dev.azure.com/dnceng-public/public/_build/results?buildId=374065&view=ms.vss-test-web.build-test-results-tab&runId=7949792&paneView=debug

+ grep DOTNET
DOTNET_EnableCrashReport=1
DOTNET_TieredCompilation=0
DOTNET_JitStress=2
DOTNET_DbgMiniDumpName=/home/helixbot/dotnetbuild/dumps/coredump.%d.dmp
DOTNET_JitStressRegs=0x10
DOTNET_DbgEnableMiniDump=1
+ ./RunTests.sh --runtime-path /root/helix/work/correlation
----- start Tue Aug 15 07:09:38 UTC 2023 =============== To repro directly: =====================================================
pushd .
/root/helix/work/correlation/dotnet exec --runtimeconfig System.Memory.Tests.runtimeconfig.json --depsfile System.Memory.Tests.deps.json xunit.console.dll System.Memory.Tests.dll -xml testResults.xml -nologo -nocolor -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing 
popd
===========================================================================================================
/root/helix/work/workitem/e /root/helix/work/workitem/e
  Discovering: System.Memory.Tests (method display = ClassAndMethod, method display options = None)
  Discovered:  System.Memory.Tests (found 2691 of 2718 test cases)
  Starting:    System.Memory.Tests (parallel test collections = on, max threads = 2)

Assert failure(PID 27 [0x0000001b], Thread: 41 [0x0029]): !CREATE_CHECK_STRING(pMT && pMT->Validate())
    File: /__w/1/s/src/coreclr/vm/object.cpp Line: 522
    Image: /root/helix/work/correlation/dotnet

[createdump] Gathering state for process 27 dotnet
[createdump] Crashing thread 0029 signal 6 (0006)
[createdump] Writing crash report to file /home/helixbot/dotnetbuild/dumps/coredump.27.dmp.crashreport.json
[createdump] Crash report successfully written
[createdump] Writing minidump with heap to file /home/helixbot/dotnetbuild/dumps/coredump.27.dmp
[createdump] Written 237355008 bytes (57948 pages) to core file
[createdump] Target process is alive
[createdump] Dump successfully written in 443ms
waitpid() returned successfully (wstatus 00000000) WEXITSTATUS 0 WTERMSIG 0
./RunTests.sh: line 168:    27 Aborted                 (core dumped) "$RUNTIME_PATH/dotnet" exec --runtimeconfig System.Memory.Tests.runtimeconfig.json --depsfile System.Memory.Tests.deps.json xunit.console.dll System.Memory.Tests.dll -xml testResults.xml -nologo -nocolor -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing $RSP_FILE
/root/helix/work/workitem/e
----- end Tue Aug 15 07:10:11 UTC 2023 ----- exit code 134 ----------------------------------------------------------
@BruceForstall BruceForstall added arch-arm32 os-linux Linux OS (any supported distro) JitStress CLR JIT issues involving JIT internal stress modes area-CodeGen-coreclr CLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI labels Aug 15, 2023
@BruceForstall BruceForstall added this to the 8.0.0 milestone Aug 15, 2023
@ghost
Copy link

ghost commented Aug 15, 2023

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Issue Details

net8.0-linux-Release-arm-CoreCLR_checked-jitstress2_jitstressregs0x10
System.Memory.Tests

https://dev.azure.com/dnceng-public/public/_build/results?buildId=374065&view=ms.vss-test-web.build-test-results-tab&runId=7949792&paneView=debug

+ grep DOTNET
DOTNET_EnableCrashReport=1
DOTNET_TieredCompilation=0
DOTNET_JitStress=2
DOTNET_DbgMiniDumpName=/home/helixbot/dotnetbuild/dumps/coredump.%d.dmp
DOTNET_JitStressRegs=0x10
DOTNET_DbgEnableMiniDump=1
+ ./RunTests.sh --runtime-path /root/helix/work/correlation
----- start Tue Aug 15 07:09:38 UTC 2023 =============== To repro directly: =====================================================
pushd .
/root/helix/work/correlation/dotnet exec --runtimeconfig System.Memory.Tests.runtimeconfig.json --depsfile System.Memory.Tests.deps.json xunit.console.dll System.Memory.Tests.dll -xml testResults.xml -nologo -nocolor -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing 
popd
===========================================================================================================
/root/helix/work/workitem/e /root/helix/work/workitem/e
  Discovering: System.Memory.Tests (method display = ClassAndMethod, method display options = None)
  Discovered:  System.Memory.Tests (found 2691 of 2718 test cases)
  Starting:    System.Memory.Tests (parallel test collections = on, max threads = 2)

Assert failure(PID 27 [0x0000001b], Thread: 41 [0x0029]): !CREATE_CHECK_STRING(pMT && pMT->Validate())
    File: /__w/1/s/src/coreclr/vm/object.cpp Line: 522
    Image: /root/helix/work/correlation/dotnet

[createdump] Gathering state for process 27 dotnet
[createdump] Crashing thread 0029 signal 6 (0006)
[createdump] Writing crash report to file /home/helixbot/dotnetbuild/dumps/coredump.27.dmp.crashreport.json
[createdump] Crash report successfully written
[createdump] Writing minidump with heap to file /home/helixbot/dotnetbuild/dumps/coredump.27.dmp
[createdump] Written 237355008 bytes (57948 pages) to core file
[createdump] Target process is alive
[createdump] Dump successfully written in 443ms
waitpid() returned successfully (wstatus 00000000) WEXITSTATUS 0 WTERMSIG 0
./RunTests.sh: line 168:    27 Aborted                 (core dumped) "$RUNTIME_PATH/dotnet" exec --runtimeconfig System.Memory.Tests.runtimeconfig.json --depsfile System.Memory.Tests.deps.json xunit.console.dll System.Memory.Tests.dll -xml testResults.xml -nologo -nocolor -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing $RSP_FILE
/root/helix/work/workitem/e
----- end Tue Aug 15 07:10:11 UTC 2023 ----- exit code 134 ----------------------------------------------------------
Author: BruceForstall
Assignees: -
Labels:

arch-arm32, os-linux, JitStress, area-CodeGen-coreclr
Milestone: 8.0.0

@JulieLeeMSFT
Copy link
Member

@jakobbotsch, could you please take a look?

jakobbotsch added a commit to jakobbotsch/runtime that referenced this issue Aug 16, 2023
@jakobbotsch
JIT: Disallow mismatched GC-ness for physical promotions
4b26e73 
Physical promotion was working under the assumption that reinterpreting
GC pointers is undefined behavior, and would happily promote GC pointers
as integers if it saw such accesses. However, physical promotion is
function wide while the UB accesses can be happening in a restricted
(dynamically unreachable) scope. This exact situation happens in
MemoryExtensions.Contains. The issue was uncovered under jit stress
where we did not fold away the guard early enough, meaning that
promotion then saw a `TYP_LONG` access of a `struct { object, int }` and
proceeded to promote it as such.

Fix dotnet#90602
@jakobbotsch jakobbotsch mentioned this issue Aug 16, 2023
Merged
@ghost ghost added in-pr There is an active PR which will close this issue when it is merged and removed in-pr There is an active PR which will close this issue when it is merged labels Aug 16, 2023
jakobbotsch added a commit that referenced this issue Aug 17, 2023
@jakobbotsch
JIT: Disallow mismatched GC-ness for physical promotions (#90694)
45acd38 
Physical promotion was working under the assumption that reinterpreting
GC pointers is undefined behavior, and would happily promote GC pointers
as integers if it saw such accesses. However, physical promotion is
function wide while the UB accesses can be happening in a restricted
(dynamically unreachable) scope. This exact situation happens in
MemoryExtensions.Contains. The issue was uncovered under jit stress
where we did not fold away the guard early enough, meaning that
promotion then saw a `TYP_LONG` access of a `struct { object, int }` and
proceeded to promote it as such.

Fix #90602
@ghost ghost removed the in-pr There is an active PR which will close this issue when it is merged label Aug 17, 2023
github-actions bot pushed a commit that referenced this issue Aug 17, 2023
@jakobbotsch
JIT: Disallow mismatched GC-ness for physical promotions
62946ee 
Physical promotion was working under the assumption that reinterpreting
GC pointers is undefined behavior, and would happily promote GC pointers
as integers if it saw such accesses. However, physical promotion is
function wide while the UB accesses can be happening in a restricted
(dynamically unreachable) scope. This exact situation happens in
MemoryExtensions.Contains. The issue was uncovered under jit stress
where we did not fold away the guard early enough, meaning that
promotion then saw a `TYP_LONG` access of a `struct { object, int }` and
proceeded to promote it as such.

Fix #90602
carlossanlop pushed a commit that referenced this issue Aug 17, 2023
@github-actions @jakobbotsch
[release/8.0] JIT: Disallow mismatched GC-ness for physical promotions (
3ab4246 
#90739)

* JIT: Disallow mismatched GC-ness for physical promotions

Physical promotion was working under the assumption that reinterpreting
GC pointers is undefined behavior, and would happily promote GC pointers
as integers if it saw such accesses. However, physical promotion is
function wide while the UB accesses can be happening in a restricted
(dynamically unreachable) scope. This exact situation happens in
MemoryExtensions.Contains. The issue was uncovered under jit stress
where we did not fold away the guard early enough, meaning that
promotion then saw a `TYP_LONG` access of a `struct { object, int }` and
proceeded to promote it as such.

Fix #90602

* Address feedback

---------

Co-authored-by: Jakob Botsch Nielsen <[email protected]>
@ghost ghost locked as resolved and limited conversation to collaborators Sep 16, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@jakobbotsch jakobbotsch

Labels
arch-arm32 area-CodeGen-coreclr CLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI JitStress CLR JIT issues involving JIT internal stress modes os-linux Linux OS (any supported distro)
Projects
None yet
Milestone
8.0.0
Development

Successfully merging a pull request may close this issue.

JIT: Disallow mismatched GC-ness for physical promotions jakobbotsch/runtime
3 participants
@jakobbotsch @BruceForstall @JulieLeeMSFT