Skip to content

[wasm] Notify jiterpreter when a method is freed - #89980

Merged
kg merged 8 commits into
dotnet:mainfrom
kg:jiterp-method-free
Aug 21, 2023
Merged

[wasm] Notify jiterpreter when a method is freed#89980
kg merged 8 commits into
dotnet:mainfrom
kg:jiterp-method-free

Conversation

@kg

@kgkg commented Aug 3, 2023

Copy link
Copy Markdown
Contributor

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information.

It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

@kgkg added NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) arch-wasm WebAssembly architecture labels Aug 3, 2023
@ghostghost assigned kgAug 3, 2023
@ghostghost added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Aug 3, 2023
@ghost

ghost commented Aug 3, 2023

Copy link
Copy Markdown

Tagging subscribers to 'arch-wasm': @lewing
See info in area-owners.md if you want to be subscribed.

Issue Details

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information. It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

Author:kg
Assignees:-
Labels:

NO-MERGE, arch-wasm

Milestone:-

@kg

kg commented Aug 8, 2023

Copy link
Copy Markdown
ContributorAuthor

Updated so that the interp_entry and jit_call queues are now stored in the native heap in thread-local lists, and there's a central list tracking all of those lists. So any time a method is freed we can acquire a lock and go through all the queues and ensure the freed method isn't in them, synchronously. This avoids the need to somehow push a callback to all of our threads. (We do still need to clean up their state, but it's less important)

kg added 2 commits August 14, 2023 18:33
Notify jiterpreter when a method is freed and ensure it isn't in the jit queues
Fix infosByMethod not being populated
Checkpoint: Migrate jiterpreter jit queues to C thread-local memory
Use tlqueue for interp_entry as well
@kg
kgforce-pushed the jiterp-method-free branch from 9728807 to 7c4cb62CompareAugust 15, 2023 02:03
@kg
kg marked this pull request as ready for review August 15, 2023 02:52
@kgkg added area-Codegen-Interpreter-mono and removed NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners labels Aug 15, 2023
@ghost

Copy link
Copy Markdown

Tagging subscribers to this area: @BrzVlad, @kotlarmilos
See info in area-owners.md if you want to be subscribed.

Issue Details

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information.

It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

Author:kg
Assignees:kg
Labels:

arch-wasm, area-Codegen-Interpreter-mono

Milestone:-

@kg
kg requested a review from lambdageekAugust 15, 2023 02:53

@lambdageeklambdageek left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Two areas to call out (but I'm not sure if there's anything to be done about it):

  1. the EMSCRIPTEN_KEEPALIVE functions are pretty fragile since they don't have GC state transitions and use OS (not coop) mutexes. It might be enough to just comment that adding work inside those locks needs to be done carefully.
  2. I don't know if the jiterp would ever run outside of WASM, but we do have mono helpers for the TLS keys and atomic increments.

Comment threadsrc/mono/mono/mini/interp/jiterpreter.c
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c Outdated
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c Outdated
@kg
kg requested a review from lambdageekAugust 16, 2023 02:48
@lewing

Copy link
Copy Markdown
Member

Should we take this in main? Should it still be considered for 8?

@kg

kg commented Aug 18, 2023

Copy link
Copy Markdown
ContributorAuthor

Should we take this in main? Should it still be considered for 8?

We would have to backport both this and multithreading support to take this in 8.

@kg
kg merged commit 1e40c04 into dotnet:mainAug 21, 2023
@ghostghost locked as resolved and limited conversation to collaborators Sep 20, 2023
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@kg@lewing@lambdageek
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
[wasm] Notify jiterpreter when a method is freed by kg · Pull Request #89980 · dotnet/runtime · GitHub
Skip to content

[wasm] Notify jiterpreter when a method is freed - #89980

Merged
kg merged 8 commits into
dotnet:mainfrom
kg:jiterp-method-free
Aug 21, 2023
Merged

[wasm] Notify jiterpreter when a method is freed#89980
kg merged 8 commits into
dotnet:mainfrom
kg:jiterp-method-free

Conversation

@kg

@kgkg commented Aug 3, 2023

Copy link
Copy Markdown
Contributor

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information.

It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

@kgkg added NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) arch-wasm WebAssembly architecture labels Aug 3, 2023
@ghostghost assigned kgAug 3, 2023
@ghostghost added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Aug 3, 2023
@ghost

ghost commented Aug 3, 2023

Copy link
Copy Markdown

Tagging subscribers to 'arch-wasm': @lewing
See info in area-owners.md if you want to be subscribed.

Issue Details

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information. It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

Author:kg
Assignees:-
Labels:

NO-MERGE, arch-wasm

Milestone:-

@kg

kg commented Aug 8, 2023

Copy link
Copy Markdown
ContributorAuthor

Updated so that the interp_entry and jit_call queues are now stored in the native heap in thread-local lists, and there's a central list tracking all of those lists. So any time a method is freed we can acquire a lock and go through all the queues and ensure the freed method isn't in them, synchronously. This avoids the need to somehow push a callback to all of our threads. (We do still need to clean up their state, but it's less important)

kg added 2 commits August 14, 2023 18:33
Notify jiterpreter when a method is freed and ensure it isn't in the jit queues
Fix infosByMethod not being populated
Checkpoint: Migrate jiterpreter jit queues to C thread-local memory
Use tlqueue for interp_entry as well
@kg
kgforce-pushed the jiterp-method-free branch from 9728807 to 7c4cb62CompareAugust 15, 2023 02:03
@kg
kg marked this pull request as ready for review August 15, 2023 02:52
@kgkg added area-Codegen-Interpreter-mono and removed NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners labels Aug 15, 2023
@ghost

Copy link
Copy Markdown

Tagging subscribers to this area: @BrzVlad, @kotlarmilos
See info in area-owners.md if you want to be subscribed.

Issue Details

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information.

It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

Author:kg
Assignees:kg
Labels:

arch-wasm, area-Codegen-Interpreter-mono

Milestone:-

@kg
kg requested a review from lambdageekAugust 15, 2023 02:53

@lambdageeklambdageek left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Two areas to call out (but I'm not sure if there's anything to be done about it):

  1. the EMSCRIPTEN_KEEPALIVE functions are pretty fragile since they don't have GC state transitions and use OS (not coop) mutexes. It might be enough to just comment that adding work inside those locks needs to be done carefully.
  2. I don't know if the jiterp would ever run outside of WASM, but we do have mono helpers for the TLS keys and atomic increments.

Comment threadsrc/mono/mono/mini/interp/jiterpreter.c
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c Outdated
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c Outdated
@kg
kg requested a review from lambdageekAugust 16, 2023 02:48
@lewing

Copy link
Copy Markdown
Member

Should we take this in main? Should it still be considered for 8?

@kg

kg commented Aug 18, 2023

Copy link
Copy Markdown
ContributorAuthor

Should we take this in main? Should it still be considered for 8?

We would have to backport both this and multithreading support to take this in 8.

@kg
kg merged commit 1e40c04 into dotnet:mainAug 21, 2023
@ghostghost locked as resolved and limited conversation to collaborators Sep 20, 2023
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@kg@lewing@lambdageek
, 'i'); if (__m === '*' || __re.test(location.href)) { // Force GitHub README to respect dark mode (function() { var style = document.createElement('style'); style.textContent = ' .markdown-body { color-scheme: dark light; } .markdown-body pre { background: #161b22 !important; } .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; } .markdown-body table th, .markdown-body table td { border-color: #30363d !important; } .markdown-body img { background: #0d1117; } .markdown-body blockquote { border-left-color: #8b949e; } .markdown-body hr { border-color: #30363d; } '; document.head.appendChild(style); })(); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' [wasm] Notify jiterpreter when a method is freed by kg · Pull Request #89980 · dotnet/runtime · GitHub
Skip to content

[wasm] Notify jiterpreter when a method is freed - #89980

Merged
kg merged 8 commits into
dotnet:mainfrom
kg:jiterp-method-free
Aug 21, 2023
Merged

[wasm] Notify jiterpreter when a method is freed#89980
kg merged 8 commits into
dotnet:mainfrom
kg:jiterp-method-free

Conversation

@kg

@kgkg commented Aug 3, 2023

Copy link
Copy Markdown
Contributor

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information.

It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

@kgkg added NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) arch-wasm WebAssembly architecture labels Aug 3, 2023
@ghostghost assigned kgAug 3, 2023
@ghostghost added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Aug 3, 2023
@ghost

ghost commented Aug 3, 2023

Copy link
Copy Markdown

Tagging subscribers to 'arch-wasm': @lewing
See info in area-owners.md if you want to be subscribed.

Issue Details

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information. It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

Author:kg
Assignees:-
Labels:

NO-MERGE, arch-wasm

Milestone:-

@kg

kg commented Aug 8, 2023

Copy link
Copy Markdown
ContributorAuthor

Updated so that the interp_entry and jit_call queues are now stored in the native heap in thread-local lists, and there's a central list tracking all of those lists. So any time a method is freed we can acquire a lock and go through all the queues and ensure the freed method isn't in them, synchronously. This avoids the need to somehow push a callback to all of our threads. (We do still need to clean up their state, but it's less important)

kg added 2 commits August 14, 2023 18:33
Notify jiterpreter when a method is freed and ensure it isn't in the jit queues
Fix infosByMethod not being populated
Checkpoint: Migrate jiterpreter jit queues to C thread-local memory
Use tlqueue for interp_entry as well
@kg
kgforce-pushed the jiterp-method-free branch from 9728807 to 7c4cb62CompareAugust 15, 2023 02:03
@kg
kg marked this pull request as ready for review August 15, 2023 02:52
@kgkg added area-Codegen-Interpreter-mono and removed NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners labels Aug 15, 2023
@ghost

Copy link
Copy Markdown

Tagging subscribers to this area: @BrzVlad, @kotlarmilos
See info in area-owners.md if you want to be subscribed.

Issue Details

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information.

It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

Author:kg
Assignees:kg
Labels:

arch-wasm, area-Codegen-Interpreter-mono

Milestone:-

@kg
kg requested a review from lambdageekAugust 15, 2023 02:53

@lambdageeklambdageek left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Two areas to call out (but I'm not sure if there's anything to be done about it):

  1. the EMSCRIPTEN_KEEPALIVE functions are pretty fragile since they don't have GC state transitions and use OS (not coop) mutexes. It might be enough to just comment that adding work inside those locks needs to be done carefully.
  2. I don't know if the jiterp would ever run outside of WASM, but we do have mono helpers for the TLS keys and atomic increments.

Comment threadsrc/mono/mono/mini/interp/jiterpreter.c
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c Outdated
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c Outdated
@kg
kg requested a review from lambdageekAugust 16, 2023 02:48
@lewing

Copy link
Copy Markdown
Member

Should we take this in main? Should it still be considered for 8?

@kg

kg commented Aug 18, 2023

Copy link
Copy Markdown
ContributorAuthor

Should we take this in main? Should it still be considered for 8?

We would have to backport both this and multithreading support to take this in 8.

@kg
kg merged commit 1e40c04 into dotnet:mainAug 21, 2023
@ghostghost locked as resolved and limited conversation to collaborators Sep 20, 2023
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@kg@lewing@lambdageek
, 'i'); if (__m === '*' || __re.test(location.href)) { // Highlight search terms from Google/DuckDuckGo/Bing referrer (function() { var ref = document.referrer; var terms = []; if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) { var url = new URL(ref); var q = url.searchParams.get('q') || url.searchParams.get('p'); if (q) { terms = q.split(/\s+/).filter(function(t) { return t.length > 2; }); } } if (terms.length === 0) return; var style = document.createElement('style'); style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }'; document.head.appendChild(style); function highlight(node) { if (node.nodeType === 3) { // text node var text = node.textContent; var found = false; terms.forEach(function(term) { var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' [wasm] Notify jiterpreter when a method is freed by kg · Pull Request #89980 · dotnet/runtime · GitHub
Skip to content

[wasm] Notify jiterpreter when a method is freed - #89980

Merged
kg merged 8 commits into
dotnet:mainfrom
kg:jiterp-method-free
Aug 21, 2023
Merged

[wasm] Notify jiterpreter when a method is freed#89980
kg merged 8 commits into
dotnet:mainfrom
kg:jiterp-method-free

Conversation

@kg

@kgkg commented Aug 3, 2023

Copy link
Copy Markdown
Contributor

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information.

It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

@kgkg added NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) arch-wasm WebAssembly architecture labels Aug 3, 2023
@ghostghost assigned kgAug 3, 2023
@ghostghost added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Aug 3, 2023
@ghost

ghost commented Aug 3, 2023

Copy link
Copy Markdown

Tagging subscribers to 'arch-wasm': @lewing
See info in area-owners.md if you want to be subscribed.

Issue Details

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information. It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

Author:kg
Assignees:-
Labels:

NO-MERGE, arch-wasm

Milestone:-

@kg

kg commented Aug 8, 2023

Copy link
Copy Markdown
ContributorAuthor

Updated so that the interp_entry and jit_call queues are now stored in the native heap in thread-local lists, and there's a central list tracking all of those lists. So any time a method is freed we can acquire a lock and go through all the queues and ensure the freed method isn't in them, synchronously. This avoids the need to somehow push a callback to all of our threads. (We do still need to clean up their state, but it's less important)

kg added 2 commits August 14, 2023 18:33
Notify jiterpreter when a method is freed and ensure it isn't in the jit queues
Fix infosByMethod not being populated
Checkpoint: Migrate jiterpreter jit queues to C thread-local memory
Use tlqueue for interp_entry as well
@kg
kgforce-pushed the jiterp-method-free branch from 9728807 to 7c4cb62CompareAugust 15, 2023 02:03
@kg
kg marked this pull request as ready for review August 15, 2023 02:52
@kgkg added area-Codegen-Interpreter-mono and removed NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners labels Aug 15, 2023
@ghost

Copy link
Copy Markdown

Tagging subscribers to this area: @BrzVlad, @kotlarmilos
See info in area-owners.md if you want to be subscribed.

Issue Details

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information.

It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

Author:kg
Assignees:kg
Labels:

arch-wasm, area-Codegen-Interpreter-mono

Milestone:-

@kg
kg requested a review from lambdageekAugust 15, 2023 02:53

@lambdageeklambdageek left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Two areas to call out (but I'm not sure if there's anything to be done about it):

  1. the EMSCRIPTEN_KEEPALIVE functions are pretty fragile since they don't have GC state transitions and use OS (not coop) mutexes. It might be enough to just comment that adding work inside those locks needs to be done carefully.
  2. I don't know if the jiterp would ever run outside of WASM, but we do have mono helpers for the TLS keys and atomic increments.

Comment threadsrc/mono/mono/mini/interp/jiterpreter.c
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c Outdated
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c Outdated
@kg
kg requested a review from lambdageekAugust 16, 2023 02:48
@lewing

Copy link
Copy Markdown
Member

Should we take this in main? Should it still be considered for 8?

@kg

kg commented Aug 18, 2023

Copy link
Copy Markdown
ContributorAuthor

Should we take this in main? Should it still be considered for 8?

We would have to backport both this and multithreading support to take this in 8.

@kg
kg merged commit 1e40c04 into dotnet:mainAug 21, 2023
@ghostghost locked as resolved and limited conversation to collaborators Sep 20, 2023
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@kg@lewing@lambdageek
, 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ' [wasm] Notify jiterpreter when a method is freed by kg · Pull Request #89980 · dotnet/runtime · GitHub
Skip to content

[wasm] Notify jiterpreter when a method is freed - #89980

Merged
kg merged 8 commits into
dotnet:mainfrom
kg:jiterp-method-free
Aug 21, 2023
Merged

[wasm] Notify jiterpreter when a method is freed#89980
kg merged 8 commits into
dotnet:mainfrom
kg:jiterp-method-free

Conversation

@kg

@kgkg commented Aug 3, 2023

Copy link
Copy Markdown
Contributor

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information.

It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

@kgkg added NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) arch-wasm WebAssembly architecture labels Aug 3, 2023
@ghostghost assigned kgAug 3, 2023
@ghostghost added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Aug 3, 2023
@ghost

ghost commented Aug 3, 2023

Copy link
Copy Markdown

Tagging subscribers to 'arch-wasm': @lewing
See info in area-owners.md if you want to be subscribed.

Issue Details

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information. It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

Author:kg
Assignees:-
Labels:

NO-MERGE, arch-wasm

Milestone:-

@kg

kg commented Aug 8, 2023

Copy link
Copy Markdown
ContributorAuthor

Updated so that the interp_entry and jit_call queues are now stored in the native heap in thread-local lists, and there's a central list tracking all of those lists. So any time a method is freed we can acquire a lock and go through all the queues and ensure the freed method isn't in them, synchronously. This avoids the need to somehow push a callback to all of our threads. (We do still need to clean up their state, but it's less important)

kg added 2 commits August 14, 2023 18:33
Notify jiterpreter when a method is freed and ensure it isn't in the jit queues
Fix infosByMethod not being populated
Checkpoint: Migrate jiterpreter jit queues to C thread-local memory
Use tlqueue for interp_entry as well
@kg
kgforce-pushed the jiterp-method-free branch from 9728807 to 7c4cb62CompareAugust 15, 2023 02:03
@kg
kg marked this pull request as ready for review August 15, 2023 02:52
@kgkg added area-Codegen-Interpreter-mono and removed NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners labels Aug 15, 2023
@ghost

Copy link
Copy Markdown

Tagging subscribers to this area: @BrzVlad, @kotlarmilos
See info in area-owners.md if you want to be subscribed.

Issue Details

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information.

It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

Author:kg
Assignees:kg
Labels:

arch-wasm, area-Codegen-Interpreter-mono

Milestone:-

@kg
kg requested a review from lambdageekAugust 15, 2023 02:53

@lambdageeklambdageek left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Two areas to call out (but I'm not sure if there's anything to be done about it):

  1. the EMSCRIPTEN_KEEPALIVE functions are pretty fragile since they don't have GC state transitions and use OS (not coop) mutexes. It might be enough to just comment that adding work inside those locks needs to be done carefully.
  2. I don't know if the jiterp would ever run outside of WASM, but we do have mono helpers for the TLS keys and atomic increments.

Comment threadsrc/mono/mono/mini/interp/jiterpreter.c
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c Outdated
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c Outdated
@kg
kg requested a review from lambdageekAugust 16, 2023 02:48
@lewing

Copy link
Copy Markdown
Member

Should we take this in main? Should it still be considered for 8?

@kg

kg commented Aug 18, 2023

Copy link
Copy Markdown
ContributorAuthor

Should we take this in main? Should it still be considered for 8?

We would have to backport both this and multithreading support to take this in 8.

@kg
kg merged commit 1e40c04 into dotnet:mainAug 21, 2023
@ghostghost locked as resolved and limited conversation to collaborators Sep 20, 2023
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@kg@lewing@lambdageek
, 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' [wasm] Notify jiterpreter when a method is freed by kg · Pull Request #89980 · dotnet/runtime · GitHub
Skip to content

[wasm] Notify jiterpreter when a method is freed - #89980

Merged
kg merged 8 commits into
dotnet:mainfrom
kg:jiterp-method-free
Aug 21, 2023
Merged

[wasm] Notify jiterpreter when a method is freed#89980
kg merged 8 commits into
dotnet:mainfrom
kg:jiterp-method-free

Conversation

@kg

@kgkg commented Aug 3, 2023

Copy link
Copy Markdown
Contributor

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information.

It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

@kgkg added NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) arch-wasm WebAssembly architecture labels Aug 3, 2023
@ghostghost assigned kgAug 3, 2023
@ghostghost added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Aug 3, 2023
@ghost

ghost commented Aug 3, 2023

Copy link
Copy Markdown

Tagging subscribers to 'arch-wasm': @lewing
See info in area-owners.md if you want to be subscribed.

Issue Details

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information. It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

Author:kg
Assignees:-
Labels:

NO-MERGE, arch-wasm

Milestone:-

@kg

kg commented Aug 8, 2023

Copy link
Copy Markdown
ContributorAuthor

Updated so that the interp_entry and jit_call queues are now stored in the native heap in thread-local lists, and there's a central list tracking all of those lists. So any time a method is freed we can acquire a lock and go through all the queues and ensure the freed method isn't in them, synchronously. This avoids the need to somehow push a callback to all of our threads. (We do still need to clean up their state, but it's less important)

kg added 2 commits August 14, 2023 18:33
Notify jiterpreter when a method is freed and ensure it isn't in the jit queues
Fix infosByMethod not being populated
Checkpoint: Migrate jiterpreter jit queues to C thread-local memory
Use tlqueue for interp_entry as well
@kg
kgforce-pushed the jiterp-method-free branch from 9728807 to 7c4cb62CompareAugust 15, 2023 02:03
@kg
kg marked this pull request as ready for review August 15, 2023 02:52
@kgkg added area-Codegen-Interpreter-mono and removed NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners labels Aug 15, 2023
@ghost

Copy link
Copy Markdown

Tagging subscribers to this area: @BrzVlad, @kotlarmilos
See info in area-owners.md if you want to be subscribed.

Issue Details

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information.

It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

Author:kg
Assignees:kg
Labels:

arch-wasm, area-Codegen-Interpreter-mono

Milestone:-

@kg
kg requested a review from lambdageekAugust 15, 2023 02:53

@lambdageeklambdageek left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Two areas to call out (but I'm not sure if there's anything to be done about it):

  1. the EMSCRIPTEN_KEEPALIVE functions are pretty fragile since they don't have GC state transitions and use OS (not coop) mutexes. It might be enough to just comment that adding work inside those locks needs to be done carefully.
  2. I don't know if the jiterp would ever run outside of WASM, but we do have mono helpers for the TLS keys and atomic increments.

Comment threadsrc/mono/mono/mini/interp/jiterpreter.c
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c Outdated
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c Outdated
@kg
kg requested a review from lambdageekAugust 16, 2023 02:48
@lewing

Copy link
Copy Markdown
Member

Should we take this in main? Should it still be considered for 8?

@kg

kg commented Aug 18, 2023

Copy link
Copy Markdown
ContributorAuthor

Should we take this in main? Should it still be considered for 8?

We would have to backport both this and multithreading support to take this in 8.

@kg
kg merged commit 1e40c04 into dotnet:mainAug 21, 2023
@ghostghost locked as resolved and limited conversation to collaborators Sep 20, 2023
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@kg@lewing@lambdageek
, 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' [wasm] Notify jiterpreter when a method is freed by kg · Pull Request #89980 · dotnet/runtime · GitHub
Skip to content

[wasm] Notify jiterpreter when a method is freed - #89980

Merged
kg merged 8 commits into
dotnet:mainfrom
kg:jiterp-method-free
Aug 21, 2023
Merged

[wasm] Notify jiterpreter when a method is freed#89980
kg merged 8 commits into
dotnet:mainfrom
kg:jiterp-method-free

Conversation

@kg

@kgkg commented Aug 3, 2023

Copy link
Copy Markdown
Contributor

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information.

It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

@kgkg added NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) arch-wasm WebAssembly architecture labels Aug 3, 2023
@ghostghost assigned kgAug 3, 2023
@ghostghost added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Aug 3, 2023
@ghost

ghost commented Aug 3, 2023

Copy link
Copy Markdown

Tagging subscribers to 'arch-wasm': @lewing
See info in area-owners.md if you want to be subscribed.

Issue Details

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information. It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

Author:kg
Assignees:-
Labels:

NO-MERGE, arch-wasm

Milestone:-

@kg

kg commented Aug 8, 2023

Copy link
Copy Markdown
ContributorAuthor

Updated so that the interp_entry and jit_call queues are now stored in the native heap in thread-local lists, and there's a central list tracking all of those lists. So any time a method is freed we can acquire a lock and go through all the queues and ensure the freed method isn't in them, synchronously. This avoids the need to somehow push a callback to all of our threads. (We do still need to clean up their state, but it's less important)

kg added 2 commits August 14, 2023 18:33
Notify jiterpreter when a method is freed and ensure it isn't in the jit queues
Fix infosByMethod not being populated
Checkpoint: Migrate jiterpreter jit queues to C thread-local memory
Use tlqueue for interp_entry as well
@kg
kgforce-pushed the jiterp-method-free branch from 9728807 to 7c4cb62CompareAugust 15, 2023 02:03
@kg
kg marked this pull request as ready for review August 15, 2023 02:52
@kgkg added area-Codegen-Interpreter-mono and removed NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners labels Aug 15, 2023
@ghost

Copy link
Copy Markdown

Tagging subscribers to this area: @BrzVlad, @kotlarmilos
See info in area-owners.md if you want to be subscribed.

Issue Details

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information.

It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

Author:kg
Assignees:kg
Labels:

arch-wasm, area-Codegen-Interpreter-mono

Milestone:-

@kg
kg requested a review from lambdageekAugust 15, 2023 02:53

@lambdageeklambdageek left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Two areas to call out (but I'm not sure if there's anything to be done about it):

  1. the EMSCRIPTEN_KEEPALIVE functions are pretty fragile since they don't have GC state transitions and use OS (not coop) mutexes. It might be enough to just comment that adding work inside those locks needs to be done carefully.
  2. I don't know if the jiterp would ever run outside of WASM, but we do have mono helpers for the TLS keys and atomic increments.

Comment threadsrc/mono/mono/mini/interp/jiterpreter.c
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c Outdated
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c Outdated
@kg
kg requested a review from lambdageekAugust 16, 2023 02:48
@lewing

Copy link
Copy Markdown
Member

Should we take this in main? Should it still be considered for 8?

@kg

kg commented Aug 18, 2023

Copy link
Copy Markdown
ContributorAuthor

Should we take this in main? Should it still be considered for 8?

We would have to backport both this and multithreading support to take this in 8.

@kg
kg merged commit 1e40c04 into dotnet:mainAug 21, 2023
@ghostghost locked as resolved and limited conversation to collaborators Sep 20, 2023
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@kg@lewing@lambdageek
, 'i'); if (__m === '*' || __re.test(location.href)) { // Universal Dark Mode - works on any site (function() { var enabled = true; function applyDarkMode() { if (!enabled) return; // Create style element if it doesn't exist var style = document.getElementById('universal-dark-mode-style'); if (!style) { style = document.createElement('style'); style.id = 'universal-dark-mode-style'; document.head.appendChild(style); } // Dark mode CSS - inverts colors but preserves images/video style.textContent = ' /* Invert everything except media */ html { filter: invert(1) hue-rotate(180deg) !important; background: #1a1a2e !important; } /* Restore images, videos, iframes, canvas */ img, video, iframe, canvas, svg, picture, [style*="background-image"] { filter: invert(1) hue-rotate(180deg) !important; } /* Preserve specific elements that should not be inverted */ .no-dark-mode, .no-dark-mode *, [data-theme="light"], [data-theme="light"], .ace_editor, .ace_editor *, .CodeMirror, .CodeMirror *, .monaco-editor, .monaco-editor *, .markdown-body pre, .markdown-body pre *, .highlight, .highlight *, pre code, pre code * { filter: none !important; } /* Fix common UI elements */ .modal, .popup, .dropdown-menu, .tooltip, .popover { filter: invert(1) hue-rotate(180deg) !important; background: #2d2d44 !important; border-color: #444 !important; } /* Scrollbars */ ::-webkit-scrollbar { background: #1a1a2e !important; } ::-webkit-scrollbar-thumb { background: #444 !important; } ::-webkit-scrollbar-thumb:hover { background: #555 !important; } /* Selection */ ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; } ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; } '; } function removeDarkMode() { var style = document.getElementById('universal-dark-mode-style'); if (style) style.remove(); } // Toggle with Alt+Shift+D document.addEventListener('keydown', function(e) { if (e.altKey && e.shiftKey && e.key === 'D') { e.preventDefault(); enabled = !enabled; if (enabled) { applyDarkMode(); console.log('[Universal Dark Mode] Enabled'); } else { removeDarkMode(); console.log('[Universal Dark Mode] Disabled'); } } }); // Apply on load applyDarkMode(); // Re-apply on dynamic content var observer = new MutationObserver(function(mutations) { if (enabled && !document.getElementById('universal-dark-mode-style')) { applyDarkMode(); } }); observer.observe(document.head, { childList: true }); console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle'); })(); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })(); [wasm] Notify jiterpreter when a method is freed by kg · Pull Request #89980 · dotnet/runtime · GitHub
Skip to content

[wasm] Notify jiterpreter when a method is freed - #89980

Merged
kg merged 8 commits into
dotnet:mainfrom
kg:jiterp-method-free
Aug 21, 2023
Merged

[wasm] Notify jiterpreter when a method is freed#89980
kg merged 8 commits into
dotnet:mainfrom
kg:jiterp-method-free

Conversation

@kg

@kgkg commented Aug 3, 2023

Copy link
Copy Markdown
Contributor

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information.

It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

@kgkg added NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) arch-wasm WebAssembly architecture labels Aug 3, 2023
@ghostghost assigned kgAug 3, 2023
@ghostghost added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Aug 3, 2023
@ghost

ghost commented Aug 3, 2023

Copy link
Copy Markdown

Tagging subscribers to 'arch-wasm': @lewing
See info in area-owners.md if you want to be subscribed.

Issue Details

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information. It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

Author:kg
Assignees:-
Labels:

NO-MERGE, arch-wasm

Milestone:-

@kg

kg commented Aug 8, 2023

Copy link
Copy Markdown
ContributorAuthor

Updated so that the interp_entry and jit_call queues are now stored in the native heap in thread-local lists, and there's a central list tracking all of those lists. So any time a method is freed we can acquire a lock and go through all the queues and ensure the freed method isn't in them, synchronously. This avoids the need to somehow push a callback to all of our threads. (We do still need to clean up their state, but it's less important)

kg added 2 commits August 14, 2023 18:33
Notify jiterpreter when a method is freed and ensure it isn't in the jit queues
Fix infosByMethod not being populated
Checkpoint: Migrate jiterpreter jit queues to C thread-local memory
Use tlqueue for interp_entry as well
@kg
kgforce-pushed the jiterp-method-free branch from 9728807 to 7c4cb62CompareAugust 15, 2023 02:03
@kg
kg marked this pull request as ready for review August 15, 2023 02:52
@kgkg added area-Codegen-Interpreter-mono and removed NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners labels Aug 15, 2023
@ghost

Copy link
Copy Markdown

Tagging subscribers to this area: @BrzVlad, @kotlarmilos
See info in area-owners.md if you want to be subscribed.

Issue Details

In some cases a MonoMethod and its associated InterpMethod can be freed at runtime. The jiterpreter currently knows nothing about this, and in very rare circumstances it's possible that something new would get allocated at the same address. Very bad things would probably happen if so.

This PR updates the jiterpreter to clear freed methods from its JIT queues and discards some state so that if a new object is allocated at the same address, it won't inherit old information.

It also changes some tables that previously used raw memory addresses to use assigned indices instead, which should help with the 'we freed something and then put something new there' problem.

It is very hard to manually reproduce the scenario that I think caused #89670 but I was at least able to verify during testing that methods can be freed while the jit queue is not empty, so hopefully this will fix that.

At some point we probably also want to update the jiterpreter so that if a method is freed, we remove the function pointer so that the browser is able to potentially release the memory used by the compiled traces inside of it. But that's a big undertaking thanks to threads, so it's not in this PR.

Depends on #88279

Author:kg
Assignees:kg
Labels:

arch-wasm, area-Codegen-Interpreter-mono

Milestone:-

@kg
kg requested a review from lambdageekAugust 15, 2023 02:53

@lambdageeklambdageek left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Two areas to call out (but I'm not sure if there's anything to be done about it):

  1. the EMSCRIPTEN_KEEPALIVE functions are pretty fragile since they don't have GC state transitions and use OS (not coop) mutexes. It might be enough to just comment that adding work inside those locks needs to be done carefully.
  2. I don't know if the jiterp would ever run outside of WASM, but we do have mono helpers for the TLS keys and atomic increments.

Comment threadsrc/mono/mono/mini/interp/jiterpreter.c
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c Outdated
Comment threadsrc/mono/mono/mini/interp/jiterpreter.c Outdated
@kg
kg requested a review from lambdageekAugust 16, 2023 02:48
@lewing

Copy link
Copy Markdown
Member

Should we take this in main? Should it still be considered for 8?

@kg

kg commented Aug 18, 2023

Copy link
Copy Markdown
ContributorAuthor

Should we take this in main? Should it still be considered for 8?

We would have to backport both this and multithreading support to take this in 8.

@kg
kg merged commit 1e40c04 into dotnet:mainAug 21, 2023
@ghostghost locked as resolved and limited conversation to collaborators Sep 20, 2023
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@kg@lewing@lambdageek