[BOLT] Discard BB profiles with a hash of 0 in yaml from a Post-BAT binary

[Jinjie-Huang]

When generating the YAML profile from a Post-BAT binary, the writer seems to unconditionally trust and use the BBHashMap from the BAT table. However, it appears that in some scenarios, a recorded basic block (BB) hash within this map is 0.

When infer-stale-profile is enabled, profile.yaml generated by this way may trigger an assertion failure here and crash. So this patch tries to drop the BB profiles with a hash of 0 in writeBATYAML().

[llvmbot]

@llvm/pr-subscribers-bolt

Author: Jinjie Huang (Jinjie-Huang)

Changes

When generating the YAML profile from a Post-BAT binary, the writer seems to unconditionally trust and use the BBHashMap from the BAT table. However, it appears that in some scenarios, a recorded basic block (BB) hash within this map is 0.

When infer-stale-profile is enabled, profile.yaml generated this way may trigger an assertion failure here and crash. So this patch tries to drop the BB profiles with a hash of 0 in writeBATYAML().

---

Full diff: https://github.com/llvm/llvm-project/pull/169627.diff

1 Files Affected:

• (modified) bolt/lib/Profile/DataAggregator.cpp (+1)

diff --git a/bolt/lib/Profile/DataAggregator.cpp b/bolt/lib/Profile/DataAggregator.cpp
index 6b969011df589..dcda502a6912d 100644
--- a/bolt/lib/Profile/DataAggregator.cpp
+++ b/bolt/lib/Profile/DataAggregator.cpp
@@ -2417,6 +2417,7 @@ std::error_code DataAggregator::writeBATYAML(BinaryContext &BC,
       // Skip printing if there's no profile data
       llvm::erase_if(
           YamlBF.Blocks, [](const yaml::bolt::BinaryBasicBlockProfile &YamlBB) {
+            if ((size_t)YamlBB.Hash == 0) return true;
             auto HasCount = [](const auto &SI) { return SI.Count; };
             bool HasAnyCount = YamlBB.ExecCount ||
                                llvm::any_of(YamlBB.Successors, HasCount) ||

[Jinjie-Huang]

The BAT entry dump from the case we encountered in practice:

3763913: 00000000697e9686   323 FUNC    LOCAL  HIDDEN    33 Curl_close

Function Address: 0x697e9686, hash: 0x1dcc63912d34940d
BB mappings:
0x0 -> 0x0 hash: 0x2600d303c7740000
0x8 -> 0x8 (branch)
0xe -> 0xe hash: 0x204210dfb8d0000e
0x14 -> 0x14 (branch)
0x1a -> 0x1a hash: 0xddc0155a5e1b001a
0x24 -> 0x24 (branch)
0x33 -> 0x33 (branch)
0x39 -> 0x3d hash: 0xdd56da00b8d0003d
0x43 -> 0x47 (branch)
0x49 -> 0x49 hash: 0x69c0e100f2ca0049
0x4e -> 0x4e (branch)
0x5e -> 0xf9 hash: 0x6e3ffa7206900f9
0x6b -> 0x106 (branch)
0x77 -> 0x112 (branch)
0x77 -> 0x112 (branch)
0x77 -> 0x112 (branch)
0x84 -> 0x112 hash: 0x0
0x89 -> 0x112 hash: 0x0
0x97 -> 0x123 (branch)
0x97 -> 0x123 (branch)
0x97 -> 0x123 (branch)
0xa4 -> 0x123 hash: 0x0
0xa9 -> 0x123 hash: 0x0
0xb7 -> 0x134 (branch)
0xb7 -> 0x134 (branch)
0xb7 -> 0x134 (branch)
0xc4 -> 0x134 hash: 0x0
0xc9 -> 0x134 hash: 0x0
0xd8 -> 0x146 (branch)
0xe0 -> 0x14e (branch)
0xec -> 0x15a (branch)
0xec -> 0x15a (branch)
0xec -> 0x15a (branch)
0xf9 -> 0x15a hash: 0x0
0xfe -> 0x15a hash: 0x0
0x10c -> 0x16b (branch)
0x10c -> 0x16b (branch)
0x10c -> 0x16b (branch)
0x119 -> 0x16b hash: 0x0
0x11e -> 0x16b hash: 0x0
0x138 -> 0x188 (branch)
NumBlocks: 14

And the corresponding profile.yaml:

  - name:            'Curl_close/url.c/1'
    fid:             2418089
    hash:            0x1DCC63912D34940D
    exec:            9
    nblocks:         14
    blocks:
      - bid:             0
        insns:           0
        hash:            0x2600D303C7740000
        exec:            9
        succ:            [ { bid: 1, cnt: 9 } ]
      - bid:             1
        insns:           0
        hash:            0x204210DFB8D0000E
        succ:            [ { bid: 2, cnt: 1 }, { bid: 13, cnt: 8, mis: 2 } ]
      - bid:             2
        insns:           0
        hash:            0xDDC0155A5E1B001A
        calls:           [ { off: 0xA, fid: 2418075, cnt: 1 } ]
        succ:            [ { bid: 4, cnt: 1 } ]
      - bid:             4
        insns:           0
        hash:            0xDD56DA00B8D0003D
        succ:            [ { bid: 6, cnt: 1, mis: 1 } ]
      - bid:             5
        insns:           0
        hash:            0x69C0E100F2CA0049
        succ:            [ { bid: 6, cnt: 1 } ]
      - bid:             6
        insns:           0
        hash:            0x74DD12BA8D7F0059
        calls:           [ { off: 0x9, fid: 2418070, cnt: 2 } ]
        succ:            [ { bid: 8, cnt: 2, mis: 1 } ]
      - bid:             8
        insns:           0
        hash:            0x3D72E8558D5008A
        calls:           [ { off: 0x3, fid: 2412008, cnt: 2 }, { off: 0xB, fid: 2412673, cnt: 2 } ]
      **- bid:             0
        insns:           0
        calls:           [ { off: 0x37, fid: 2412928, cnt: 2, mis: 1 } ]
        succ:            [ { bid: 13, cnt: 2 } ]**

Alternatively, we may handle this in inferStaleProfile() by having it detect this scenario and not trigger an assertion failure for such BBs.

[github-actions]

✅ With the latest revision this PR passed the C/C++ code formatter.

[aaupov]

Thank you for the report. I have the proper fix, just need to put up a test case reproing the behavior. Please hold off with this diff, I'll put it up shortly.

[aaupov]

#145124 is the fix