Skip to content

[VM] Preserve 64-bit values in internal calls - #24946

Open
zhangpan2001 wants to merge 1 commit into
iree-org:mainfrom
zhangpan2001:fix/24929-unbatched-threefry-binding-length
Open

zhangpan2001 wants to merge 1 commit into
iree-org:mainfrom
zhangpan2001:fix/24929-unbatched-threefry-binding-length

Conversation

@zhangpan2001

Copy link
Copy Markdown
Contributor

Internal calls marshaled one 32-bit register per argument and result, so the high word of a 64-bit value was dropped or overwritten by the next argument. When that value feeds a buffer bound it surfaces in HAL command buffer validation as an out-of-range binding, as seen in #24929.

Marshal each argument and result at its full width from the callee's calling convention, and align argument registers to match how external calls and imports are already marshaled.

Adds call_ops.vmasm cases for consecutive i64 arguments, i64 results, and mixed primitive/ref calls. The full VM bytecode test suite passes, and the repro from #24929, which aborted with OUT_OF_RANGE before the fix, now returns the expected output.

Fixes #24929

Internal calls copied one 32-bit register per argument and result,
corrupting 64-bit values used as buffer offsets.

Use the callee signature to copy values at their full width and align
argument registers. Cover consecutive i64 arguments, high result words,
and mixed primitive and reference values.

Fixes iree-org#24929

Co-authored-by: OpenAI <noreply@openai.com>
Signed-off-by: zhangpan <98025960+zhangpan2001@users.noreply.github.com>

@schuermans-roofline schuermans-roofline left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thanks. However, I have a question about the removed TODO (please see my in-line comment).

int i32_reg_offset = 0;
int ref_reg_offset = 0;
for (int i = 0; i < src_reg_list->size; ++i) {
// TODO(benvanik): change encoding to avoid this branching.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This TODO comment had asked for removal of the branching. This PR adds more branching (three cases instead of two), but drops this comment. I do see why introducing the third case makes sense and solves the issue. However, I don't have full understand of what exactly the TODO was suggesting here and why the change solves it. Can you please explain?
(This also applies to the removed "TODO" below.)

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Runtime abort (OUT_OF_RANGE, length=2^39+N) invoking un-batched JAX Threefry on a runtime-input key; two or more lanes is fine

2 participants