bugThe FreeType Project - Bugs: bug #46223, slow run in TT_RunIns

 
 

bug #46223: slow run in TT_RunIns

Submitted by:  Kostya Serebryany <kcc>
Submitted on:  Fri 16 Oct 2015 06:16:46 AM UTC  
 
Severity: 3 - NormalItem Group: None
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.6.2

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Mon 26 Oct 2015 06:48:05 PM UTC, comment #7:

This made the bot almost 2x faster, perfect!

Compare the logs:
http://107.178.217.50/pass-2015-10-26-14-36-36.log
Done 582403 runs in 7201 second(s)
Done 483288 runs in 7201 second(s)
Done 465963 runs in 7201 second(s)
Done 518273 runs in 7201 second(s)
Done 510137 runs in 7201 second(s)
Done 496732 runs in 7202 second(s)
Done 579282 runs in 7202 second(s)
Done 470582 runs in 7272 second(s)

http://107.178.217.50/pass-2015-10-26-16-40-22.log
Done 959092 runs in 7201 second(s)
Done 947588 runs in 7201 second(s)
Done 815351 runs in 7201 second(s)
Done 979212 runs in 7201 second(s)
Done 781432 runs in 7201 second(s)
Done 962566 runs in 7201 second(s)
Done 962319 runs in 7201 second(s)
Done 982520 runs in 7201 second(s)

Kostya Serebryany <kcc>
Project Member
Mon 26 Oct 2015 02:42:12 PM UTC, comment #6:

Thanks, this input was very helpful, pointing to an issue completely unrelated to bytecode execution speed. The slowness should be fixed now in the git, please test!

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Sat 24 Oct 2015 05:01:22 AM UTC, comment #5:

the fuzzer bot periodically discovers slower and slower inputs.
This one takes 6 seconds to digest w/o any extra instrumentation
(20+ seconds with asan and coverage),

TT_RunIns eats 86%, so I guess I need to reopen this one.

(file #35276)

Kostya Serebryany <kcc>
Project Member
Thu 22 Oct 2015 09:28:12 PM UTC, comment #4:

TT_RunIns is still the 2nd hottest function for the fuzzer.
Attached are 10 small inputs, each consumes 1-2 seconds,
their profiles looks like this:

88.62% [.] TT_RunIns
7.18% [.] Compute_Funcs
2.03% [.] Project_y
1.09% [.] Write_CVT
0.76% [.] Read_CVT

The profile for running the entire corpus looks like this:
+ 23.66% [.] memset
+ 15.69% [.] TT_RunIns
+ 11.76% [.] tt_cmap4_char_next
+ 7.68% [.] tt_cmap4_next

So, improving TT_RunIns would be nice, but may not have a dramatic effect on fuzzing, at least now

(file #35266)

Kostya Serebryany <kcc>
Project Member
Sun 18 Oct 2015 04:16:25 PM UTC, comment #3:

Fixed now in git, thanks.

Note that it is not a duplicate of #46208.

And the `runnable' option is now surrounded with #ifndef, as you are suggesting.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Fri 16 Oct 2015 07:54:04 PM UTC, comment #2:

One option for what I think what may be wanted for the fuzzer is to put an 'ifndef TT_CONFIG_OPTION_MAX_RUNNABLE_OPCODES' around the current define of TT_CONFIG_OPTION_MAX_RUNNABLE_OPCODES, so that it can be changed without actually changing ftoption.h .

Since this is a very advanced configuration configuration feature, it might make sense to put it in an ifndef and also put it back in the source file. I must admit that doing so (having an option not listed in ftoption.h seems a bit dirty.

The current means of setting this on the fuzzer side is to point to it's own ftoption.h, or to patch ftoption.h after checkout. This just means more possible maintenance on the fuzzer side, though this may be the right thing to do anyway, given that it may be beneficial to be able to change other settings here as well.

One rather squirrely thing I noticed is that FT_CONFIG_OPTION_USE_PNG define in ftoption.h is commented out, but that 'configure' will set 'FT_CONFIG_OPTION_USE_PNG=1' if libpng is found when configuring (leading to fun redefinition errors if the FT_CONFIG_OPTION_USE_PNG define is uncommented in ftoption.h and then one uses configure). If TT_CONFIG_OPTION_MAX_RUNNABLE_OPCODES were in ftoption.h but default commented out, with the implementation file providing the default if it isn't defined, then configure could grow a '--for-fuzzing-max-runnable-opcoes' or something like this to set it.

In any event, there are many possible ways of doing this, but it would be nice to have one which makes it easy for the fuzzer to indicate it.

bungeman <bungeman>
Fri 16 Oct 2015 12:33:43 PM UTC, comment #1:

This may be a dup of http://savannah.nongnu.org/bugs/?func=detailitem&item_id=46208 .

bungeman <bungeman>
Fri 16 Oct 2015 06:16:46 AM UTC, original submission:

Found with libFuzzer.

The attached reproducer runs for ~1 minute in src/tools/ftfuzzer/ftfuzzer.cc

Most of the time is spent in TT_RunIns

Kostya Serebryany <kcc>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #35266:  SLOW.tgz added by kcc (2KiB - application/x-compressed-tar)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by bungeman (Posted a comment)
  • -unavailable- added by kcc (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 24 Oct 2015 05:01:22 AM UTCkccAttached File-=>Added CORPORA-ARTIFACTS-slow-unit-0f365acefde457a84b04fabe776961838075b807, #35276
    Thu 22 Oct 2015 09:28:12 PM UTCkccAttached File-=>Added SLOW.tgz, #35266
    Sun 18 Oct 2015 04:16:25 PM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.6.2
    Fri 16 Oct 2015 06:16:46 AM UTCkccAttached File-=>Added CORPORA-ARTIFACTS-slow-unit-793f94bb79d9fb060357876de45b0be5a343b07f, #35212

    Back to the top


    Powered by Savane 3.1-cleanup1