bugThe FreeType Project - Bugs: bug #46223, slow run in TT_RunIns

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #46223: slow run in TT_RunIns

Submitter:  Kostya Serebryany <kcc>
Submitted:  Fri 16 Oct 2015 06:16:46 AM UTC
   
 
Severity:  3 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  wl Open/Closed:  Closed
Planned Release:  2.6.2

Jump to the original submission

Mon 26 Oct 2015 06:48:05 PM UTC, comment #7: 

This made the bot almost 2x faster, perfect!

Compare the logs:
http://107.178.217.50/pass-2015-10-26-14-36-36.log
Done 582403 runs in 7201 second(s)
Done 483288 runs in 7201 second(s)
Done 465963 runs in 7201 second(s)
Done 518273 runs in 7201 second(s)
Done 510137 runs in 7201 second(s)
Done 496732 runs in 7202 second(s)
Done 579282 runs in 7202 second(s)
Done 470582 runs in 7272 second(s)

http://107.178.217.50/pass-2015-10-26-16-40-22.log
Done 959092 runs in 7201 second(s)
Done 947588 runs in 7201 second(s)
Done 815351 runs in 7201 second(s)
Done 979212 runs in 7201 second(s)
Done 781432 runs in 7201 second(s)
Done 962566 runs in 7201 second(s)
Done 962319 runs in 7201 second(s)
Done 982520 runs in 7201 second(s)

Kostya Serebryany <kcc>
Group Member
Mon 26 Oct 2015 02:42:12 PM UTC, comment #6: 

Thanks, this input was very helpful, pointing to an issue completely unrelated to bytecode execution speed.  The slowness should be fixed now in the git, please test!

Werner LEMBERG <wl>
Group administrator
Sat 24 Oct 2015 05:01:22 AM UTC, comment #5: 

the fuzzer bot periodically discovers slower and slower inputs.
This one takes 6 seconds to digest w/o any extra instrumentation
(20+ seconds with asan and coverage),

TT_RunIns eats 86%, so I guess I need to reopen this one.

(file #35276)

Kostya Serebryany <kcc>
Group Member
Thu 22 Oct 2015 09:28:12 PM UTC, comment #4: 

TT_RunIns is still the 2nd hottest function for the fuzzer.
Attached are 10 small inputs, each consumes 1-2 seconds,
their profiles looks like this:

 88.62%    [.] TT_RunIns                                                                                                                                    
  7.18%    [.] Compute_Funcs                                                                                                                                
  2.03%    [.] Project_y                                                                                                                                    
  1.09%    [.] Write_CVT                                                                                                                                    
  0.76%    [.] Read_CVT                     


The profile for running the entire corpus looks like this:
+  23.66%    [.] memset                                                                                                                                    
+  15.69%    [.] TT_RunIns                                                                                                                                 
+  11.76%    [.] tt_cmap4_char_next                                                                                                                        
+   7.68%    [.] tt_cmap4_next        

So, improving TT_RunIns would be nice, but may not have a dramatic effect on fuzzing, at least now

(file #35266)

Kostya Serebryany <kcc>
Group Member
Sun 18 Oct 2015 04:16:25 PM UTC, comment #3: 

Fixed now in git, thanks.

Note that it is not a duplicate of #46208.

And the `runnable' option is now surrounded with #ifndef, as you are suggesting.

Werner LEMBERG <wl>
Group administrator
Fri 16 Oct 2015 07:54:04 PM UTC, comment #2: 

One option for what I think what may be wanted for the fuzzer is to put an 'ifndef TT_CONFIG_OPTION_MAX_RUNNABLE_OPCODES' around the current define of TT_CONFIG_OPTION_MAX_RUNNABLE_OPCODES, so that it can be changed without actually changing ftoption.h .

Since this is a very advanced configuration configuration feature, it might make sense to put it in an ifndef and also put it back in the source file. I must admit that doing so (having an option not listed in ftoption.h seems a bit dirty.

The current means of setting this on the fuzzer side is to point to it's own ftoption.h, or to patch ftoption.h after checkout. This just means more possible maintenance on the fuzzer side, though this may be the right thing to do anyway, given that it may be beneficial to be able to change other settings here as well.

One rather squirrely thing I noticed is that FT_CONFIG_OPTION_USE_PNG define in ftoption.h is commented out, but that 'configure' will set 'FT_CONFIG_OPTION_USE_PNG=1' if libpng is found when configuring (leading to fun redefinition errors if the FT_CONFIG_OPTION_USE_PNG define is uncommented in ftoption.h and then one uses configure). If TT_CONFIG_OPTION_MAX_RUNNABLE_OPCODES were in ftoption.h but default commented out, with the implementation file providing the default if it isn't defined, then configure could grow a '--for-fuzzing-max-runnable-opcoes' or something like this to set it.

In any event, there are many possible ways of doing this, but it would be nice to have one which makes it easy for the fuzzer to indicate it.

bungeman <bungeman>
Fri 16 Oct 2015 12:33:43 PM UTC, comment #1: 
bungeman <bungeman>
Fri 16 Oct 2015 06:16:46 AM UTC, original submission:  

Found with libFuzzer.

The attached reproducer runs for ~1 minute in src/tools/ftfuzzer/ftfuzzer.cc

Most of the time is spent in TT_RunIns

Kostya Serebryany <kcc>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #35266:  SLOW.tgz added by kcc (2KiB - application/x-compressed-tar)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wl (Posted a comment)
  • -email is unavailable- added by bungeman (Posted a comment)
  • -email is unavailable- added by kcc (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-10-24 kcc Attached File- Added CORPORA-ARTIFACTS-slow-unit-0f365acefde457a84b04fabe776961838075b807, #35276
    2015-10-22 kcc Attached File- Added SLOW.tgz, #35266
    2015-10-18 wl StatusNone Fixed
        Assigned toNone wl
        Open/ClosedOpen Closed
        Planned ReleaseNone 2.6.2
    2015-10-16 kcc Attached File- Added CORPORA-ARTIFACTS-slow-unit-793f94bb79d9fb060357876de45b0be5a343b07f, #35212

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code