[Wasm] AOT Benchmark hang

[lewing]

Blazor benchmark hanging/failing when AOT'd
Sample here https://github.com/pranavkm/AOT_OutOfBounds

Looks like possibly a bug in chromium/v8 jit as it tiers up.

One stack I got looked like

dotnet.6.0.0-preview.4.21213.3.js:1 * Assertion: should not be reached at /__w/1/s/src/mono/mono/mini/../sgen/sgen-scan-object.h:91

4739772 @ dotnet.6.0.0-preview.4.21213.3.js:1
2dotnet.6.0.0-preview.4.21213.3.js:1 Uncaught RuntimeError: table index is out of bounds
    at <anonymous>:wasm-function[44677]:0xd996a9
    at <anonymous>:wasm-function[17363]:0x57e398
    at <anonymous>:wasm-function[45229]:0xdd4bc0
    at <anonymous>:wasm-function[27493]:0x6cea7e
    at <anonymous>:wasm-function[28686]:0x6fefab
    at <anonymous>:wasm-function[28517]:0x6f45b8
    at <anonymous>:wasm-function[27422]:0x6bf879
    at invoke_viii (http://localhost:8080/_framework/dotnet.6.0.0-preview.4.21213.3.js:1:258801)
    at <anonymous>:wasm-function[1248]:0x57b98
    at invoke_viiiii (http://localhost:8080/_framework/dotnet.6.0.0-preview.4.21213.3.js:1:259519)

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

Tagging subscribers to 'arch-wasm': @lewing
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Blazor benchmark hanging/failing when AOT'd
Sample here https://github.com/pranavkm/AOT_OutOfBounds

This is an interesting case:

• Chrome/Edge
  • Works when inspector window is open
  • Page eventually hangs at a different place each time
  • sometimes you can still open the inspector window and get a trace
  • Haven’t been able to get a trace with real symbols yet
• Firefox works
• Safari works

Looks like possibly a bug in chromium/v8 jit as it tiers up.

One stack I got looked like

dotnet.6.0.0-preview.4.21213.3.js:1 * Assertion: should not be reached at /__w/1/s/src/mono/mono/mini/../sgen/sgen-scan-object.h:91

4739772 @ dotnet.6.0.0-preview.4.21213.3.js:1
2dotnet.6.0.0-preview.4.21213.3.js:1 Uncaught RuntimeError: table index is out of bounds
    at <anonymous>:wasm-function[44677]:0xd996a9
    at <anonymous>:wasm-function[17363]:0x57e398
    at <anonymous>:wasm-function[45229]:0xdd4bc0
    at <anonymous>:wasm-function[27493]:0x6cea7e
    at <anonymous>:wasm-function[28686]:0x6fefab
    at <anonymous>:wasm-function[28517]:0x6f45b8
    at <anonymous>:wasm-function[27422]:0x6bf879
    at invoke_viii (http://localhost:8080/_framework/dotnet.6.0.0-preview.4.21213.3.js:1:258801)
    at <anonymous>:wasm-function[1248]:0x57b98
    at invoke_viiiii (http://localhost:8080/_framework/dotnet.6.0.0-preview.4.21213.3.js:1:259519)

Author:	lewing
Assignees:	-
Labels:	arch-wasm, untriaged
Milestone:	-

[lewing]

cc @radekdoulik @kg @pranavkm

[lewing]

Got it to fail in firefox

Uncaught (in promise) Error: System.ArrayTypeMismatchException: Arg_ArrayTypeMismatchException
    endInvokeDotNetFromJS http://localhost:8080/_framework/blazor.webassembly.js:1
    invokeJSFromDotNet http://localhost:8080/_framework/blazor.webassembly.js:1
    lt http://localhost:8080/_framework/blazor.webassembly.js:1
    _mono_wasm_invoke_js_blazor http://localhost:8080/_framework/dotnet.6.0.0-preview.4.21213.3.js:1
    invoke_viiiii http://localhost:8080/_framework/dotnet.6.0.0-preview.4.21213.3.js:1
    _mono_wasm_invoke_method http://localhost:8080/_framework/dotnet.6.0.0-preview.4.21213.3.js:1
    managed__Microsoft_AspNetCore_Components_WebAssembly__Microsoft_AspNetCore_Components_WebAssembly_Services_DefaultWebAssemblyJSRuntime_BeginInvokeDotNet https://mono-wasm.invalid/managed__Microsoft_AspNetCore_Components_WebAssembly__Microsoft_AspNetCore_Components_WebAssembly_Services_DefaultWebAssemblyJSRuntime_BeginInvokeDotNet:19
    beginInvokeDotNetFromJS http://localhost:8080/_framework/blazor.webassembly.js:1
    h http://localhost:8080/_framework/blazor.webassembly.js:1
    invokeMethodAsync http://localhost:8080/_framework/blazor.webassembly.js:1
    o http://localhost:8080/_framework/blazor.webassembly.js:1
    invokeWhenHeapUnlocked http://localhost:8080/_framework/blazor.webassembly.js:1
    o http://localhost:8080/_framework/blazor.webassembly.js:1
    s http://localhost:8080/_framework/blazor.webassembly.js:1
    dispatchGlobalEventToAllElements http://localhost:8080/_framework/blazor.webassembly.js:1
    onGlobalEvent http://localhost:8080/_framework/blazor.webassembly.js:1
    measureRenderList http://localhost:8080/benchmarks/renderListBenchmark.js:10
    <anonymous> http://localhost:8080/benchmarks/renderList.js:18
    _runBlock http://localhost:8080/benchmarks/lib/minibench/minibench.js:145
blazor.webassembly.js:1:2941```

[lewing]

  | 4739772 | @ | dotnet.6.0.0-preview.4.21213.3.js:1
-- | -- | -- | --
  | _emscripten_asm_const_int | @ | dotnet.6.0.0-preview.4.21213.3.js:1
  | wasm_trace_logger | @ | VM31 06282142:1
  | eglib_log_adapter | @ | VM31 06282142:1
  | monoeg_g_logstr | @ | VM31 06282142:1
  | monoeg_g_logv_nofree | @ | VM31 06282142:1
  | monoeg_g_log | @ | VM31 06282142:1
  | g_log_disabled | @ | VM31 06282142:1
  | sgen_stop_world | @ | VM31 06282142:1
  | sgen_perform_collection_inner | @ | VM31 06282142:1
  | sgen_perform_collection | @ | VM31 06282142:1
  | sgen_ensure_free_space | @ | VM31 06282142:1
  | sgen_alloc_obj_nolock | @ | VM31 06282142:1
  | mono_gc_alloc_string | @ | VM31 06282142:1
  | mono_string_new_size_handle | @ | VM31 06282142:1
  | mono_string_new_size_checked | @ | VM31 06282142:1
  | mono_string_new_utf16_checked | @ | VM31 06282142:1
  | mono_string_new_utf16 | @ | VM31 06282142:1
  | mono_wasm_string_from_utf16 | @ | VM31 06282142:1
  | Module._mono_wasm_string_from_utf16 | @ | dotnet.6.0.0-preview.4.21213.3.js:1
  | js_string_to_mono_string_new | @ | dotnet.6.0.0-preview.4.21213.3.js:1
  | js_string_to_mono_string | @ | dotnet.6.0.0-preview.4.21213.3.js:1
  | converter_ssss | @ | converter_ssss:15
  | managed__Microsoft_AspNetCore_Components_WebAssembly__Microsoft_AspNetCore_Components_WebAssembly_Services_DefaultWebAssemblyJSRuntime_BeginInvokeDotNet | @ | managed__Microsoft_A…eginInvokeDotNet:10
  | beginInvokeDotNetFromJS | @ | blazor.webassembly.js:1
  | h | @ | blazor.webassembly.js:1
  | e.invokeMethodAsync | @ | blazor.webassembly.js:1
  | (anonymous) | @ | blazor.webassembly.js:1
  | invokeWhenHeapUnlocked | @ | blazor.webassembly.js:1
  | o | @ | blazor.webassembly.js:1
  | s | @ | blazor.webassembly.js:1
  | dispatchGlobalEventToAllElements | @ | blazor.webassembly.js:1
  | onGlobalEvent | @ | blazor.webassembly.js:1
  | measureRenderList | @ | renderListBenchmark.js:10
  | benchmark.descriptor.name | @ | renderList.js:30
  | _runBlock | @ | minibench.js:145
  | async function (async) |   |  
  | _runBlock | @ | minibench.js:138
  | run | @ | minibench.js:121
  | async function (async) |   |  
  | run | @ | minibench.js:121
  | _measureTimings | @ | minibench.js:248
  | (anonymous) | @ | minibench.js:201
  | (anonymous) | @ | minibench.js:35
  | Promise.then (async) |   |  
  | addToWorkQueue | @ | minibench.js:35
  | run | @ | minibench.js:192
  | (anonymous) | @ | minibench.js:287
  | runAll | @ | minibench.js:286
  | (anonymous) | @ | minibench.ui.js:152
  | HtmlUI.runButton.onclick

[lewing]

Reproduced across multiple browsers, looks similar to the thing @vargaz has been trying to track down.

[kg]

The reason a hang is observed is that even if an assertion is hit and the runtime is in a horrible state, despite the fact that the equivalent of exit(N) has been called the page is still running JS and happily calling into the runtime. So each invoke of managed code is at a higher and higher risk of asserting again or going into an infinite loop. I managed to catch a couple hangs with devtools open and in each case the console showed that multiple assertions had been hit inside of JS timer callbacks. In this case the hangs are almost certainly a symptom of the underlying issue(s) causing the errors above