Platform
All / Unknown
Runtime Variant
host_build_graph
Description
host_build_graph initialises the dep_gen collector but never completes its
wiring:
src/a2a3/runtime/host_build_graph/runtime/scheduler/scheduler_cold_path.cpp:899
calls dep_gen_aicpu_init().
- Nothing in the hbg tree calls
dep_gen_aicpu_set_orch_thread_idx() or
dep_gen_aicpu_flush(). tensormap_and_ringbuffer calls both, from the
orchestrator block of aicpu_executor.cpp.
s_orch_thread_idx therefore stays at its initialiser, -1
(src/common/platform/shared/aicpu/dep_gen_collector_aicpu.cpp), and any
enqueue_ready record would index queues[-1] — an out-of-bounds write on the
AICPU. Without the flush, whatever did get captured is never handed to the host
either.
Not reachable today: hbg has no dep_gen consumer path, so no record is produced
and the negative index is never used. It is latent, not live — but the init call
implies a working subsystem that is not there, and the next person to enable
dep_gen on hbg gets a silent memory corruption rather than a missing feature.
Two ways out, both reasonable, and picking one is the point of this issue:
- Finish the wiring — call
set_orch_thread_idx() from hbg's orchestrator
path and flush() at teardown, matching tensormap_and_ringbuffer.
- Remove the init — drop
dep_gen_aicpu_init() from hbg's cold path so the
subsystem is honestly absent rather than half-present.
Either way s_orch_thread_idx should be validated before use so a -1 can
never reach an array subscript.
Steps to Reproduce
Static; no runtime repro exists because the path is unreachable.
# init is called
rg -n 'dep_gen_aicpu_init' src/a2a3/runtime/host_build_graph/
# the other two halves are not
rg -n 'dep_gen_aicpu_set_orch_thread_idx|dep_gen_aicpu_flush' src/a2a3/runtime/host_build_graph/
# tensormap_and_ringbuffer, for contrast, calls all three
rg -n 'dep_gen_aicpu_init|dep_gen_aicpu_set_orch_thread_idx|dep_gen_aicpu_flush' \
src/a2a3/runtime/tensormap_and_ringbuffer/
Expected Behavior
Either dep_gen is fully wired on host_build_graph, or it is not initialised
there at all. s_orch_thread_idx is never used as an index while negative.
Actual Behavior
dep_gen is initialised but left with s_orch_thread_idx == -1 and no flush, so
enabling it on host_build_graph would write queues[-1] and produce no output.
Git Commit ID
bddd321
CANN Version
N/A — static defect, not version-specific
Host Platform
Linux (aarch64)
Additional Context
Found while root-causing #1486 (dep_gen initialised behind the AICore handshake
on tensormap_and_ringbuffer, so the orchestrator's first submits raced it).
That is a different defect on a different runtime; this one is being filed
rather than folded in, since fixing it means choosing whether hbg should support
dep_gen at all.
Platform
All / Unknown
Runtime Variant
host_build_graph
Description
host_build_graphinitialises the dep_gen collector but never completes itswiring:
src/a2a3/runtime/host_build_graph/runtime/scheduler/scheduler_cold_path.cpp:899calls
dep_gen_aicpu_init().dep_gen_aicpu_set_orch_thread_idx()ordep_gen_aicpu_flush().tensormap_and_ringbuffercalls both, from theorchestrator block of
aicpu_executor.cpp.s_orch_thread_idxtherefore stays at its initialiser,-1(
src/common/platform/shared/aicpu/dep_gen_collector_aicpu.cpp), and anyenqueue_readyrecord would indexqueues[-1]— an out-of-bounds write on theAICPU. Without the flush, whatever did get captured is never handed to the host
either.
Not reachable today: hbg has no dep_gen consumer path, so no record is produced
and the negative index is never used. It is latent, not live — but the init call
implies a working subsystem that is not there, and the next person to enable
dep_gen on hbg gets a silent memory corruption rather than a missing feature.
Two ways out, both reasonable, and picking one is the point of this issue:
set_orch_thread_idx()from hbg's orchestratorpath and
flush()at teardown, matchingtensormap_and_ringbuffer.dep_gen_aicpu_init()from hbg's cold path so thesubsystem is honestly absent rather than half-present.
Either way
s_orch_thread_idxshould be validated before use so a-1cannever reach an array subscript.
Steps to Reproduce
Static; no runtime repro exists because the path is unreachable.
Expected Behavior
Either dep_gen is fully wired on host_build_graph, or it is not initialised
there at all.
s_orch_thread_idxis never used as an index while negative.Actual Behavior
dep_gen is initialised but left with
s_orch_thread_idx == -1and no flush, soenabling it on host_build_graph would write
queues[-1]and produce no output.Git Commit ID
bddd321
CANN Version
N/A — static defect, not version-specific
Host Platform
Linux (aarch64)
Additional Context
Found while root-causing #1486 (dep_gen initialised behind the AICore handshake
on
tensormap_and_ringbuffer, so the orchestrator's first submits raced it).That is a different defect on a different runtime; this one is being filed
rather than folded in, since fixing it means choosing whether hbg should support
dep_gen at all.