Skip to content

[Bug] host_build_graph inits dep_gen but never sets its orch thread index, leaving queues[-1] #1487

Description

@ChaoWao

Platform

All / Unknown

Runtime Variant

host_build_graph

Description

host_build_graph initialises the dep_gen collector but never completes its
wiring:

  • src/a2a3/runtime/host_build_graph/runtime/scheduler/scheduler_cold_path.cpp:899
    calls dep_gen_aicpu_init().
  • Nothing in the hbg tree calls dep_gen_aicpu_set_orch_thread_idx() or
    dep_gen_aicpu_flush(). tensormap_and_ringbuffer calls both, from the
    orchestrator block of aicpu_executor.cpp.

s_orch_thread_idx therefore stays at its initialiser, -1
(src/common/platform/shared/aicpu/dep_gen_collector_aicpu.cpp), and any
enqueue_ready record would index queues[-1] — an out-of-bounds write on the
AICPU. Without the flush, whatever did get captured is never handed to the host
either.

Not reachable today: hbg has no dep_gen consumer path, so no record is produced
and the negative index is never used. It is latent, not live — but the init call
implies a working subsystem that is not there, and the next person to enable
dep_gen on hbg gets a silent memory corruption rather than a missing feature.

Two ways out, both reasonable, and picking one is the point of this issue:

  • Finish the wiring — call set_orch_thread_idx() from hbg's orchestrator
    path and flush() at teardown, matching tensormap_and_ringbuffer.
  • Remove the init — drop dep_gen_aicpu_init() from hbg's cold path so the
    subsystem is honestly absent rather than half-present.

Either way s_orch_thread_idx should be validated before use so a -1 can
never reach an array subscript.

Steps to Reproduce

Static; no runtime repro exists because the path is unreachable.

# init is called
rg -n 'dep_gen_aicpu_init' src/a2a3/runtime/host_build_graph/

# the other two halves are not
rg -n 'dep_gen_aicpu_set_orch_thread_idx|dep_gen_aicpu_flush' src/a2a3/runtime/host_build_graph/

# tensormap_and_ringbuffer, for contrast, calls all three
rg -n 'dep_gen_aicpu_init|dep_gen_aicpu_set_orch_thread_idx|dep_gen_aicpu_flush' \
   src/a2a3/runtime/tensormap_and_ringbuffer/

Expected Behavior

Either dep_gen is fully wired on host_build_graph, or it is not initialised
there at all. s_orch_thread_idx is never used as an index while negative.

Actual Behavior

dep_gen is initialised but left with s_orch_thread_idx == -1 and no flush, so
enabling it on host_build_graph would write queues[-1] and produce no output.

Git Commit ID

bddd321

CANN Version

N/A — static defect, not version-specific

Host Platform

Linux (aarch64)

Additional Context

Found while root-causing #1486 (dep_gen initialised behind the AICore handshake
on tensormap_and_ringbuffer, so the orchestrator's first submits raced it).
That is a different defect on a different runtime; this one is being filed
rather than folded in, since fixing it means choosing whether hbg should support
dep_gen at all.

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions