Skip to content

[Bug] host_build_graph inits dep_gen but never sets its orch thread index, leaving queues[-1] #1487

Description

@ChaoWao

Platform

All / Unknown

Runtime Variant

host_build_graph

Description

host_build_graph initialises the dep_gen collector but never completes its
wiring:

  • src/a2a3/runtime/host_build_graph/runtime/scheduler/scheduler_cold_path.cpp:899
    calls dep_gen_aicpu_init().
  • Nothing in the hbg tree calls dep_gen_aicpu_set_orch_thread_idx() or
    dep_gen_aicpu_flush(). tensormap_and_ringbuffer calls both, from the
    orchestrator block of aicpu_executor.cpp.

s_orch_thread_idx therefore stays at its initialiser, -1
(src/common/platform/shared/aicpu/dep_gen_collector_aicpu.cpp), and any
enqueue_ready record would index queues[-1] — an out-of-bounds write on the
AICPU. Without the flush, whatever did get captured is never handed to the host
either.

Not reachable today: hbg has no dep_gen consumer path, so no record is produced
and the negative index is never used. It is latent, not live — but the init call
implies a working subsystem that is not there, and the next person to enable
dep_gen on hbg gets a silent memory corruption rather than a missing feature.

Two ways out, both reasonable, and picking one is the point of this issue:

  • Finish the wiring — call set_orch_thread_idx() from hbg's orchestrator
    path and flush() at teardown, matching tensormap_and_ringbuffer.
  • Remove the init — drop dep_gen_aicpu_init() from hbg's cold path so the
    subsystem is honestly absent rather than half-present.

Either way s_orch_thread_idx should be validated before use so a -1 can
never reach an array subscript.

Steps to Reproduce

Static; no runtime repro exists because the path is unreachable.

# init is called
rg -n 'dep_gen_aicpu_init' src/a2a3/runtime/host_build_graph/

# the other two halves are not
rg -n 'dep_gen_aicpu_set_orch_thread_idx|dep_gen_aicpu_flush' src/a2a3/runtime/host_build_graph/

# tensormap_and_ringbuffer, for contrast, calls all three
rg -n 'dep_gen_aicpu_init|dep_gen_aicpu_set_orch_thread_idx|dep_gen_aicpu_flush' \
   src/a2a3/runtime/tensormap_and_ringbuffer/

Expected Behavior

Either dep_gen is fully wired on host_build_graph, or it is not initialised
there at all. s_orch_thread_idx is never used as an index while negative.

Actual Behavior

dep_gen is initialised but left with s_orch_thread_idx == -1 and no flush, so
enabling it on host_build_graph would write queues[-1] and produce no output.

Git Commit ID

bddd321

CANN Version

N/A — static defect, not version-specific

Host Platform

Linux (aarch64)

Additional Context

Found while root-causing #1486 (dep_gen initialised behind the AICore handshake
on tensormap_and_ringbuffer, so the orchestrator's first submits raced it).
That is a different defect on a different runtime; this one is being filed
rather than folded in, since fixing it means choosing whether hbg should support
dep_gen at all.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions