bug: repro for graph copy bug

bin/wrapper.sh

@@ -18,7 +18,7 @@ declare -A envs # list of expected environment variables with paths to products
 # Define build products here
 real[moc]=src/moc
 hint[moc]="make -C $rel_root/src moc"
-envs[moc]="MOC_NON_INCREMENTAL_RELEASE_RTS MOC_NON_INCREMENTAL_DEBUG_RTS MOC_INCREMENTAL_RELEASE_RTS MOC_INCREMENTAL_DEBUG_RTS"
+envs[moc]="MOC_RELEASE_RTS MOC_DEBUG_RTS"
 real[mo-ld]=src/mo-ld
 hint[mo-ld]="make -C $rel_root/src mo-ld"
 real[mo-doc]=src/mo-doc
@@ -32,10 +32,8 @@ hint[candid-tests]="make -C $rel_root/src candid-tests"
 
 rts_hint="make -C $rel_root/rts"
 
-real[MOC_NON_INCREMENTAL_RELEASE_RTS]=rts/mo-rts.wasm
-real[MOC_NON_INCREMENTAL_DEBUG_RTS]=rts/mo-rts-debug.wasm
-real[MOC_INCREMENTAL_RELEASE_RTS]=rts/mo-rts-incremental.wasm
-real[MOC_INCREMENTAL_DEBUG_RTS]=rts/mo-rts-incremental-debug.wasm
+real[MOC_RELEASE_RTS]=rts/mo-rts.wasm
+real[MOC_DEBUG_RTS]=rts/mo-rts-debug.wasm
 
 for var in ${envs[moc]}; do
   hint[$var]=$rts_hint

default.nix

@@ -20,6 +20,10 @@ let ic-ref-run =
       cp ${ic-hs-pkgs.ic-hs}/bin/ic-ref-run $out/bin
   ''; in
 
+let
+  nixos-unstable = import nixpkgs.sources.nixpkgs-unstable {};
+in
+
 let haskellPackages = nixpkgs.haskellPackages.override {
       overrides = import nix/haskell-packages.nix nixpkgs subpath;
     }; in
@@ -35,6 +39,7 @@ let
     wasmtime
     rust-bindgen
     python3
+    nixos-unstable.emscripten
   ] ++ pkgs.lib.optional pkgs.stdenv.isDarwin [
     libiconv
   ];
@@ -193,7 +198,7 @@ rec {
         name = "motoko-rts-deps";
         src = subpath ./rts;
         sourceRoot = "rts/motoko-rts-tests";
-        sha256 = "sha256-jN5nx5UNBHlYKnC0kk90h6mWPUNrqPS7Wln2TixbGgA=";
+        sha256 = "sha256-YEw2AFi15JVKP7owsPDoBT3qSegOO90FRn2qoUBAICw=";
         copyLockfile = true;
       };
 
@@ -241,6 +246,7 @@ rec {
           "directory" = "$(stripHash ${allDeps})"
         __END__
 
+
         ${llvmEnv}
         export TOMMATHSRC=${nixpkgs.sources.libtommath}
         export MUSLSRC=${nixpkgs.sources.musl-wasi}/libc-top-half/musl
@@ -257,8 +263,6 @@ rec {
         mkdir -p $out/rts
         cp mo-rts.wasm $out/rts
         cp mo-rts-debug.wasm $out/rts
-        cp mo-rts-incremental.wasm $out/rts
-        cp mo-rts-incremental-debug.wasm $out/rts
       '';
 
       # This needs to be self-contained. Remove mention of nix path in debug
@@ -269,11 +273,6 @@ rec {
           -t ${rtsDeps} \
           -t ${rustStdDeps} \
           $out/rts/mo-rts.wasm $out/rts/mo-rts-debug.wasm
-        remove-references-to \
-          -t ${nixpkgs.rustc-nightly} \
-          -t ${rtsDeps} \
-          -t ${rustStdDeps} \
-          $out/rts/mo-rts-incremental.wasm $out/rts/mo-rts-incremental-debug.wasm
       '';
 
       allowedRequisites = [];
@@ -363,26 +362,6 @@ rec {
       (test_subdir dir deps).overrideAttrs {
           EXTRA_MOC_ARGS = "--sanity-checks";
       };
-
-    generational_gc_subdir = dir: deps:
-      (test_subdir dir deps).overrideAttrs {
-          EXTRA_MOC_ARGS = "--generational-gc";
-      };
-
-    snty_compacting_gc_subdir = dir: deps:
-      (test_subdir dir deps).overrideAttrs {
-          EXTRA_MOC_ARGS = "--sanity-checks --compacting-gc";
-      };
-
-    snty_generational_gc_subdir = dir: deps:
-      (test_subdir dir deps).overrideAttrs {
-          EXTRA_MOC_ARGS = "--sanity-checks --generational-gc";
-      };
-
-    snty_incremental_gc_subdir = dir: deps:
-      (test_subdir dir deps).overrideAttrs {
-          EXTRA_MOC_ARGS = "--sanity-checks --incremental-gc";
-      };
 
     perf_subdir = dir: deps:
       (test_subdir dir deps).overrideAttrs (args: {
@@ -442,23 +421,24 @@ rec {
       '';
     };
 
-    profiling-graphs = testDerivation {
-      src = test_src "perf";
-      buildInputs =
-        (with nixpkgs; [ perl wabt wasm-profiler-instrument wasm-profiler-postproc flamegraph-bin ]) ++
-        [ moc nixpkgs.drun ];
-      checkPhase = ''
-        patchShebangs .
-        type -p moc && moc --version
-        type -p drun && drun --help
-        ./profile-report.sh
-      '';
-      installPhase = ''
-        mv _profile $out;
-        mkdir -p $out/nix-support
-        echo "report flamegraphs $out index.html" >> $out/nix-support/hydra-build-products
-      '';
-    };
+    # wasm-profiler is not compatible with passive data segments and memory64
+    # profiling-graphs = testDerivation {
+    #  src = test_src "perf";
+    #  buildInputs =
+    #    (with nixpkgs; [ perl wabt wasm-profiler-instrument wasm-profiler-postproc flamegraph-bin ]) ++
+    #    [ moc nixpkgs.drun ];
+    #  checkPhase = ''
+    #    patchShebangs .
+    #    type -p moc && moc --version
+    #    type -p drun && drun --help
+    #    ./profile-report.sh
+    #  '';
+    #  installPhase = ''
+    #    mv _profile $out;
+    #    mkdir -p $out/nix-support
+    #    echo "report flamegraphs $out index.html" >> $out/nix-support/hydra-build-products
+    #  '';
+    #};
 
 
     fix_names = builtins.mapAttrs (name: deriv:
@@ -497,9 +477,6 @@ rec {
       # ic-ref-run = test_subdir "run-drun"   [ moc ic-ref-run ];
       drun       = test_subdir "run-drun"   [ moc nixpkgs.drun ];
       drun-dbg   = snty_subdir "run-drun"   [ moc nixpkgs.drun ];
-      drun-compacting-gc = snty_compacting_gc_subdir "run-drun" [ moc nixpkgs.drun ] ;
-      drun-generational-gc = snty_generational_gc_subdir "run-drun" [ moc nixpkgs.drun ] ;
-      drun-incremental-gc = snty_incremental_gc_subdir "run-drun" [ moc nixpkgs.drun ] ;
       fail       = test_subdir "fail"       [ moc ];
       repl       = test_subdir "repl"       [ moc ];
       ld         = test_subdir "ld"         ([ mo-ld ] ++ ldTestDeps);
@@ -510,7 +487,8 @@ rec {
       perf       = perf_subdir "perf"       [ moc nixpkgs.drun ];
       bench      = perf_subdir "bench"      [ moc nixpkgs.drun ic-wasm ];
       # viper      = test_subdir "viper"      [ moc nixpkgs.which nixpkgs.openjdk nixpkgs.z3 ];
-      inherit qc lsp unit candid profiling-graphs coverage;
+      # TODO: profiling-graph is excluded because the underlying partity_wasm is deprecated and does not support passive data segments and memory64.
+      inherit qc lsp unit candid coverage;
     }) // { recurseForDerivations = true; };
 
   samples = stdenv.mkDerivation {
@@ -554,7 +532,7 @@ rec {
         doInstallCheck = true;
         test = ./test + "/test-${n}.js";
         installCheckPhase = ''
-          NODE_PATH=$out/bin node $test
+          NODE_PATH=$out/bin node --experimental-wasm-memory64 $test
         '';
       };
     in
@@ -702,15 +680,13 @@ EOF
     mkdir -p $out
     ln -s ${base-doc} $out/base-doc
     ln -s ${docs} $out/docs
-    ln -s ${tests.profiling-graphs} $out/flamegraphs
     ln -s ${tests.coverage} $out/coverage
     cd $out;
     # generate a simple index.html, listing the entry points
     ( echo docs/overview-slides.html;
       echo docs/html/motoko.html;
       echo base-doc/
-      echo coverage/
-      echo flamegraphs/ ) | \
+      echo coverage/ ) | \
       tree -H . -l --fromfile -T "Motoko build reports" > index.html
   '';
 
@@ -779,8 +755,9 @@ EOF
       check-grammar
       check-error-codes
     ] ++
-    builtins.attrValues tests ++
-    builtins.attrValues js;
+    builtins.attrValues tests
+    ++ builtins.attrValues js
+    ;
   };
 
   viperServer = nixpkgs.fetchurl {

design/GraphCopyStabilization.md

@@ -0,0 +1,129 @@
+# Graph-Copy-Based Stabilization
+
+This is part of the enhanced orthogonal persistence support, see `OrthogonalPersistence.md`.
+It allows future potentially radical changes of the persistent memory layout, such as introducing a new GC, rearranging persistent metadata, or specializing arrays for small element types etc. 
+
+## Purpose
+
+This allows potentially radical changes of the persistent main memory layout, e.g. introducing a new GC or rearranging persistent metadata. 
+This also relies on precise value tagging to allow more advanced changes that require value metadata, e.g. specializing arrays for small value element types or even downgrading to 32-bit heap layouts (provided that the amount of live data fits into a 32-bit memory).
+
+## Design
+
+Graph copy of sub-graph of stable objects from main memory to stable memory and vice versa on upgrades.
+
+## Properties
+* Preserve sharing for all objects like in the heap.
+* Allow the serialization format to be independent of the main memory layout.
+* Limit the additional main memory needed during serialization and deserialization.
+* Avoid deep call stack recursion (stack overflow).
+* Allows arbitrarily long large stabilization/destabilization due to incremental mechanism (see below).
+
+## Memory Compatibility Check
+Apply a memory compatibility check analogous to the enhanced orthogonal persistence, since the upgrade compatibility of the graph copy is not identical to the Candid subtype relation.
+
+
+## Incremental Upgrade
+
+Supporting arbitrarily large upgrades beyond the instruction limit:
+* Splitting the stabilization/destabilization in multiple asynchronous messages.
+* Limiting the stabilization work units to fit the update or upgrade messages.
+* Blocking other messages during the explicit incremental stabilization.
+* Restricting the upgrade functionality to the canister owner and controllers.
+* Stopping the GC during the explicit incremental upgrade process.
+
+**Note**: Graph copying needs to be explicitly initiated as the usual upgrade engages enhanced orthogonal persistence, simply retaining main memory with compatibility check.
+
+### Usage
+
+When upgrading to a Motoko version that is not compatible with the current enhanced orthogonal persistence:
+
+1. Initiate the explicit stabilization before the upgrade:
+
+```
+dfx canister call CANISTER_ID __motoko_stabilize_before_upgrade "()"
+```
+
+* An assertion first checks that the caller is the canister owner or a canister controller.
+* All other messages to the canister will be blocked until the upgrade has been successfully completed.
+* The GC is stopped.
+* If defined, the actor's pre-upgrade function is called before the explicit stabilization.
+* The stabilzation runs in possibly multiple asynchronous messages, each with a limited number of instructions.
+
+2. Run the actual upgrade:
+
+```
+dfx deploy CANISTER_ID
+```
+
+* Completes the explicit stabilization if not yet done before this call.
+* Perform the actual upgrade of the canister on the IC.
+* Detects that graph-copying is in use.
+* Clears the heap if enhanced orthogonal persistence is active.
+* Start the destabilization with a limited number of steps to fit into the upgrade message.
+* If destabilization cannot be completed, the canister does not start the GC and does not accept messages except step 3.
+
+3. Complete the explicit destabilization after the upgrade:
+
+```
+dfx canister call CANISTER_ID __motoko_destabilze_after_upgrade "()"
+```
+
+* An assertion checks that the caller is the canister owner or a canister controller.
+* All other messages remain blocked until the successful completion of the destabilization.
+* The destabilzation runs in possibly multiple asynchronous messages, each with a limited number of instructions.
+* If defined, the actor's post-upgrade function is called at the end of the explicit destabilization.
+* The GC is restarted.
+
+### Remarks
+
+* Steps 2 (explicit destabilization) may not be needed if the corresponding operation fits into the upgrade message.
+* Stabilization and destabilization steps are limited to the increment limits:
+
+    Operation | Message Type | IC Instruction Limit | **Increment Limit**
+    ----------|--------------|----------------------|--------------------
+    **Explicit (de)stabilization step** | Update | 20e9 | **16e9**
+    **Actual upgrade** | Upgrade | 200e9 | **160e9**
+
+## Graph-Copy Algorithm
+Applying Cheney’s algorithm [1, 2] for both serialization and deserialization:
+
+### Serialization
+* Cheney’s algorithm using main memory as from-space and stable memory as to-space: 
+* Focusing on stable variables as root (sub-graph of stable objects).
+* The target pointers and Cheney’s forwarding pointers denote the (skewed) offsets in stable memory.
+* Using streaming reads for the `scan`-pointer and streaming writes for the `free`-pointer in stable memory.
+
+### Deserialization
+* Cheney’s algorithm using stable memory as from-space and main memory as to-space: 
+* Starting with the stable root created during the serialization process.
+* A scan stack is used in the main memory to remember the deserialized objects for later scanning.
+* Objects are allocated in main memory using the default allocator.
+* Using random read/write access on the stable memory.
+
+## Stable Format
+For a long-term perspective, the object layout of the serialized data in the stable memory is fixed and independent of the main memory layout.
+* Pointers are represented in 64-bit like main memory in enhanced orthogonal persistence.
+* The Brooks forwarding pointer used by the incremental GC is omitted.
+* The pointers encode skewed stable memory offsets to the corresponding target objects.
+* References to the null objects are encoded by a defined null sentinel value.
+* `BigInt` are explicitly serialized in a defined portable little endian representation, without that the serialization or deserialization allocates temporary objects.
+The format is also versioned to allow future refinements of the graph copy algorithm.
+
+## Specific Aspects
+* Field hashes in objects are serialized in a blob. On deserialization, the hash blob is allocated in the dynamic heap. Same-typed objects that have been created by the same program version share the same hash blob.
+* Stable records can dynamically contain non-stable fields due to structural sub-typing. A dummy value can be serialized for such fields as a new program version can no longer access this field through the stable types.
+* For backwards compatibility, old Candid destabilzation is still supported when upgrading from a program that used older compiler version.
+* Incremental GC: Serialization needs to consider Brooks forwarding pointers (not to be confused with the Cheney's forwarding information), while deserialization can deal with partitioned heap that can have internal fragmentation (free space at partition ends).
+* The partitioned heap prevents linear scanning of the heap, especially in the presence of large objects that can be placed at a higher partition than subsequently allocated normal-sized objects. For this reason, a scan stack is allocated in the main memory, remembering the deserialized objects that still need to be scanned. With this, the deserialization does not need to make any assumptions of the heap structure (e.g. monotonically increasing allocations, free space markers, empty heap on deserialization start etc.).
+* If actor fields are promoted to the `Any` type in a new program version, their content is released in that variable to allow memory reclamation.
+
+## Open Aspects
+* Unused fields in stable records that are no longer declared in a new program versions should be removed. This could be done during garbage collection, when objects are moved/evacuated. This scenario equally applies to enhanced orthogonal persistence.
+* The scan stack used during destabilization involves dynamic allocations.
+
+## References
+
+[1] C. J. Cheney. A Non-Recursive List Compacting Algorithm. Communications of the ACM, 13(11):677-8, November 1970.
+
+[2] R. Jones and R. Lins. Garbage Collection: Algorithms for Automatic Dynamic Memory Management. Wiley 2003. Algorithm 6.1: Cheney's algorithm, page 123.

design/StableMemory.md → design/OldStableMemory.md

@@ -1,4 +1,8 @@
-# Stable Memory API
+# Old Stable Memory API
+
+This describes the legacy stable memory mechanism intended to be replaced by 
+true orthogonal persistence where the main memory is retained across upgrades.
+See `OrthogonalPersistence.md`.
 
 The current implementation of stable variables is based on
 serialization and deserialization of all stable data on upgrade. This