New spawn with scheduler

chain/src/tests/load_code_with_snapshot.rs

@@ -113,7 +113,7 @@ fn test_load_code() {
     let tx_status = tx_pool.get_tx_status(tx.hash());
     assert_eq!(
         tx_status.unwrap().unwrap(),
-        (TxStatus::Pending, Some(11174))
+        (TxStatus::Pending, Some(11325))
     );
 }
 

script/Cargo.toml

@@ -22,7 +22,7 @@ ckb-traits = { path = "../traits", version = "= 0.117.0-pre" }
 byteorder = "1.3.1"
 ckb-types = { path = "../util/types", version = "= 0.117.0-pre" }
 ckb-hash = { path = "../util/hash", version = "= 0.117.0-pre" }
-ckb-vm = { git = "https://github.com/chenyukang/ckb-vm.git", version = "=0.24.9", default-features = false, branch = "yukang-local-changes"}
+ckb-vm = { version = "= 0.24.12", default-features = false }
 faster-hex = "0.6"
 ckb-logger = { path = "../util/logger", version = "= 0.117.0-pre", optional = true }
 serde = { version = "1.0", features = ["derive"] }
@@ -40,3 +40,5 @@ ckb-crypto = { path = "../util/crypto", version = "= 0.117.0-pre" }
 ckb-db-schema = { path = "../db-schema", version = "= 0.117.0-pre" }
 tempfile.workspace = true
 rand = "0.8.4"
+daggy = "0.8.0"
+molecule = "0.8.0"

script/build.rs

@@ -19,4 +19,5 @@ fn main() {
     if cfg!(any(feature = "asm", feature = "detect-asm")) && can_enable_asm {
         println!("cargo:rustc-cfg=has_asm");
     }
+    println!("cargo:rerun-if-changed=src");
 }

script/fuzz/.gitignore

@@ -3,3 +3,7 @@ target
 corpus
 artifacts
 coverage
+flamegraph.svg
+perf.data
+perf.data.old
+

script/fuzz/Cargo.toml

@@ -47,3 +47,9 @@ name = "syscall_exec"
 path = "fuzz_targets/syscall_exec.rs"
 test = false
 doc = false
+
+[[bin]]
+name = "syscall_spawn"
+path = "fuzz_targets/syscall_spawn.rs"
+test = false
+doc = false

script/fuzz/README.md

@@ -14,7 +14,7 @@ cargo install cargo-fuzz
 
 run fuzz test
 ```
-cargo +nightly fuzz run transaction_scripts_verifier_data1
+cargo +nightly fuzz run -j $(nproc) transaction_scripts_verifier_data1
 ```
 
 generate coverage report

script/fuzz/fuzz_targets/syscall_spawn.rs

@@ -0,0 +1,136 @@
+#![no_main]
+use libfuzzer_sys::fuzz_target;
+
+use ckb_chain_spec::consensus::ConsensusBuilder;
+use ckb_script::{TransactionScriptsVerifier, TxVerifyEnv};
+use ckb_traits::{CellDataProvider, ExtensionProvider, HeaderProvider};
+use ckb_types::{
+    bytes::Bytes,
+    core::{
+        capacity_bytes,
+        cell::{CellMetaBuilder, ResolvedTransaction},
+        hardfork::{HardForks, CKB2021, CKB2023},
+        Capacity, HeaderView, ScriptHashType, TransactionBuilder, TransactionInfo,
+    },
+    h256,
+    packed::{
+        self, Byte32, CellInput, CellOutput, CellOutputBuilder, OutPoint, Script,
+        TransactionInfoBuilder, TransactionKeyBuilder,
+    },
+    prelude::*,
+};
+
+#[derive(Default, PartialEq, Eq, Clone)]
+struct MockDataLoader {}
+
+impl CellDataProvider for MockDataLoader {
+    fn get_cell_data(&self, _out_point: &OutPoint) -> Option<Bytes> {
+        None
+    }
+
+    fn get_cell_data_hash(&self, _out_point: &OutPoint) -> Option<Byte32> {
+        None
+    }
+}
+
+impl HeaderProvider for MockDataLoader {
+    fn get_header(&self, _block_hash: &Byte32) -> Option<HeaderView> {
+        None
+    }
+}
+
+impl ExtensionProvider for MockDataLoader {
+    fn get_block_extension(&self, _hash: &Byte32) -> Option<packed::Bytes> {
+        None
+    }
+}
+
+fn mock_transaction_info() -> TransactionInfo {
+    TransactionInfoBuilder::default()
+        .block_number(1u64.pack())
+        .block_epoch(0u64.pack())
+        .key(
+            TransactionKeyBuilder::default()
+                .block_hash(Byte32::zero())
+                .index(1u32.pack())
+                .build(),
+        )
+        .build()
+        .unpack()
+}
+
+static PROGRAM_DATA: &[u8] = include_bytes!("../../testdata/spawn_fuzzing");
+
+fn run(data: &[u8]) {
+    if data.len() < 8 {
+        return;
+    }
+    let split_offset = data[0] as usize;
+    let split_offset = usize::min(split_offset, data.len() - 1);
+    let parent_witness = Bytes::copy_from_slice(&data[0..split_offset]);
+    let child_witness = Bytes::copy_from_slice(&data[split_offset..]);
+    let witnesses = vec![parent_witness.pack(), child_witness.pack()];
+
+    let transaction = TransactionBuilder::default()
+        .input(CellInput::new(OutPoint::null(), 0))
+        .set_witnesses(witnesses)
+        .build();
+
+    let data: Bytes = (Vec::from(PROGRAM_DATA)).into();
+    let script = Script::new_builder()
+        .hash_type(ScriptHashType::Data2.into())
+        .code_hash(CellOutput::calc_data_hash(&data))
+        .build();
+    let dep_cell = CellMetaBuilder::from_cell_output(
+        CellOutput::new_builder()
+            .capacity(Capacity::bytes(data.len()).unwrap().pack())
+            .build(),
+        data,
+    )
+    .transaction_info(mock_transaction_info())
+    .out_point(OutPoint::new(h256!("0x0").pack(), 0))
+    .build();
+
+    let input_cell = CellMetaBuilder::from_cell_output(
+        CellOutputBuilder::default()
+            .capacity(capacity_bytes!(100).pack())
+            .lock(script)
+            .build(),
+        Bytes::new(),
+    )
+    .transaction_info(mock_transaction_info())
+    .build();
+
+    let rtx = ResolvedTransaction {
+        transaction,
+        resolved_cell_deps: vec![dep_cell],
+        resolved_inputs: vec![input_cell],
+        resolved_dep_groups: vec![],
+    };
+
+    let provider = MockDataLoader {};
+    let hardfork_switch = HardForks {
+        ckb2021: CKB2021::new_mirana().as_builder().build().unwrap(),
+        ckb2023: CKB2023::new_mirana()
+            .as_builder()
+            .rfc_0049(0)
+            .build()
+            .unwrap(),
+    };
+    let consensus = ConsensusBuilder::default()
+        .hardfork_switch(hardfork_switch)
+        .build();
+    let tx_verify_env =
+        TxVerifyEnv::new_submit(&HeaderView::new_advanced_builder().epoch(0.pack()).build());
+    let verifier = TransactionScriptsVerifier::new(
+        rtx.into(),
+        provider,
+        consensus.into(),
+        tx_verify_env.into(),
+    );
+    let _ = verifier.verify(70_000_000);
+}
+
+fuzz_target!(|data: &[u8]| {
+    run(data);
+});

script/fuzz/programs/exec_caller.c

@@ -1,3 +1,4 @@
+#include <stdlib.h>
 #include <stdint.h>
 
 static inline long __internal_syscall(long n, long _a0, long _a1, long _a2,

script/src/lib.rs

@@ -1,17 +1,18 @@
 //! CKB component to run the type/lock scripts.
 pub mod cost_model;
 mod error;
+mod scheduler;
 mod syscalls;
 mod type_id;
 mod types;
 mod verify;
 mod verify_env;
 
 pub use crate::error::{ScriptError, TransactionScriptError};
-pub use crate::syscalls::spawn::update_caller_machine;
+pub use crate::scheduler::{Scheduler, ROOT_VM_ID};
 pub use crate::types::{
-    ChunkCommand, CoreMachine, MachineContext, ResumableMachine, ScriptGroup, ScriptGroupType,
-    ScriptVersion, TransactionSnapshot, TransactionState, VerifyResult, VmIsa, VmVersion,
+    ChunkCommand, CoreMachine, DataPieceId, RunMode, ScriptGroup, ScriptGroupType, ScriptVersion,
+    TransactionSnapshot, TransactionState, TxData, VerifyResult, VmIsa, VmState, VmVersion,
 };
 pub use crate::verify::{TransactionScriptsSyscallsGenerator, TransactionScriptsVerifier};
 pub use crate::verify_env::TxVerifyEnv;