search

staticanalysis / data-race-test

Automatically exported from code.google.com/p/data-race-test
0 stars 0 forks source link

RecentSegmentsCache is accessed from concurrent threads without synchronization #59

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
When a child thread is created, it pokes its parent to create a new segment and 
update (clear) its recent segments cache. In the parallel version of 
ThreadSanitizer the parent thread may be pushing a SID into the cache at the 
same moment.

To reproduce, compile and link racecheck_unittest with LLVM RTL and run it 
under ThreadSanitizer:

$ tsan --show-pc=yes  bin/racecheck_unittest-linux-x86-O0  2>&1  |tee log

==3103== WARNING: Possible data race during read of size 4 at 0x7E08348: {{{
==3103==    T18 (L{L1, L4}):
==3103==     #0  0x81B0939: RecentSegmentsCache::ShortenQueue(unsigned int) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:176
==3103==     #1  0x81B78F4: Thread::NewSegmentForSignal() 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:3921
==3103==     #2  0x81BA1C0: Detector::HandleThreadStart(TID, TID, unsigned int) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:4755
==3103==     #3  0x81BD59A: Detector::HandleOneEvent(Event*) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:6151
==3103==     #4  0x8195ED5: ThreadSanitizerHandleOneEvent(Event*) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:8133
==3103==     #5  0x81BE1F4: SPut(EventType, int, unsigned int, unsigned int, 
unsigned int) /home/glider/src/tsan-llvm/llvm/tsan_rtl/tsan_rtl.cc:291
==3103==     #6  0x81C4643: pthread_callback(void*) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/tsan_rtl.cc:630
==3103==     #7  0x54B1392: ThreadSanitizerStartThread 
/tmp/z/drt/tsan/ts_valgrind_intercepts.c:641
==3103==   Concurrent write(s) happened at (OR AFTER) these points:
==3103==    T0 (L{}):
==3103==     #0  0x81B56A1: RecentSegmentsCache::Push(SID) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:176
==3103==     #1  0x81B60CC: Thread::HandleSblockEnter(unsigned int, bool) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:4654
==3103==     #2  0x81B698E: Detector::HandleMemoryAccessInternal(TID, Thread*, 
unsigned int*, unsigned int, unsigned int, unsigned int, bool, bool, bool) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:7089
==3103==     #3  0x81B6DD2: Detector::HandleTraceLoop(TraceInfo*, Thread*, TID, 
unsigned int*, unsigned int, bool, bool) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:5931
==3103==     #4  0x819539A: ThreadSanitizerHandleTrace(int, TraceInfo*, 
unsigned int*) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:5956
==3103==     #5  0x81C62D8: flush_trace() 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/tsan_rtl.cc:360
==3103==     #6  0x81BDFC1: bb_flush 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/tsan_rtl.cc:1703
==3103==     #7  0x80DE938: MyThreadArray::Join() 
/home/glider/src/tsan-llvm/unittest/bin/racecheck_unittest-linux-x86-O0
==3103==     #8  0x817A3E9: test125::NegativeTests_test125_Test::TestBody() 
/home/glider/src/tsan-llvm/unittest/bin/racecheck_unittest-linux-x86-O0
==3103==     #9  0x81330A8: testing::Test::Run() 
/home/glider/src/tsan-llvm/unittest/bin/racecheck_unittest-linux-x86-O0
==3103==   Location 0x7E08348 is 48 bytes inside a block starting at 0x7E08318 
of size 128 allocated by T0 from heap:
==3103==     #0  0x54B1D75: malloc /tmp/z/drt/tsan/ts_valgrind_intercepts.c:409
==3103==     #1  0x8197A0C: stlp_std::__malloc_alloc::allocate(unsigned int) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/stlport/stl/_alloc.h:75
==3103==     #2  0x81B58AA: RecentSegmentsCache::Push(SID) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/stlport/stl/_alloc.h:310
==3103==     #3  0x81B60CC: Thread::HandleSblockEnter(unsigned int, bool) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:4654
==3103==     #4  0x81B698E: Detector::HandleMemoryAccessInternal(TID, Thread*, 
unsigned int*, unsigned int, unsigned int, unsigned int, bool, bool, bool) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:7089
==3103==     #5  0x81B6DD2: Detector::HandleTraceLoop(TraceInfo*, Thread*, TID, 
unsigned int*, unsigned int, bool, bool) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:5931
==3103==     #6  0x819539A: ThreadSanitizerHandleTrace(int, TraceInfo*, 
unsigned int*) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:5956
==3103==     #7  0x81C62D8: flush_trace() 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/tsan_rtl.cc:360
==3103==     #8  0x81BDFC1: bb_flush 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/tsan_rtl.cc:1703
==3103==     #9  0x80D110D: MyThreadArray::MyThreadArray(void (*)(), void 
(*)(), void (*)(), void (*)(), void (*)()) 
/home/glider/src/tsan-llvm/unittest/bin/racecheck_unittest-linux-x86-O0
==3103==   Locks involved in this report (reporting last lock sites): {L1, L4}
==3103==    L1 (0x166F0220)
==3103==     #0  0x54AD215: pthread_mutex_lock 
/tmp/z/drt/tsan/ts_valgrind_intercepts.c:882
==3103==     #1  0x81C8C7F: TSLock::Lock() 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/ts_util.cc:488
==3103==     #2  0x81BB3AA: Detector::HandleOneEvent(Event*) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:102
==3103==     #3  0x8195ED5: ThreadSanitizerHandleOneEvent(Event*) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:8133
==3103==     #4  0x81BE1F4: SPut(EventType, int, unsigned int, unsigned int, 
unsigned int) /home/glider/src/tsan-llvm/llvm/tsan_rtl/tsan_rtl.cc:291
==3103==     #5  0x81C4643: pthread_callback(void*) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/tsan_rtl.cc:630
==3103==     #6  0x54B1392: ThreadSanitizerStartThread 
/tmp/z/drt/tsan/ts_valgrind_intercepts.c:641
==3103==    L4 (0x146EF9C4)
==3103==     #0  0x54AD215: pthread_mutex_lock 
/tmp/z/drt/tsan/ts_valgrind_intercepts.c:882
==3103==     #1  0x81BDD17: GIL::Lock() 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/tsan_rtl.cc:159
==3103==     #2  0x81C453A: pthread_callback(void*) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/tsan_rtl.cc:598
==3103==     #3  0x54B1392: ThreadSanitizerStartThread 
/tmp/z/drt/tsan/ts_valgrind_intercepts.c:641
==3103==    Race verifier data: 0x81B0939,0x81B56A1
==3103== }}}

==3103== WARNING: Possible data race during write of size 4 at 0x16D35450: {{{
==3103==    T18 (L{L1, L4}):
==3103==     #0  0x81B09D4: RecentSegmentsCache::ShortenQueue(unsigned int) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../third_party/stlport/stl/_deque.h:
713
==3103==     #1  0x81B78F4: Thread::NewSegmentForSignal() 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:3921
==3103==     #2  0x81BA1C0: Detector::HandleThreadStart(TID, TID, unsigned int) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:4755
==3103==     #3  0x81BD59A: Detector::HandleOneEvent(Event*) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:6151
==3103==     #4  0x8195ED5: ThreadSanitizerHandleOneEvent(Event*) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:8133
==3103==     #5  0x81BE1F4: SPut(EventType, int, unsigned int, unsigned int, 
unsigned int) /home/glider/src/tsan-llvm/llvm/tsan_rtl/tsan_rtl.cc:291
==3103==     #6  0x81C4643: pthread_callback(void*) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/tsan_rtl.cc:630
==3103==     #7  0x54B1392: ThreadSanitizerStartThread 
/tmp/z/drt/tsan/ts_valgrind_intercepts.c:641
==3103==   Concurrent read(s) happened at (OR AFTER) these points:
==3103==    T0 (L{}):
==3103==     #0  0x81B56C7: RecentSegmentsCache::Push(SID) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/ts_lock.h:106
==3103==     #1  0x81B60CC: Thread::HandleSblockEnter(unsigned int, bool) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:4654
==3103==     #2  0x81B698E: Detector::HandleMemoryAccessInternal(TID, Thread*, 
unsigned int*, unsigned int, unsigned int, unsigned int, bool, bool, bool) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:7089
==3103==     #3  0x81B6DD2: Detector::HandleTraceLoop(TraceInfo*, Thread*, TID, 
unsigned int*, unsigned int, bool, bool) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:5931
==3103==     #4  0x819539A: ThreadSanitizerHandleTrace(int, TraceInfo*, 
unsigned int*) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:5956
==3103==     #5  0x81C62D8: flush_trace() 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/tsan_rtl.cc:360
==3103==     #6  0x81BDFC1: bb_flush 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/tsan_rtl.cc:1703
==3103==     #7  0x80DE851: MyThread::Join() 
/home/glider/src/tsan-llvm/unittest/bin/racecheck_unittest-linux-x86-O0
==3103==     #8  0x80DE940: MyThreadArray::Join() 
/home/glider/src/tsan-llvm/unittest/bin/racecheck_unittest-linux-x86-O0
==3103==     #9  0x817A3E9: test125::NegativeTests_test125_Test::TestBody() 
/home/glider/src/tsan-llvm/unittest/bin/racecheck_unittest-linux-x86-O0
==3103==   Location 0x16D35450 is 1832 bytes inside a block starting at 
0x16D34D28 of size 1884 allocated by T0 from heap:
==3103==     #0  0x54B39BF: operator new(unsigned int) 
/tmp/z/drt/tsan/ts_valgrind_intercepts.c:429
==3103==     #1  0x81BA33D: Detector::HandleThreadStart(TID, TID, unsigned int) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:7308
==3103==     #2  0x81BD59A: Detector::HandleOneEvent(Event*) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:6151
==3103==     #3  0x8195ED5: ThreadSanitizerHandleOneEvent(Event*) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:8133
==3103==     #4  0x81BE1F4: SPut(EventType, int, unsigned int, unsigned int, 
unsigned int) /home/glider/src/tsan-llvm/llvm/tsan_rtl/tsan_rtl.cc:291
==3103==     #5  0x81C1F9F: initialize() 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/tsan_rtl.cc:491
==3103==     #6  0x81CF6DB: 
???//home/glider/src/tsan-llvm/unittest/bin/racecheck_unittest-linux-x86-O0 
/home/glider/src/tsan-llvm/unittest/bin/racecheck_unittest-linux-x86-O0
==3103==     #7  0x804B5F7: 
???//home/glider/src/tsan-llvm/unittest/bin/racecheck_unittest-linux-x86-O0 
/home/glider/src/tsan-llvm/unittest/bin/racecheck_unittest-linux-x86-O0
==3103==     #8  0x81CF5F4: __libc_csu_init 
/home/glider/src/tsan-llvm/unittest/bin/racecheck_unittest-linux-x86-O0
==3103==     #9  0x6AB3B72: (below main) 
/build/buildd/eglibc-2.11.1/csu/libc-start.c:185
==3103==   Locks involved in this report (reporting last lock sites): {L1, L4}
==3103==    L1 (0x166F0220)
==3103==     #0  0x54AD215: pthread_mutex_lock 
/tmp/z/drt/tsan/ts_valgrind_intercepts.c:882
==3103==     #1  0x81C8C7F: TSLock::Lock() 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/ts_util.cc:488
==3103==     #2  0x81BB3AA: Detector::HandleOneEvent(Event*) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:102
==3103==     #3  0x8195ED5: ThreadSanitizerHandleOneEvent(Event*) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/../../tsan/thread_sanitizer.cc:8133
==3103==     #4  0x81BE1F4: SPut(EventType, int, unsigned int, unsigned int, 
unsigned int) /home/glider/src/tsan-llvm/llvm/tsan_rtl/tsan_rtl.cc:291
==3103==     #5  0x81C4643: pthread_callback(void*) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/tsan_rtl.cc:630
==3103==     #6  0x54B1392: ThreadSanitizerStartThread 
/tmp/z/drt/tsan/ts_valgrind_intercepts.c:641
==3103==    L4 (0x146EF9C4)
==3103==     #0  0x54AD215: pthread_mutex_lock 
/tmp/z/drt/tsan/ts_valgrind_intercepts.c:882
==3103==     #1  0x81BDD17: GIL::Lock() 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/tsan_rtl.cc:159
==3103==     #2  0x81C453A: pthread_callback(void*) 
/home/glider/src/tsan-llvm/llvm/tsan_rtl/tsan_rtl.cc:598
==3103==     #3  0x54B1392: ThreadSanitizerStartThread 
/tmp/z/drt/tsan/ts_valgrind_intercepts.c:641
==3103==    Race verifier data: 0x81B09D4,0x81B56C7
==3103== }}}

Original issue reported on code.google.com by ramosian.glider@gmail.com on 13 Dec 2010 at 2:36

GoogleCodeExporter commented 9 years ago 
In fact the runtime library was behaving in a wrong way not sending 
THR_CREATE_AFTER event.
Fixed in r2919.

Original comment by ramosian.glider@gmail.com on 16 Dec 2010 at 3:06