A true positives theorem for a static race detector

Abstract

RacerD is a static race detector that has been proven to be effective in engineering practice: it has seen thousands of data races fixed by developers before reaching production, and has supported the migration of Facebook's Android app rendering infrastructure from a single-threaded to a multi-threaded architecture. We prove a True Positives Theorem stating that, under certain assumptions, an idealized theoretical version of the analysis never reports a false positive. We also provide an empirical evaluation of an implementation of this analysis, versus the original RacerD.The theorem was motivated in the first case by the desire to understand the observation from production that RacerD was providing remarkably accurate signal to developers, and then the theorem guided further analyzer design decisions. Technically, our result can be seen as saying that the analysis computes an underapproximation of an over-approximation, which is the reverse of the more usual (over of under) situation in static analysis. Until now, static analyzers that are effective in practice but unsound have often been regarded as ad hoc; in contrast, we suggest that, in the future, theorems of this variety might be generally useful in understanding, justifying and designing effective static analyses for bug catching.RacerD is not sound in the sense of computing an over-approximation of some abstraction of executions. Over-approximations support a theorem: if the analyzer says there are no bugs, then there are none. I.e., there are no false negatives (when the program has no bugs), which is often considered as a "soundness" theorem. RacerD favours reducing false positives over false negatives. A design goal was to "detect actionable races that developers find useful and respond to" but "no need to (provably) find them all". In fact, it is very easy to generate artificial false negatives, but Blackshear et al. (2018) say that few have been reported in over a year of RacerD in production.One can react to this by saying that RacerD is simply an ad hoc, if effective, tool. But, the tool does not heuristically filter out bug reports in order to reduce false positives. It first does computations with an abstract domain, and then issues data race reports if any potential races are found according to the abstract domain. Its architecture is like that of a principled analyzer based on abstract interpretation, even though it does not satisfy the usual soundness theorem. This suggests that saying RacerD is ad hoc because it does not satisfy a standard soundness theorem is somehow missing something: It would be better if a demonstrably-effective analyzer with a principled design came with a theoretical explanation, even if partial, for its effectiveness. That is the research problem we set ourselves to solve in this work.A natural question is if it is possible to actually modify RacerD so as to make it sound, without losing its effectiveness in generating signal-actionable and useful data race reports that developers are keen to fix. RacerD's initial d...

Scaling static analyses at Facebook

“…Instead, we established a 'completeness' theorem saying that, under certain assumptions, a theoretical variant of the analyzer reports only true positives. 10 The analysis checks for data races in Java programs-two concurrent memory accesses, one of which is a write. The example in Figure 2 (top) illustrates: If we run the Infer on this code it doesn't find a problem.…”

“…5 Another Infer analysis involves recently published research results on concurrency analysis. 2,10 Zoncolan implements a new modular parallel taint analysis algorithm.…”

Optimal prediction of synchronization-preserving races

“…Our convention for this nomenclature ensures that no false positives are reported by a sound algorithm [Sergey 2019] and is consistent with prior work on data race prediction [Genç et al 2019;Kini et al 2017;Pavlogiannis 2019;Roemer et al 2018;Smaragdakis et al 2012]. Soundness is often a desirable property for dynamic race predictors for widespread adoption [Gorogiannis et al 2019].…”

Local Reasoning About the Presence of Bugs: Incorrectness Separation Logic

“…It is natural to consider how the ideas of ISL extend to concurrency. The RacerD analyzer [ 25 ] provided a static analysis for data races in concurrent programs; this analysis was provably under-approximate under certain assumptions. RacerD was intuitively inspired by concurrent separation logic (CSL [ 6 ]), but did not match the over-approximate CSL theory (just as Infer did not match SL).…”