Fast and Accurate Static Data-Race Detection for Concurrent Programs

Abstract

Abstract. We present new techniques for fast, accurate and scalable static data race detection in concurrent programs. Focusing our analysis on Linux device drivers allowed us to identify the unique challenges posed by debugging largescale real-life code and also pinpointed drawbacks in existing race warning generation methods. This motivated the development of new techniques that helped us in improving both the scalability as well as the accuracy of each of the three main steps in a race warning generation system. The first and most crucial step is the automatic discovery of shared variables. Towards that end, we present a new, efficient dataflow algorithm for shared variable detection which is more effective than existing correlation-based techniques that failed to detect the shared variables responsible for data races in majority of the drivers in our benchmark suite. Secondly, accuracy of race warning generation strongly hinges on the precision of the pointer analysis used to compute aliases for lock pointers. We formulate a new scalable context sensitive alias analysis that effectively combines a divide and conquer strategy with function summarization and is demonstrably more efficient than existing BDD-based techniques. Finally, we provide a new warning reduction technique that leverages lock acquisition patterns to yield provably better warning reduction than existing lockset based methods.

Precise Analysis of Value-Dependent Synchronization in Priority Scheduled Programs

“…Taking into account the control flow of procedure call and return, makes the analysis context-sensitive. Static analysis of concurrency errors requires context-sensitive alias analysis, and there are various solutions to obtain context-sensitive alias analysis for race detection, including approaches based on procedure summaries of relative locksets [19], bootstrapping of alias analyses [3], type based label-flow [12], and conditional must-not aliasing [10].…”

“…We need to exclude semantically invalid interleavings, not merely invalid paths in the flow-graphs. None of the static race detection tools we are aware of [3,9,13,19] attempt to exclude semantically invalid interleavings based on boolean guards. Also, our tests with state-of-theart dynamic race detection tool, Intel Inspector XE 2013 (formerly Intel Thread Checker [14]), revealed that boolean flags confuse the analysis such that no warnings are generated at all even when negating the flag to make it invalid.…”

Type Systems Based Data Race Detector

“…The output of program depends on scheduling of accessing memory. Detecting data race is a promising area of research, it has been studied extensively (Cheng, Feng, Leiserson, Randall, & Stark, 1998;Flanagan et al, 2002;Kahlon, Yang, Sankaranarayanan, & Gupta, 2007;Permandla, Roberson, & Boyapati, 2007;Voung, Jhala, & Lerner, 2007). The first methodology to detect data races is the static race detection (Flanagan et al, 2002).…”

“…proving the bug-freeness of programs. Examples of static detectors (Kahlon, Sinha, Kruus, & Zhang, 2009;Kahlon, Yang, Sankaranarayanan, & Gupta, 2007;Naik, Aiken, & Whaley, 2006;Voung, Jhala, & Lerner, 2007). On the other hand, dynamic detectors like (Savage, Burrows, Nelson, Sobalvarro, & Anderson, 1997;Wang, Kelly, Kudlur, Lafortune, & Mahlke, 2008;Yu, Rodeheffer, & Chen, 2005) track program execution and report a data-race problem if the program follow a certain concurrency order.…”

A Uniform Classification of Common Concurrency Errors

“…Better results were obtained, e.g., in [52,38] where two more static analyses were incorporated into the machinery. An alias analysis [55] identifies a set of variables that refer to the same memory location, and an escape analysis [55] identifies a set of objects that are accessible in more than one thread.…”