Types for Safe Locking

Abstract

A race condition is a situation where two threads manipulate a data structure simultaneously, without synchronization. Race conditions are common errors in multithreaded programming. They often lead to unintended nondeterminism and wrong results. Moreover, they are notoriously hard to diagnose, and attempts to eliminate them can introduce deadlocks. In practice, race conditions and deadlocks are often avoided through prudent programming discipline: protecting each shared data structure with a lock and imposing a partial order on lock acquisitions. In this paper we show that this discipline can be captured (if not completely, to a significant extent) through a set of static rules. We present these rules as a type system for a concurrent, imperative language. Although weaker than a full-blown program-verification calculus, the type system is effective and easy to apply. We emphasize a core, first-order type system focused on race conditions; we also consider extensions with polymorphism, existential types, and a partial order on lock types.

Type-Based Deadlock-Freedom Verification for Non-Block-Structured Lock Primitives and Mutable References

“…So far, much effort has been paid for static deadlock-freedom verification [1,2,7,8,11,12,14]. However, non-block-structured lock primitives and mutable references to locks are not dealt with in a sufficient manner.…”

“…However, non-block-structured lock primitives and mutable references to locks are not dealt with in a sufficient manner. For example, the analyses by Boyapati, Lee and Rinard [2] and by Flanagan and Abadi [8] consider only block-structured synchronization primitives (i.e., synchronized blocks in the Java language.) Kobayashi et al [11,12,14] proposed a deadlock-freedom analy- …”

Ownership Types for Object Synchronisation

“…The simplest mechanism for thread-safety is to employ the per-object monitor. SafeJava [5] extends previous type systems for data race freedom [12], with ownership types where objects are encapsulated within threads or on the heap. In SafeJava, at most one thread can be active within a tree at any one time; this may be problematic for some applications.…”

“…Table 5 presents a small step operational semantics. The transition rules are mostly standard [12,11,2], where each single step is atomic and task interleaving is modelled as random choices (in [R-INT]). The label on the transition ε is the effect of the transition, which may either be empty (∅) or a singleton location ({l}).…”

Typed memory management in a calculus of capabilities

“…When the code releases the lock, the type system would revoke the capability on the data, just as it revokes a capability after a region is freed. Flanagan and Abadi [13] have investigated this idea in the context of a high-level lexically-scoped language. Just as we compiled Tofte and Talpin's high-level region language into the Capability Calculus, we conjecture we could compile Flanagan and Abadi's locking language into a variant of the Capability Calculus with locking primitives instead of allocation primitives.…”