RaceMob: Crowdsourced Data Race Detec,on

Transcription

1 RaceMob: Crowdsourced Data Race Detec,on Baris Kasikci, Cris,an Zamfir, and George Candea School of Computer & Communica3on Sciences

2 Data Races to shared memory loca,on By mul3ple threads At least one of the accesses is a write shared x Thread 1 Thread 2 x = 1 x = 2 Synchroniza3on opera3ons do not enforce an order among the accesses 2

3 Spectrum of Data Races Kept for performance??? Caused massive losses 2003 Blackout 3

4 PiLalls Programs with data races are incorrect according to POSI & C/C++ standards Compilers can break correctness of programs with data races [HotPar 11] Harmless data races can become harmful Developers need to know every true data race 4

5 How to Find All Data Races? Sta,c race detectors Dynamic race detectors Full path analysis Per- run analysis Cheap (0 run3me overhead) Expensive ( 200x) Few false nega5ves Many false nega5ves Many false posi5ves (~80%) Few false posi5ves (~0%) Exis,ng detectors are not prac,cal 5

6 How to Find All Data Races? Full path analysis Cheap (0 run3me overhead) Few false nega5ves Few false posi5ves (~0%) 6

7 RaceMob Full path analysis Cheap (0 run3me overhead) Few false nega2ves Few false posi2ves (~0%) All Memory Sta,c Detec,on Poten5ally Racing Dynamic Context Inference Likely Racing On- demand Valida,on True Races Crowdsourcing Race & Hang Race & Crash 7

8 Issues Usage Model program Applica,on Home (e.g., AppStore) Users run instrumented programs RaceMob 8

9 Insights Use sta,c race detec,on to prune memory accesses that need not be monitored Cost of dynamic detec,on can be amor,zed across many users Using the crowd, we can detect races that majer 9

10 RaceMob All Memory Sta,c Detec,on Poten5ally Racing Dynamic Context Inference Likely Racing On- demand Valida,on True Races Crowdsourcing Detected 106 real Race & Hang races in 10 Race & Crash programs with 2.3% average overhead 10

11 Sta,c Data Race Detec,on We use RELAY [FSE 07] Analyzes en3re program paths at once Computes & composes per- func3on summaries to scale Tracks locks Example Thread 1 Thread 2 x = 1 lock(l)... unlock(l) LS1 = {} lock(l)... unlock(l) x = 2 LS2 = {} x = 1 and x = 2 are poten,ally racing 11

12 RaceMob All Memory Sta,c Detec,on Poten5ally Racing Dynamic Context Inference Likely Racing On- demand Valida,on True Races Crowdsourcing Race & Hang Race & Crash 12

13 Dynamic Context Inference (DCI) Inaccuracy in sta,c data race detec,on Pointer alias analysis errors Inability to infer mul3threaded program context DCI checks at run,me: If accesses are from different threads If accesses alias } If yes, accesses are likely racing Dynamic context inference reduced the set of accesses to monitor by 53% 13

14 DCI Example Alice Thread 1 x = 1 lock(l)... unlock(l) Thread 2 lock(l)... unlock(l) x = 2 Address = 0xBEEF ThreadID = 1 Address = 0xBEEF ThreadID = 2 Proceed to on- demand data race valida,on 14

15 RaceMob All Memory Sta,c Detec,on Poten5ally Racing Dynamic Context Inference Likely Racing On- demand Valida,on True Races Crowdsourcing Race & Hang Race & Crash 15

16 On- demand Data Race Valida,on Happens- before based Track synchroniza3on Few false posi3ves Minimal tracking Thread 1 Thread 2 x=1 unlock(l) lock(l) x=2 Only memory accesses of the target data race Synchroniza3on in between these accesses Un,l enough happens- before edges form Steers thread schedule to expose races 16

17 On- demand Valida,on Example Alice Thread 1 Thread 2 x = 1 lock(l)... unlock(l) HB No Race lock(l)... unlock(l) x = 2 Bob Thread 1 Thread 2 x = 1 lock(l)... unlock(l) No HB x = 2 x = 1 lock(l)... unlock(l) Race 17

18 Detec,on Results RACE RACE & CRASH RACE & HANG NO RACE NOT ALIASING NOT MULTITHREADED NOT SEEN program Applica,on Home (AppStore, Play) RaceMob 18

19 RaceMob All Memory Sta,c Detec,on Poten5ally Racing Dynamic Context Inference Likely Racing On- demand Valida,on True Races Crowdsourcing Race & Hang Race & Crash 19

20 memcached Evalua,on Pbzip2 pfscan SPLASH-2 Detec,on effec,veness Contribu,on of techniques to reducing overhead Breakdown of overhead Comparison to other detectors Comparison to concurrency tes,ng tools Scalability analysis 20

21 memcached Evalua,on Pbzip2 pfscan SPLASH-2 Detec,on effec,veness Contribu,on of techniques to reducing overhead Breakdown of overhead Comparison to other detectors Comparison to concurrency tes,ng tools Scalability analysis 21

22 841 Detec,on Effec,veness Total Race & Crash 106 true data races 3 3 Race & Hang 100 Race Not Aliasing Not Mul,threaded No Race 84 Not seen RaceMob detected and confirmed 106 data races 22

23 How Does Each Technique Detec,on,me/ Na,ve execu,on,me Lower the Overhead? Dynamic detec,on Sta,c + dynamic detec,on RaceMob (sta,c + dynamic + DCI +on- demand valida,on) aggregate RaceMob per- user 30x 30x 26.1x 3.6x Ocean (CPU- bound) 1.01x 6.3x 5.4x Pbzip2 (I/O- bound) 1.03x All techniques are required for low overhead 23

24 Run,me overhead vs. na,ve execu,on 5.00 % 3.75 % 2.50 % 1.25 % 1.00 % 0 Breakdown of overhead Instrumenta,on Valida,on Apache SQLite Memcached Fmm Barnes Ocean Pbzip2 Knot Aget Pfscan 2.3% average run,me overhead per- user 24

25 RaceMob All Memory Sta,c Detec,on Poten5ally Racing Dynamic Context Inference Likely Racing On- demand Valida,on True Races Crowdsourcing Detected 106 real Race & Hang races in 10 programs with 2.3% Race & Crash average overhead 25