EventRacer: Finding Concurrency Errors in Event-Driven Applications. Pavol Bielik

Size: px

Start display at page:

Download "EventRacer: Finding Concurrency Errors in Event-Driven Applications. Pavol Bielik"

Isabella Thornton
5 years ago
Views:

1 Eventr: Finding Concurrency Errors in Event-Driven Applications Pavol Bielik

2 Android Errors Caused by Concurrency Display article twice 1 Display wrong directory Display wrong order

3 Web Page Errors Caused by Concurrency Incomplete form submitted 2 jquery version used nondeterministically Non-operational menu

4 Event-Driven Applications designed to hide latency, various asynchronous APIs network, disk, database, timers, UI events highly asynchronous and complex control flow scheduling non-determinism asynchrony is not intuitive 3

5 Trouble with Asynchrony Background task, progress dialog, orientation change - is there any 100% working solution JavaScript function sometimes called, sometimes not Avoiding race conditions in Google Analytics asynchronous tracking Ajax Call Sometimes Works, Sometime works and refreshes, Sometimes refreshes and fails Is AsyncTask really conceptually flawed or am I just missing something 4

6 Hello World of web page concurrency <html><body> <script> var v=undefined; Browser v:undefined Server fetch img1.png </script> fetch img2.png <img src="img1.png" onload="v='hi!';"> <img src="img2.png" onload="alert(v);"> load img1.png v: Hi! Hi! </body></html> 5 load img2.png

7 Bad interleaving <html><body> <script> var v=undefined; Browser v:undefined Server fetch img1.png </script> fetch img2.png <img src="img1.png" onload="v='hi!';"> <img src="img2.png" onload="alert(v);">.png lo g2 ad im undefined </body></html> 5

8 Understanding the problem <html><body> Event Actions <script> var v=undefined; </script> <img src= img1.png onload= v= Hi! ; > <img src= img2.png onload= alert(v); > </body></html> 6

9 Understanding the problem <html><body> Event Actions <script> var v=undefined; </script> Happens-before <img src= img1.png onload= v= Hi! ; > <img src= img2.png onload= alert(v); > </body></html> 6

10 Understanding the problem <html><body> Event Actions <script> var v=undefined; </script> Happens-before write v <img src= img1.png onload= v= Hi! ; > <img src= img2.png onload= alert(v); > read v </body></html> 6

11 Online Analysis 7

12 Eventr end-to-end System Android App, Web Page Instrumented System Execution Trace Happens-before Graph Detector 7 Filtering and Grouping Explorer

13 Eventr end-to-end System Android App, Web Page Instrumented System Execution Trace Happens-before Graph Detector Filtering and Grouping Explorer What are the memory locations on which asynchronous events can race JS variables, functions, arrays DOM nodes and attributes <img id="img1" src="img1.png" onload="v='hi!';"> write(#img1) write(#img1.onload) <script> v='hi!'; write(v) <script> function f() {} write(f) document.getelementbyid("img1") messages[2] = 42; write(messages[2]) </script> 8 read(#img1).addeventlistener("click", f); write(#img1.click) </script>

14 Eventr end-to-end System Android App, Web Page Instrumented System Execution Trace Happens-before Graph Detector Filtering and Grouping Explorer What are the atomic events used in event-driven applications <script> var v=undefined; </script> Web - parsing an HTML element - executing a script - handling user input <img src= img1.png onload= v= Hi! ; > <img src= img2.png onload= alert(v); >

15 Eventr end-to-end System Android App, Web Page Instrumented System Execution Trace Happens-before Graph Detector Filtering and Grouping Explorer What is the event happens-before <script> var v=undefined; </script> Web setinterval, SetTimeout, AJAX, Android postdelayed, postatfront, postidle, Happens-before <img src= img1.png onload= v= Hi! ; > <img src= img2.png onload= alert(v); >

16 Eventr end-to-end System Android App, Web Page Instrumented System Execution Trace Happens-before Graph Detector Explorer Filtering and Grouping 11 How to make scalable race detection in event-based setting <script> (Naive algorithms have asymptotic complexity O(N3) and require O(N2) space) </script> State of the art Eventr runtime TIMEOUT 2.4sec memory 25181MB 171MB var v=undefined; write v <img src= img1.png onload= v= Hi! ; > <img src= img2.png onload= alert(v); > read v

17 Eventr end-to-end System Android App, Web Page Instrumented System Execution Trace Happens-before Graph Detector Filtering and Grouping Is the system effective at finding harmful races while reporting few benign races We filter common classes of benign races: commutative operations, recycled objects, lazy initialization, local reads, Web Android # races found # races reported reduction 37x 100x Explorer

18 Manual evaluation Web (314 reports) Fortune 100 Web Pages 24.6% 25% 58.4% 17.3% 17% 57.7% Harmful bugs unhandled exceptions UI glitches broken analytics page needs refresh to work normally 14 Android (104 reports) 8 Play Store Applications synchronization races various idioms: if (ready) try { } catch { retry } array of callbacks etc. harmless races commutative operations benign races framework related

19 Simple GPS Tracker protected void oncreate() { locationmanager.requestlocationupdates(gps_provider, 0, 0, mlistener); mdbhelper = new SQLiteOpenHelper(this, DB_NAME, DB_VERSION); } LocationListener mlistener = new LocationListener() { public void onlocationchanged(location location) { //show location on map mdbhelper.getwritabledatabase().insert(loc); } }; protected void onstop() { locationmanager.removeupdates(mlistener); mdbhelper.close(); } 15

20 Simple GPS Tracker protected void oncreate() { locationmanager.requestlocationupdates(gps_provider, 0, 0, mlistener); mdbhelper = new SQLiteOpenHelper(this, DB_NAME, DB_VERSION); } public void removeupdates (LocationListener listener) LocationListener mlistener = new LocationListener() { in API level 1 public voidadded onlocationchanged(location location) { //show location on map Removes all location updates for the specified LocationListener. mdbhelper.getwritabledatabase().insert(loc); } }; Following this call, updates will no longer occur for this listener. protected void onstop() { locationmanager.removeupdates(mlistener); mdbhelper.close(); } 15

21 16

22 Analysis Results onlocationchanged and onstop are reported as not ordered event 1 source async IPC, interface(android.location.ilocationlistener), code(onlocationchanged)) event 2 source async IPC, interface(android.app.iapplicationthread), code (SCHEDULE_STOP_ACTIVITY)) calling context Landroid/database/sqlite/SQLiteDatabase;.insert(...) calling context Landroid/database/sqlite/SQLiteClosable;.close(...) UPDATE-UPDATE Landroid/database/sqlite/SQLiteConnectionPool;.mAvailablePrimaryConnection READ-UPDATE Landroid/database/sqlite/SQLiteConnectionPool;.mIsOpen READ-UPDATE Landroid/database/sqlite/SQLiteConnection;.mConnectionPtr READ-UPDATE Landroid/database/sqlite/SQLiteConnection;.mPreparedStatementPool 16

23 Is the Alternative Interleaving Feasible D/GPS: D/GPS: D/GPS: D/GPS: D/GPS: D/GPS: D/GPS: oncreate insert: Location[gps insert: Location[gps insert: Location[gps insert: Location[gps onstop insert: Location[gps , , , , acc=10 acc=10 acc=10 acc=10 et=0 et=0 et=0 et=0 vel=2.0 vel=2.0 vel=2.0 vel=2.0 mock] mock] mock] mock] , acc=10 et=0 vel=2.0 mock] E/AndroidRuntime: FATAL EXCEPTION: main E/AndroidRuntime: Process: com.example.gps, PID: 2249 E/AndroidRuntime: java.lang.illegalstateexception: attempt to re-open an already-closed object: SQLiteDatabase: /data/data/com.example.gps/test.db 16

24 Current Directions Google Chromium port V8 javascript engine instrumentation Testing tools based on Eventr Integration with Selenium PhantomJS Application for Parallelization Other Application Domains (beyond Web Pages, Android) Node.js 17

org Martin Vechev, Veselin Raychev, Pavol Bielik Anders Møller,

25 Android App, Web Page Instrumented System Execution Trace Happens-before Graph Detector Filtering and Grouping Martin Vechev, Veselin Raychev, Pavol Bielik Anders Møller, Casper Jensen Manu Sridharan Boris Petrov, Yasen Trifonov Julian Dolby Explorer

Software Architecture and Engineering: Part II

Software Architecture and Engineering: Part II ETH Zurich, Spring 2016 Prof. http://www.srl.inf.ethz.ch/ Framework SMT solver Alias Analysis Relational Analysis Assertions Second Project Static Analysis