Abstract
Data race is one of the most dangerous errors in multithreaded programming, and despite intensive studies, it remains a notorious cause of failures in concurrent systems. Detecting data races is already a hard problem, and yet it is even harder for a programmer to decide whether or how a reported data race can appear in the actual program execution. In this paper we propose an algorithm for generating debugging aid information called witnesses, which are concrete thread schedules that can deterministically trigger the data races. More specifically, given a concrete execution trace, e.g. non-erroneous one which may have triggered a warning in Eraser-style data race detectors, we use a symbolic analysis based on SMT solvers to search for a data race witness among alternative interleavings of events of that trace. Our symbolic analysis precisely encodes the sequential consistency semantics using a scalable predictive model to ensure that the reported witness is always feasible.
The work was supported in part by NSF Grants CCF-0811287, CCF-0810865 and ONR Grant N000140910740.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Boyapati, C., Rinard, M.C.: A parameterized type system for race-free Java programs. In: OOPSLA 2001. SIGPLAN Notices, vol. 36(11), pp. 56–69. ACM, New York (2001)
Wang, C., Mahmoud Said, A.G.: Coverage guided systematic concurrency testing. In: International Conference on Software Engineering, ICSE 2011 (2011)
Christey, S. (ed.): Top 25 most dangerous programming errors. CWE/SANS report (2009), http://cwe.mitre.org/top25/
Dutertre, B., de Moura, L.: A Fast Linear-Arithmetic Solver for DPLL(T). In: Ball, T., Jones, R.B. (eds.) CAV 2006. LNCS, vol. 4144, pp. 81–94. Springer, Heidelberg (2006)
Elmas, T., Qadeer, S., Tasiran, S.: Goldilocks: a race and transaction-aware Java runtime. j-SIGPLAN 42(6), 245–255 (2007)
Engler, D., Ashcraft, K.: RacerX: effective, static detection of race conditions and deadlocks. In: ACM Symposium on Operating Systems Principles, pp. 237–252. ACM, New York (2003)
Farchi, E., Nir, Y., Ur, S.: Concurrent bug patterns and how to test them. In: Parallel and Distributed Processing, p. 286.2. IEEE Computer Society, Washington, DC (2003)
Flanagan, C., Freund, S.: Type-based race detection for Java. In: Programming Language Design and Implementation, pp. 219–232. ACM, New York (2000)
Flanagan, C., Freund, S.N.: Fasttrack: efficient and precise dynamic race detection. In: Programming Language Design and Implementation, pp. 121–133. ACM, New York (2009)
Havelund, K.: Using runtime analysis to guide model checking of java programs. In: Havelund, K., Penix, J., Visser, W. (eds.) SPIN 2000. LNCS, vol. 1885, pp. 245–264. Springer, Heidelberg (2000)
Havelund, K., Pressburger, T.: Model checking JAVA programs using JAVA PathFinder. International Journal on Software Tools for Technology Transfer (STTT) 2(4), 366–381 (2000)
Joint cav/issta special even on specification, verification, and testing of concurrent software, http://research.microsoft.com/qadeer/cavissta.htm
Kahlon, V., Yang, Y., Sankaranarayanan, S., Gupta, A.: Fast and accurate static data-race detection for concurrent programs. In: Damm, W., Hermanns, H. (eds.) CAV 2007. LNCS, vol. 4590, pp. 226–239. Springer, Heidelberg (2007)
Kahlon, V., Ivancic, F., Gupta, A.: Reasoning about threads communicating via locks. In: Etessami, K., Rajamani, S.K. (eds.) CAV 2005. LNCS, vol. 3576, pp. 505–518. Springer, Heidelberg (2005)
Manson, J., Pugh, W., Adve, S.V.: The java memory model. In: Principles of Programming Languages (2005)
Musuvathi, M., Qadeer, S., Ball, T., Musuvathi, M., Qadeer, S., Ball, T.: Chess: A systematic testing tool for concurrent software. Tech. Rep. MSR-TR-2007-149, Microsoft Research (2007)
Naik, M., Aiken, A.: Conditional must not aliasing for static race detection. In: Principles of programming languages. ACM, New York (2007)
Pratikakis, P., Foster, J., Hicks, M.: LOCKSMITH: context-sensitive correlation analysis for race detection. In: Programming Language Design and Implementation, pp. 320–331. ACM, New York (2006)
von Praun, C., Gross, T.R.: Static detection of atomicity violations in object-oriented programs. Object Technology 3(6) (2004)
The java grande forum benchmark suite, http://www2.epcc.ed.ac.uk/computing/research_activities/java_grande/index_1.html
Savage, S., Burrows, M., Nelson, G., Sobalvarro, P., Anderson, T.E.: Eraser: A dynamic data race detector for multi-threaded programs. ACM Trans. Comput. Syst. 15(4), 391–411 (1997)
Serbănută, T.F., Chen, F., Rosu, G.: Maximal causal models for multithreaded systems. Tech. Rep. UIUCDCS-R-2008-3017, University of Illinois at Urbana-Champaign (2008)
Siegel, S.F., Mironova, A., Avrunin, G.S., Clarke, L.A.: Using model checking with symbolic execution to verify parallel numerical programs. In: ISSTA (2006)
Voung, J., Jhala, R., Lerner, S.: RELAY: static race detection on millions of lines of code. In: Foundations of Software Engineering, pp. 205–214. ACM, New York (2007)
Wang, C., Kundu, S., Ganai, M., Gupta, A.: Symbolic predictive analysis for concurrent programs. In: International Symposium on Formal Methods. ACM, New York (2009)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2011 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Said, M., Wang, C., Yang, Z., Sakallah, K. (2011). Generating Data Race Witnesses by an SMT-Based Analysis. In: Bobaru, M., Havelund, K., Holzmann, G.J., Joshi, R. (eds) NASA Formal Methods. NFM 2011. Lecture Notes in Computer Science, vol 6617. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-20398-5_23
Download citation
DOI: https://doi.org/10.1007/978-3-642-20398-5_23
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-20397-8
Online ISBN: 978-3-642-20398-5
eBook Packages: Computer ScienceComputer Science (R0)