Type-Based Race Detection for J AVA

1. Type-Based Race Detection for JAVA by Cormac Flanagan, Stephen N. Freund 22nd Feb 2008 presented by Hong,Shin Type-Based Race Detection for JAVA

2. Introduction • Race condition occurs when two thread manipulate a shared data structure simultaneously without synchronization. • Race condition errors are schedule-dependent that these are difficult to catch using traditional testing technologies. • Support lock-based synchronization discipline by tracking the protecting lock for each shared field in the program and verifying that the appropriate lock is held whenever a shared field is accessed. • Express the reasoning and checks performed by this analysis as an extension of JAVA’s type system. Type-Based Race Detection for JAVA

3. Introduction 2/2 • Start by adopting the target system to a core subset of JAVA. • And then extends the type system with a number of additional features: • classes parameterized by the locks • classes that are local to a particular thread Type-Based Race Detection for JAVA

4. CONCURRENT JAVA 1/2 • CONCURRENT JAVA is a multithreaded subset of JAVA. • Syntax if final modifier is present, then the field cannot be updated after initialization. Type-Based Race Detection for JAVA

5. CONCURRENT JAVA2/3 • Informal Semantics • CONCURRENT JAVA supports multithreaded programs by including the operation fork e which spawn a new thread for the evaluation of e. • Locks are provided: each object has an associated binary lock. The expression synchronized e1 in e2is evaluated as follow: (1) acquire the associated lock of e1 . (2) e2 is then evaluated. (3) release the associated lock of e1. Type-Based Race Detection for JAVA

6. CONCURRENT JAVA 3/3 Schedule Scenario 1 <Thread 1> <Thread2> 8 call a.deposit(10) 4 this.balance+x=10 4 this.balance:=10 8 call a.deposit(10) 4 this.balance+x=20 4 this.balance :=20 1 class Account { 2 int balance = 0 • int deposit(int x) { 4 this.balance = this.balance + x 5 } 6 } 7 let Account a = new Account in { 8 fork { a.deposit(10) } 9 fork { a.deposit(10) } 10 } Schedule Scenario 2 <Thread 1> <Thread2> 8 call a.deposit(10) 8 call a.deposit(10) 4 this.balance+x=10 4 this.balance+x=10 4 this.balance :=10 4 this.balance :=10 • 1 class Account { • int balance = 0 • int deposit(int x) { • synchronized this in { • this.balance = this.balance + x • } • } • } • let Account a = new Account in { • fork { a.deposit(10) } • fork { a.deposit(10) } • } /* Race-Free Account */ Type-Based Race Detection for JAVA

7. RACEFREE JAVA 1/1 • Race conditions are commonly avoided by the lock-based synchronization discipline. • The type system needs to verify that each field has a protecting lock that is held whenever the field is accessed or updated. (1) associates a protecting lock with each field declaration. → programmers provide additional type annotations (2) tracks the set of locks held at each field access or update. → the type system automatically verifies that the locks are indeed held at each field access, field update, and call-site of the method. • RACEFREE JAVA • An extended language of CONCURRENT JAVA • The modified syntax field::= [final]optt fdguarded_byl = e meth ::= t mn (arg*) [requiresls]opt{ e } ls ::= l* l ::= e Type-Based Race Detection for JAVA

8. Type System 1/5 • Type Judgment • P ; E ; ls`e : t P : the program being checked E : an environment providing types for the free variables of e ls : a set of final expressions describing the locks that are held when the expression e is evaluated. e : an expression t : the type of e • Type Rules • The type rules track the set of locks held each program point. { } P ; E`fianll : c checks that l is a final expression of some class type c Type-Based Race Detection for JAVA

9. Type System 2/5 P ; E `fianl e1 : c checks that e1 is a final expression of some class type c Check that the lock l guarding fd is held at this program point; i.e., that l denotes the same lock as some expression l’ in current lock set. → approximates semantic equivalence by syntactic equivalence, and simply to check that l≡ l’. ex) final Object a = new Object final Object b = a int data guarded_by a : synchronized b in { data = 0 } Type-Based Race Detection for JAVA

10. Type System – Example 3/5 P ; Account this ` int P ; Account this `Á P ; Account this, int x ; Á` synchronized …. : int -------------------------[METHOD] P ; Account this `final this : Account P ; Account this ; Á` 0 : int -------------------------[FIELD] E = Account this P ; Account this ` int balance guarded_by this=0 P ; Account this ` int deposit(int x) { … } -------------------[CLASS] P = class Account{ …} let Account a = new Account …. P ` class Account{…} P ; Á ; Á` let Account a = new Account in … : int --------------------[PROG] ` P : int P : class Account { int balance guarded_by this = 0 int deposit(int x) synchronized this in { this.balance = this.balance + x } } let Account a = new Account in { fork { a.deposit(10 } fork { a.deposit(10) } } Type-Based Race Detection for JAVA

11. Type System – Example 4/5 P ; Account this, int x ` this : Account P ; Account this, int x ` (int balance guarded_by this = 0) 2 Account P ; Account this, int x ` this 2 {this} P ; Account this, int x ` int -------------------[EXP REF] P ; Account this, int x ; {this} ` this.balance+x : Account P ; Account this, int x ` (int balance guarded_by this = 0) 2 Account P ; Account this, int x ` this 2{this} P ; Account this, int x ; {this} ` this.balance+x -------------------[EXP ASSIGN] P ; Account this, int x `final this : Account P ; Account this, int x ; {this} ` {this.balance=this.balance+x} : int ------------------[EXP SYNC] P ; Account this, int x ; Á` synchronized this in {this.balance=this.balance+x} : int : : Type-Based Race Detection for JAVA

12. Type System – Example 5/5 P ; Account a ; Á` a : Account P ; Account a ` (int deposit(int x)) 2 Account P ; Account a ; Á` 10 : int P ; Account a `ÁµÁ P ; Account a ` int --------------------[EXP INVOKE] P ; Account a `Á P ; Account a ; Á` a.deposit(10) : int --------------------[EXP FORK] P ; Á ; Á` new Account : Account P ; Account a ; Á` fork{a.deposit(10)} fork{a.deposit(10)} : s P ; Á ; Á` s ---------------------[EXP LET] P = defn e <defn: class Account …, e: let Account ..> P ` defn P ; Á ; Á` let Account a = new Account in {…} : int --------------------[PROG] ` P : int Type-Based Race Detection for JAVA

13. External Locks 1/2 • The only variable in scope at a field declaration is this, the fields of an object must be protected by a lock that is accessible from the object. • It is necessary to protect the fields of an object by some locks external to the object. Ex) In a linked list, the node objects in a list should be synchronized by a lock which is outside of the node class. • To accommodate this programming pattern, we extend RACEFREE JAVA to allow classes to be parameterized by external locks defn ::= classcn<garg*> body garg ::= ghostt x c ::= cn<l*> | Object Type-Based Race Detection for JAVA

14. External Locks 2/2 Type-Based Race Detection for JAVA

15. Thread-Local Classes 1/2 • Large multithreaded programs typically have sections of code that operate on data that is not shared across multiple threads. • To accommodate this situation, the concept of thread-local classes is introduced. • The language is extended to allow an optional thread_local modifier on class definitions and to make guarded_by clause on field declarations optional in a thread-local class. defn::=[thread_local]optclasscn <garg*> body field::= [final]optt fd [guarded_by l]opt = e Type-Based Race Detection for JAVA

16. Thread-Local Classes 2/2 • The type system must ensure that thread-local objects are not accessible from non thread-local objects. • extends the rules not to eliminate this possibility. Type-Based Race Detection for JAVA

17. Implementation 1/1 • RACEFREE JAVA type system is extended to support full JAVA language in rccjava implementation. • The comments that start with the character “#” are treated as type annotations by the tool. • The tool was built on top of an existing JAVA front-end that includes a scanner, parser, and type checker. Type-Based Race Detection for JAVA

18. Experiment Results 1/2 • To test effectiveness of the tool, several multithreaded JAVA program was checked by the tool. • It was reported that the annotation process proceeded at a rate of 1000lines of code per programmer-hour. Type-Based Race Detection for JAVA

19. Experiment Results 2/2 class Vector { Object elementData[] /*# guarded_by this */ int elementCount /*# guarded_by this */ synchronized boolean removeAllElements() { : elementCount = 0 ; : } synchronized int lastIndexOf(Object elem, int n) { for (int i = n ; --i >= 0 ; ) if (elem.equals(elementData[i])) { … } } int lastIndexOf(Object elem) { return lastIndexOf(elem, elementCount) ; } } Excerpt from java.util.Vector Two threads work on the same Vector object elementCount = 10 ; <Thread1><Thread2> 13 invokel lastIndexOf(elem) 4 invoke synchronized removeAllElements() 5 elementCount = 0 14 invoke lastIndexOf(elem, 10)  Race! Type-Based Race Detection for JAVA

20. Conclusion • The type system enforces programmers to write locking strategies of a program as annotations and checks whether the programmer wrote the program with the strategies or not. • This type system enables race conditions to be detected early in the development cycle. • The annotations can be used as documentation of locking strategies. • Some synchronization patters are not supported in the type system (ex. reader-writer locks) Type-Based Race Detection for JAVA

21. Further work • Efficient and Precise Datarace Detection for Multithreaded Object-Oriented Programs (PLDI’02) • LOCKSMITH: Context-Sensitive Correlation Analysis for Race Detection(PLDI’06) Type-Based Race Detection for JAVA

22. Reference [1] Type-Based Race Detection for JAVA, Cormac Flanagan, Stephen N. Freund, PLDI 2000 Type-Based Race Detection for JAVA