c. flanagantype systems for multithreaded software1 cormac flanagan uc santa cruz stephen n. freund...
TRANSCRIPT
C. Flanagan Type Systems for Multithreaded Software 1
Type Systems for Multithreaded Software
Cormac FlanaganUC Santa Cruz
Stephen N. FreundWilliams College
Shaz QadeerMicrosoft Research
C. Flanagan Type Systems for Multithreaded Software 2
Towards Reliable Multithreaded Software
• Multithreaded software– increasingly common (Java, C#, GUIs, servers)– decrease latency, exploit underlying hardware
• Heisenbugs due to thread interference– race conditions– atomicity violations
• Need type systems for multithreaded software
C. Flanagan Type Systems for Multithreaded Software 3
Race Conditions
class Ref { int i; void add(Ref r) { i = i + r.i; }}
C. Flanagan Type Systems for Multithreaded Software 4
Race Conditions
class Ref { int i; void add(Ref r) { i = i + r.i; }} Ref x = new Ref(0);Ref y = new Ref(3);
x.add(y); x.add(y);
assert x.i == 6;
C. Flanagan Type Systems for Multithreaded Software 5
Race Conditions
class Ref { int i; void add(Ref r) { i = i + r.i; }} Ref x = new Ref(0);Ref y = new Ref(3);parallel { x.add(y); // two calls happen x.add(y); // in parallel}assert x.i == 6;
A race condition occurs if
• two threads access a shared variable at the same time
• at least one of those accesses is a write
C. Flanagan Type Systems for Multithreaded Software 6
Lock-Based Synchronization
class Ref { int i; // guarded by this void add(Ref r) { i = i + r.i; }} Ref x = new Ref(0);Ref y = new Ref(3);parallel { synchronized (x,y) { x.add(y); } synchronized (x,y) { x.add(y); }}assert x.i == 6;
• Field guarded by a lock
• Lock acquired before accessing field
• Ensures race freedom
C. Flanagan Type Systems for Multithreaded Software 7
Verifying Race Freedom with Types
class Ref { int i; void add(Ref r) { i = i + r.i; }} Ref x = new Ref(0);Ref y = new Ref(3);parallel { synchronized (x,y) { x.add(y); } synchronized (x,y) { x.add(y); }}assert x.i == 6;
• Race freedom – key correctness
property
• Rccjava– race condition checker– verifies race freedom– extra type annotations
express locking discipline
C. Flanagan Type Systems for Multithreaded Software 8
Verifying Race Freedom with Types
class Ref { int i; void add(Ref r) { i = i + r.i; }} Ref x = new Ref(0);Ref y = new Ref(3);parallel { synchronized (x,y) { x.add(y); } synchronized (x,y) { x.add(y); }}assert x.i == 6;
C. Flanagan Type Systems for Multithreaded Software 9
Verifying Race Freedom with Types
class Ref { int i guarded_by this; void add(Ref r) requires this, r { i = i + r.i; }} Ref x = new Ref(0);Ref y = new Ref(3);parallel { synchronized (x,y) { x.add(y); } synchronized (x,y) { x.add(y); }}assert x.i == 6;
check: this { this, r }
C. Flanagan Type Systems for Multithreaded Software 10
Verifying Race Freedom with Types
class Ref { int i guarded_by this; void add(Ref r) requires this, r { i = i + r.i; }} Ref x = new Ref(0);Ref y = new Ref(3);parallel { synchronized (x,y) { x.add(y); } synchronized (x,y) { x.add(y); }}assert x.i == 6;
check: this { this, r } check: this[this:=r] = r { this, r }
replace this by r
C. Flanagan Type Systems for Multithreaded Software 11
Verifying Race Freedom with Types
class Ref { int i guarded_by this; void add(Ref r) requires this, r { i = i + r.i; }} Ref x = new Ref(0);Ref y = new Ref(3);parallel { synchronized (x,y) { x.add(y); } synchronized (x,y) { x.add(y); }}assert x.i == 6;
check: this { this, r } check: this[this:=r] = r { this, r }
check: {this,r}[this:=x,r:=y] { x, y }
replace formals this,rby actuals x,y
C. Flanagan Type Systems for Multithreaded Software 12
Verifying Race Freedom with Types
class Ref { int i guarded_by this; void add(Ref r) requires this, r { i = i + r.i; }} Ref x = new Ref(0);Ref y = new Ref(3);parallel { synchronized (x,y) { x.add(y); } synchronized (x,y) { x.add(y); }}assert x.i == 6;
check: {this,r}[this:=x,r:=y] { x, y }
check: this { this, r } check: this[this:=r] = r { this, r }
check: {this,r}[this:=x,r:=y] { x, y }
Soundness Theorem:Well-typed programs are race-free
replace formals this,rby actuals x,y
C. Flanagan Type Systems for Multithreaded Software 13
Type Inference for Race-Freedom
Annotated Program:class Ref { int i guarded_by this; ...
Unannotated Program:class Ref { int i; ...
Error: potential race on field i
unsatisfiable
satisfiable
BooleanFormula
SatisfyingAssignment
SATSolver
C. Flanagan Type Systems for Multithreaded Software 14
Experimental Results: Race Freedom
Program
Lines
of
code
Number
of Fields
Manual
Annotations
(per KLOC)
I nference
time
(s/KLOC)
% fields
race
free
elevator 529 23 7.6 9.5 100tsp 723 37 6.9 9.5 92sor 687 29 1.5 6.6 100raytracer 1,982 77 2.5 10.6 95moldyn 1,408 107 2.1 8.9 94montecarlo 3,674 110 0.3 5.6 100mtrt 11,315 181 1.0 12.3 98jbb 30,519 787 1.5 90.9 97
C. Flanagan Type Systems for Multithreaded Software 16
Limitations of Race-Freedom
class Ref { int i; ... void inc() { int t; synchronized (this) { t = i; i = t + 1; } } ...}
inc()• race-free• behaves correctly in a
multithreaded context
C. Flanagan Type Systems for Multithreaded Software 17
Limitations of Race-Freedom
class Ref { int i; ... void inc() { int t; synchronized (this) { t = i; } synchronized (this) { i = t+1; } } ...}
inc()• race-free• behaves incorrectly in a
multithreaded context
Race freedom does not prevent errors due to unexpected interactionsbetween threads
C. Flanagan Type Systems for Multithreaded Software 18
Atomicity•The method inc() is atomic if concurrent
threads do not interfere with its behavior– (maximal non-interference property)
•Guarantees that for every interleaved
execution
•there is a serial execution with same behavior acq(this) t=i i=t+1 rel(this)x y z
acq(this) t=i i=t+1 rel(this)x y z
acq(this) t=i i=t+1 rel(this)x y z
C. Flanagan Type Systems for Multithreaded Software 19
Atomicity• Canonical property
– (cmp. linearizability, serializability, ...)
• Enables sequential reasoning– simplifies validation of multithreaded code
• Matches existing practice – most methods (80%+) are atomic
• Verifiable using type systems– atomicity violations often indicate errors– Lipton’s theory of reduction
C. Flanagan Type Systems for Multithreaded Software 20
Reduction [Lipton 75]acq(this)
X t=i Y i=t+1 Z rel(this)
acq(this)
X t=iY i=t+1 Zrel(this)
acq(this) X t=iY i=t+1 Z rel(this)
acq(this)X t=iY i=t+1 Z rel(this)
C. Flanagan Type Systems for Multithreaded Software 21
Checking Atomicity
atomic void inc() { int t; synchronized (this) { t = i; i = t + 1; } }
R: right-mover lock acquireL: left-mover lock releaseB: both-mover race-free variable
accessA: atomic conflicting variable
access
Reducible blocks have form: R* [A] L*
acq(this) t=i i=t+1 rel(this)
R B B L
A
C. Flanagan Type Systems for Multithreaded Software 22
Checking Atomicity (cont.)
atomic void inc() { int t; synchronized (this) { t = i; } synchronized (this) { i = t + 1; }}
R: right-mover lock acquireL: left-mover lock releaseB: both-mover race-free variable
accessA: atomic conflicting variable
access
R B L R B L
acq(this)t=i i=t+1 rel(this)acq(this) rel(this)
Compound
AA
C. Flanagan Type Systems for Multithreaded Software 23
Conditional Atomicity
atomic void inc() { int t; synchronized (this) { t = i; i = t + 1; }}
atomic void incByTwo() {
inc(); inc();
}
C. Flanagan Type Systems for Multithreaded Software 24
Conditional Atomicity
atomic void inc() { int t; synchronized (this) { t = i; i = t + 1; }}
atomic void incByTwo() { synchronized (this) { inc(); inc(); }}
C. Flanagan Type Systems for Multithreaded Software 25
Conditional Atomicity
(this ? mover : atomic) void inc() { int t; synchronized (this) { t = i; i = t + 1; }}
atomic void incByTwo() { synchronized (this) { inc(); inc(); }}
C. Flanagan Type Systems for Multithreaded Software 26
java.lang.StringBuffer/** ... used by the compiler to implement the binary
string concatenation operator ... String buffers are safe for use by multiple
threads. The methods are synchronized so that all the operations on any particular instance behave as if they occur in some serial order that is consistent with the order of the method calls made by each of the individual threads involved.
*/public atomic class StringBuffer { ... }
FALSE
C. Flanagan Type Systems for Multithreaded Software 27
class StringBuffer { private int count; synchronized int length() { return count; } synchronized void getChars(...) { ... } atomic synchronized void append(StringBuffer sb){
int len = sb.length(); ... ... ... sb.getChars(...,len,...); ... }}
java.lang.StringBuffer
A
ACompound
C. Flanagan Type Systems for Multithreaded Software 28
UnannotatedJava
Program
atomicityinference
Rcc/Sat
AtomicityWarnings
Program withAtomicity
Annotations
Type Inference for Atomicity• Finds most precise atomicity for each method• Leverages race-free type inference algorithm
(Rcc/Sat)
Bohr
C. Flanagan Type Systems for Multithreaded Software 29
Atomicity Inference
class Ref { int i guarded_by this; void inc() {...}}
AtomicityConstraints
ConstraintsSolution
ConstraintSolver
class Ref { int i guarded_by this; atomic void inc(){...}}
Program w/ Locking Annotations
Program w/ Atomicity Annotations
C. Flanagan Type Systems for Multithreaded Software 30
Thread-Safe Classes
0
20
40
60
80
100
String
String
Buffe
r
Vecto
r
Infla
ter
Deflat
er
ZipFile
Obs
erva
ble
Synch
List
URL
PrintW
riter
Synch
Bool
Synch
Doubl
e
Class
% A
tom
ic
Methods Synch. Blocks
C. Flanagan Type Systems for Multithreaded Software 31
Benchmarks
0
20
40
60
80
100
elevator tsp sor ray-tracer moldyn monte-carlo
mtrt jbb
Program
% A
tom
ic
Methods Synch. Blocks
C. Flanagan Type Systems for Multithreaded Software 32
Summary• Concurrency errors are notorious and
subtle– race conditions– atomicity violations
• Can be detected/prevented using types – type checking and type inference tractable and
reasonably precise– over 80% of methods in jbb are atomic