Lecture Notes in Computer Science 3472

532 Séverine Colin and Leonardo Mariani
occur in the examined execution trace. The goal is to extract as much information
as possible from a single execution trace to be able to forecast problems that can
occur in executions that have not been explored. In the case of multi-threaded
software, debugging is complex since execution of threads is not deterministic
and many combinations are possible, thus verification requires specific tools. In
this section, we present the application of run-time verification techniques for
detecting data races and deadlocks.
18.4.1 Data Races
The Eraser algorithm [SBN + 97] is one of the first algorithms that dynamically
detects data races in multi-threaded programs. A date race occurs when two
concurrent threads access a shared variable with at least one write access and
threads use no explicit mechanism to prevent accesses from being simultaneous.
The Eraser algorithm takes an unmodified program binary as input and
adds instrumentation to produce a new binary that is functionally identical, but
includes calls to the Eraser run-time which implements the Lockset algorithm.
The Lockset algorithm enforces the locking discipline requiring that every
variable shared between threads is protected by a mutual exclusion lock. As a
consequence, the lock must be held by threads accessing the variable. Basically,
Eraser instruments standard C, C++ and Unix memory allocation routines and
monitors all read and write operations to check whether the program respects
or not the locking policy. Eraser does not know which locks are intended to protect
which variables, so it must infer the protection relation from the execution
history.
In particular, for each shared variable v, Eraser maintains the set C (v) of
candidate locks for v. This set contains those locks that have protected v for
the computation so far, that is, a lock l is in C (v) if in the current computation
every thread that has accessed v was holding l at the moment of the access.
When a new variable v is initialized, its candidate set C (v) is considered to hold
all possible locks. When the variable is accessed, Eraser updates C (v) withthe
intersection of C (v) and the set of locks held by the current thread. This process,
called lockset refinement, ensures that anylockthatconsistentlyprotectsv is
contained in C (v). If C (v) becomes empty, no locks consistently protect v.
A lock is a simple synchronization object used to implement mutual exclusion.
Locks can be either available or owned by a thread. The operations that can be
performed on a lock mu are lock(mu) andunlock(mu). Figure 18.3 shows an
example taken from the paper presenting the Eraser algorithm [SBN + 97] that
illustrates how a potential data race is discovered through lockset refinement.
The left column contains the program statements that are executed;the column
in the middle contains the set of locks held by the considered thread; and the
right column contains the set of candidate locks C (v). The example uses two
locks mu1 and mu2, thusC (v) initially contains both of them. Then, the lock
mu1 is acquired and v is accessed. Thus, C (v) is refined by computing the
intersection of C (v) with the set of acquired locks. Later, v is accessed again,
when only mu2 is held. The intersection of the singleton {mu1} with {mu2} is