We present a new open-source analysis system called EventRacer (www.eventracer.org) developed at the Software Reliability Lab at ETH Zurich, that finds harmful concurrency errors in event-driven applications such as web pages and Android applications. We illustrate how these concurrency errors can occur in real-world applications as well as the key analysis mechanisms behind EventRacer.
2. Android Errors Caused by Concurrency
Display article twice Display wrong directory Display wrong order 1
3. Web Page Errors Caused by Concurrency
Incomplete form
jQuery version used non-deterministically
submitted Non-operational menu
2
4. Event-Driven Applications
designed to hide latency, various asynchronous APIs
network, disk, database, timers, UI events
highly asynchronous and complex control flow
scheduling non-determinism
asynchrony is not intuitive
3
5. Trouble with Asynchrony
Background task, progress dialog, orientation change - is there any 100% working solution?
JavaScript function sometimes called, sometimes not
Avoiding race conditions in Google Analytics asynchronous tracking
Ajax Call Sometimes Works, Sometime works and refreshes, Sometimes refreshes and fails …?
Is AsyncTask really conceptually flawed or am I just missing something?
4
6. “Hello World” of web page concurrency
<html><body>
<script>
var v=undefined;
</script>
<img src="img1.png" onload="v='Hi!';">
<img src="img2.png" onload="alert(v);">
</body></html>
Browser Server
fetch img1.png
fetch img2.png
load img1.png
load img2.png
v:undefined
v:’Hi!’
Hi!
5
7. Bad interleaving
<html><body>
<script>
var v=undefined;
</script>
<img src="img1.png" onload="v='Hi!';">
<img src="img2.png" onload="alert(v);">
</body></html>
Browser Server
fetch img1.png
fetch img2.png
load img2.png
v:undefined
undefined
5
8. Understanding the problem
<html><body>
<script>
var v=undefined;
</script>
<img src=”img1.png” onload=”v=’Hi!’;”>
<img src=”img2.png” onload=”alert(v);”>
</body></html>
Event Actions
6
9. Understanding the problem
<html><body>
<script>
var v=undefined;
</script>
<img src=”img1.png” onload=”v=’Hi!’;”>
<img src=”img2.png” onload=”alert(v);”>
</body></html>
Event Actions
Happens-before
6
10. Understanding the problem
<html><body>
<script>
var v=undefined;
</script>
<img src=”img1.png” onload=”v=’Hi!’;”>
<img src=”img2.png” onload=”alert(v);”>
</body></html>
Race
write v
read v
Event Actions
Happens-before
6
12. EventRacer end-to-end System
Instrumented
System
Execution
Trace
Happens-before
Graph
Race
Detector
?
?
?
Race
Explorer
Race Filtering
and Grouping
Android App,
Web Page
7
13. EventRacer end-to-end System
DOM nodes and attributes
<img id="img1" src="img1.png"
onload="v='Hi!';">
<script>
document.getElementById("img1")
.addEventListener("click", f);
</script>
↦ write(#img1)
↦ write(#img1.onload)
↦ read(#img1)
↦ write(#img1.click)
Instrumented
System
Execution
Trace
What are the memory locations on
which asynchronous events can race?
JS variables, functions, arrays
<script>
v='Hi!';
function f() {}
messages[2] = 42;
</script>
↦ write(v)
↦ write(f)
↦ write(messages[2])
Happens-before
Graph
Race
Detector
?
?
?
Race
Explorer
Race Filtering
and Grouping
Android App,
Web Page
8
14. EventRacer end-to-end System
Instrumented
System
Web
- parsing an HTML element
- executing a script
- handling user input
- ...
<script>
var v=undefined;
</script>
<img src=”img1.png” onload=”v=’Hi!’;”>
<img src=”img2.png” onload=”alert(v);”>
Execution
Trace
What are the atomic events used in
event-driven applications?
Happens-before
Graph
Race
Detector
?
?
?
Race
Explorer
Race Filtering
and Grouping
Android App,
Web Page
9
15. EventRacer end-to-end System
Happens-before
<script>
var v=undefined;
</script>
Happens-before
<img src=”img1.png” onload=”v=’Hi!’;”>
<img src=”img2.png” onload=”alert(v);”>
Instrumented
System
Execution
Trace
What is the event happens-before?
Web
setInterval, SetTimeout, AJAX, …
Android
postDelayed, postAtFront, postIdle, ...
Graph
Race
Detector
?
?
?
Race
Explorer
Race Filtering
and Grouping
Android App,
Web Page
10
16. EventRacer end-to-end System
<script>
var v=undefined;
</script>
Race
write v
<img src=”img1.png” onload=”v=’Hi!’;”>
<img src=”img2.png” onload=”alert(v);”>
read v
Instrumented
System
Execution
Trace
How to make scalable race detection in
event-based setting?
(Naive algorithms have asymptotic complexity O(N3) and
require O(N2) space)
State of the art EventRacer
runtime TIMEOUT 2.4sec
memory 25181MB 171MB
Happens-before
Graph
Race
Detector
?
?
?
Race
Explorer
Race Filtering
and Grouping
Android App,
Web Page
11
17. EventRacer end-to-end System
Is the system effective at finding
harmful races while reporting few
benign races?
We filter common classes of benign
races:
commutative operations, recycled objects, lazy
initialization, local reads, ...
Web Android
# races found 646 1328
# races reported 17.3 13
reduction 37x 100x
Instrumented
System
Execution
Trace
Happens-before
Graph
Race
Detector
?
?
?
Race
Explorer
Race Filtering
and Grouping
Android App,
Web Page
13
18. Manual evaluation
Fortune 100 Web Pages
25%
17.3%
synchronization races
various idioms:
✓ if (ready) …
✓ try { … } catch { retry }
✓ array of callbacks
✓ etc.
harmless races
✓ commutative
operations
✓ benign races
✓ framework related
Web (314 reports)
Harmful bugs
✓ unhandled exceptions
✓ UI glitches
✓ broken analytics
✓ page needs refresh to
work normally
Android (104 reports)
8 Play Store Applications
14
24.6%
58.4%
17% 57.7%
20. Simple GPS Tracker
protected void onCreate() {
locationManager.requestLocationUpdates(GPS_PROVIDER, 0, 0, mListener);
mDbHelper = new SQLiteOpenHelper(this, DB_NAME, DB_VERSION);
}
LocationListener mListener = new LocationListener() {
public void onLocationChanged(Location location) {
//show location on map
mDbHelper.getWritableDatabase().insert(loc);
} };
protected void onStop() {
locationManager.removeUpdates(mListener);
mDbHelper.close();
}
15
public void removeUpdates (LocationListener listener)
Added in API level 1
Removes all location updates for the specified LocationListener.
Following this call, updates will no longer occur for this listener.
24. Current Directions
Google Chromium port
V8 javascript engine instrumentation
Testing tools based on EventRacer
Integration with Selenium
PhantomJS
Application for Parallelization
Other Application Domains (beyond Web Pages, Android)
Node.js
17
25. www.eventracer.org
Martin Vechev, Veselin Raychev, Pavol Bielik
Anders Møller, Casper Jensen
Manu Sridharan
Boris Petrov, Yasen Trifonov
Julian Dolby
Instrumented
System
Execution
Trace
Happens-before
Graph
Race
Detector
?
?
?
Race
Explorer
Race Filtering
and Grouping
Android App,
Web Page