UNICORN: A Unified Approach for Localizing Non-deadlock Concurrency Bugs

UNICORN: A UNIFIED APPROACH
FOR LOCALIZING NON-DEADLOCK
CONCURRENCY BUGS

Sangmin Park, Richard Vuduc,
and Mary Jean Harrold
College of Computing
Georgia Institute of Technology

Concurrency Bugs Technique Studies Conclusion

Motivation

Interleaving Space

Correct Buggy Interleaving Buggy Interleaving
Interleaving involving single involving multiple
resource resources

2


Existing Techniques
 Detect concurrency bugs — single variable
 Data race detectors [FastTrack, Eraser]
 Order violation detectors [Falcon]
 Atomicity violation detectors [AVIO, Falcon, CTrigger]

 Detect atomicity violations --- multiple variables
 Atomicity violation detectors [ColorSafe, AtomTracker]

 Detect concurrency bugs --- single and multiple
 General bug detectors w/ statistical analysis
[CCI, Bugaboo, Recon, DefUse]
3


Existing Techniques
 Data race
Limitation detectors [FastTrack, Eraser]
Don't detect concurrency bugs involving multiple
variables

 Detect atomicity violations --- multiple variables

4


Existing Techniques
 Data race
variables

 Detect atomicity violations — multiple variables

5


Existing Techniques
 Data race
variables

Limitation
Don't detect order violations

6


Existing Techniques
 Data race
variables

Limitation
Don't detect order violations

 Detect concurrency bugs — single and multiple
7


Existing Techniques
 Data race
  Order violation detectors [Falcon]
variables


Limitation
 Don't detect order violations
 Detect concurrency bugs — single and multiple
General bug detectors w/ statistical analysis

Limitation
 Don't provide bug type information
8


Overview
 Concurrency Bugs
 Order violation
 Single-variable atomicity violation

 Multi-variable atomicity violation

 UNICORN Technique
 Detects three types of concurrency bugs
 Provides bug type information

 Empirical Studies
 Conclusion
9


Bug: Order Violation
Thread 1 Thread 2

void main(…) { void * consumer (…) {
…
pthread_create(consumer);
…

W1
…
mutex = NULL;

 …
Lock(mutex); R2
…
…
} }

* This example is from PBZip2. 10


Bug: Single-Variable Atomicity
Thread 1 Thread 2

void new_file(…) { int mysql_insert(…) {
…  // actual insert
saved_type = log_type; …
W1 log_type = CLOSED;  if (log_type != CLOSED)
R2
… {
// update file LOG.write(…);
… }
W3 log_type = saved_type; …
… }
}

* This example is from MySQL-791. 11


Bug: Multi-Variable Atomicity
Thread 1 Thread 2

int mysql_delete(…) { int mysql_insert(…) {
… …
Lock(X); 
 Lock(X);
W1 Table.remove (); Table.insert();
W2
Unlock(X); Unlock(X);
… …
Lock(Y); Lock(Y);
W4 LOG.write(); LOG.write(); W3
Unlock(Y); Unlock(Y);
… …
} }


Bug: Multi-Variable Atomicity
Thread 1 Thread 2

int mysql_delete(…) { int mysql_insert(…) {
… …

W1
Lock(X);
Table.remove ();
 Lock(X);
Table.insert();
Note W2
Unlock(X); Unlock(X);
These
… three types of concurrency bugs are the
…
most important types of non-deadlock concurrency
Lock(Y); Lock(Y);
W4 bugs [Lu 08].
LOG.write(); LOG.write(); W3
… …
} }


Problematic Access Patterns
#Var Type Memory Access Patterns
R1,S(x) W2,S(x)
Order W1,S(x) R2,S(x)
W1,S(x) W2,S(x)
R1,S(x) W2,S(x) R1,S(x)
Single
W1,S(x) W2,S(x) R1,S(x)
Single-Variable
W1,S(x) R2,S(x) W1,S(x)
Atomicity
W1,S(x) R2,S(x) W1,S(x)
W1,S(x) W2,S(x) W1,S(x)
W1,S(x) W2,S(x) W2,S(y) W1,S(y)
W1,S(x) W2,S(y) W2,S(x) W1,S(y)
W1,S(x) W2,S(y) W1,S(y) W2,S(x) * The patterns
W1,S(x) R2,S(x) R2,S(y) W1,S(y) were identified
Multi
Multi-Variable
W1,S(x) R2,S(y) R2,S(x) W1,S(y)
by previous work
Atomicity [Lu 06, Vaziri
R1,S(x) W2,S(x) W2,S(y) R1,S(y) 06, Hammer 08].
R1,S(x) W2,S(y) W2,S(x) R1,S(y)
R1,S(x) W2,S(y) R1,S(y) W2,S(x)
14
W1,S(x) R2,S(x) W1,S(y) R2,S(y)


UNICORN: Overview

[ Fault-localization technique ]

P ranked-
UNICORN patterns
T

15


UNICORN: Overview

[ UNICORN: A UNIfied approach for localizing non-deadlock COncuRreNcy Bugs ]

Find both single-variable and
multi-variable patterns

pairs, patterns, ranked-
P Step 1: Step 2: Step 3:
outcomes outcomes patterns
Collect Pairs Combine Pairs Rank
T Patterns
From Executions Into Patterns

Intuition: Patterns consist of
(one or two) pairs

16


Problematic Access Patterns
#Var Type Memory Access Patterns Memory Access Pairs
R1,S(x) W2,S(x) R1,S(x) W2,S(x)
Order W1,S(x) R2,S(x) W1,S(x) R2,S(x)
W1,S(x) W2,S(x) W1,S(x) W2,S(x)
R1,S(x) W2,S(x) R1,S(x) R1,S(x) W2,S(x) W2,S(x) R1,S(x)
Single
W1,S(x) W2,S(x) R1,S(x) W1,S(x) W2,S(x) W2,S(x) R1,S(x)
Single-
Variable W1,S(x) R2,S(x) W1,S(x) W1,S(x) R2,S(x) R2,S(x) W1,S(x)
Atomicity
W1,S(x) R2,S(x) W1,S(x) W1,S(x) R2,S(x) R2,S(x) W1,S(x)
W1,S(x) W2,S(x) W1,S(x) W1,S(x) W2,S(x) W2,S(x) W1,S(x)
W1,S(x) W2,S(x) W2,S(y) W1,S(y) W1,S(x) W2,S(x) W2,S(y) W1,S(y)
W1,S(x) W2,S(y) W2,S(x) W1,S(y) W1,S(x) W2,S(x) W2,S(y) W1,S(y)
W1,S(x) W2,S(y) W1,S(y) W2,S(x) W1,S(x) W2,S(x) W2,S(y) W1,S(y)
W1,S(x) R2,S(x) R2,S(y) W1,S(y) W1,S(x) R2,S(x) R2,S(y) W1,S(y)
Multi-
Multi Variable W1,S(x) R2,S(y) R2,S(x) W1,S(y) W1,S(x) R2,S(x) R2,S(y) W1,S(y)
Atomicity
R1,S(x) W2,S(x) W2,S(y) R1,S(y) R1,S(x) W2,S(x) W2,S(y) R1,S(y)
R1,S(x) W2,S(y) W2,S(x) R1,S(y) R1,S(x) W2,S(x) W2,S(y) R1,S(y)
R1,S(x) W2,S(y) R1,S(y) W2,S(x) R1,S(x) W2,S(x) W2,S(y) R1,S(y)
17
W1,S(x) R2,S(x) W1,S(y) R2,S(y) W1,S(x) R2,S(x) R2,S(y) W1,S(y)


Step 1: Collect Pairs in Executions

 Collect pairs using sliding window [Falcon, ICSE 2010]
 Maintain a window per shared variable (pair window)
 Collect WR, RW, WW access-pairs within window

P Step 1: Step 2: Step 3: patterns
outcomes outcomes
T Patterns

18



[Run 1] Failing
Thread 1 Thread 2
Accesses
int delete(…) { int insert(…) {
R0 R0 R1 R1 W0 W0 W1 W2 W3 W4
… …
Lock(X); Lock(X);
W1: Tbl(); W2: Tbl(); Windows
Unlock(X); Unlock(X); Tbl: …
… … LOG: …
Lock(Y); Lock(Y);
W4: LOG(); W3: LOG();
Unlock(Y); Unlock(Y); Pairs
… … R0-W0, R0-W1, R1-W0, R1-W1
} } R0-W0, R0-W1
W1-W2 pairs for the
W3-W4 code in the slide
19



Thread 1 Thread 2

int delete(…) { int insert(…) { I R R R R R R
Pair
D 1 2 3 4 5 6
… …
W1 (Tbl)-
Lock(X); Lock(X); 1    
W2 (Tbl)
W1: Tbl(); W2: Tbl(); W3 (LOG)-
2    
Unlock(X); Unlock(X); W4 (LOG)
… … W2 (Tbl)-
3  
Lock(Y); Lock(Y); W1 (Tbl)

W4: LOG(); W3: LOG(); W4 (LOG)-
4  
W3 (LOG)
F P P F P P
… …
} }

20


Step 2: Combine Pairs to Patterns

1. Set pairs to patterns for order violation
2. Combine pairs to patterns using sliding window
 Sort pairs in time order
 Combine two-pair-based patterns within pattern window

outcomes outcomes
T Patterns

21



[Run 1] Failing
Thread 1 Thread 2
Pairs Patterns
int delete(…) { int insert(…) { R0-W0
R0-W0
… … R0-W1 R0-W1
Lock(X); Lock(X); R0-W0 R0-W0
R0-W1 R0-W1
W1: Tbl(); W2: Tbl();
R1-W0 R1-W0
Unlock(X); Unlock(X); R1-W1 R1-W1
… … R1-W2 R1-W2
R1-W0 R1-W0
Lock(Y); Lock(Y);
R1-W1 R1-W1
W4: LOG(); W3: LOG(); R1-W2 R1-W2
Unlock(Y); Unlock(Y); W1-W2 W1-W2
W3-W4 W3-W4
… …
} } W1-W2-W3-W4

22



Thread 1 Thread 2 I R R R R R R
Pattern
D 1 2 3 4 5 6
int delete(…) { int insert(…) {
W1 (Tbl)-
1    
… … W2 (Tbl)
Lock(X); Lock(X); W3 (LOG)-
2    
W1: Tbl(); W2: Tbl(); W4 (LOG)

Unlock(X); Unlock(X); W2 (Tbl)-
3  
W1 (Tbl)
… …
W4 (LOG)-
Lock(Y); Lock(Y); 4  
W3 (LOG)
W4: LOG(); W3: LOG(); W1 (Tbl)-
Unlock(Y); Unlock(Y); 5
W2 (Tbl)-
 
W3 (LOG)-
… …
W4 (LOG)
} }
F P P F P P

23


Step 3: Rank Patterns

 Rank patterns
 Compute suspiciousness of patterns
Jaccard formula [Abreu07]
failed (P)
suspiciousness(P) =
totalfailed + passed(P)

outcomes outcomes
T Patterns

24


failed (P)
suspiciousness(P) =
Thread 1 Thread 2 totalfailed + passed(P)

Pattern Susp
D 1 2 3 4 5 6
… …
W1 (Tbl)-
Lock(X); Lock(X); 1     0.5
W2 (Tbl)
W1: Tbl(); W2: Tbl(); W3 (LOG)-
2     0.5
Unlock(X); Unlock(X); W4 (LOG)
… … 3
W2 (Tbl)-
  0.0
W1 (Tbl)
Lock(Y); Lock(Y);
W4 (LOG)-
W4: LOG(); W3: LOG(); 4   0.0
W3 (LOG)
W1 (Tbl)-
… … W2 (Tbl)-
5   1.0
} } W3 (LOG)-
W4 (LOG)
F P P F P P
25


failed (P)
suspiciousness(P) =
Thread 1 Thread 2 totalfailed + passed(P)

Pattern Susp
D 1 2 3 4 5 6
… …
W1 (Tbl)-
Lock(X); Lock(X); 1     0.5
W2 (Tbl)
W1: Tbl(); W2: Tbl(); W3 (LOG)-
Summary Unlock(X); 2      0.5
Unlock(X); W4 (LOG)
… UNICORN… 3
W2 (Tbl)-
  0.0
W1 (Tbl)
•
Lock(Y); Detects Lock(Y); access pairs
memory
W4 (LOG)-
•
W4: LOG(); Combines pairs into patterns
W3: LOG(); 4
W3 (LOG)
   0.0
• Ranks patterns w.r.t. suspiciousness
W1 (Tbl)-
… … W2 (Tbl)-
5    1.0
} } W3 (LOG)-
W4 (LOG)
F
P P
F P F P P
26


Empirical Studies
 Studies
1. Evaluate effectiveness of the technique
2. Measure distance of the pattern window
3. Evaluate efficiency of the technique (see paper)

 Empirical Setup
 Implemented in Java (Soot) and C++ (LLVM)
 Evaluated on a set of subjects

27


Subjects
Language Program LOC % Failed Bug Type

TimerThread 68 14.4 Order

LoadScript 110 49.8 Single-variable atomicity

MysqlLog 89 2.8 Single-variable atomicity
C++
Extracted JsString 95 1.4 Multi-variable atomicity

MysqlDelete 103 3.8 Multi-variable atomicity

MysqlSlave 94 0.4 Multi-variable atomicity

PBZip2 2k 2.8 Order

Mysql-791 372k 64.0 Single-variable atomicity
C++
Complete Aget 1.2k 49.0 Multi-variable atomicity

Mysql-169 334k 63.0 Multi-variable atomicity

StringBuffer 1.4k 22.3 Multi-variable atomicity
Java
Vector 9.5k 7.6 Multi-variable atomicity
28


Study 1: Effectiveness
 Goal
 Todetermine how well UNICORN ranks the
pattern of the actual bug

 Method
 Set pair-window size to 5
 Set pattern-window size to 100

 Ran each subject 100 times and computed
suspiciousness and rankings

29


Study 1: Effectiveness
1
Num of Num of Susp Susp Susp Rank Num of
Program
Pairs Patterns (Pair 1) (Pair 2) (Pattern) (Bug) Top rank
TimerThread 6 7 1.0 - 1.0 1 3

LoadScript 3 4 0.86 1.0 1.0 1 2

MysqlLog 4 5 0.02 1.0 1.0 1 2

JsString 5 8
2 0.04 1.0 1.0 1 3

MysqlDelete 7 1 0.04 0.27 1.0 1 1

MysqlSlave 6 11 0.01 0.66 1.0 31 1

PBZip2 59 333 0.42 - 0.42 1 6

Mysql-791 1082 10936 1.0 0.64 1.0 1 4

Aget 37 94 0.51 0.50 0.70 1 1

Mysql-169 894 9051 0.63 0.63 1.0 1 7

StringBuffer 8 18 0.58 1.0 1.0 1 3

Vector 11 25 1.0 1.0 1.0 1 4
30


Study 2: Pattern-window size
 Goal
 Toinvestigate the practicality of the pattern-
window size

 Method
 Computed the distance between the two pairs of
the actual concurrency bugs (using data from
Study 1)
 Computed the median and maximum distances

31


Study 2: Pattern-window size
Num of Num of Median Maximum
Program
Pairs Patterns distance distance
TimerThread 6 7 N/A N/A

LoadScript 3 4 2 2

MysqlLog 4 5 2 2

JsString 5 8 3 3

MysqlDelete 7 1 2 2

MysqlSlave 6 11 2 2

PBZip2 59 333 N/A N/A

Mysql-791 1082 10936 18 27

Aget 37 94 2 3

Mysql-169 894 9051 41 41

StringBuffer 8 18 4 5

Vector 11 25 2 2
32


Future Work
 Provide information to understand bugs
 Problem: Several patterns ranked top together
 Approach: In-depth analysis on the ranking

 Provide information on test-suite
 Problem: No study on effectiveness vs. test suite
 Approach: Investigation on quality of test suite

 Improve overhead
 Problem: Significant overhead on monitoring
 Approach: Use techniques such as sampling

33


Contributions
 UNICORN is the first unified technique that
 detects memory-access pairs, combines pairs to get
patterns, and ranks patterns with respect to
suspiciousness
 handles both single- and multi-variable violations

 Empirical studies show that UNICORN
 is effective in identifying patterns associated with
real bugs
 is efficient
 it needs small-/fixed-sized windows to find patterns
 its runtime overhead comparable to other techniques

Questions 34

UNICORN: A Unified Approach for Localizing Non-deadlock Concurrency Bugs

Recommended

Recommended

More Related Content

Similar to UNICORN: A Unified Approach for Localizing Non-deadlock Concurrency Bugs

Similar to UNICORN: A Unified Approach for Localizing Non-deadlock Concurrency Bugs (20)

Recently uploaded

Recently uploaded (20)

UNICORN: A Unified Approach for Localizing Non-deadlock Concurrency Bugs