Finding concurrency-related bugs using random isolation

Abstract

Abstract. This paper describes the methods used in Empire, a tool to detect concurrency-related bugs, namely atomic-set serializability violations in Java programs. The correctness criterion is based on atomic sets of memory locations, which share a consistency property, and units of work, which preserve consistency when executed sequentially. Empire checks that, for each atomic set, its units of work are serializable. This notion subsumes data races (single-location atomic sets), and serializability (all locations in one atomic set).To obtain a sound, finite model of locking behavior for use in Empire, we devised a new abstraction principle, random isolation, which allows strong updates to be performed on the abstract counterpart of each randomly-isolated object. This permits Empire to track the status of a Java lock, even for programs that use an unbounded number of locks. The advantage of random isolation is that properties proved about a randomly-isolated object can be generalized to all objects allocated at the same site. We ran Empire on eight programs from the ConTest benchmark suite, for which Empire detected numerous violations.

Detecting atomic-set serializability violations in multithreaded programs through active randomized testing

“…Kidd et al [13] proposed to verify atomic-set serializability by model checking techniques. Although this approach is able to explore all executions, it is not scalable even for medium-sized programs [12].…”

“…One can alternatively use model checking techniques to enumerate all interleavings. However, model checking techniques for atomic-set serializability [13] are not scalable even for medium-sized programs [12] because the number of possible thread interleavings often grows exponentially with the length of an execution.…”

“…If ASSETFUZZER infers that no interleavings in the same relaxed partial order may violate atomic-set serializability, then these interleavings must satisfy this criterion. Note that existing techniques [9,13] need to fully explore all these interleavings to discover this fact. If ASSETFUZZER infers that there are potential violations in these interleavings, it records problematic access patterns that capture these violations.…”

An Integrated Specification and Verification Technique for Highly Concurrent Data Structures

“…Our use of data variables in observers for specifying properties that hold for all data values in some domain is related in spirit to the identification of arbitrary but fixed objects or resources by Emmi et al [13] and Kidd et al [18]. In the framework of regular model checking, universally quantified temporal logic properties can be compiled into automata with data variables that are assigned arbitrary initial values [1].…”

Verifying Information Flow Control over Unbounded Processes

“…Our approach to this problem is to leverage progress in model checkers [5,6] that check concurrent programs against temporal logic properties (e.g., linear temporal logic). However, the translation from arbitrary, multiprocess systems to systems that can be reasoned about by model checkers poses key challenges due to potential unboundedness along multiple dimensions.…”