Peng Liu and Charles Zhang Prism Research Group Department of Computer Science and Engineering Hong Kong University of Science and Technology 1

Motivation An Atomicity Violation (AV) in StringBuffer. The accesses, assumed to be atomic, are interleaved non-serializably by a remote access. run(){ // s1.append(s2): synchronized(s1) { int len = s2.length(); s2.getChars(0, len, s1…); } Thread 1 2

Motivation An Atomicity Violation (AV) in StringBuffer. The accesses, assumed to be atomic, are interleaved non-serializably by a remote access. run(){ // s1.append(s2): synchronized(s1) { int len = s2.length(); s2.getChars(0, len, s1…); } Thread 1 3

Motivation An Atomicity Violation (AV) in StringBuffer. The accesses, assumed to be atomic, are interleaved non-serializably by a remote access. run(){ // s1.append(s2): synchronized(s1) { int len = s2.length(); s2.getChars(0, len, s1…); } Thread 1 4

Motivation An Atomicity Violation (AV) in StringBuffer. The accesses, assumed to be atomic, are interleaved non-serializably by a remote access. run(){ // s1.append(s2): synchronized(s1) { int len = s2.length(); s2.getChars(0, len, s1…); } Thread 1 5

Motivation An Atomicity Violation (AV) in StringBuffer. The accesses, assumed to be atomic, are interleaved non-serializably by a remote access. run(){ // s1.append(s2): synchronized(s1) { int len = s2.length(); s2.getChars(0, len, s1…); } run(){ s2.delete(0, s2.length()); } Thread 1 Thread 2 6

Motivation An Atomicity Violation (AV) in JDK StringBuffer. The accesses, assumed to be atomic, are interleaved non-serializably by a remote access. run(){ // s1.append(s2): synchronized(s1) { a int len = s2.length(); b s2.getChars(0, len, s1…); } run(){ r s2.delete(0, s2.length()); } Thread 1 Thread 2 7

Motivation Common approach of Fixing the Atomicity Violation Synchronize the atomicity sequence (from a to b) and the remote access (r) with locks. run(){ // s1.append(s2): synchronized(s1) { + lockM.lock(); a int len = s2.length(); b s2.getChars(0, len, s1…); + lockM.unlock(); } run(){ + lockM.lock(); r s2.delete(0, s2.length()); + lockM.unlock(); } Thread 1 Thread 2 8

Motivation Problems with Fixing the Violations 9

Motivation Problems with Fixing the Violations 10

Motivation Introduce New Deadlocks AV (a,b,r) and the original lock oL protecting some irrelevant vars. Thread 1 Thread 2 a oL.lock(); … oL.unlock(); b oL.lock();... r... oL.unlock(); 11

Motivation Introduce New Deadlocks AV (a,b,r) and the original lock oL protecting some irrelevant vars. Thread 1 Thread 2 a oL.lock(); … oL.unlock(); b oL.lock();... r... oL.unlock(); 12

Motivation Introduce New Deadlocks AV (a,b,r) and the original lock oL protecting some irrelevant vars. Thread 1 Thread 2 a oL.lock(); … oL.unlock(); b oL.lock();... r... oL.unlock(); 13

Motivation Introduce New Deadlocks AV (a,b,r) and the original lock oL protecting some irrelevant vars. Thread 1 Thread 2 a oL.lock(); … oL.unlock(); b oL.lock();... r... oL.unlock(); + L.lock(); + L.unlock(); + L.lock(); + L.unlock(); 14

Motivation Introduce New Deadlocks AV (a,b,r) and the original lock oL protecting some irrelevant vars. Thread 1 Thread 2 a oL.lock(); … oL.unlock(); b oL.lock();... r... oL.unlock(); + L.lock(); + L.unlock(); + L.lock(); + L.unlock(); 15

Motivation Problems with Fixing the Violations 16

Motivation Sacrifice the Concurrency Greatly Two overlapping Avs: (a,b,r) and (a’b,r’). Thread 1 Thread 3 a b a b Thread 2 r’ a’ … r … b’ 17

Motivation Sacrifice the Concurrency Greatly Two overlapping Avs: (a,b,r) and (a’b,r’). Thread 1 Thread 3 a b a b Thread 2 r’ a’ … r … b’ 18

Motivation Sacrifice the Concurrency Greatly Two overlapping Avs: (a,b,r) and (a’b,r’). Thread 1 Thread 3 a b a b Thread 2 r’ a’ … r … b’ 19

Motivation Sacrifice the Concurrency Greatly Two overlapping Avs: (a,b,r) and (a’b,r’). Thread 1 Thread 3 a b a b Thread 2 r’ a’ … r … b’ 20

Motivation Sacrifice the Concurrency Greatly Two overlapping Avs: (a,b,r) and (a’b,r’). Thread 1 Thread 3 a b a b Thread 2 r’ a’ … r … b’ 21

Motivation Sacrifice the Concurrency Greatly Two overlapping Avs: (a,b,r) and (a’b,r’). Thread 1 Thread 3 a b a b Thread 2 r’ a’ … r … b’ 22

Motivation Sacrifice the Concurrency Greatly Two overlapping Avs: (a,b,r) and (a’b,r’). Thread 1 Thread 3 +L.lock(); a b +L.unlock(); Thread 2 +L.lock(); r’ +L.unlock(); +L.lock(); a’ … r … b’ +L.unlock(); 23

Motivation Our Guarantee 24

Motivation Our Guarantee 25

Motivation Our Approach 26

Motivation Our Approach Bug report: …… 27

Motivation Our Approach 28

Motivation Our Approach Constraints: no two pandas on the single-plank bridge simultaneously. Solver: control theory. 29

Motivation Rationale Performance – Loose constraints – Concurrency-preserving solver. Safety – Handle deadlocks with solver 30

thread1.start(); thread2.start(); Thread 1 run(){ synchronized(s1) { int len = s2.length(); s2.getChars(0, len, s1…); } Thread 2 run(){ s2.delete(0, s2.length()); } thread1.join(); thread2.join(); 31

Abstract graphical and mathematical model. Places (circles) Transitions (horizontal bars) Arcs between them 32

Abstract graphical and mathematical model. Places (circles) Transitions (horizontal bars) Arcs between them 33

Abstract graphical and mathematical model. Places (circles) Transitions (horizontal bars) Arcs between them 34

Abstract graphical and mathematical model. Places (circles) Transitions (horizontal bars) Arcs between them 35

Abstract graphical and mathematical model. Places contain tokens Transitions, when triggered, move tokens Arcs (the weights) determine how many to move. 1 by default. 36

Abstract graphical and mathematical model. Places contain tokens Transitions, when triggered, move tokens Arcs (the weights) determine how many to move. 1 by default. 37

Abstract graphical and mathematical model. Places contain tokens Transitions, when triggered, move tokens Arcs (the weights) instruct how many to remove or give. 1 by default. 38

Abstract graphical and mathematical model. A transition can be triggered only if the input place contains enough tokens. 39

Statements -> places. Control flows-> transitions Branch 40

Statements -> places. Control flows-> transitions Branch 41

Statements -> places. Control flows-> transitions Branch 42

Statements -> places. Control flows-> transitions Branch 43

Statements -> places. Control flows-> transitions Branch 44

Statements -> places. Control flows-> transitions Loop 45

Statements -> places. Control flows-> transitions Loop 46

Statements -> places. Control flows-> transitions Loop 47

Statements -> places. Start/Join/Control flows-> transitions Threading 48

Statements -> places. Start/Join/Control flows-> transitions Threading 49

Statements -> places. Start/Join/Control flows-> transitions Threading 50

Statements -> places. Lock/Unlock/Control flows-> transitions Locking 51

Statements -> places. Lock/Unlock/Control flows-> transitions Locking 52

Statements -> places. Lock/Unlock/Control flows-> transitions Locking 53

Mathematical form. 54 T1T2 P1 P20 P301 D = Structure Matrix (initial) Token Distribution Vector U 0 = P11 P20 P30 P1 T1T2 P2 P3 1

thread1.start(); thread2.start(); Thread 1 run(){ synchronized(s1) { int len = s2.length(); s2.getChars(0, len, s1…); } Thread 2 run(){ s2.delete(0, s2.length()); } thread1.join(); thread2.join(); 55 P1 T1 P2 T2 P3 T3 P4 T4 P5 L T5 P6 P7 P8 P9 T6 T7

thread1.start(); thread2.start(); Thread 1 run(){ synchronized(s1) { int len = s2.length(); s2.getChars(0, len, s1…); } Thread 2 run(){ s2.delete(0, s2.length()); } thread1.join(); thread2.join(); 56 P1 T1 P2 T2 P3 T3 P4 T4 P5 L T5 P7 P8 P9 T6 T7 P6

thread1.start(); thread2.start(); Thread 1 run(){ synchronized(s1) { int len = s2.length(); s2.getChars(0, len, s1…); } Thread 2 run(){ s2.delete(0, s2.length()); } thread1.join(); thread2.join(); 57 P1 T1 P2 T2 P3 T3 P4 T4 P5 L T5 P7 P8 P9 T6 T7 P6

thread1.start(); thread2.start(); Thread 1 run(){ synchronized(s1) { int len = s2.length(); s2.getChars(0, len, s1…); } Thread 2 run(){ s2.delete(0, s2.length()); } thread1.join(); thread2.join(); 58 P1 T1 P2 T2 P3 T3 P4 T4 P5 L T5 P6 P7 P8 P9 T6 T7

thread1.start(); thread2.start(); Thread 1 run(){ synchronized(s1) { int len = s2.length(); s2.getChars(0, len, s1…); } } Thread 2 run(){ s2.delete(0, s2.length()); } thread1.join(); thread2.join(); 59 P1 T1 P2 T2 P3 T3 P4 T4 P5 L T5 P6 P7 P8 P9 T6 T7

thread1.start(); thread2.start(); Thread 1 run(){ synchronized(s1) { int len = s2.length(); s2.getChars(0, len, s1…); } } Thread 2 run(){ s2.delete(0, s2.length()); } thread1.join(); thread2.join(); 60 P1 T1 P2 T2 P3 T3 P4 T4 P5 L T5 P6 P7 P8 P9 T6 T7

thread1.start(); thread2.start(); Thread 1 run(){ synchronized(s1) { int len = s2.length(); s2.getChars(0, len, s1…); } Thread 2 run(){ s2.delete(0, s2.length()); } thread1.join(); thread2.join(); P1 T1 P2 T2 P3 T3 P4 T4 P5 L T5 P6 P7 P8 P9 T6 T7

thread1.start(); thread2.start(); Thread 1 run(){ synchronized(s1) { int len = s2.length(); s2.getChars(0, len, s1…); } Thread 2 run(){ s2.delete(0, s2.length()); } thread1.join(); thread2.join(); 62 P1 T1 P2 T2 P3 T3 P4 T4 P5 L T5 P6 P7 P8 P9 T6 T7

thread1.start(); thread2.start(); Thread 1 run(){ synchronized(s1) { int len = s2.length(); s2.getChars(0, len, s1…); } Thread 2 run(){ s2.delete(0, s2.length()); } thread1.join(); thread2.join(); 63 P1 T1 P2 T2 P3 T3 P4 T4 P5 L T5 P6 P7 P8 P9 T6 T7

64 P1 T1 P2 T2 P3 T3 P4 T4 P5 L T5 P6 P7 P8 P9 T6 T7 Thread 1 run(){ synchronized(s1) { int len = s2.length(); s2.getChars(0, len, s1…); } Thread 2 Inter-thread constraint: U(P3) + U(P7) <=1 run(){ s2.delete(0, s2.length()); }

65 P1 T1 P2 T2 P3 T3 P4 T4 P5 L T5 P6 P7 P8 P9 T6 T7 thread1.start(); thread2.start(); Thread 1 run(){ synchronized(s1) { int len = s2.length(); s2.getChars(0, len, s1…); } Thread 2 thread1.join(); thread2.join(); run(){ s2.delete(0, s2.length()); }

66 P1 T1 P2 T2 P3 T3 P4 T4 P5 L T5 P6 P7 P8 P9 T6 T7 Thread 1 run(){ synchronized(s1) { int len = s2.length(); s2.getChars(0, len, s1…); } Thread 2 Inter-thread constraint: U(P4) + U(P7) <=1 run(){ s2.delete(0, s2.length()); }

67 P1 T1 P2 T2 P3 T3 P4 T4 P5 L T5 P6 P7 P8 P9 T6 T7 thread1.start(); thread2.start(); Thread 1 run(){ synchronized(s1) { int len = s2.length(); s2.getChars(0, len, s1…); } Thread 2 thread1.join(); thread2.join(); run(){ s2.delete(0, s2.length()); }

68 P1 T1 P2 T2 P3 T3 P4 T4 P5 L T5 P6 P7 P8 P9 T6 T7 thread1.start(); thread2.start(); Thread 1 run(){ synchronized(s1) { int len = s2.length(); s2.getChars(0, len, s1…); } Thread 2 thread1.join(); thread2.join(); run(){ s2.delete(0, s2.length()); }

69 P1 T1 P2 T2 P3 T3 P4 T4 P5 L T5 P6 P7 P8 P9 T6 T7 thread1.start(); thread2.start(); Thread 1 run(){ synchronized(s1) { int len = s2.length(); s2.getChars(0, len, s1…); } Thread 2 thread1.join(); thread2.join(); run(){ s2.delete(0, s2.length()); }

70 P1 T1 P2 T2 P3 T3 P4 T4 P5 L T5 P6 P7 P8 P9 T6 T7 Intra-thread constraint: thread-representing token stays in P3, or P4, but not both at any time. U(P3) + U(P4) <=1

71 P1 T1 P2 T2 P3 T3 P4 T4 P5 L T5 P6 P7 P8 P9 T6 T7 Inter-thread: U(P3) + U(P7) <=1 U(P4) + U(P7) <=1 Intra-thread: U(P3) + U(P4) <=1 Equivalent form: U(P3) + U(P4) + U(P7) <=1

Supervision Based on Place Invariants (SBPI) Input: constraints, e.g., U(P3) + U(P4) + U(P7) <=1 Output: augmentation to PN to satisfy the constraints. Output augmentation: New control places with tokens Arcs connecting them to the original PN. Mathematic form.

Output augmentation in its math form: New control places with tokens Arcs connecting them to the original PN. Output of our example: New place M. M has one token (U 0 M = 1 ). Connecting to T2, T6, from T4, T7. D M = T1T2T3T4T5T6T7 M0010 1

Output augmentation in its math form: New control places with tokens Arcs connecting them to the original PN. Output of our example: New place M. M has one token (U 0 M = 1 ). Connecting to T2, T6, from T4, T7. D M = T1T2T3T4T5T6T7 M0010 1

Output: New place M, with one token. Connecting to T2, T6, from T4, T7. M 75 P1 T1 P2 T2 P3 T3 P4 T4 P5 L T5 P6 P7 P8 P9 T6 T7

Wang’s deadlock avoidance (SBPI) [POPL’09] Reuse. Part program. Deadlocks introduced by our fix.

Control place -> lock (static field). Arc to (from) a transition -> locking operation at the control flow (between a pair of statements). Injected locking operations should not affect other control flows (sharing common statements).

M 78 P1 T1 P2 T2 P3 T3 P4 T4 P5 L T5 P6 P7 P8 P9 T6 T7 Thread 1 synchronized(s1) { +lockM.lock(); int len = s2.length(); s2.getChars(0, len, s1…); +lockM.unlock(); } Thread 2 +lockM.lock(); s2.delete(0, s2.length()); +lockM.unlock();

Evaluation Benchmarks: OpenJMS, messaging service implementation. Derby, Apache’s database system. Jigsaw, W3C’s webserver platform. Violation detection: Pecan [ISSTA ‘11] Evaluated properties: Performance of patched code Safety

Evaluation Benchmarks: OpenJMS, messaging service implementation. Derby, Apache’s database system. Jigsaw, W3C’s webserver platform. Violation detection: Pecan [ISSTA ‘11] Evaluated properties: Performance of patched code Safety

Evaluation (performance) Compared to the state of the art fixes, 1.Axis-noDA is 7% faster 2.Axis-DA is only 3% slower. (It has strong safety guarantee.) OpenJMSJigsaw Derby

Evaluation (safety) 1.No deadlocks are identified for Axis-DA. 2.Frequent deadlocks for other fixes, including Axis-noDA and AFix. Patched programT=2T=4T=8T=12 OpenJMSAxis-noDA0027 AFix0025 JigsawAxis-noDA20 AFix20 DerbyAxis-noDA00011 AFix0007

Conclusion A formal violation-fixing approach with strong guarantees on Performance. Sacrifice the concurrency minimally. Safety. No deadlocks are introduced. Implementation & Evaluation Compared to the state of the art, Axis-noDA is 7% faster. Axis-DA (with strong safety guarantee) is merely 3% slower.