1. Prescient Memory: Exposing Weak Memory Model Behavior by Looking into the Future MAN CAO JAKE ROEMER ARITRA SENGUPTA MICHAEL D. BOND 1

2. Parallel Programming is Hard 2

3. Shared-memory 3 Main Memory CPU Cache CPU Cache CPU Cache CPU Cache

4. Parallel Programming is Hard Shared-memory Difficult to be both correct and scalable 4 Main Memory CPU Cache CPU Cache CPU Cache CPU Cache

5. Parallel Programming is Hard Shared-memory Difficult to be both correct and scalable Data race 5 Main Memory CPU Cache CPU Cache CPU Cache CPU Cache

6. Parallel Programming is Hard Shared-memory Difficult to be both correct and scalable Data race -Fundamentally, lacks strong semantic guarantees 6 Main Memory CPU Cache CPU Cache CPU Cache CPU Cache

7. Example #1: Weak Semantics 7 T1 T2 data = new Foo(); flag = true; if (flag) data.bar(); Foo data = null; boolean flag= false;

8. Example #1: Weak Semantics 8 Null pointer exception! T1 T2 data = new Foo(); flag = true; if (flag) data.bar(); Foo data = null; boolean flag= false;

9. Example #1: Weak Semantics 9 No data dependence T1 T2 data = new Foo(); flag = true; Foo data = null; boolean flag= false; Null pointer exception! if (flag) data.bar();

10. Exposing Behaviors of Data Races Existing Approaches Dynamic analyses Model checkers 10

11. Exposing Behaviors of Data Races Existing Approaches Dynamic analyses - Limitation: coverage Model checkers - Limitation: scalability 11

12. Exposing Behaviors of Data Races Existing Approaches Dynamic analyses - Limitation: coverage Model checkers - Limitation: scalability Prescient Memory (PM) Dynamic analysis with better coverage 12

13. Outline Memory Models and Behaviors of Data Races Design Prescient Memory (PM) PM-profiler PM Workflow Evaluation 13

14. Memory Model 14 Defines possible values that a load can return

15. Memory Model Defines possible values that a load can return 15 Sequential Consistency (SC) Impractical to enforce Strong

16. Memory Model Defines possible values that a load can return 16 Sequential Consistency (SC) Impractical to enforce Strong Enables compiler & hardware optimizations DRF0, C++11, Java Weak

17. Behaviors Allowed by Memory Models 17 DRF0 Memory Model Java Memory Model (JMM)

18. Behaviors Allowed by Memory Models 18 DRF0 Memory Model Java Memory Model (JMM) Racy execution No semantics Data-race-free execution Strong semantics (SC)

19. Behaviors Allowed by Memory Models 19 DRF0 Memory Model Java Memory Model (JMM) Racy execution No semantics Data-race-free execution Strong semantics (SC) Racy execution Weak semantics Data-race-free execution Strong semantics (SC)

20. Behaviors Allowed by Memory Models 20 DRF0 Memory Model Java Memory Model (JMM) Racy execution No semantics Data-race-free execution Strong semantics (SC) Racy execution Weak semantics Data-race-free execution Strong semantics (SC) Racy execution can still lead to surprising behaviors!

21. Behaviors Allowed in JMM #1: Revisit 21 T1 T2 data = new Foo(); flag = true; if (flag) data.bar(); Foo data = null; boolean flag= false;

22. Behaviors Allowed in JMM #1: Revisit 22 T1 T2 data = new Foo(); flag = true; if (flag) data.bar(); Foo data = null; boolean flag= false; stale value latest value

23. Behaviors Allowed in JMM #1: Revisit 23 Null pointer exception! T1 T2 data = new Foo(); flag = true; if (flag) data.bar(); Foo data = null; boolean flag= false; stale value latest value

24. Behaviors Allowed in JMM #1: Revisit 24 T1 T2 data = new Foo(); flag = true; if (flag) data.bar(); Foo data = null; boolean flag= false; Returning stale value can trigger the exception

25. Behaviors Allowed in JMM #2 25 r = data; flag = 1; T1T2 int data = flag = 0; while (flag == 0) {} data = 1; assert r == 0;

26. Behaviors Allowed in JMM #2 26 r = data; flag = 1; T1T2 int data = flag = 0; while (flag == 0) {} data = 1; assert r == 0;

27. Behaviors Allowed in JMM #2 27 r = data; flag = 1; T1T2 int data = flag = 0; while (flag == 0) {} data = 1; assert r == 0; latest value future value

28. Behaviors Allowed in JMM #2 28 r = data; flag = 1; T1T2 int data = flag = 0; while (flag == 0) {} data = 1; assert r == 0; latest value future value Valid due to lack of happens-before ordering

29. Behaviors Allowed in JMM #2 29 r = data; flag = 1; T1T2 int data = flag = 0; while (flag == 0) {} data = 1; assert r == 0; latest value future value Assertion failure!

30. Behaviors Allowed in JMM #2 30 r = data; flag = 1; T1T2 int data = flag = 0; while (flag == 0) {} data = 1; assert r == 0; Assertion failure!

31. Behaviors Allowed in JMM #2 31 r = data; flag = 1; T1T2 int data = flag = 0; while (flag == 0) {} data = 1; assert r == 0; Requires returning future value or reordering to trigger the assertion failure

32. Example #3 32 r1 = x; y = r1; T1T2 r2 = y; if (r2 == 1) { r3 = y; x = r3; } else x = 1; assert r2 == 0; int x = y = 0;

33. Example #3 33 r1 = x; y = r1; T1T2 r2 = y; if (r2 == 1) { r3 = y; x = r3; } else x = 1; assert r2 == 0; int x = y = 0; JMM disallows r2 == 1 because of causality requirements – Ševčík and Aspinall, ECOOP, 2008

34. Example #3 34 r1 = x; y = r1; T1T2 r2 = y; if (r2 == 1) { r3 = r2; x = r3; } else x = 1; assert r2 == 0; int x = y = 0; However, in a JVM, after redundant read elimination

35. Example #3 35 r1 = x; y = r1; T1T2 r2 = y; if (r2 == 1) { r3 = r2; x = r3; } else x = 1; assert r2 == 0; int x = y = 0; However, in a JVM, after redundant read elimination r2 = y; If (r2 == 1) x = r2; else x = 1;

36. Example #3 36 r1 = x; y = r1; T1T2 r2 = y; if (r2 == 1) { r3 = r2; x = r3; } else x = 1; assert r2 == 0; int x = y = 0; However, in a JVM, after redundant read elimination r2 = y; x = 1; r2 = y; If (r2 == 1) x = r2; else x = 1;

37. Example #3 37 r1 = x; y = r1; T1T2 r2 = y; if (r2 == 1) { r3 = r2; x = r3; } else x = 1; assert r2 == 0; int x = y = 0; However, in a JVM, after redundant read elimination r2 = y; x = 1; r2 = y; If (r2 == 1) x = r2; else x = 1; Assertion failure possible!

38. Behaviors Allowed by Memory Models and JVMs 38 DRF0 Memory Model Java Memory Model Typical JVMs

39. Behaviors Allowed by Memory Models and JVMs 39 DRF0 Memory Model Java Memory Model Typical JVMs Unsatisfactory, impractical to enforce

40. Exposing Behaviors of Example #3 40 T1T2 int x = y = 0; Consider future value r1 = x; y = r1; r2 = y; if (r2 == 1) { r3 = y; x = r3; } else x = 1; assert r2 == 0;

41. Exposing Behaviors of Example #3 41 r1 = x; // r1 = 1 y = r1; // y = 1 T1T2 r2 = y; // r2 = 1 if (r2 == 1) { r3 = y; // r3 = 1 x = r3; // x = 1 } else x = 1; assert r2 == 0; int x = y = 0; Consider future value

42. Exposing Behaviors of Example #3 42 r1 = x; // r1 = 1 y = r1; // y = 1 T1T2 r2 = y; // r2 = 1 if (r2 == 1) { r3 = y; // r3 = 1 x = r3; // x = 1 } else x = 1; assert r2 == 0; int x = y = 0; Consider future value r1 = 1 justified! Assertion failure!

43. Exposing Behaviors of Example #3 43 r1 = x; y = r1; T1T2 r2 = y; if (r2 == 1) { r3 = y; x = r3; } else x = 1; assert r2 == 0; int x = y = 0; Requires returning future value or compiler optimization and reordering to trigger the assertion failure

44. Exposing Behaviors with Dynamic Analyses Typical approaches Simulate weak memory models behaviors [1,2,3] Explore multiple thread interleavings [4, 5] 44 1.Adversarial Memory, Flanagan & Freund, PLDI’09 2.Relaxer, Burnim et al, ISSTA’11 3.Portend+, Kasikci et al, TOPLAS’15 4.Replay Analysis, Narayanasamy et al, PLDI’07 5.RaceFuzzer, Sen, PLDI’08

45. Exposing Behaviors with Dynamic Analyses Typical approaches Simulate weak memory models behaviors [1,2,3] Explore multiple thread interleavings [4, 5] Coverage Limitation Return stale values only, not future values Cannot expose assertion failures in Examples #2, #3 45 1.Adversarial Memory, Flanagan & Freund, PLDI’09 2.Relaxer, Burnim et al, ISSTA’11 3.Portend+, Kasikci et al, TOPLAS’15 4.Replay Analysis, Narayanasamy et al, PLDI’07 5.RaceFuzzer, Sen, PLDI’08

46. Relationship among memory models and exposed behaviors 46 DRF0 Memory Model Java Memory Model Existing Dynamic Analyses Typical JVMs

47. Relationship among memory models and exposed behaviors 47 DRF0 Memory Model Our Goal Java Memory Model Existing Dynamic Analyses Typical JVMs

48. Relationship among memory models and exposed behaviors 48 DRF0 Memory Model Our Goal Java Memory Model Existing Dynamic Analyses Typical JVMs Example #1 data = new Foo(); if (flag) flag = true; data.bar(); Example #2 r = data; while (flag == 0) {} flag = 1; data = 1; Example #3 r1 = x; r2 = y; y = r1; if (r2 == 1) { r3 = y; x = r3; } else x = 1;

49. Relationship among memory models and exposed behaviors 49 DRF0 Memory Model Our Goal Java Memory Model Existing Dynamic Analyses Typical JVMs Example #1 data = new Foo(); if (flag) flag = true; data.bar(); Example #2 r = data; while (flag == 0) {} flag = 1; data = 1; Example #3 r1 = x; r2 = y; y = r1; if (r2 == 1) { r3 = y; x = r3; } else x = 1; Real-world evidence is valuable here!

50. Outline Memory Models and Behaviors of Data Races Design Prescient Memory (PM) PM-profiler PM Workflow Evaluation 50

51. Prescient Memory: Key Idea Speculatively “guess” a future value at a load Validate the speculative value at a later store 51

52. Prescient Memory: Key Idea Speculatively “guess” a future value at a load Validate the speculative value at a later store 52

53. Returning Future Values is Tricky 53 r1 = x; y = r1; T1T2 r2 = y; if (r2 == 0) x = 1; assert r1 == 0 || r2 == 0; int x = y = 0;

54. Returning Future Values is Tricky 54 r1 = x; y = r1; T1T2 assert r1 == 0 || r2 == 0; int x = y = 0; r2 = y; if (r2 == 0) x = 1;

55. Returning Future Values is Tricky 55 T1T2 int x = y = 0; r1 = x; // r1 = 1 y = r1; // y = 1 assert r1 == 0 || r2 == 0; r2 = y; // r2 = 1 if (r2 == 0) x = 1;

56. Returning Future Values is Tricky 56 T1T2 int x = y = 0; r1 = x; // r1 = 1 y = r1; // y = 1 assert r1 == 0 || r2 == 0; r2 = y; // r2 = 1 if (r2 == 0) x = 1; r1 = 1 not justified

57. Returning Future Values is Tricky 57 T1T2 int x = y = 0; r1 = x; // r1 = 1 y = r1; // y = 1 assert r1 == 0 || r2 == 0; r2 = y; // r2 = 1 if (r2 == 0) x = 1; r1 = 1 not justified Invalid execution!

58. Returning Future Values is Tricky 58 T1T2 int x = y = 0; r1 = x; y = r1; assert r1 == 0 || r2 == 0; r2 = y; if (r2 == 0) x = 1; Should never fail!

59. Returning Future Values is Tricky 59 r1 = x; y = r1; T1T2 r2 = y; if (r2 == 0) x = 1; assert r1 == 0 || r2 == 0; int x = y = 0; Validating speculative values is necessary to prevent nonsensical results

60. Prescient Memory: Key Idea Speculatively “guess” a future value at a load Validate the speculative value at a later store 60

61. Prescient Memory: Key Idea Speculatively “guess” a future value at a load Validate the speculative value at a later store 61 Valid future value Store writes the same value Store races with load

62. Prescient Memory: Key Idea Speculatively “guess” a future value at a load Maintain a per-variable speculative read history Records Validate the speculative value at a later store 62 Valid future value Store writes the same value Store races with load

63. PM Example 63 1: r = x; 2: y = 1; T1T2 int x = y = 0; 3: while (y == 0) {} 4: x = 1; assert r == 0; S[x] = ∅ Timestamp: K 1 Timestamp: K 2

64. PM Example 64 1: r = x; 2: y = 1; T1T2 int x = y = 0; 3: while (y == 0) {} 4: x = 1; 1 ⇠ predict(…) // guess value 1 S[x] = { } S[x] = ∅ assert r == 0; Timestamp: K 1 Timestamp: K 2

65. PM Example 65 1: r = x; 2: y = 1; T1T2 int x = y = 0; 3: while (y == 0) {} 4: x = 1; S[x] = ∅ validate S[x]: K 1 ⋢ K 2 && 1 == 1 1 is a valid future value! assert r == 0; Timestamp: K 1 Timestamp: K 2 1 ⇠ predict(…) // guess value 1 S[x] = { }

66. Challenges How to guess a future value? 66 predict(…) ?

67. Challenges How to guess a future value? Which load should return a future value? What value should be returned? 67

68. Challenges How to guess a future value? Which load should return a future value? What value should be returned? Solution Profile possible future values in a prior run 68

69. Profiling Future Values Helper Dynamic Analysis: PM-profiler Maintains a per-variable concrete read history At a load, records: 69

70. Profiling Future Values Helper Dynamic Analysis: PM-profiler At a store, detects: 70 Potential future value for a previous load Store races with the previous load Store writes a value distinct from visible values of the previous load

71. Prescient Memory Workflow 71 Data race detector PM-ProfilerPM Racy accesses Potential future values and loads First Execution Second Execution

72. Prescient Memory Workflow 72 Data race detector PM-ProfilerPM Racy accesses Potential future values and loads First Execution Second Execution Run-to-run nondeterminism affects validatable future values

73. Prescient Memory Workflow 73 Data race detector PM-ProfilerPM Racy accesses Potential future values and loads First Execution Second Execution Run-to-run nondeterminism affects validatable future values Solution: record and replay

74. Prescient Memory Workflow 74 Data race detector PM-ProfilerPM Fuzzy ReplayRecord Racy accesses Potential future values and loads

75. Prescient Memory Workflow 75 Data race detector PM-ProfilerPM Fuzzy ReplayRecord Racy accesses Potential future values and loads Returning a future value could diverge from the record execution Best-effort, fuzzy replay

76. Outline Memory Models and Behaviors of Data Races Design Prescient Memory (PM) PM-profiler PM Workflow Evaluation 76

77. Methodology and Implementation ◦Compare with Adversarial Memory (AM) [Flanagan & Freund, PLDI’09]: a dynamic analysis that only uses stale values 77

78. Methodology and Implementation ◦Compare with Adversarial Memory (AM) [Flanagan & Freund, PLDI’09]: a dynamic analysis that only uses stale values ◦Platform Jikes RVM 3.1.3 DaCapo Benchmark 2006, 2009 and SPEC JBB 2000 & 2005 4-Core Intel Core i5-2500 Record and Replay [Replay, Bond et al. PPPJ’15] 78

79. Methodology and Implementation ◦Compare with Adversarial Memory (AM) [Flanagan & Freund, PLDI’09]: a dynamic analysis that only uses stale values ◦Platform Jikes RVM 3.1.3 DaCapo Benchmark 2006, 2009 and SPEC JBB 2000 & 2005 4-Core Intel Core i5-2500 Record and Replay [Replay, Bond et al. PPPJ’15] ◦Implementation limitation Does not support reference-type fields 79

80. Exposed Erroneous Behaviors ProgramAMPM hsqldbNon-terminationData corruption hsqldbNonePerformance bug avroraData corruption lusearch (GNU Classpath)Performance bugNone sunflowNull ptr exception jbb2000Non-terminationData corruption jbb2000Data corruption jbb2005 (GNU Classpath)Data corruption jbb2005 (GNU Classpath)Data corruptionNone 80

81. Exposed Erroneous Behaviors 81 PM found 3 new erroneous behaviors! ProgramAMPM hsqldbNon-terminationData corruption hsqldbNonePerformance bug avroraData corruption lusearch (GNU Classpath)Performance bugNone sunflowNull ptr exception jbb2000Non-terminationData corruption jbb2000Data corruption jbb2005 (GNU Classpath)Data corruption jbb2005 (GNU Classpath)Data corruptionNone

82. Exposed Erroneous Behaviors 82 PM exposes most bugs that AM found. ProgramAMPM hsqldbNon-terminationData corruption hsqldbNonePerformance bug avroraData corruption lusearch (GNU Classpath)Performance bugNone sunflowNull ptr exception jbb2000Non-terminationData corruption jbb2000Data corruption jbb2005 (GNU Classpath)Data corruption jbb2005 (GNU Classpath)Data corruptionNone  

83. Exposed Erroneous Behaviors 83 Paper contains detailed analysis of each bug. ProgramAMPM hsqldbNon-terminationData corruption hsqldbNonePerformance bug avroraData corruption lusearch (GNU Classpath)Performance bugNone sunflowNull ptr exception jbb2000Non-terminationData corruption jbb2000Data corruption jbb2005 (GNU Classpath)Data corruption jbb2005 (GNU Classpath)Data corruptionNone

84. Conclusion First dynamic analysis to expose legal behaviors due to future values in large, real programs Successfully found new harmful behaviors due to future values in real programs Reaffirms that “benign” races are harmful Helps future revisions to language specifications by finding evidence of controversial behaviors in real programs 84

85. Backup slides 85

86. Data Races are Evil 86 Challenging to reason about correctness, unsafe software. Lacks semantic guarantees Atomicity violation, sequential consistency violation, nondeterminism. Leads to other concurrency errors Hard to avoid, detect, reproduce or eliminate Widespread

87. DRF0 Memory Model – Adve and Hill, ISCA, 1990 87 Racy execution No semantics Data-race-free execution Strong semantics Execution is sequentially consistent (SC)

88. Java Memory Model (JMM) Based on DRF0 Need to ensure memory and type safety 88 Racy execution Weak semantics Racy execution can still lead to surprising behaviors Unsatisfactory, impractical to enforce JVMs do not strictly conform to JMM

89. Relationship among memory models and exposed behaviors 89 DRF0 Memory Model Happens-Before Memory Model Our Goal Java Memory Model Existing Dynamic Analyses Typical JVMs

90. Relationship among memory models and exposed behaviors 90 DRF0 Memory Model Our Goal Java Memory Model Existing Dynamic Analyses Typical JVMs Out-of-thin-air results?

91. Example #5: Out-Of-Thin- Air Result 91 r1 = x; y = r1; T1 T2 r2 = y; x = r2 assert r1 != 42; int x = y = 0; Assertion can fail in DRF0!

92. Contrived Transformation 92 r1 = 42; y = r1; r3 = x; if (r3 != r1) y = r3; T1T2 r2 = y; x = r2 assert r1 != 42; int x = y = 0; r1 = x; y = r1; T1

93. Contrived Transformation 93 r1 = 42; y = r1; r3 = x; if (r3 != r1) y = r3; T1T2 r2 = y; x = r2 assert r1 != 42; int x = y = 0; r1 = x; y = r1; T1 Assertion can fail in DRF0!

94. Example #6: Out-of-thin-air results for a DRF program 94 r1 = x; if (r1 == 1) y = 1; T1 T2 r2 = y; if (r2 == 1) x = 1; assert r1 == 0 && r2 == 0; int x = y = 0; Cannot fail in DRF0 or JMM.

95. Example #7 95 r1 = z; if (r1 == 1) x = 1; T1 T2 r2 = x; if (r2 == 1) y = 1; else z = 1; assert r3 == 0; int x = y = z = 0; T3 r3 = y; if (r3 == 1) x = 1;

96. Example #7 96 r1 = z; if (r1 == 1) x = 1; T1 T2 r2 = x; if (r2 == 1) y = 1; else z = 1; assert r3 == 0; int x = y = z = 0; T3 r3 = y; if (r3 == 1) x = 1;

97. Example #7 97 r1 = z; // r1 = 0 if (r1 == 1) x = 1; T1 T2 r2 = x; // r2 = 1 if (r2 == 1) y = 1; else z = 1; assert r3 == 0; int x = y = z = 0; T3 r3 = y; // r3 = 1 if (r3 == 1) x = 1; // justifies r2 = 1

98. Model checkers Typical approaches Explore all behaviors allowed in the memory model Target routines for concurrent data structures Could expose behaviors due to future values Example: CDSChecker Coverage Limitation Do not scale to large, real programs 98

99. PM-profiler Example 99 1: r = x; 2: y = 1; T1T2 int x = y = 0; 3: while (y == 0) {} 4: x = 1; assert r == 0; RH[x] = ∅, RH[y] = ∅ Timestamp: K 1 Timestamp: K 2

100. PM-profiler Example 100 1: r = x; 2: y = 1; T1T2 int x = y = 0; 3: while (y == 0) {} 4: x = 1; assert r == 0; RH[x] = { } RH[x] = ∅, RH[y] = ∅ Timestamp: K 1 Timestamp: K 2

101. PM-profiler Example 101 1: r = x; 2: y = 1; T1T2 int x = y = 0; 3: while (y == 0) {} 4: x = 1; assert r == 0; RH[x] = { } RH[x] = ∅, RH[y] = ∅ check RH[y]: Timestamp: K 1 Timestamp: K 2 no previous load!

102. PM-profiler Example 102 1: r = x; 2: y = 1; T1T2 int x = y = 0; 3: while (y == 0) {} 4: x = 1; RH[x] = ∅, RH[y] = ∅ RH[y] = { } assert r == 0; Timestamp: K 1 Timestamp: K 2 RH[x] = { }

103. PM-profiler Example 103 1: r = x; 2: y = 1; T1T2 int x = y = 0; 3: while (y == 0) {} 4: x = 1; RH[x] = { } RH[x] = ∅, RH[y] = ∅ RH[y] = { } check RH[x]: K 1 ⋢ K 2 && 1 ∉ {0} 1 is a potential future value for load at 1@T1! assert r == 0; Timestamp: K 1 Timestamp: K 2