Dynamic Race Prediction in Linear Time

TL;DR

This paper introduces a new relation called weak-causally-precedes (WCP) that improves race detection in concurrent software by detecting more races efficiently in linear time across entire executions.

Contribution

The paper proposes WCP, a relation that is more effective than previous methods like HB and CP, with a linear time algorithm applicable to complete executions.

Findings

WCP detects more data races than CP and HB.

WCP algorithm runs in linear time.

WCP works on entire execution traces without fragmentation.

Abstract

Writing reliable concurrent software remains a huge challenge for today's programmers. Programmers rarely reason about their code by explicitly considering different possible inter-leavings of its execution. We consider the problem of detecting data races from individual executions in a sound manner. The classical approach to solving this problem has been to use Lamport's happens-before (HB) relation. Until now HB remains the only approach that runs in linear time. Previous efforts in improving over HB such as causally-precedes (CP) and maximal causal models fall short due to the fact that they are not implementable efficiently and hence have to compromise on their race detecting ability by limiting their techniques to bounded sized fragments of the execution. We present a new relation weak-causally-precedes (WCP) that is provably better than CP in terms of being able to detect more races, while still remaining sound. Moreover it admits a linear time algorithm which works on the entire execution without having to fragment it.

Full text

{CCSXML}

<ccs2012> <concept> <concept_id>10011007.10011074.10011099.10011102.10011103</concept_id> <concept_desc>Software and its engineering Software testing and debugging</concept_desc> <concept_significance>500</concept_significance> </concept> <concept> <concept_id>10011007.10011074.10011099.10011692</concept_id> <concept_desc>Software and its engineering Formal software verification</concept_desc> <concept_significance>300</concept_significance> </concept> </ccs2012>

\ccsdesc

[500]Software and its engineering Software testing and debugging \ccsdesc[300]Software and its engineering Formal software verification

1 Introduction

Writing reliable concurrent program remains a huge challenge; depending on the order in which threads are scheduled, there are a large number of possible executions. Many of these executions remain unexplored despite extensive testing. The most common symptom of a programming error in multi-threaded programs is a data race. A data race is a pair of conflicting memory accesses such that in some execution of the program, these memory accesses are performed consecutively; here, by conflicting memory accesses, we mean, pair of read/write events to the same memory location performed by different threads, such that at least one of them is a write. The goal of dynamic race detectors is to discover the presence of a data race in a program by examining a single execution. Given its singular role in debugging multi-threaded programs, dynamic race detection has received robust attention from the research community since the seminal papers Lamport [1978]; Savage et al. [1997] more than two decades ago.

All dynamic race detection algorithms can be broadly classified into three categories. First are the lock-set based approaches Savage et al. [1997]; Elmas et al. [2007] that detect potential data races by tracking the set of locks held during each data access. These methods are fast and have low overhead, but are unsound in that many potential races reported are spurious. The second class of techniques falls in the category of predictive runtime analysis techniques Huang et al. [2014]; Said et al. [2011]. Here the race detector explores all possible reorderings of the given trace, searching for a possible witness that demonstrates a data race. These techniques are precise — races detected are indeed data races, and they are likely to find all such races. The downside is that they are expensive. A single trace has potentially exponentially many reorderings. Therefore, these techniques are applied by slicing the trace in small-sized fragments, and searching for a race in these short fragments. The last class of techniques are what we call partial order based techniques. In these, one identifies a partial order $P$ on the events in the trace such that events unordered by $P$ correspond to “concurrent events”. These algorithms are sound (presence of unordered conflicting events indicates a data race) and have low overhead (typically polynomial in the size of the trace). However, they are conservative and may miss anomalies detected by the predictive runtime analysis techniques. The approach presented in this paper falls in this last category.

Happens-before (HB) Lamport [1978] is the simplest, and most commonly used partial order to detect races. It orders the events in a trace as follows: (i) two events performed by the same thread are ordered the way they appear in the trace, and (ii) synchronization events across threads are also HB-ordered in order of appearance in the trace if those events access the same synchronization objects. Rule (i) says that we cannot reorder events within a thread because we have no information about the underlying program which allows us to infer an alternate execution of the thread. Rule (ii) says that we cannot reorder synchronization events on the same objects (in our case locks) as they would lead to violation of mutual exclusion (critical sections on same lock should not overlap—also referred to as lock semantics). Consider for example the trace shown in Figure 1a. (In all the example figures we follow the convention of representing events of the trace top-to-bottom, where temporally earlier events appear above the later ones. We also use the syntax of ${\mathtt{acq(l)}}/{\mathtt{rel(l)}}$ for acquire/release events of lock $\tt{l}$ and r(x)/w(x) for read/write events on variable $\tt{x}$.) The events on lines 4 and 5 cannot be interchanged temporally as mutual exclusion will be violated. We could consider circumventing this lock semantics violation by reordering the entire critical sections (which would also change relative positions of events on lines 4, 5), but we cannot infer such a move because the r(x) event of thread $t_{2}$ could see a different value which could cause alternative executions in the underlying program and hence the events following it might be different. So in this case the HB reasoning, of avoiding lock semantics violation correctly, though unwittingly, prevented the swapping of critical sections (the swapping does not violate lock semantics). Had the two w(x) events been absent, we could have actually swapped the two critical sections temporally to get a feasible alternate execution. For example, the trace in Figure 1b can be reordered to expose a race on the access of $\tt{y}$ by performing the critical section of $t_{2}$ before the other. Such a race is called predictable as the trace that exposes it can be obtained from the given trace by rearranging the temporal order of events across threads. That is, it can be predicted from the trace without having to look at the underlying program. For Figure 1b, HB will still not declare a race since events on lines 4 and 5 would be ordered.

The partial order Causally-Precedes (CP) Smaragdakis et al. [2012] was introduced to detect races missed by HB such as those in Figure 1b while being sound. The CP relation is a subset of HB, which implies that CP can detect races above and beyond those detected by HB. Soundness of CP guarantees that a CP race is either an actual race or a deadlock. But there are two main drawbacks of CP. Firstly CP misses races that are predictable. Consider the traces shown in Figure 2; the only difference between the two traces is that lines 6 and 7 have been swapped. There is no predictable race in Figure 2a because r(x) in $t_{2}$ (line 6) must be performed after w(x) in $t_{1}$ (line 3), which prevents the critical sections from being reordered. On the other hand, Figure 2b has a predictable race on $\tt{y}$ — the sequence $e_{5},e_{6},e_{1}$ reveals the race ($e_{i}$ refers to the event at line $i$). CP, however, does not detect a race in either trace, because it is agnostic to the ordering of events within a critical section. The second drawback of CP is that, while it can be detected in polynomial time Smaragdakis et al. [2012], there is no known linear time algorithm 111We believe that there is quadratic time lower bound on any CP algorithm.. This severely hampers its use on real-world examples with traces several gigabytes large. So any implementation of CP must resort to windowing where the trace is partitioned into small fragments. This means that it can only find races within bounded fragments of the trace, and so detects fewer races than what CP promises. Our experiments (Section 4) reveal windowing to be a serious impediment to race detection in large examples. A recent implementation of CP Roemer and D. [2016] performs an online analysis while avoiding windowing, even though, theoretically, its running time is not linear. Currently, it seems slower than our implementation of WCP, as it processes roughly a few million events in a few hours.

We address the two drawbacks of CP in one shot. We propose a partial order Weak Causally-Precedes (WCP) which, as the name suggests, is a weakening of the CP partial order. Thus WCP detects all races that CP does and even more (like the race in Figure 2b as explained in Section 2.3). We prove that WCP enjoys the same soundness guarantees as CP. Additionally, like HB, WCP admits a linear time Vector-Clock algorithm for race detection, thus solving the main open problem proposed in Smaragdakis et al. [2012]. This is surprising because when HB was weakened to obtain CP it resulted in detecting more races but came at the cost of an expensive algorithm. But weakening CP to WCP not only allows for detecting more races but enables an efficient algorithm.

Our key contributions are the following:

We define a new sound relation weak-causally-precedes (WCP), which is weaker than causally-precedes. The definition and its soundness proof, as claimed in Smaragdakis et al. [2012], is challenging.

“It is worth emphasizing that multiple researchers have fruitlessly pursued such a weakening of HB in the past. …(Both the definition of CP and our proof of soundness are results of multi-year collaborative work, with several intermediate failed attempts.)”

Even though we had the benefit of following the work on CP, our experience concurs with the above observation. The subtlety in these ideas is highlighted by the fact that the soundness proof for CP, presented in Smaragdakis et al. [2012], is incorrect; informed readers can find an explanation of the errors in the CP soundness proof in Appendix B. Our attempts at fixing the CP proof led us to multiple years of fruitless labor until finally the results presented here. Our soundness proof for WCP (which also, by definition, applies to CP) requires significant extensions to the proof ideas outlined in Smaragdakis et al. [2012] (see Appendix A for the full proof). 2. 2.

We achieve the holy grail for dynamic race detection algorithms — a linear running time. It is based on searching for conflicting events that are unordered by WCP. We prove that our algorithm is correct. Our algorithm uses linear space in the worst case, as opposed to the logarithmic space requirement of happens-before vector clock algorithm. However, in our experiments, we did not encounter these worst case bounds. Our algorithm scales to traces with hundreds of millions of events and the memory usage stays below $3\%$ for most benchmarks (see Table 1). We further show that our algorithm is optimal in terms of its asymptotic running time and memory usage. 3. 3.

Our experiments show the benefits of our algorithm, in terms of the number of races detected and its efficiency when compared to state of the art tools such as $\mathsf{RVPredict}$. They reveal the tremendous power of being able to analyze the entire trace as opposed to trace fragments that other sound race detection algorithms (other than those based on HB) are forced to be restricted to.

In Section 2 we describe the partial order WCP, and how it is a weakening of the CP relation. Section 3 describes the Vector-Clock algorithm that implements WCP faithfully and runs in linear time. In Section 4 we describe the implementation and the experimental results. We provide related work in Section 5 and give concluding remarks in Section 6.

2 Weak Causal Precedence

2.1 Preliminaries

In this paper we consider the sequential consistency model for assigning semantics to concurrent programs wherein the execution is viewed as an interleaving of operations performed by individual threads. The possible operations include lock acquire and release (${\mathtt{acq(l)}}$, ${\mathtt{rel(l)}}$) and variable access which include read and write to variables (r(x), w(x)).

Orderings:

Let $\sigma$ be a sequence of events. We say $e_{1}$ is earlier than $e_{2}$ according to $\sigma$, denoted by $e_{1}<_{\textit{tr}}^{\sigma}e_{2}$, when $e_{1}$ is performed before $e_{2}$ in the trace $\sigma$. We shall use $t(e)$ to denote the thread that performs $e$. We say $e_{1}$ is thread ordered before $e_{2}$, denoted by $e_{1}<_{\textit{TO}}^{\sigma}e_{2}$ to mean that $e_{1}<_{\textit{tr}}^{\sigma}e_{2}$ and $t(e_{1})=t(e_{2})$. We use $=^{\sigma}$ to denote the identity relation on events of $\sigma$ and $\leq_{\textit{tr}}^{\sigma},\leq_{\textit{TO}}^{\sigma}$ to denote the relations $(<_{\textit{tr}}^{\sigma}\cup=^{\sigma})$ and $(<_{\textit{TO}}^{\sigma}\cup=^{\sigma})$. We shall drop $\sigma$ from the superscript of the relations when it is clear from context. We use $\sigma\!\upharpoonright_{t}$ to denote the projection of $\sigma$ onto the events by thread $t$.

Lock events:

For a lock acquire/release event $e$, we use $l(e)$ to denote the lock on which it is operating. For an acquire event $a$ we use $\textit{match}(a)$ to denote the earliest release event $r$ such that $l(a)=l(r)$ and $a<_{\textit{TO}}r$. We similarly define the match of a release event $r$ to be the latest acquire $a$ such that $l(a)=l(r)$ and $a<_{\textit{TO}}r$. A critical section is the set of events of a thread that are between (and including) an acquire and its matching release, or if the matching release is absent then all events that are thread order after an acquire. We use $\textup{CS}(e)$ to denote a critical section starting/ending at an acquire/release event $e$. For event $e$ and lock $\ell$ we use $e{\in}\ell$ to denote that $e$ is contained in a critical section over $\ell$.

Trace:

For a sequence of events $\sigma$ to be called a trace it needs to satisfy two properties:

lock semantics: for any two acquisition events $a_{1}$ and $a_{2}$ if $l(a_{1})=l(a_{2})$ and $a_{1}<_{\textit{tr}}a_{2}$ then $r_{1}=\textit{match}(a_{1})$ exists in $\sigma$ and $r_{1}<_{\textit{tr}}a_{2}$ 2. 2.

well nestedness: for any critical section $C$, if there exists an acquire event $a$ such that $a\in C$, then $r=\textit{match}(a)$ exists and $r\in C$.

Race:

Two events are said to be conflicting if they access the same variable and at least one of them is a write and the events are performed by different threads. We use $e_{1}\asymp e_{2}$ to denote that $e_{1}$ and $e_{2}$ are conflicting. When one can execute a concurrent program such that conflicting events can be performed next to each other in the trace, we say that the trace has revealed a race in the program.

Deadlock:

When a program is being executed to obtain a trace, the scheduler picks a thread and performs the “next event” in that thread. Note that when this event is performed the next event of the other threads is not going to be affected. This concept of next event is needed for understanding a deadlock. A trace is said to reveal a deadlock when a set of threads $D$ cannot proceed because each of them is trying to acquire a lock that is held by another thread in that set. In other words, the next event in each thread in $D$ is an ${\mathtt{acq(l)}}$ such that the lock $\tt{l}$ is acquired by another thread in $D$ without having released it. In such a situation none of the threads in $D$ can proceed because lock semantics will be violated, and no matter how the rest of the threads proceed the next event of these threads will not change.

Predictability and Correct Reordering:

In order to formalize the concept of predictable race/deadlock we need the notion of correct reordering. A trace $\sigma^{\prime}$ is said to be a correct reordering of another trace $\sigma$ if for every thread $t$, $\sigma^{\prime}\!\upharpoonright_{t}$ is a prefix of $\sigma\!\upharpoonright_{t}$, and the last w(x) event before any r(x) event is the same in both $\sigma$ and $\sigma^{\prime}$. This ensures that every read event in $\sigma^{\prime}$ sees/returns the same value as it did in $\sigma$. We say a trace $\sigma$ has a predictable race (predictable deadlock) if there is a correct reordering of it which exhibits a race (deadlock).

2.2 Partial Orders

Given a trace $\sigma$, we consider various partial orders on its events. Formally, let $\mathcal{E}$ be the set of events in $\sigma$. A partial order $P$ is a binary relation $\leq_{P}^{\sigma}$ on $\mathcal{E}$ (i.e. $\leq_{P}^{\sigma}\subseteq\mathcal{E}{\times}\mathcal{E}$) which is reflexive, antisymmetric and transitive. The relations $\leq_{\textit{tr}}^{\sigma},\leq_{\textit{TO}}^{\sigma}$ defined earlier are examples of partial orders. We say two events $e_{1},e_{2}$ are unordered by a partial order $P$, denoted by $e_{1}\parallel_{P}e_{2}$, when neither $e_{1}\leq_{P}^{\sigma}e_{2}$, nor $e_{2}\leq_{P}^{\sigma}e_{1}$.

We say a trace $\sigma$ exhibits a $P$-race between events $e_{1},e_{2}$ when they are conflicting ($e_{1}\asymp e_{2}$) and are unordered by $P$ ($e_{1}\parallel_{P}e_{2}$). The aim, in this race-detection paradigm of using partial orders, is to design partial orders $P$ which can guarantee that for any $\sigma$, the presence of $P$-race in $\sigma$ implies the presence of a predictable-race in $\sigma$. Such partial orders are said to be strongly sound. A partial order is said to be weakly sound if for any trace containing unordered conflicting events there is a correct reordering of the trace which reveals either a race or a deadlock. From a programmer’s perspective deadlocks are as undesirable as races. Additionally, a weaker notion might allow for detection of additional races that are otherwise harder to detect. For programs which are guaranteed to be deadlock-free, the two notions coincide.

Before we delve into specific partial orders, we present some intuition regarding partial orders and alternative executions. Linearizations of a partial order $\leq_{P}^{\sigma}$ are possible executions of the trace with different interleavings of the threads. If two events are unordered by some partial order, then we can obtain a linearization in which the two events are placed next to one another (performed simultaneously). But this by itself does not imply soundness. This is because a linearization $\rho$ of $\leq_{P}^{\sigma}$ (i) might not be a valid trace as it might violate lock semantics, or (ii) might not be a correct reordering of $\sigma$ as there might be a read event r(x) whose corresponding last w(x) event in $\rho$ does not match with that in $\sigma$. Therefore, two conflicting events unordered by a partial order only indicates the possibility of, and does not necessarily guarantee the existence of a predictable race. The cleverness lies in designing partial orders for which this possibility is indeed a guarantee.

We will now describe partial orders HB, CP (from literature) and WCP (our contribution).

Definition 1** (Happens-Before).**

*Given a trace $\sigma$, $\leq_{\textit{HB}}^{\sigma}$ is the smallest partial order on the events in $\sigma$ with $<_{\textit{TO}}^{\sigma}\subseteq\leq_{\textit{HB}}^{\sigma}$ that satisfies the following rule: for a ${\mathtt{rel(l)}}$ event $r$ and an ${\mathtt{acq(l)}}$ event $a$, if $r<_{\textit{tr}}^{\sigma}a$, then $r\leq_{\textit{HB}}^{\sigma}a$. *

Two salient features of HB are: (i) it is strongly sound, and (ii) it can be computed in linear time. Several race detection tools Pozniansky and Schuster [2003]; Flanagan and Freund [2009] have been developed using this technique. However, as discussed in Section 1, HB can miss many races. The Causally-Precedes (CP) partial order was then introduced Smaragdakis et al. [2012] as an improvement over HB. CP is a subset of HB i.e it has fewer orderings and hence more possible interleavings. It is thus able to detect more races than HB. CP is proved to be weakly sound. However, it is not known if CP can be computed in linear time. The race detection algorithm for CP is polynomial time but not linear.

Definition 2** (Causally-Precedes).**

Given a trace $\sigma$, $\prec_{\textit{CP}}^{\sigma}$ is the smallest relation satisfying the following rules:

1. (a)

for a ${\mathtt{rel(l)}}$ event $r$ and an ${\mathtt{acq(l)}}$ event $a$ with $r<_{\textit{tr}}^{\sigma}a$, if the critical sections of $r$ and $a$ contain conflicting events $(e_{1}\in\textup{CS}(r)$, $e_{2}\in\textup{CS}(a)$, $e_{1}\asymp e_{2})$, then $r\prec_{\textit{CP}}^{\sigma}a$. 2. (b)

for a ${\mathtt{rel(l)}}$ event $r$ and an ${\mathtt{acq(l)}}$ event $a$ with $r<_{\textit{tr}}^{\sigma}a$, if the critical sections of $r$ and $a$ contain CP-ordered events $(e_{1}\in\textup{CS}(r),e_{2}\in\textup{CS}(a),e_{1}\prec_{\textit{CP}}^{\sigma}e_{2})$, then $r\prec_{\textit{CP}}^{\sigma}a$. 3. (c)

$\prec_{\textit{CP}}^{\sigma}={(\prec_{\textit{CP}}^{\sigma}\circ\leq_{\textit{HB}}^{\sigma})}={(\leq_{\textit{HB}}^{\sigma}\circ\prec_{\textit{CP}}^{\sigma})}$, i.e., $\prec_{\textit{CP}}^{\sigma}$ is closed under composition with $\leq_{\textit{HB}}$.

As seen in the examples in Figure 2, CP is agnostic to the relative order of the events inside the same critical sections. That is, if we were to consider two read/write events that are enclosed within the same set of critical sections in the trace, and we interchanged their positions, then the resulting trace would have exactly the same CP orderings across threads. This is because Rule (a) of CP, that depends upon the position of read/write events, is only concerned with whether or not it occurs inside some critical section and not how they are relatively order within the critical section. This constraint prevents CP it from detecting races, as we saw in Figure 2b.

Next we look at WCP, the partial order we introduce in this paper. It is obtained by weakening rules (a) and (b) of CP as follows:

Definition 3** (Weak-Causally-Precedes).**

Given a trace $\sigma$, $\prec_{\textit{WCP}}^{\sigma}$ is the smallest relation that satisfies the following rules:

1. (a)

for a ${\mathtt{rel(l)}}$ event $r$ and a read/write event $e\in\mathtt{l}$ with $r<_{\textit{tr}}^{\sigma}e$, if $\textup{CS}(r)$ contains an event conflicting with $e$ $(e^{\prime}\in\textup{CS}(r)$, $e\asymp e^{\prime})$, then $r\prec_{\textit{WCP}}^{\sigma}e$. 2. (b)

for ${\mathtt{rel(l)}}$ events $r_{1},r_{2}$ with $r_{1}<_{\textit{tr}}^{\sigma}r_{2}$, if the critical sections of $r_{1},r_{2}$ contain WCP-ordered events ${(e_{1}\in\textup{CS}(r_{1})}$, ${e_{2}\in\textup{CS}(r_{2})}$, $e_{1}\prec_{\textit{WCP}}^{\sigma}e_{2})$, then ${r_{1}\prec_{\textit{WCP}}^{\sigma}r_{2}}$. 3. (c)

$\prec_{\textit{WCP}}^{\sigma}={(\prec_{\textit{WCP}}^{\sigma}\circ\leq_{\textit{HB}}^{\sigma})}={(\leq_{\textit{HB}}^{\sigma}\circ\prec_{\textit{WCP}}^{\sigma})}$, i.e., $\prec_{\textit{WCP}}^{\sigma}$ is closed under composition with $\leq_{\textit{HB}}^{\sigma}$,

Note that, Rule (a) of WCP orders the release event before the read/write event (and not the acquire as in CP). Thus, WCP makes a distinction between events of the same thread based on the relative order inside a critical section.

Note that $\prec_{\textit{CP}}^{\sigma}$ and $\prec_{\textit{WCP}}^{\sigma}$ are not partial orders as they are not reflexive. And unlike $\leq_{\textit{HB}}^{\sigma}$ they do not contain thread order. But if we consider the relations $\leq_{\textit{CP}}^{\sigma}=(\prec_{\textit{CP}}^{\sigma}\cup\leq_{\textit{TO}}^{\sigma})$ and $\leq_{\textit{WCP}}^{\sigma}=(\prec_{\textit{WCP}}^{\sigma}\cup\leq_{\textit{TO}}^{\sigma})$, then both $\leq_{\textit{CP}}^{\sigma}$ and $\leq_{\textit{WCP}}^{\sigma}$ are partial orders. When defining races we use these partial orders. When clear from the context, we drop $\sigma$ from superscript of the relations. Rules (a) and (b) in WCP are weaker versions of rules (a) and (b) in CP respectively. One can prove inductively that $\leq_{\textit{WCP}}\subseteq\leq_{\textit{CP}}$ hence any CP-race is also a WCP-race. Next we state the soundness theorem for WCP whose proof is provided in the Appendix.

Theorem 1** (Soundness of WCP).**

WCP is weakly sound, i.e., given any trace $\sigma$, if $\sigma$ exhibits a WCP-race then $\sigma$ exhibits a predictable race or a predictable deadlock.

2.3 Illustrations

Going back to the example in Figure 2b let us see how WCP is able to detect a race that CP cannot. Note that the ${\mathtt{rel(l)}}$ in $t_{1}$ is CP-ordered before the ${\mathtt{acq(l)}}$ in $t_{2}$ by rule (a) of CP. Further using rule (c) of CP we obtain that the operations on variable y are CP-ordered and therefore CP does not detect the predictable race as uncovered by the trace $e_{5},e_{1},e_{6}$. WCP on the other hand does not order the ${\mathtt{rel(l)}}$ and ${\mathtt{acq(l)}}$. Rule (a) of WCP only orders the r(x) in $t_{2}$ after the ${\mathtt{rel(l)}}$ of $t_{1}$. If we look at the example to its left in Figure 2a the same reasoning can be used to obtain that CP does not detect any race, and indeed there is no predictable race. In the case of WCP since the r(x) in $t_{2}$ appears above the r(y), it ends up ordering w(y) and r(y) thus not declaring any race either.

The intuitive reason for formulating rule (a) in CP is that “two conflicting events have to occur in the same order in every correctly reordered execution if it is the case that they do not constitute a race. Consequently the critical sections containing them need to be ordered in their entirety” Smaragdakis et al. [2012]. This intuition is correct when we know for sure that the conflicting events do occur in the correctly reordered execution (a correctly reordered execution need not include all the events in the given execution, but only prefixes for each thread). In the example in Figure 2b the two operations on x do not appear in the set of events that need to be scheduled in order to reveal a race, and hence any orderings derived from them need not be considered. But then if the r(x) is indeed included in some (other) reordering then the ${\mathtt{rel(l)}}$ to ${\mathtt{acq(l)}}$ ordering should be respected. Rule (a) of WCP does not enforce this ordering completely, it only makes sure that the later of the conflicting events is ordered after the earlier release. It would seem that this ordering is not sufficient to enforce lock semantics of the traces we would be interested in, but it turns out that this weaker version is sufficient to guarantee soundness.

We also weaken rule (b) in the same spirit as above. When considering critical sections over the same lock containing ordered events, instead of ordering the critical sections entirely (as CP does by ordering ${\mathtt{rel(l)}}$ of the earlier CS and the ${\mathtt{acq(l)}}$ of the latter) WCP only orders the earlier ${\mathtt{rel(l)}}$ before the latter ${\mathtt{rel(l)}}$.

In Figure 3 we show a trace in which there is a predictable race which is not detected by CP but is detected by WCP owing to weakening of rule (b). We use $e_{i}$ to refer to event at line number $i$. Borrowing notation from Smaragdakis et al. [2012], the event ${\mathtt{sync(x)}}$ is a shorthand for ${\mathtt{acq(x)}}$ r(xVar)w(xVar) ${\mathtt{rel(x)}}$, where $\tt{xVar}$ is the unique variable associated with lock $\tt{x}$. Any two sync events over the same lock are ordered by CP/WCP using Rule (a) (for WCP the ordering is from the ${\mathtt{rel(x)}}$ to the latter r(xVar) but for our example this is not important). Now we describe the example in Figure 3 in detail. First note that there is a predictable race between $e_{3}$ and $e_{12}$ as revealed by the correctly reordered trace $e_{1},e_{2},e_{10},e_{11},e_{3},e_{12}$. This race is not detected by CP as the conflicting events $e_{3}$ and $e_{12}$ are CP related as follows: Firstly $e_{2}\prec_{\textit{CP}}e_{5}$. We have $e_{1}\leq_{\textit{HB}}e_{2}$ and $e_{5}\leq_{\textit{HB}}e_{6}$ (thread ordering). Applying Rule (c) of HB/CP composition on $e_{1}\leq_{\textit{HB}}e_{2}\prec_{\textit{CP}}e_{5}\leq_{\textit{HB}}e_{6}$ we get $e_{1}\prec_{\textit{CP}}e_{6}$. Next we apply Rule (b) of CP on the critical sections over lock $\tt{l}$ to get $e_{4}\prec_{\textit{CP}}e_{6}$. We also have $e_{8}\leq_{\textit{HB}}e_{10}$ (critical sections over same lock $\tt{n}$). Applying Rule (c) of CP ($e_{3}<_{\textit{TO}}e_{4}\prec_{\textit{CP}}e_{6}<_{\textit{TO}}e_{8}\leq_{\textit{HB}}e_{10}<_{\textit{TO}}e_{12}$) we obtain $e_{3}\prec_{\textit{CP}}e_{12}$. We see that this line of reasoning fails if you try to prove $e_{3}\prec_{\textit{WCP}}e_{12}$ because $e_{4}$ and $e_{6}$ are not $\prec_{\textit{WCP}}$ related. Rule (b) of WCP would give us that the releases are ordered i.e., $e_{4}\prec_{\textit{WCP}}e_{9}$ but this cannot be composed with HB edges to get a path to $e_{12}$. It turns out $e_{3}$ and $e_{12}$ are not ordered by $\prec_{\textit{WCP}}$, and therefore the race that exists between them is correctly detected by WCP.

We present a more involved example in Figure 4 to once again see how a predictable race is revealed by WCP but not CP. Starting with the two ${\mathtt{sync(x)}}$ events that are CP related we get enclosing critical section on lock $\tt{n}$ to be CP related by Rule (b) i.e., $e_{9}\prec_{\textit{CP}}e_{11}$. We then use $e_{3}\leq_{\textit{HB}}e_{6}$ along with thread orderings and Rule (c) to get $e_{1}\prec_{\textit{CP}}e_{12}$. Applying Rule (b) we obtain $e_{5}\prec_{\textit{CP}}e_{12}$ which then gives $e_{4}\prec_{\textit{CP}}e_{15}$ from Rule (c), hence CP declares that the two conflicting events r(z)/w(z) are not in race. But they are indeed in race as revealed by the correctly reordered trace $e_{6},e_{7},e_{8},e_{9},e_{10},e_{11},e_{12},e_{13},e_{14},e_{1},e_{2},e_{3},e_{4},e_{15}$. Unlike CP, WCP does not order $e_{4}$ and $e_{15}$. This is because WCP does not order $e_{9}$ and $e_{11}$ since the weaker Rule (b) only gives $e_{9}\prec_{\textit{WCP}}e_{14}$ which does not compose with the HB edge on the critical sections over lock $\tt{l}$.

In Figure 5 we show a trace that is only slightly different from the previous example but the subtlety involved results in the absence of a predictable race but presence of a predictable deadlock. The reordered trace $e_{1},e_{6},e_{10}$ exhibits the deadlock. Using identical reasoning as in the previous example we can derive that the two conflicting events r(z)/w(z) are CP ordered and WCP unordered. The proof of correctness of CP shows that it cannot detect deadlocks involving more than 2 threads as in this example. This shows that WCP can detect deadlocks that CP cannot.

3 Vector-Clock Algorithm for WCP

In this section we describe a vector clock algorithm that implements WCP. The algorithm assigns a “timestamp” $C_{e}$ to each event $e$. These timestamps are vector times which can be compared to each other. The key property about the timestamps is that it preserves the WCP relation ($\leq_{\textit{WCP}}$). This means in order to find out if two events are WCP ordered we can simply compare their timestamps. Therefore we also refer to these timestamps as WCP time or simply time.

3.1 Vector Clocks and Times

Let us first recall some basic notions pertaining to vector times. A vector time VT : Tid $\to$ Nat, is a function that maps each thread in a trace to a non-negative integer. It can also be viewed as ${\mathcal{T}}$-tuple, where ${\mathcal{T}}$ is the number of threads in the given trace. Vector times support comparison operation $\sqsubseteq$ for point-wise comparison, join operation ($\sqcup$) for point-wise maximum, and component assignment of the form $V[t:=n]$ which assigns the time $n{\in}$Nat to component $t{\in}$Tid of vector time $V$. Vector time $\bot$ maps all threads to 0.

[TABLE]

Before we describe the algorithm we would like to point out the distinction between clocks and times. Clocks are to be thought of as variables, they are place holders for times which are the values taken up by the clock. The time of a clock will change as the trace is processed. Events will be assigned different kinds of times based on the value of different clocks right after the event is processed. We use double struck font for denoting clocks (e.g., $\mathbb{C},\mathbb{P},\mathbb{H},\mathbb{N}$) and normal font for denoting vector times (e.g., $C,P,H,N$).

3.2 Algorithm

Our algorithm works in a streaming fashion and processes the trace by looking at its events one-by-one from beginning to end. As it handles each event it updates its state. The state captures all the information required to assign a timestamp (a vector time) to the last event of the trace. At each step, an event is processed and the state is updated, which allows us to compute a timestamp of that event from the updated state. For each thread $t$ the state is going to consist of a vector clock $\mathbb{C}_{t}$ (among other things) that reflects the time of the last event in the thread $t$ so far. The timestamp/time of an event $e$ denoted by $C_{e}$ is simply the value of $\mathbb{C}_{t(e)}$ just after having processed $e$. To ensure that the assigned times preserve WCP ordering, the algorithm needs to ensure that the time of an event $a$ is “communicated” to $b$ if there is a WCP edge from $a$ to $b$. Thus, $b$ can be assigned a time $C_{b}$ such that $C_{a}\sqsubseteq C_{b}$. In order to achieve this communication, we refer to auxiliary times $P_{e}$ (WCP-predecessor time) and $H_{e}$ (HB time) associated with every event $e$. Formally $P_{e}=\bigsqcup\{C_{e^{\prime}}\;|\;e^{\prime}\prec_{\textit{WCP}}e\}$ and $H_{e}=\bigsqcup\{C_{e^{\prime}}\;|\;e^{\prime}\leq_{\textit{HB}}e\}$. We use vector clocks $\mathbb{P}_{t}$ and $\mathbb{H}_{t}$ in the state to record times $P_{e}$ and $H_{e}$ of the last events $e$ of thread $t$.

In the following paragraphs we motivate different components of the state, and explain how these components are updated as part of the algorithm. The state update procedure is described in Algorithm 1. It consists of procedures that are prompted depending on the type of event being processed. Each procedure has an argument $t$ denoting the thread that is performing the event. The argument $\ell$ for acquire/release events denotes the lock being operated. The argument $x$ for read/write denotes the variable being accessed in the event. The parameter $L$ for read/write events denotes the set of locks corresponding to the enclosing critical sections of the event. The parameters $R/W$ for the release event correspond to the set of variables that have been read/written inside the critical section corresponding to the release in question. The purpose of these parameters will become clear as we move forward. Next we describe different components of the state along with how these procedures manipulate them.

Local Clock $\mathbb{N}_{t}$ :

With each thread $t$ we associate an integer counter $\mathbb{N}_{t}$ in the state. It represents the local clock of thread $t$. The local time of an event $e$, denoted by $N_{e}$, is the value of $\mathbb{N}_{t}$ after $e$ is processed. For any $t$ the value $\mathbb{C}_{t}(t)$ will always refer to $\mathbb{N}_{t}$.

Local Clock Increment :

The local clock $\mathbb{N}_{t}$ is incremented just before an event of $t$ is processed iff the previous event in $t$ was a release. Since this increment is common to all events, we omit it from the pseudocode.

WCP clocks $\mathbb{P}_{t},\mathbb{P}_{\ell}$ :

With each thread we associate a vector clock $\mathbb{P}_{t}$. The WCP-predecessor time $P_{b}$ of an event $b$ is the value of the clock $\mathbb{P}_{t(b)}$ after $b$ has been processed. As defined earlier, $P_{b}$ represents the “knowledge” that $b$ has about other events with respect to the $\prec_{\textit{WCP}}$ relation. Note that, for any event $a$, if $N_{a}\leq P_{b}(t(a))$ (i.e., $P_{b}$ “knows” $a$), then it is the case that $a\prec_{\textit{WCP}}b$ (Lemma C.8 in Appendix). This invariant is maintained by making sure that whenever $a\prec_{\textit{WCP}}b$ then the WCP-time of $a$, $C_{a}$ (which also has local time of $a$), is made known to $b$ so that it can update $\mathbb{P}_{t(b)}$ appropriately. Sending the entire vector time $C_{a}$ (rather than just $N_{a}$) to $b$ ensures that $P_{b}$ also gets to “know” the events in other threads that transitively precede it via the event $a$.

We also maintain, for each lock $\ell$, a vector clock $\mathbb{P}_{\ell}$ that remembers the WCP-predecessor time $P_{r}$ of the last ${\mathtt{rel(\ell)}}$ event $r$ seen until then (Line 9). $\mathbb{P}_{\ell}$ is needed so that the clock $\mathbb{P}_{t}$ can be maintained correctly. Consider the case when an ${\mathtt{acq(\ell)}}$ event $a$ by thread $t$ is processed. Now, an event $b$ such that $b\prec_{\textit{WCP}}a$ but not $b\prec_{\textit{WCP}}prev(a)$ ($prev$ refers to the previous event in the thread) has to be such that $b\prec_{\textit{WCP}}r$, where $r$ is the last ${\mathtt{rel(\ell)}}$ event before $a$, in some thread other than $t(a)$. This is because WCP edges entering an acquire event from another thread are due to WCP-HB composition (Rule (c) of WCP). Now $C_{b}$ is already known to $P_{r}$ since $b\prec_{\textit{WCP}}r$. So the event $a$ can obtain time of events such as $b$ through clock $\mathbb{P}_{\ell}$. This is achieved on Line 2 of the algorithm.

We shall come back to how $\mathbb{P}_{t}$ is updated on other events (release/read/write) as it deals with other components of the state which are described below. For now, note that $\mathbb{P}_{t}$ corresponds to the relation $\prec_{\textit{WCP}}$ and $\mathbb{C}_{t}$ corresponds to $\leq_{\textit{WCP}}=(\prec_{\textit{WCP}}\cup\leq_{\textit{TO}})$. Therefore $\mathbb{C}_{t}$ is simply obtained by incorporating thread order information obtained from the local clock $\mathbb{N}_{t}$ into $\mathbb{P}_{t}$ as: $\mathbb{C}_{t}=\mathbb{P}_{t}[t:=\mathbb{N}_{t}]$. Since $\mathbb{C}_{t}$ can be derived this way from the components $\mathbb{P}_{t}$ and $\mathbb{N}_{t}$, we choose not to feature how $\mathbb{C}_{t}$ is updated in the algorithm.

HB clocks $\mathbb{H}_{t},\mathbb{H}_{\ell}$ :

For events $a,b$ if $a\prec_{\textit{WCP}}b$, then $P_{b}$ should not only receive $a$’s time $C_{a}$, but also the time $C_{c}$ of every event $c$ such that $c\leq_{\textit{HB}}a$ (Rule (c)). To account for this, we maintain a clock $\mathbb{H}_{t}$ for each thread $t$ in the state. Right after an event $e$ is performed, the clock $\mathbb{H}_{t(e)}$ holds the value of the HB time $H_{e}$, defined earlier. So going back to $a\prec_{\textit{WCP}}b$, instead of passing $C_{a}$ to $P_{b}$, we pass $H_{a}$ so that the times of all events $c$ (including $a$) with $c\leq_{\textit{HB}}a$, is received by $b$. Again, the clock $\mathbb{H}_{t}(t)$ is made to refer to $\mathbb{N}_{t}$ so that we do not have to specify when $\mathbb{H}_{t}(t)$ has to be changed.

We also maintain a vector clock $\mathbb{H}_{\ell}$ for each lock $\ell$ that stores the HB time of the last ${\mathtt{rel(\ell)}}$ event seen till then (Line 9). Consider, once again, the case when an ${\mathtt{acq(\ell)}}$ event $a$ is processed. If there is any event $b$ where $b\leq_{\textit{HB}}a$ but not $b\leq_{\textit{HB}}prev(a)$, then $b\leq_{\textit{HB}}r$ where $r$ is the last ${\mathtt{rel(\ell)}}$ event before $a$. To ensure that $b$’s time $C_{b}$ reaches $a$ we pass $H_{r}$ to $a$ using $\mathbb{H}_{\ell}$. $\mathbb{H}_{\ell}$ contains the time of all events $b$ such that $b\leq_{\textit{HB}}r$. This is achieved in Line 1 of the algorithm.

In order to motivate the remaining components of the state, we look at an example trace in Figure 6. We use the event ${\mathtt{acrl(y)}}$ as a short hand for the events ${\mathtt{acq(y)}}{\mathtt{rel(y)}}$ performed in succession. This way two ${\mathtt{acrl(y)}}$s are HB related. An edge between two events in the trace indicates a WCP order between them that can be deduced using Rules (a) or (b); the other ordering edges are omitted for clarity. As before, we will use $e_{i}$ to denote the event on Line $i$.

Release Times $\mathbb{L}_{\ell,x}^{r},\mathbb{L}_{\ell,x}^{w}$ :

Consider the edge $e_{6}\prec_{\textit{WCP}}e_{17}$ derived from Rule (a). Here $e_{17}$ should receive the HB time of $e_{6}$, and more generally, the HB time of any other ${\mathtt{rel(\ell)}}$ event $r$ on lock $\ell$ enclosing $e_{17}$ ($e_{17}\in\ell$) such that the critical section $\textup{CS}(r)$ contains an event conflicting with $e_{17}$. For this purpose, we maintain, for every lock $\ell$ and variable $x$, a vector clock $\mathbb{L}_{\ell,x}^{r}$ that records the join of the HB times of all ${\mathtt{rel(\ell)}}$ events (seen so far) whose critical sections contain a r$(x)$ event. Similarly, for each lock $\ell$ and variable $x$, $\mathbb{L}_{\ell,x}^{w}$ maintains the join of the HB times of all the ${\mathtt{rel(\ell)}}$ events (seen so far) whose critical sections contain a w$(x)$ event. Lines 7 and 8 of Algorithm 1 maintain these invariants. Hence, when $e_{17}$ is processed it can look up the time of $e_{6}$ using $\mathbb{L}^{w}_{\tt{l_{0}},x}$. This is achieved in Line 11 of the algorithm. Similarly when a w$(x)$ event is encountered within a critical section of lock $\ell$, the times of the relevant releases (those that contain either read or write of $x$) can be accessed using $\mathbb{L}^{r}_{\ell,x},\mathbb{L}^{w}_{\ell,x}$. This is achieved in Line 12 of Algorithm 1.

FIFO Queues $Acq_{\ell}(t),Rel_{\ell}(t)$ :

Consider the WCP edge $e_{10}\prec_{\textit{WCP}}e_{20}$ introduced because of Rule (b) — the critical sections of $e_{10}$ and $e_{20}$ contain WCP ordered events (because $e_{3}<_{\textit{TO}}e_{4}\leq_{\textit{HB}}e_{5}<_{\textit{TO}}e_{6}\prec_{\textit{WCP}}e_{17}<_{\textit{TO}}e_{20}$ giving $e_{3}\prec_{\textit{WCP}}e_{20}$ by Rule (c)). Note that two events in two critical sections are WCP ordered iff the acquire of the first is WCP ordered to the release of the second (this follows from thread order and Rule (c)). When processing $e_{20}$, if we somehow knew that $e_{3}\prec_{\textit{WCP}}e_{20}$ then we would need the HB time of $e_{10}=\textit{match}(e_{3})$ to be communicated to $e_{20}$ because $e_{10}\prec_{\textit{WCP}}e_{20}$ by Rule (b). Therefore the appropriate times of the critical section $e_{3},e_{10}$ (and possibly of other critical sections on the same lock performed before $e_{20}$) need to be stored in the state so they can be used for future reference by events such as $e_{20}$. Note that, once $e_{20}$ receives the time of $e_{10}$, no future critical section over lock m, if any, in thread $t_{2}$ (for example, $e_{24}$ in this case) is required explicitly receive the time of $e_{3}$, because a previous release in the same thread ($e_{20}$) has already received the time of the appropriate release event ($e_{10}$). Thus, as far as $t_{2}$ is concerned, once the critical section $e_{3},e_{10}$ is processed at $e_{20}$, it can be discarded. Therefore, for each lock $\ell$ and thread $t$ (in this case m and $t_{2}$), we need to accumulate, in a queue, appropriates times for critical sections on lock $\ell$, to be later used when a ${\mathtt{rel(\ell)}}$ events of thread $t$ is encountered. With this in mind, we maintain, in the state of our algorithm, two FIFO queues $Acq_{\ell}(t),Rel_{\ell}(t)$ for every lock $\ell$ and every thread $t$. These queues will store the times of ${\mathtt{acq(\ell)}}/{\mathtt{rel(\ell)}}$ events (in chronological order), performed by other threads $t^{\prime}$ ($\neq t$) (Lines 3 & 10). When processing a ${\mathtt{rel(\ell)}}$ event performed by thread $t$, the algorithm looks up the times of the critical section in the front of the queue and removes it from the queue if Rule (b) is applicable, and further, updates its own time (Lines 4-6 in Algorithm 1).

Initialization :

The vector clocks $\mathbb{P}_{t},\mathbb{P}_{\ell},\mathbb{H}_{\ell},\mathbb{L}^{r}_{\ell,x},\mathbb{L}^{w}_{\ell,x}$ for any thread $t$, lock $\ell$ and variable $x$ are initialized to $\bot$. For every thread $t$ , the local clock $\mathbb{N}_{t}$ is initialized to 1 and the vector clock $\mathbb{H}_{t}$ is initialized to $\bot[t:=\mathbb{N}_{t}]$. Each of the queues $Acq_{\ell}(t),Rel_{\ell}(t)$ is empty to begin with.

Next we state the correctness of the algorithm which states the correspondence between the ordering of timestamps assigned to events ($C_{e}$ for event $e$) and the WCP ordering. The proof the theorem is provided in Appendix C.

Theorem 2** (Correctness of Algorithm 1).**

For a trace $\sigma$ and events $a,b$ with $a<_{\textit{tr}}^{\sigma}b$, we have $a\leq_{\textit{WCP}}^{\sigma}b\iff C_{a}\sqsubseteq C_{b}$

Theorem 2 tells us that two events $a$ and $b$ where $a<_{\textit{tr}}b$ are in WCP-race exactly when $C_{a}$ and $C_{b}$ are incomparable. This yields an algorithm for checking all the WCP-races for the trace. For each variable $x$, we maintain vector clocks $\mathbb{R}_{x}$ and $\mathbb{W}_{x}$ that record the join of the $C_{e}$ times of all the read and write events $e$ on the variable $x$ that have been seen for the prefix of the trace that is processed. On encountering a read event $e=\mathtt{r}(x)$, we check if $\mathbb{W}_{x}\sqsubseteq C_{e}$ to confirm that all earlier events conflicting with $e$ are indeed ordered before $e$. If this check fails, then $e$ is in WCP-race with some earlier conflicting write event, and thus we can declare a warning. Similarly for a write event $e=\mathtt{w}(x)$, we check if $\mathbb{R}_{x}\sqcup\mathbb{W}_{x}\sqsubseteq C_{e}$ holds and declare a warning otherwise. Note that our soundness theorem only guarantees that the first race pair is an actual race. But in practice we have observed that subsequent pairs that are in WCP-race also happen to be in race. Note that this methodology only gives us the second component $e_{2}$ of a pair $(e_{1},e_{2})$ of events in race. In order to determine the first part, we would have to go over the trace once more and individually compare the WCP times of the events against those conflicting events appearing later that were flagged to be in race in the initial analysis.

3.3 Linear Running Time

In order to analyze the running time of Algorithm 1, we fix the following parameters for a given trace $\sigma$. Let ${\mathcal{T}}$ be the number of threads, $\mathcal{L}$ be the number of locks used in $\sigma$, and $\mathcal{N}$ be the total number of events in $\sigma$. We state the running time in Theorem 3 and provide the proof in Appendix D. Note that we assume arithmetic operations take constant time.

Theorem 3**.**

Given a trace $\sigma$ with parameters $\mathcal{N},{\mathcal{T}}$ and $\mathcal{L}$ as defined above, the total running time of the WCP vector-clock algorithm over $\sigma$ is proportional to $\mathcal{N}{\cdot}(\mathcal{L}+{\mathcal{T}}^{2})$.

Note that for most applications the parameter ${\mathcal{T}}$ is usually small ($<25$) and parameter $\mathcal{L}$ is at most a few thousand. Typically, the bottleneck for any online race-detection technique is the length of the trace $\mathcal{N}$ which can be of the order of hundreds of millions or even billions ($10^{8}$,$10^{9}$) especially for industrial scenarios. Our proposed algorithm is linear in the size of the trace $\mathcal{N}$ (unlike CP/$\mathsf{RVPredict}$) and therefore truly scales to large traces without having to rely on any windowing strategy that would restrict the scope of the races detected. Our experimental evaluation (Section 4) supports this claim by showing that the algorithm scales well in practice.

3.4 Lower Bounds

Our algorithm is clearly optimal in terms of running time (in terms of the length of the trace), since one has to spend linear time just looking at the entire trace. However, it can take up linear space in the worst case owing to the queues that hold the times of the previous acquires/releases. In this section, we state lower bounds result that states that any algorithm that implements WCP in linear time takes linear space. Hence our algorithm is also optimal in terms of the space requirements.

The goal is to show that one needs linear space to recognize WCP. But we want to do this when the number of threads ${\mathcal{T}}$ is constant, and the number of variables $\mathcal{V}$ and locks $\mathcal{L}$ is sublinear in the size of the trace $(O(\frac{n}{log{n}}))$. If the number of variables and locks is linear then it is easy to get a linear space lower bound, and even HB takes linear space in that case. The following theorem is proved in Appendix E.

Theorem 4**.**

Any algorithm that implements WCP by doing a single pass over the trace takes $\Omega(n)$ space.

In Theorem 5, we prove a lower bound result that applies to any algorithm (not just single pass), with details in Appendix E.

Theorem 5**.**

For any algorithm that computes the WCP relation in time $T(n)$ and space $S(n)$ it is the case that $T(n)S(n)\in\Omega(n^{2})$

Therefore, our WCP algorithm is optimal in terms of time/space trade-off as well.

4 Experimental Evaluation

We implemented the vector clock algorithm (Algorithm 1) in our tool Rapid (Race Prediction) written in Java, available at rap . Rapid uses the logging functionality of the tool $\mathsf{RVPredict}$ Rosu , to generate program traces which can be used for race detection. Rapid only considers events corresponding to read/write to memory locations, lock acquire/release, and thread fork/join events, and ignores other events (such as branch events) generated by $\mathsf{RVPredict}$. Rapid also implements a vector algorithm for detecting HB races.

Algorithm 1 runs in linear time. Also, since the sizes of data structures involved in the algorithm do not grow very fast, even for very large benchmarks, the memory requirement for the algorithm did not seem to be a huge bottleneck. Hence, we did not have to split our analysis into small windows, to handle large traces in Rapid. This is in stark contrast to most predictive dynamic race detection techniques Huang et al. [2014]; Smaragdakis et al. [2012].

Our experiments were conducted on an 8-core 2.6GHz 46-bit Intel Xeon(R) Linux machine, with HotSpot 1.8.0 64-Bit Server as the JVM and 50 GB heap space. We set a time limit of 4 hours for evaluating each of the techniques on each of the benchmarks. Our results are summarized in Table 1.

We compare the performance of Rapid only against sound techniques for race detection. For each of the techniques compared, as in Huang et al. [2014], we attempt to analyze the following two characteristics of our algorithm:

Race detection capability, measured by the number of distinct race pairs detected. A WCP (HB) race pair is an unordered tuple of program locations corresponding to some pair of events in the trace that are unordered by the partial order WCP (HB). We compare the race detection capability of Rapid’s WCP vector clock algorithm with $\mathsf{RVPredict}$ (version 1.8.2), which, in theory, detects at least as many races as any sound dynamic race detection technique. 2. 2.

Scalability, measured by the time taken to analyze the entire trace. We compare our analysis time against HB vector clock algorithm for race detection (also implemented in Rapid), since HB is the simplest sound technique, and admits a fast linear time algorithm.

As stated earlier, WCP detects all the races detected using CP. Further, it is not clear if an algorithm based on CP relation can scale without windowing strategy. Therefore, we omit any comparison with CP Smaragdakis et al. [2012].

We run all the three techniques (HB, WCP, $\mathsf{RVPredict}$) on the same set of traces. This was possible because both $\mathsf{RVPredict}$ and Rapid can analyze a logged trace produced by $\mathsf{RVPredict}$’s logging feature. We have tried to ensure that the comparison is fair; we implement the linear time vector clock algorithm for detecting HB Mattern [1988], and do not restrict the HB analysis to small windows, unlike in Huang et al. [2014] and Smaragdakis et al. [2012].

$\mathsf{RVPredict}$ supports tuning of parameters like window sizes and timeout for its backend SMT solver. The tight interplay between window sizes and solver timeout in $\mathsf{RVPredict}$ makes it difficult to estimate the best combination of these parameters. Small windows result in a low number of reported races because every occurrence of most of the races occur across multiple windows. On the other hand, a large window implies that the logical formulae generated in $\mathsf{RVPredict}$ are too large to be solved for the SMT solver, within the timeout, as a result of which, most of the windows do not report any races.

In Figure 7, we depict how the number of races vary for different values of solver timeouts and window sizes, for three benchmark examples, and as can be seen, there is no clear pattern. We run $\mathsf{RVPredict}$ on each of the benchmarks with several parameter combinations; we vary window sizes as (1K, 2K, 5K, 10K) and solver timeout values as (60s, 120s, 240s). An attempt of testing $\mathsf{RVPredict}$ beyond these parameter values often led to very large running times or excessive memory requirements. In Table 1, we report the observations only for two of these combinations.

4.1 Benchmarks

Our evaluation benchmarks (Column 1) have primarily been derived from Huang et al. [2014]. The benchmarks are designed for a comprehensive performance evaluation : the lines of code range from 60 to 0.5M, and the number of events vary from an order of 10 to 200M. The first set of small-sized benchmarks (account to pingpong) and are originally derived from IBM Contest benchmark suite Farchi et al. [2003]. The second set of medium sized benchmarks are derived from the Java Grande Forum benchmark suite Smith and Bull [2001]. The third set of benchmarks come from large real world software - Apache FTPServer, W3C Jigsaw web server, Apache Derby, and some applications from the DaCaPo benchmark suite (version 9.12)  Blackburn et al. [2006].

4.2 Scalability

Columns 12-15 report the times taken by WCP, HB and $\mathsf{RVPredict}$. WCP analysis times are comparable to HB analysis for all the examples.

For the small set of examples, all the three techniques finish their analysis in a reasonably small time, roughly proportional to the size of the traces. However, for large examples, both WCP and HB outperform the running times of $\mathsf{RVPredict}$. For ‘derby’, $\mathsf{RVPredict}$ exceeds the time limit of 4 hours for large window sizes. In general, it is difficult to gauge the running times of $\mathsf{RVPredict}$ from the length of the trace and window size, because the actual size of the internal logical formulation generated by $\mathsf{RVPredict}$ for every window, and the running times of its backend SMT solver crucially depend on how complex these windows are.

We highlight that the worst case linear space complexity of Algorithm 1 was not observed in our experiments. In Column 11, we report the maximum value of the total lengths of the FIFO queues (Section 3), attained at any point while performing WCP analysis on the traces, as a percentage of the number of events. As can be seen, this fraction stays below $3\%$ for almost all examples, and is $10\%$ for ‘bufwriter’ benchmark.

4.3 Bug Detection Capability

Columns 6 and 7 report the number of distinct HB and WCP race pairs. Columns 8-10 report the number of race pairs detected by $\mathsf{RVPredict}$, with different parameters. The extra races discovered by WCP and not by HB (boldfaced entries in Column 6) were either found to be $\mathsf{RVPredict}$ races, or were manually inspected to be valid race pairs.

For the smaller benchmarks, when the number of events is relatively small, the number of race pairs detected by the three techniques is almost the same, with WCP and HB detecting the maximum number of races for each of these benchmark examples, despite the fact that $\mathsf{RVPredict}$ employs a theoretically more comprehensive technique than WCP.

For the larger benchmark examples, the number of races detected by $\mathsf{RVPredict}$ are much lower than those predicted by WCP or HB. For the ‘derby’ benchmark, $\mathsf{RVPredict}$ could not finish its analysis within 4 hours. In fact, for the benchmark ‘bubblesort’, $\mathsf{RVPredict}$ runs out of memory (50GB) for a window size of 5K. This is primarily because of the tight interplay between the window sizes and timeout parameter for the backend SMT solver. We conjecture that most of the races that are not reported by $\mathsf{RVPredict}$ either occur across windows, or are missed because the solver did not return with an answer within the specified time limit. On the other hand, the theoretical guarantee provided by the techniques used in $\mathsf{RVPredict}$ Huang et al. [2014] would have ideally resulted in it detecting possibly more data races than both HB and WCP. This indicates that a windowing strategy for analyzing large traces can potentially result in significant loss in the bug detection capability of any dynamic race detection technique. In fact, on careful analysis of the predicted races, we found that both HB and WCP detect races having a distance of millions of events — the distance of a race between program locations $(pc_{1},pc_{2})$ is the minimum separation (in terms of the number of events in the trace) between any pair of events $(e_{1},e_{2})$ exhibiting the $(pc_{1},pc_{2})$ race. Specifically, both HB and WCP expose more than 25 races in ‘eclipse’ having a distance of at least $4.8$ million events, with the maximum distance being 53 million. Clearly, any windowing based analysis will be incapable of catching these races.

In all the examples, the set of races detected by HB are a subset of the set of races detected by WCP. This is expected as WCP is a weakening of CP (and hence of HB). For the large benchmarks ‘eclipse’, ‘jigsaw’ and ‘xalan’, the number of races detected by WCP are more than those detected by HB. In all examples, the set of races detected by $\mathsf{RVPredict}$ are a subset of the races reported by WCP and HB, except in ‘mergesort’ and ‘ftpserver’, where $\mathsf{RVPredict}$ reports one extra race each.

Note that, our WCP based race detection algorithm does not report drastically more races than the simpler HB based algorithm. While this is surprising, given the optimistic comparison of CP and $\mathsf{RVPredict}$  versus HB, as reported in Smaragdakis et al. [2012]; Huang et al. [2014], the apparent disparity can be explained by the fact that both Smaragdakis et al. [2012] and Huang et al. [2014] compare their techniques against a windowed implementation of HB based vector clock algorithm, which can potentially miss HB races between pairs of events (unordered by HB) that occur far apart in the trace, and thus, possibly missing out on program location pairs corresponding to these event pairs. As stated before, our implementation of HB vector clock algorithm is not windowed and catches these far-away event pairs unordered by HB. That being said, the few extra races missed by (our implementation of) HB, but predicted by WCP and/or $\mathsf{RVPredict}$, are quite subtle.

5 Related Work

Our work generalizes the causally-precedes (CP) relation proposed by Smaragdakis et. al Smaragdakis et al. [2012]. WCP is a weaker relation than CP (any data race detected by CP will also be detected by WCP) and can be implemented using a linear time vector clock algorithm. WCP based race detection can be viewed as belonging to the class of predictive analysis techniques, similar to CP Smaragdakis et al. [2012], Said et. al Said et al. [2011] $\mathsf{RVPredict}$ Huang et al. [2014], IPA Liu et al. [2016], Wang et al. [2009], which essentially reason about correct reorderings of a given trace for estimating concurrency errors in other possible executions. $\mathsf{RVPredict}$ Huang et al. [2014] and Rosu et. al., Şerbănuţă et al. [2012] both show how maximal and sound causal models can be used to resolve concurrency bugs. These methods explore all possible interleavings that can be deduced from the given trace, but such complete explorations are known to be intractable. $\mathsf{RVPredict}$ Rosu has also been extended for analyzing traces with missing events Huang and Rajagopalan [2016]. Predictive analysis techniques have also been used for checking atomicity violations and synchronization errors in tools like jPredictor Chen et al. [2008], Sen et al. [2005] and TAME Huang and Rauchwerger [2015]. GPredict Huang et al. [2015] uses predictive analysis for resolving higher level concurrency issues like authentication-before-use in Java. Our experimental evaluation suggests that heavy weight predictive techniques such as SMT based search do not scale well in practical scenarios, and often forego predictive power for scalability.

Lockset based techniques such as Eraser Savage et al. [1997], which assign sets of locks to program locations and variable accesses are known to be unsound. Methods such as random testing Sen [2008] and static escape analysis von Praun and Gross [2001] aim to improve the efficiency of, and reduce the number of false alarms raised by lockset based analysis.

Other dynamic race detection techniques use Lamport’s happens-before (HB) relation. HB admits a linear time vector clock algorithm Mattern [1988], and is adopted by various techniques including Pozniansky and Schuster [2003]; Flanagan and Freund [2009]; Christiaens and Bosschere [2001]. The DJIT+ Pozniansky and Schuster [2003] algorithm uses the epoch optimization for performance improvement in the traditional vector clock algorithm. This was further enhanced by Fasttrack Flanagan and Freund [2009]. Both WCP and CP are weaker relations than HB, and thus, in principle, detect all the races that any happens-before based race detection algorithm.

Other techniques include combinations of HB and lockset approach Elmas et al. [2007]; O’Callahan and Choi [2003]; Serebryany and Iskhodzhanov [2009]; Yu et al. [2005], statistical techniques Bond et al. [2010]; Marino et al. [2009], and crowd-sourced inference Kasikci et al. [2013]. Tools such as RoadRunner Flanagan and Freund [2010] and $\mathsf{Sofya}$ Kinneer et al. [2007] provide frameworks for implementing dynamic analysis tools. Techniques such as Feng and Leiserson [1997]; Cheng et al. [1998]; Raman et al. [2012]; Surendran and Sarkar [2016]; Yoga et al. [2016] leverage structured parallelism to optimize memory overhead for dynamic race detection.

Static race detection techniques Naik et al. [2006]; Engler and Ashcraft [2003]; Pratikakis et al. [2011]; Voung et al. [2007]; Zhan and Huang [2016]; Radoi and Dig [2013] suffer from the undecidability problem, and raise many false alarms, but still remain popular amongst developers. Type systems for detecting concurrency errors Boyapati et al. [2002]; Flanagan and Freund [2000]; Abadi et al. [2006], aim to help programmers write safer programs.

Model checking techniques like Musuvathi et al. [2008] and Yahav [2001] aim to exhaustively explore all possible concurrent executions to detect data races. However, due to the state explosion problem, explicit state model checking encounters a huge slowdown.

6 Conclusion

In this paper, we presented a sound technique for detecting data races through a new partial order called Weak-Causally-Precedes (WCP). Since WCP is a weakening of CP, it provably detects more races than CP. We showed how WCP races can be detected in linear time using a vector clock algorithm and we proved its optimality. We implemented our techniques in a prototype tool Rapid which shows promising results when evaluated on industrial sized benchmarks.

There are several avenues for future work. These include use of epoch based optimizations for improving memory requirements of the implementation, further weakening of the WCP relation while preserving soundness, and incorporating control flow information for enhanced race detection capability.

Acknowledgments

We thank Grigore Rosu and Yilong Li for their help with setting up $\mathsf{RVPredict}$, and Jeff Huang for providing many of the benchmark examples. We gratefully acknowledge the support of the following grants — Dileep Kini was partially supported by NSF TWC 1314485; Umang Mathur was partially supported by NSF CSR 1422798; and Mahesh Viswanathan was partially supported by NSF CPS 1329991 and AFOSR FA9950-15-1-0059.

Appendix A Soundness of WCP

Our soundness proof of WCP is along the lines of that of CP, but crucially differs when it comes down to proving existence of deadlocks. For CP, when it shown that there is a deadlock because of a CP-race, the deadlock always involves only two threads. For WCP, we end up proving that there could be deadlocks involving more than just two threads. In doing so we explore deeper structures about deadlocks which are novel contributions in themselves apart from those mentioned in the paper.

Given a trace $\sigma$ with a WCP-race the aim is to obtain a correct reordering of $\sigma$, which exhibits a race or a deadlock. Let the first WCP-race be between events $e_{1}$ and $e_{2}$, where first means there is no other pair in WCP-race before $e_{2}$ and no other event $e_{1}^{\prime}$ such that $e_{1}<_{\textit{tr}}^{\sigma}e_{1}^{\prime}<_{\textit{tr}}^{\sigma}e_{2}$ , $e_{1}^{\prime},e_{2}$ are in WCP-race.

Next, among all the correct reorderings of $\sigma$ we pick a $\alpha$ which satisfies the following:

• •

$e_{1},e_{2}$ is the first race in $\alpha$

• •

among traces that satisfy the above $\alpha$ is such that distance between $e_{1},e_{2}$ is minimal

• •

among traces that satisfy the above $\alpha$ is such that it minimizes the distance from $e_{2}$ to every acquire that encloses $e_{1}$ from innermost to outer acquires.

We shall refer to such a trace $\alpha$ as an extremal trace. If $e_{1},e_{2}$ are in HB-race then we can use the proof of HB correctness to get a correct reordering of the extremal trace (which is also a correct reordering of the original trace) which exhibits a race. So let us assume $e_{1},e_{2}$ are not in HB-race, i.e., $e_{1}\leq_{\textit{HB}}e_{2}$, and in this case we are going to show a predictable deadlock. Let $t_{1}$ be the thread containing $e_{1}$ and $t_{2}$ be the thread containing $e_{2}$. We observe the following properties about $\alpha$ in Lemmas A.1 to A.5 which are analogous to the Lemmas 1-5 in Smaragdakis et al. [2012], we only state these Lemmas and skip their proofs as they use exactly the same argument. The weakening of CP to WCP does not effect any of their reasoning. We provide proofs for the remaining Lemmas and of course our main theorem.

In all of our arguments we will attempt to reorder/move the events in $\alpha$ (or some trace) which if successful will violate some extremality condition. Therefore such a move cannot be possible. Most of the reorderings we make will involve moving a segment of the events of a thread, say $[a,b]$ to an earlier point in the trace, say right before $c$ (in some other thread). Such a move will always respect thread order but can still be an incorrect reordering due to the following reasons:

• •

A r(x) does not see the same value because it’s relative position w.r.t a w(x) has been changed, we call this a RW violation. If such a violation happens then the two conflicting events $e,e^{\prime}$ will be such that $c<_{\textit{tr}}e<_{\textit{tr}}e^{\prime}$ and $e^{\prime}\in[a,b]$ in $\tau$

• •

Lock semantics has been violated: this can happen in two ways

• –

$[a,b]$ contains a critical section whose lock is already held at $c$, we call this LS1 violation.

• –

$[a,b]$ contains an acquire $d={\mathtt{acq(l)}}$ but not $\textit{match}(d^{\prime})$ such that there is critical section $(h,h^{\prime})$ in another thread over the same lock $\mathtt{l}$ such that $c<_{\textit{tr}}h<_{\textit{TO}}h^{\prime}<_{\textit{tr}}d$. We call this a LS2 violation.

Lemma A.1**.**

For all events $e$ such that $e_{1}\leq_{\textit{tr}}e\leq_{\textit{tr}}e_{2}$ we have

$e_{1}\leq_{\textit{HB}}e\leq_{\textit{HB}}e_{2}$** 2. 2.

$e_{1}\nprec_{\textit{WCP}}e$* and $e\nprec_{\textit{WCP}}e_{2}$*

Lemma A.2**.**

Let $a_{1}$ be an acquire event such that $e_{1}\in\textup{CS}(a_{1})$. For all events $e$ such that $a_{1}\leq_{\textit{tr}}e\leq_{\textit{tr}}e_{1}$ we have $a_{1}\leq_{\textit{HB}}e$ and $e\leq_{\textit{HB}}e_{2}$.

Lemma A.3**.**

Any conflicting pair of events appearing before $(e_{1},e_{2})$ have to be WCP ordered.

Lemma A.4**.**

For any acquire event $a_{1}$ such that $e_{1}\in\textup{CS}(a_{1})$, and any critical section $(a,r)$ such that $a<_{\textit{tr}}a_{1}<_{\textit{tr}}r<_{\textit{tr}}e_{1}$ it is the case that $a_{1}\prec_{\textit{WCP}}r$.

Lemma A.5**.**

Any acquire event $a$ such that $\textit{match}(a)\notin\alpha$ then $a$ is in $t_{2}$.

Let $f$ be the first event after $e_{1}$ which is not in $t_{1}$. Next note that by Lemma A.1 we have $e_{1}\leq_{\textit{HB}}f$ and $f$ being the first event outside $t$ has to be an acquire, say over lock $\mathtt{l}$. More over there has to be a ${\mathtt{rel(l)}}$ event, say $g^{\prime}$, such that $e_{1}<_{\textit{TO}}g^{\prime}<_{\textit{tr}}f$. Let $g^{\prime}$ be the last such event. Let $g=\textit{match}(g^{\prime})$.

Among all extremal traces, pick $\tau$ such that it minimizes the distance from $f$ to $e_{1}$, If $\textit{match}(f)$ exists in $\tau$ it shall be referred to as $f^{\prime}$. We shall refer to this $\tau$ as a minimal trace. All our arguments that follow will pertain to this minimal trace $\tau$.

Lemma A.6**.**

If there are events $e,e^{\prime}$ such that $e\prec_{\textit{WCP}}e^{\prime}$ and $g\leq_{\textit{tr}}e$ and one of the following holds: (a) $f^{\prime}\notin\tau$ (b) $e^{\prime}\leq_{\textit{HB}}f^{\prime}$, then $e_{1}\prec_{\textit{WCP}}e_{2}$

Proof.

Consider two sub-cases: $e_{1}<_{\textit{TO}}g$ and $g<_{\textit{TO}}e_{1}$.

$e_{1}<_{\textit{TO}}g$: $e_{1}<_{\textit{TO}}g\leq_{\textit{tr}}e$ implies $e_{1}\leq_{\textit{HB}}e$ using Lemma A.1. Then $e_{1}\leq_{\textit{HB}}e\prec_{\textit{WCP}}e^{\prime}\leq_{\textit{HB}}e_{2}$ gives $e_{1}\prec_{\textit{WCP}}e_{2}$ using Rule (c) of WCP. 2. 2.

$g<_{\textit{TO}}e_{1}$: consider further sub-cases

1. (a)

$f^{\prime}\in\tau$: $g\leq_{\textit{HB}}e$ (using Lemma A.2 if $e<_{\textit{tr}}e_{1}$ or Lemma A.1 if $e_{1}<_{\textit{tr}}e$) and $e\prec_{\textit{WCP}}e^{\prime}\leq_{\textit{HB}}f^{\prime}$. This implies $g\prec_{\textit{WCP}}f^{\prime}$. Applying Rule (b) we get $g^{\prime}\prec_{\textit{WCP}}f^{\prime}$. Combining this with $e_{1}<_{\textit{TO}}g^{\prime}$ and $f^{\prime}\leq_{\textit{HB}}e_{2}$ using Rule (c) we get $e_{1}\prec_{\textit{WCP}}e_{2}$. 2. (b)

$f^{\prime}\notin\tau$: $f\in t_{2}$ (Lemma A.5) and Rule (a) of WCP gives $e_{1}\prec_{\textit{WCP}}e_{2}$. ∎

Lemma A.7**.**

If segment $[a,b]$ of a thread is moved right before event $c$ where $c<_{\textit{tr}}a$ and $[a,b]$ is the suffix of a critical section then the move cannot violate LS2.

Proof.

Whenever we move a segment of a thread that is the suffix of a crtical section it is always the case that every acquire in the segment also has its matching release in the segment. This is due to well-nestedness. In a LS2 violation one requires only an acquire to be moved up without its release. ∎

The rest of the proof structure is as follows: we attempt to show that $\tau$ exhibits a predictable deadlock. In order to construct these deadlocks we are going to define structures called deadlock chains. We show that presence of a deadlock chain results in a predictable deadlock through structures called deadlock patterns.

Definition 4**.**

A critical section $(c,c^{\prime})$ appearing after $g$ (i.e., $g<_{\textit{tr}}c$) is said to be conflicting due to critical section $(d,d^{\prime})$, if $(d,d^{\prime})$ is over the same lock as $c$ such that $d<_{\textit{tr}}g<_{\textit{tr}}d^{\prime}\leq_{\textit{HB}}c$.

Definition 5**.**

A deadlock chain of type-1 of length $k$ is a sequence of threads $v_{1},\dots,v_{k+1}$ and a sequence of critical sections $(c_{1},c_{1}^{\prime}),(d_{1},d_{1}^{\prime})$ …$(c_{k},c_{k}^{\prime}),(d_{k},d_{k}^{\prime})$ such that

1. (a)

$v_{1},\dots,v_{k+1}$* are distinct and $t_{1}\notin\{v_{1},\dots,v_{k}\}$* 2. (b)

$v_{1}$* is the thread containing $f$* 3. (c)

$\forall\,i:(c_{i},c_{i}^{\prime})$* is the earliest conflicting critical section contained in $(d_{i-1},d_{i-1}^{\prime})$, or $\textup{CS}(f)$ if $i=1$* 4. (d)

$\forall\,i:(c_{i},c_{i}^{\prime})$* is conflicting due to $(d_{i},d_{i}^{\prime})$* 5. (e)

$\forall\,i:(d_{i},d_{i}^{\prime})$* is contained in thread $v_{i+1}$*

Lemma A.8**.**

If $e_{1}\in(g,g^{\prime})$ then $f^{\prime}\in\tau$

Proof.

Follows from Lemma A.5 and Rule (a) of WCP. ∎

Definition 6**.**

When $e_{1}\in(g,g^{\prime})$, an acquire event $d$ is said to be conflicting due to a critical section $(c,c^{\prime})$, if $g<_{\textit{tr}}d<_{\textit{tr}}e_{1}$, $(c,c^{\prime})$ is over the the same lock as $d$, and $g<_{\textit{tr}}c<_{\textit{TO}}c^{\prime}\leq_{\textit{HB}}d$

Definition 7**.**

A deadlock chain of type-2 of length $k$ is a sequence of threads $v_{1},\dots,v_{k+1}$ and a sequence of acquire events and critical sections $d_{1},(c_{1},c_{1}^{\prime}),\dots,d_{k},(c_{k},c_{k}^{\prime})$ such that $e_{1}\in(g,g^{\prime})$ and:

1. (a)

$v_{1},\dots,v_{k+1}$* are distinct and $t_{1}\notin\{v_{1},\dots,v_{k}\}$* 2. (b)

$v_{1}$* is the thread containing $f$* 3. (c)

$\forall\,i:$* $d_{i}$ is the earliest conflicting acquire whose critical section contains $(c_{i-1},c_{i-1}^{\prime})$, or $(f,f^{\prime})$ if $i=1$* 4. (d)

$d_{i}$* is conflicting due to $(c_{i},c_{i}^{\prime})$* 5. (e)

$(c_{i},c_{i}^{\prime})$* is contained in thread $v_{i+1}$*

Now, we go back to $\tau$ and show presence of deadlock chains.

Lemma A.9**.**

The minimal trace $\tau$ contains a deadlock chain of type-1 or type-2

Proof.

Assume two subcases:

$f^{\prime}$ occurs in $\tau$. Let $u$ be the first event after $g$ in the thread containing $f$. We attempt to move $[u,f^{\prime}]$ to right before $g$. If this move is successful it violates either:

• •

extremality by decreasing distance between $e_{1},e_{2}$ (when $g<_{\textit{TO}}e_{1}$)

• •

minimality by moving the resulting $f$ closer to $e_{1}$ (when $e_{1}<_{\textit{TO}}g$)

Hence this move cannot be successful, which cannot be due to RW violation from Lemma A.6. So lock semantics has to be violated, which can happen in two ways:

1. (a)

If LS1 is violated, there is a conflicting critical section $(c,c^{\prime})$ contained in the segment $[u,f^{\prime}]$ due to critical section $(d,d^{\prime})$.

• •

Consider $g<_{\textit{TO}}e_{1}$: if $c<_{\textit{tr}}e_{1}$ then $d^{\prime}<_{\textit{tr}}e_{1}$ and we know from Definition 4 that $g<_{\textit{tr}}d^{\prime}$. Applying Lemma A.4 on $g$ and $d^{\prime}$ gives us $g\prec_{\textit{WCP}}d^{\prime}$. But we know $d^{\prime}\leq_{\textit{HB}}c<_{\textit{TO}}f^{\prime}$ which gives us $g\prec_{\textit{WCP}}f^{\prime}$. Applying Rule (b) of WCP we get $g^{\prime}\prec_{\textit{WCP}}f^{\prime}$. Combining this with $e_{2}<_{\textit{TO}}g^{\prime}$ gives us $e_{2}\prec_{\textit{WCP}}f^{\prime}$ and we also know $f^{\prime}\leq_{\textit{HB}}e_{2}$ (Lemma A.1) which gives us $e_{1}\prec_{\textit{WCP}}e_{2}$ a contradiction. So assuming $c<_{\textit{tr}}e_{1}$ led to a contradiction and hence we get $e_{1}<_{\textit{tr}}c$, which implies $f<_{\textit{TO}}c$ because $f$ is the first event outside $t_{1}$ after $e_{1}$. By well-nestedness we get $(c,c^{\prime})$ contained in $(f,f^{\prime})$. And so a type-1 deadlock chain of length 1 is obtained.

• •

Consider $e_{1}<_{\textit{TO}}g$: In this case $u=f$ and hence $(c,c^{\prime})$ is contained in critical section $(f,f^{\prime})$ and along with $(d,d^{\prime})$ gives us a type-1 deadlock chain of length 1. 2. (b)

If LS2 is violated then there is an acquire $d\in[u,f^{\prime}]$, $match(d)\notin[u,f^{\prime}]$, and critical section $(c,c^{\prime})$ in another thread over the same lock as $d$ such that $g<_{\textit{tr}}c\leq_{\textit{TO}}c^{\prime}<_{\textit{tr}}d$. This means $d$ is conflicting due to $(c,c^{\prime})$. We also have $e_{1}\in(g,g^{\prime})$, otherwise we get that $u=f$ which implies that $match(d)\in(f,f^{\prime})$ due to well-nestedness, a contradiction. And therefore LS2 gives us a type-2 deadlock chain of length 1. 2. 2.

$f^{\prime}$ does not appear in $\tau$. Then $f^{\prime}$ is performed by $t_{2}$, with $e_{2}\in\textup{CS}(f^{\prime})$ by Lemma A.5. This implies $e_{1}\notin(g,g^{\prime})$ otherwise by Rule (a) of WCP we have $g^{\prime}\prec_{\textit{WCP}}e_{2}$ which combined with $e_{1}<_{\textit{TO}}g^{\prime}$ gives us $e_{1}\prec_{\textit{WCP}}e_{2}$ a contradiction. Next we obtain a trace $\tau^{\prime}$ from $\tau$ by dropping all events below and including $g$ from all threads other than $t_{2}$. If $\tau^{\prime}$ is a correct reordering it violates extremality as distance between $e_{1},e_{2}$ is reduced. $\tau^{\prime}$ cannot violate thread order as suffixes of threads are being dropped. If $\tau^{\prime}$ has RW violation then there is some r(x) event, say $e$ which is undropped in $t_{2}$ after $g$ and some dropped w(x), say $e^{\prime}$, such that $e^{\prime}<_{\textit{tr}}e$. Then by Lemma A.6 we have $e_{1}\prec_{\textit{WCP}}e_{2}$ which is a contradiction. So $\tau^{\prime}$ has to have a lock semantic violation, which can only be because a release $d^{\prime}$ was dropped whose matching acquire $d$ is not dropped and there is a critical section over the same lock $(c,c^{\prime})$ occuring later than $(d,d^{\prime})$, which is undropped and hence in $t_{2}$. But $f$ is the first event in $t_{2}$ after $e_{1}$ and since $e_{1}<_{\textit{TO}}g<_{\textit{tr}}d^{\prime}<_{\textit{tr}}c$ we get that $(c,c^{\prime})$ is contained in $(f,f^{\prime})$. This gives rise to type-1 deadlock chain. ∎

What remains to be done is to prove that deadlock chains result in predictable deadlocks. In order to do so we introduce intermediate structures called deadlock patterns.

Definition 8**.**

A type-1 deadlock pattern of rank $r$ is a sequence of threads $v_{1},\dots,v_{k+1}$ and a sequence of critical sections $(c_{1},c_{1}^{\prime})$, $(d_{1},d_{1}^{\prime})$ …$(c_{k},c_{k}^{\prime}),(d_{k},d_{k}^{\prime})$ such that:

1. (a)

$v_{1},\dots,v_{k+1}$* are distinct and $v_{k+1}=t_{1}$* 2. (b)

$v_{1}$* is the thread containing $f$ and $(c_{1},c_{1}^{\prime})\in\textup{CS}(f)$* 3. (c)

$\forall\,i>1:(c_{i},c_{i}^{\prime})$* is contained in $(d_{i-1},d_{i-1}^{\prime})$ in thread $v_{i}$.* 4. (d)

$\forall\,i:d_{i}$* and $c_{i}$ are over the same lock and $d_{i}^{\prime}\leq_{\textit{HB}}c_{i}$* 5. (e)

$\forall\,i\in(r,k]\;\forall\,j:P(i,j)$* (where $P(i,j)$ is defined below)* 6. (f)

$\forall\,i:$* Any critical section $(c,c^{\prime})$ such that $g<_{\textit{tr}}c<_{\textit{TO}}c_{i}$ is non-conflicting.* 7. (g)

$d_{k}<_{\textit{TO}}g$**

where $P(i,j)$ is the property that for any acquire event $h_{1}$ such that $c_{i}\in\textup{CS}(h_{1})$ and for any acquire event $h_{2}$ over the same lock as $h_{1}$ such that $h_{2}<_{\textit{TO}}c_{j}$ then $h_{2}\leq_{\textit{HB}}h_{1}$.

Lemma A.10**.**

In a deadlock chain of type-1 if $v_{k+1}\neq t_{1}$ then $f<_{\textit{tr}}d_{k}^{\prime}$

Proof.

Follows from Lemma A.4 and the fact that $f$ is first event outside $t_{1}$. ∎

Lemma A.11**.**

If there exists a deadlock chain of type-1 then there exists a type-1 deadlock pattern

Proof.

Define distance between $g$ and $d_{k}^{\prime}$ as: 0 if $v_{k+1}=t_{1}$, or number of events between $g$ and $d_{k}^{\prime}$ (inclusive) otherwise. We perform induction on this distance.

Base case: If the distance is 0 then $v_{k+1}=t_{1}$ by Lemma A.10. This gives us the desired type-1 deadlock pattern which has rank $k$. Property (e) of the pattern comes for free since rank $=k$ and the remaining properties follow from the properties of the chain.

Inductive case: if the distance $>0$ then $v_{k+1}\neq t_{1}$ (definition of the distance). Let $u$ be the first event in $v_{k+1}$ after $g$. Consider a move involving $[u,d_{k}^{\prime}]$ to just before $g$. The move violates extremality or minimality (either due to decreasing $e_{1},e_{2}$ distance or moving the resulting $f$ closer to $e_{1}$). If the move commits a RW violation then there have to be two conflicting events $e,e^{\prime}$ such that $g<_{\textit{tr}}e$ and $e^{\prime}\leq_{\textit{HB}}c_{1}$ (this can be inductively proved). So if $f^{\prime}\in\tau$ then $e^{\prime}\leq_{\textit{HB}}f$. Now applying Lemma A.3 and A.6 we get $e_{1}\prec_{\textit{WCP}}e_{2}$ a contradiction. So the move has to violate lock semantics, but it cannot be a LS2 violation since $[u,d_{k}^{\prime}]$ is a suffix of the critical section $(d_{k},d_{k}^{\prime})$ and Lemma A.7. Therefore the move has to violate LS1: which means there is a critical section $(c_{k+1},c_{k+1}^{\prime})$ in $[u,d_{k}^{\prime}]$ which is conflicting. Pick the earliest among all such critical sections. Let the conflict be due to $(d_{k+1},d_{k+1}^{\prime})$ in thread $v_{k+2}$. If $v_{k+2}\notin\{v_{1},\dots,v_{k+1}\}$ then this process extends the deadlock chain while reducing the distance, and by the induction hypothesis we have the required deadlock pattern. So consider when $v_{k+2}=v_{i}$ where $i<k+1$. We have $d_{k+1}^{\prime}<_{\textit{TO}}d_{i-1}^{\prime}$ which implies $d_{i-1}<_{\textit{TO}}d_{k+1}$. Let $a$ be the first event in $v_{i}$ after $g$. Consider a move of $[a,d_{k+1}^{\prime}]$ to right before $g$. Once again this move violates minimality/extremality. As before the move cannot commit a RW violation, and lock semantics can be violated only due to LS1. Hence there is a critical section $(c_{k+2},c_{k+2}^{\prime})$ inside $[a,d_{k+1}^{\prime}]$ that is conflicting, but this violates the choice of $(c_{i},c_{i}^{\prime})$ as the earliest conflicting critical section contained in $(d_{i-1},d_{i-1}^{\prime})$, property (c) of the deadlock chain. ∎

Similarly we define type-2 deadlock patterns which we will derive from deadlock chains of type-2.

Definition 9**.**

A type-2 deadlock pattern of rank $r$ is a sequence of threads $v_{,}\dots,v_{k+1}$ and a sequence of acquires and critical sections $d_{1},(c_{1},c_{1}^{\prime})$ …$d_{k},(c_{k},c_{k}^{\prime})$ such that $e_{1}\in(g,g^{\prime})$ and:

1. (a)

$v_{1},\dots,v_{k}$* are distinct and $v_{k+1}=t_{1}$* 2. (b)

$v_{1}$* is the thread containing $f$ and $f\in\textup{CS}(d_{1})$* 3. (c)

$\forall\,i\leq k:(c_{i},c_{i}^{\prime})$* is contained in $(d_{i+1},d_{i+1}^{\prime})$ in thread $v_{i+1}$.* 4. (d)

$\forall\,i:d_{i}$* and $c_{i}$ use the same lock and $g<_{\textit{tr}}c_{i}\leq_{\textit{HB}}d_{i}<_{\textit{tr}}e_{1}$* 5. (e)

$\forall\,i>r:\forall\,j:Q(i,j)$* (where $Q(i,j)$ is defined below)* 6. (f)

$\forall\,i\leq r:d_{i}^{\prime}=\textit{match}(d_{i})$* if present in $\tau$ then $e_{1}<_{\textit{tr}}d_{i}^{\prime}$* 7. (g)

$(c_{k},c_{k}^{\prime})\in(g,g^{\prime})$**

where $Q(i,j)$ is the property that for any acquire event $h_{1}$ such that $c_{i-1}\in\textup{CS}(h_{1})$ and for any acquire event $h_{2}$ such that $h_{2}<_{\textit{TO}}c_{j}$ then $h_{2}\leq_{\textit{HB}}h_{1}$.

Lemma A.12**.**

If there exists a deadlock chain of type-2 then there exists a type-2 deadlock pattern

Proof.

Define size of a deadlock chain of type-2 as the distance between $g$ and $c_{k}$ if $v_{k+1}\neq t_{1}$ and 0 otherwise. We perform induction on the size of the chain.

Base case: When size = 0 we get $v_{k+1}=t_{1}$ and we get the chain to be a pattern of order $k$. Property (f) of the pattern comes for free since rank $=k$ and the remaining properties follow from the properties of the chain.

Inductive case: If size $>0$ then $v_{k+1}\neq t_{1}$. Let $u$ be the first event in $v_{k+1}$ after $g$. Consider a move of $[u,c_{k}^{\prime}]$ to just before $g$. If move is successful it violates minimality, hence the move is invalid As before the move cannot commit a RW violation. Therefore the move is either a LS1 or LS2 violation. First, we show why a LS1 violation is not possible. If it does then there exists a critical section $(c_{k+1},c_{k+1}^{\prime})$ across $g$ and a moved acquired, say $a$, over the same lock in thread $v_{k+1}$. The critical section $(c_{k+1},c_{k+1}^{\prime})$ cannot be in $t_{1}$ because by well nestedness we then get $g^{\prime}<_{\textit{TO}}c_{k+1}^{\prime}$ and therefore $e_{1}<_{\textit{TO}}c_{k+1}^{\prime}$, which makes it impossible for $a$ to exist as it should be between $g$ and $e_{1}$. If $(c_{k+1},c_{k+1}^{\prime})$ is performed by $v_{k+1}\neq t_{1}$ then we get that $c_{k+1}<_{\textit{tr}}g<_{\textit{tr}}c_{k+1}^{\prime}<_{\textit{tr}}e_{1}$. Now we apply Lemma A.4 on $g$ and $(c_{k+1},c_{k+1}^{\prime})$ to get $g\prec_{\textit{WCP}}c_{k+1}^{\prime}$, that combined with $c_{k+1}^{\prime}\leq_{\textit{HB}}a<_{\textit{TO}}c_{k}^{\prime}\leq_{\textit{HB}}f^{\prime}$ gives us $g\prec_{\textit{WCP}}f^{\prime}$ and applying Lemma A.6 gives us $e_{1}\prec_{\textit{WCP}}e_{2}$, a contradiction. So we are left with LS2 violation as the only possibility in which case there is a moved acquire $d_{k+1}$ which is not released before $c_{k}^{\prime}$ and a critical section $(c_{k+1},c_{k+1}^{\prime})$ over the same lock as $d_{k+1}$ such that $g<_{\textit{tr}}c_{k+1}<_{\textit{TO}}c_{k+1}^{\prime}\leq_{\textit{HB}}d_{k+1}$. Among all such $d_{k+1}$ we choose the earliest. Now if $v_{k+2}$ so obtained is $t_{1}$ we are done because size of the extended chain becomes a zero yielding the base case. If $v_{k+2}\neq t_{1},v_{1},v_{2},\dots,v_{k}$ then we would have extended the chain while have reduced the size of the chain since $c_{k+1}$ is earlier than $c_{k}$ in $\tau$. Consider what happens when $v_{k+2}=v_{i}$ for some $i\leq k$. Let $a$ be the first event in $v_{i}$ after $g$. We attempt to move $[a,c_{k+1}^{\prime}]$ to right before $g$. The move cannot be successful because it would violate minimality of $g$. Now using reasoning similar to above we get that RW and LS1 violations are not possible, leaving us with LS2 violation. So there exists an acquire $d_{k+2}$ such that $g<_{\textit{tr}}d_{k+2}$ and $(c_{k+1},c_{k+1}^{\prime})\in\textup{CS}(d_{k+2})$. Choose $d_{k+2}$ to be the earliest such acquire. If $d_{k+2}^{\prime}=\textit{match}(d_{k+2})$ is not in $\tau$ then $\textup{CS}(d_{k+2})$ contains $(c_{i-1},c_{i-1}^{\prime})$ violating the optimal choicef $d_{i}$ in thread $v_{i}$. If $d_{k+2}^{\prime}\in\tau$ and later than $c_{i-1}^{\prime}$ and the result is similar. Consider the case when $d_{k+2}^{\prime}$ is earlier than $c_{i-1}^{\prime}$ in which case $d_{k+2}^{\prime}<_{\textit{TO}}c_{i-1}$ by well nestedness. THen consider moving segment $[a,d_{k+2}^{\prime}]$ to just before $g$. Again the move has to be unsuccessful as it violates minimality, and using reasoning exactly the same as above we can eliminate violations due to RW/LS1. Now in this case LS2 cannot happen either because if it does we get an acquire say $a^{\prime}$ held at $d_{k+2}^{\prime}$ (i.e., $d_{k+2}^{\prime}\in\textup{CS}(a^{\prime})$ and $a^{\prime}<_{\textit{TO}}d_{k+2}$) such that there is a critical section $(b,b^{\prime})$ (in some thread $\neq v_{i}$) over the same lock as $d_{k+2}$ and $g<_{\textit{tr}}b$. But this $a^{\prime}$ violates the chocie of $d_{k+2}^{\prime}$ being chosen as the earliest. So we conclude that $v_{k+2}\notin{v_{1},\dots,v_{k+2}}$ and the inductive step goes through. ∎

Next we look at how deadlock patterns can be used to show predictable deadlocks.

Lemma A.13**.**

If there exists a type-1 deadlock pattern then of any rank there exists a predictable deadlock

Proof.

We perform induction on the rank $r$.

Base case: rank $r=0$. Consider the execution $\tau^{\prime}$ obtained by dropping the following events from $\tau$: (i) events $e$ s.t $c_{i}\leq_{\textit{TO}}e$ (ii) events $e$ s.t $g\leq_{\textit{TO}}e$ (iii) events $e$ in threads $\notin\{v_{1},\dots,v_{k+1}\}$ s.t $g<_{\textit{tr}}e$. The claim is $\tau^{\prime}$ is a correct reordering of $\tau$. $\tau^{\prime}$ reveals a deadlock. Proof of claim: $\tau^{\prime}$ does not violate thread order as we are only dropping suffixes of threads. The read events that possibly don’t see the same writes is because the write events have been dropped, implying both the read event $e^{\prime}$ and the write $e$ are later than $g$, we then observe that if $f^{\prime}\in\tau$ then $e^{\prime}\leq_{\textit{HB}}f^{\prime}$ and apply Lemma A.6 to get a $e_{1}\prec_{\textit{WCP}}e_{2}$, a contradiction. But $\tau^{\prime}$ may not valid trace due to lock semantic violation. So there exists a critical section $(a_{1},r_{1})$ and acquire $a_{2}$ of the same lock such that $r_{1}\leq_{\textit{HB}}a_{2}$, $r_{1}$ is dropped and $a_{1},a_{2}$ are undropped. Since $r_{1}$ is dropped we get $g<_{\textit{tr}}r_{1}$ and so $g<_{\textit{tr}}a_{2}$ which implies $a_{2}$ is performed by some $v_{i}$. Suppose $a_{1}$ is not peformed by some $v_{j}$ then since $a_{1}$ is undropped we know $a_{1}<_{\textit{tr}}g$, but this implies $(a_{2},\textit{match}(a_{2}))$ conflicts with $(a_{1},r_{1})$ contradicting the choice of $(c_{i},c_{i}^{\prime})$ as the earliest conflicting critical section (Note that $\textit{match}(a_{2})$ exists in $\tau$ because $a_{2}\in(d_{i-1},d_{i-1}^{\prime})$ and well-nestedness). So we get $a_{2}$ is performed by some thread $v_{j}$. Consider any one such pair $a_{1},a_{2}$. Now applying property (e) with $h_{1}=a_{1}$ and $h_{2}=a_{2}$ we obtain $a_{2}\leq_{\textit{HB}}a_{1}$, a contradiction since we began with $a_{1}\leq_{\textit{HB}}a_{2}$ and $a_{1}\neq a_{2}$. We are able to apply property (e) to $a_{1},a_{2}$ as rank is 0. This implies lock semantics is not violated and hence $\tau^{\prime}$ is valid.

Inductive case: Obtain $\tau^{\prime}$ from $\tau$ as in the base case and follow the same argument until the application of property (e). Consider among all possible $a_{1},a_{2}$ those where $a_{1}$ is in $v_{j}$ for the largest $j$ and among those pick pairs where $a_{1}$ is in thread $v_{j}$ for the largest $j$, and among those pick pairs where $a_{2}$ is in thread $v_{i}$ for the smallest $i$ and among those pick the one with the earliest $a_{2}$ in $v_{i}$. First we observe $j\leq r$ which can be derived from property (e) and the fact that $a_{1}\leq_{\textit{HB}}a_{2}$. The observation $a_{1}\leq_{\textit{HB}}a_{2}$ can also be used to deduce $i<j$. Next we construct a new deadlock pattern that uses the threads $v_{1},\dots,v_{i},v_{j},\dots,v_{k+1}$, i.e. we drop threads between $v_{i}$ and $v_{j}$ and use crtical section $(a_{2},\textit{match}(a_{2}))$ in place $(c_{i},c_{i}^{\prime})$ and critical section $(a_{1},\textit{match}(a_{1}))$ in place of $(d_{j-1},d_{j-1}^{\prime})$. This surgery will result in a deadlock pattern of rank $i$ but $i<j\leq r$, hence the rank is reduced and the inductive hypothesis takes care of the rest. ∎

Lemma A.14**.**

If there exists a type-2 deadlock pattern then of any rank there exists a predictable deadlock

Proof.

As for type-1 deadlock patterns we perform induction on the rank.

Base case: rank $r=0$. Consider once again the execution $\tau^{\prime}$ obtained by dropping: (i) events $e$ s.t $c_{i}\leq_{\textit{TO}}e$ (ii) events $e$ s.t $f\leq_{\textit{TO}}e$. (iii) events $e$ in threads $\notin\{v_{1},\dots,v_{k+1}\}$ s.t $g<_{\textit{tr}}e$. The claim is $\tau^{\prime}$ is a correct reordering of $\tau$, in which case the ordering reveals a deadlock. Proof of claim: $\tau^{\prime}$ can only be invalid trace due to lock semantic violation (same argument as type-1). Once again we get a critical section $(a_{1},r_{1})$ and acquire $a_{2}$ on the same lock such that $r\leq_{\textit{HB}}a_{2}$, $r_{1}$ is dropped and $a_{1},a_{2}$ are undropped. Since $r_{1}$ is dropped we know $g<_{\textit{tr}}r_{1}$ and so $g<_{\textit{tr}}a_{2}$ which implies $a_{2}$ is performed by some $v_{i}$. If $a_{1}<_{\textit{tr}}g$ then using Lemma A.4 and Lemma A.6 we get a contradiction. So $g<_{\textit{tr}}a_{1}$ and hence $a_{1}$ is performed by some $v_{j}$. In the base case rank being 0 we can apply property (e) with $h_{1}=a_{1}$ and $h_{2}=a_{2}$ to get a contradiction $a_{2}\leq_{\textit{HB}}a_{1}$. This implies lock semantics is also not violated and hence $\tau^{\prime}$ is valid.

Inductive case: Follow the same steps as in the base case until obtaining $a_{1},a_{2}$. Then observe that $a_{1}$ has to be performed after $d_{j}$ and before $c_{j-1}$, otherwise moving the segment of that thread after $g$ until $r_{1}$ to above $g$ leads to conclusion that $d_{j}$ was not chosen as the earliest a contradiction. $a_{1}$ should be after $d_{i}$ otherwise $d_{i}$ being earliest critical section is violated due to presence of $(a_{1},r_{1})$. Now we short circuit the deadlock pattern by considering threads $v_{1},\dots,v_{i},v_{j},\dots,v_{k+1}$, replace $d_{i}$ with $a_{2}$ and $d_{j}$ with $a_{1}$. This will result in a deadlock pattern of rank $i(<j\leq r)$ and then the inductive hypothesis can be applied. ∎

Using Lemma A.9 we get that $\tau$ contains a deadlock chain. Using Lemmas A.11 and A.12 we show presence of deadlock patterns, and finally using Lemmas A.13 and A.14 we get the required predictable deadlock, thus proving Theorem 1.

Appendix B Errors in CP soundness proof

For the reader familiar with CP soundness proof Smaragdakis et al. [2012] we point out some of the errors in it.

• •

In case 1 (a) of the proof of the main theorem when $f\dots f^{\prime}$ is being moved to $g$ and is inspected for a lock semantic violation they argue “If $m$ is held at a point $g$ by a thread $t_{3}$ other than $t_{1}$ then it has to be release before $f$”. This is incorrect because the lock $m$ can be released by $t_{3}$ after $f$ and before the acquire of $m$ present in the critical section $f\dots f^{\prime}$.

• •

In case 1 (b) of the proof of the main theorem when $u\dots f^{\prime}$ is being moved to $a_{2}$ (where $u$ is the first event after $a_{2}$ in thread containing $f$) and lock semantic violation is explored they say “If such an $m$ is held by a thread $t_{3}$, other than $t_{1}$ at point $a_{2}$, then it has to be released before $e_{1}$”. This is not true because the $m$ can also be released after $e_{1}$ in which case the release will have to be after $f$ which is not a impossibility. Further more this is not the only way in which lock semantics can be violated. As we have shown in our proof there are two ways of lock semantic violation when moving up a segment of a thread: LS1 and LS2. The above argument only explores LS1 violation (that too partially). LS2 violation is completely ignored in their proof.

• •

In case 2 of the proof of the main theorem: after dropping the events to obtain the trace $tr^{\prime}$, when they argue lock semantics violation they say “The acquisition of $m$ has to be in thread $t_{1}$ (otherwise $f$ would not be the first event …)”. This is wrong because the acquisition of $m$ can be in another thread, the only thing is that the it’s corresponding release that is dropped has to be after $f$. Nothing prevents it from being after $f$.

Appendix C Correctness of algorithm

Given a trace $\sigma$, assume that we have updated the vector clocks as described in Algorithm 1 and times $C_{e},H_{e},P_{e},N_{e}$ have been assigned to event $e$ as described in Section 3.

Lemma C.1**.**

At any point: $\mathbb{H}_{\ell}=H_{r},\mathbb{P}_{\ell}=P_{r}$ where $r$ is the last ${\mathtt{rel(\ell)}}$ event. $\mathbb{L}_{\ell,x}^{r}=\sqcup_{r}H_{r}$ is where $r$ ranges over all ${\mathtt{rel(\ell)}}$ event such that $\textup{CS}(r)$ contains a r(x) event. $\mathbb{L}_{\ell,x}^{w}=\sqcup_{r}H_{r}$ is where $r$ ranges over all ${\mathtt{rel(\ell)}}$ event such that $\textup{CS}(r)$ contains a w(x) event.

Proof.

Can be observed by the fact that these clocks are only updated during a release. And the respective invariants can be easily checked from Lines 9,7,8. ∎

Lemma C.2**.**

If $a\leq_{\textit{TO}}b$ then $C_{a}\sqsubseteq C_{b}$, $P_{a}\sqsubseteq P_{b}$, $H_{a}\sqsubseteq H_{b}$

Proof.

Follows from the fact that each time clocks $\mathbb{P}_{t},\mathbb{H}_{t}$ are updated (Lines 1,2,6,11,12) they are assigned clocks which take maximum of their previous value with some other clock. Also the counter $N_{t}$ is only incremented. ∎

Lemma C.3**.**

For any two events $a,b$ if $a\leq_{\textit{HB}}b$ then $H_{a}\sqsubseteq H_{b}$ and $P_{a}\sqsubseteq P_{b}$

Proof.

If $a\leq_{\textit{TO}}b$ then by Lemma C.2 gives us the required result. Now suppose $a,b$ are in different threads. We perform induction on the position of $b$ in the trace. In the base case when $b$ is in the first position in the trace we have $a=b$ in which case the result trivially follows. Suppose $b$ is not in the first position in the trace. Consider the event $c$ preceding $b$ in its thread (it may not exist). If $a\leq_{\textit{HB}}c$ we use the induction hypothesis along with the Lemma C.2 to get our result. Otherwise $b$ has to be an ${\mathtt{acq(l)}}$ event, and there has to be a previous ${\mathtt{rel(l)}}$ event. Call the last such release before $b$ as $r$. Now $a\leq_{\textit{HB}}r$, and by the induction hypothesis we get $H_{a}\sqsubseteq H_{r}$ and $P_{a}\sqsubseteq P_{r}$. Note that when $r$ updated the state, $\mathbb{H}_{l}$ and $\mathbb{P}_{l}$ were assigned $H_{r}$ and $P_{r}$ respectively in Line 9. And when $b$ is used to update the state $H_{r}$ was joined into $\mathbb{H}_{t}$ in Line 1 and $P_{r}$ was joined into $P_{b}$ in Line 2. Hence $H_{r}\sqsubseteq H_{b}$ and $P_{r}\sqsubseteq P_{b}$, combining this with inequalities obtained from applying the induction hypothesis on $a$ and $r$ gives us our required result. ∎

Lemma C.4**.**

For any event $e$, $P_{e}\sqsubseteq C_{e}\sqsubseteq H_{e}$

Proof.

For $P_{e}\sqsubseteq C_{e}$ note that $C_{e}$ is just a short hand for $P_{e}[t(e):=N_{e}]$ and the fact that no vector clock until $e$ can have it’s $t(e)$ component’s value bigger than $N_{e}$.

For $C_{e}\sqsubseteq H_{e}$ it is sufficient to prove $P_{e}\sqsubseteq H_{e}$ because $P_{e}$ and $C_{e}$ match on every co-ordinate except possibly $t(e)$, but for $t(e)$ we know $P_{e}(t(e))=H_{e}(t(e))=N_{e}$. For $P_{e}\sqsubseteq H_{e}$ we do the following: Any thread begins with $\mathbb{P}_{t}$ and $\mathbb{H}_{t}$ being equal to the 0 vector-clock. As each event is processed we prove that the $\mathbb{P}_{t}\sqsubseteq\mathbb{H}_{t}$ is maintained inductively. We do a case analysis on the type of events. If $e$ is a an acquire, the from Lines 1 and 2 and the induction hypothesis we get that $\mathbb{P}_{t}\sqsubseteq\mathbb{H}_{t}$ is maintained.

When $e$ is a ${\mathtt{rel(l)}}$ event: $\mathbb{P}_{t}$ is updated at Line 6, which has the time $H_{r}$ of a release event ${\mathtt{rel(l)}}$, say $r$ that is performed by thread $t^{\prime}$. But note that when $a=\textit{match}(e)$ was performed $\mathbb{H}_{t}$ received the time from clock $\mathbb{H}_{l}$ (Line 1) which corresponds to the last release on lock $l$, say $r^{\prime}$. Clearly $r^{\prime}$ is later than $r$ in the trace and since they operate over the same lock we have $r\leq_{\textit{HB}}r^{\prime}$ and applying Lemma C.3 we get $H_{r}\sqsubseteq H_{r^{\prime}}$. In Line 1 when $a$ is being processed $\mathbb{H}_{t}$ is updated with $\mathbb{H}_{l}$ which is nothing but $H_{r^{\prime}}$. Which means by the time Line 6 updates $\mathbb{P}_{t}$, the value of $\mathbb{H}_{t}$ is already updated with a larger time.

Next consider the case when $e$ is either a r(x)/w(x) in which case $\mathbb{P}_{t}$ gets updated in Lines 11/12, note that in both cases it gets the time $\mathbb{L}_{\mathtt{l},x}^{r/w}$ of a certain ${\mathtt{rel(l)}}$, say $r$, only if the event $e$ is being performed inside a critical section of $\mathtt{l}$, let the acquire event of that critical section be $a$. Now we know that when $a$ is performed it receives the the time $H_{r^{\prime}}$ (through $\mathbb{H}_{l}$) of last ${\mathtt{rel(l)}}$ event $r^{\prime}$ before $a$. Now once again we have $r\leq_{\textit{HB}}r^{\prime}$ and using the same argument as in the previous paragraph we have our inequality maintained.

∎

Lemma C.5**.**

For any two events $e,r$ in a thread $u$ where $r$ is a release, if $N_{a}\leq N_{r}$ then $a\leq_{\textit{TO}}r$.

Proof.

Each time a release is processed the counter is incremented prior to the next event, this assigns a strictly greater counter for all subsequent events in that thread. ∎

Lemma C.6**.**

For any two events $a,b$ in different threads $u,v$, if $N_{a}\leq H_{b}(u)$ then $a\leq_{\textit{HB}}b$

Proof.

We prove this by induction on the position of the event $b$ in the trace. In the base case we have $b$ in the first position in trace and hence in $v$, so we get $H_{b}(u)=0$. We also have $N_{a}\geq 1$. Therefore the implication is vacuously true. Consider the inductive step: let $b$ be not the first position in the trace . We only need to consider the case where $b$ is not in the first position in the threads as well (otherwise handled like base case). Let $c$ be the event just before $b$ in $v$. If $N_{a}\leq H_{c}(u)$ then we apply induction hypothesis on $a,c$ to obtain $a\leq_{\textit{HB}}c$ and then use $c<_{\textit{TO}}b$ to get $a\leq_{\textit{HB}}b$. Now suppose event $c$ does not satisfy the requirements of the induction hypothesis $N_{a}\nleq H_{c}(u)$, then we get that $b$ is an acquire event, because those are the only events at which $\mathbb{H}_{t}$ changes. The way $\mathbb{H}_{t}$ is updated in Line 1 tells us that either $N_{a}\leq H_{r}(u)$ where $r$ is the last ${\mathtt{rel(l)}}$ event. If $a$ and $r$ are in different threads then we can apply the induction hypothesis on $r$ and use the fact that $r\leq_{\textit{HB}}b$ (definition of HB) to obtain $a\leq_{\textit{HB}}b$. If $a$ and $r$ are in the same thread then we have $N_{a}\leq N_{r}$ and we apply Lemma C.5 to get $a<_{\textit{TO}}r$ which implies $a\leq_{\textit{HB}}r$. ∎

Lemma C.7**.**

For any event $a$ in thread $u$ and a release event $r$ if $N_{a}\leq H_{r}(u)$ then $a\leq_{\textit{HB}}r$

Proof.

If $r$ is in thread $u$ we have $H_{r}(u)=N_{r}$ in which case we can apply Lemma C.5 to get $a\leq_{\textit{TO}}r$ and hence $a\leq_{\textit{HB}}r$. If not then we apply Lemma C.6 to get $a\leq_{\textit{HB}}r$. ∎

Lemma C.8**.**

For any two events $a,b$ in threads $u,v$ if $N_{a}\leq P_{b}(u)$ then $a\prec_{\textit{WCP}}^{\sigma}b$.

Proof.

We prove this by induction on position of $b$ in the trace. In the base case since $b$ is in the first position in $v$ we get $P_{b}(u)=0$. We also have $N_{a}\geq 1$. This makes the required implication vacuously true.

Consider the inductive step. Let $c$ be the event just before $b$ in $u$. If $N_{a}\leq P_{c}(u)$ then applying induction hypothesis on $a,c$ we get the required result. Suppose $P_{c}(u)<N_{a}\leq P_{b}(u)$ then we get that $b$ is an event where $\mathbb{P}_{t}$ is updated. We do case analysis on different kinds of events for $b$

• •

Suppose $b$ is ${\mathtt{acq(l)}}$ then Line 2 tells us that $N_{a}\leq P_{r}(u)$ where $r$ is the last ${\mathtt{rel(l)}}$ before $b$. Then we apply induction on $a,r$ to get $a\prec_{\textit{WCP}}r$. Using $r\leq_{\textit{HB}}b$ (Definition of HB) and applying Rule (c) of WCP we get $a\prec_{\textit{WCP}}b$.

• •

Suppose $b$ is a r(x) then Line 11 tells us that for some $\ell$, $N_{a}\leq H_{r}(u)$ where $r$ is some ${\mathtt{rel(\ell)}}$ event such that $b\in\ell$ and $\textup{CS}(r)$ contains a w(x). Applying Lemma C.7 on $N_{a}\leq H_{r}(u)$ we get $a\leq_{\textit{HB}}r$. Combining this with $r\prec_{\textit{WCP}}b$ (Rule (b)) we get $a\prec_{\textit{WCP}}b$ using Rule (c).

• •

If $b$ is a w(x) the argument is similar to the case of r(x) above.

• •

Suppose $b$ is a ${\mathtt{rel(l)}}$ event. Note that $\mathbb{P}_{t}$ is updated in Line 6 iteratively. Given $b$ we prove that for events $a$ for which $N_{a}\leq P_{b}(t(a))$ after $i$ iterations ($i$ times the while loop has been executed) $a\prec_{\textit{WCP}}b$ holds by inducting on $i$. The base case when $i=0$ implies the previous event $c$ is such that $N_{a}\leq P_{c}(u)$ and by the outer induction (on position of $b$) gives us that $a\prec_{\textit{WCP}}c$ and from thread order we have $c\leq_{\textit{HB}}b$, composing the two we get $a\prec_{\textit{WCP}}b$.

Suppose $N_{a}\leq P_{b}(u)$ after $i$ but not $i-1$ iterations. This implies there exists an acquire event $e$ and it’s matching release $r=\textit{match}(e)$ such that $N_{a}\leq H_{r}(u)$ (Line 6 and Lemma C.1). Once again if $N_{a}\leq H_{r}(u)$ then we have $a\leq_{\textit{HB}}r$ by Lemma C.7. We also have that value of $C_{b}$ at the end of $i-1$ iterations is such that $C_{e}\sqsubseteq C_{b}$ (Line 4). Which implies $N_{e}\leq C_{b}(t(e))$. But note that the queue $Acq_{\ell}(t)$ only contains acquire times of threads other than $t$ (from Line 3). This implies $C_{b}(t(e))=P_{b}(t(e))$ and we have $N_{e}\leq P_{b}(t(e))$ and by the inner induction hypothesis we have $e\prec_{\textit{WCP}}b$. Using Rule (b) of WCP we get $r\prec_{\textit{WCP}}b$ and composing the two using Rule (c) we get $a\prec_{\textit{WCP}}b$. ∎

Corollary C.1**.**

For any two events $a,b$ such that $a<_{\textit{tr}}b$ if $C_{a}\sqsubseteq C_{b}$ then $a\leq_{\textit{WCP}}b$.

Proof.

If $a$ and $b$ are in the same thread then we have $a<_{\textit{TO}}b$ and so we get $a\leq_{\textit{WCP}}b$. If $a$ and $b$ are in different threads $u$ and $v$, then $N_{a}=C_{a}(u)\leq C_{b}(u)=P_{b}(u)$ or $N_{a}\leq P_{b}(u)$ and then by using Lemma C.8 we get $a\prec_{\textit{WCP}}b$. ∎

Next we see how to prove the other side of the correspondence.

Lemma C.9**.**

For any two events $a,b$ if $a\prec_{\textit{WCP}}b$ then $H_{a}\sqsubseteq P_{b}$

Proof.

We look at how $a\prec_{\textit{WCP}}b$ is derived from the Rules of WCP and perform induction on this derivation/proof. The base case is when the derivation is of size one i.e., it is derived from Rule (a) of WCP, in which case $a$ is a ${\mathtt{rel(l)}}$ such that $\textup{CS}(a)$ contains an event $e$ which conflicts with $b$ which occurs later inside a different critical section of $\tt{l}$. When $a$ updates the state, the clocks $\mathbb{L}_{l,x}^{w}/\mathbb{L}_{l,x}^{r}$ (depending upon $e$ being r(x)/w(x)) are joined with $H_{a}$ in Lines 7/8. Later when $b$ updates the state it reads from $\mathbb{L}_{l,x}^{w}/\mathbb{L}_{l,x}^{r}$ (Line 11/12) and assigns it to $P_{b}$ and therefore $H_{a}\sqsubseteq P_{b}$

The inductive case involves considering the last step of the derivation which could be the use of Rule (b) or (c). Let us consider Rule (b) first. Here $a$ and $b$ are two ${\mathtt{rel(l)}}$ events such that their critical sections contain events $e_{1},e_{2}$ such that $e_{1}\prec_{\textit{WCP}}e_{2}$. By the induction hypothesis we have $H_{e_{1}}\sqsubseteq P_{e_{2}}$. Let $d$ be the acquire event $\textit{match}(a)$. Since $d\leq_{\textit{TO}}e_{1}$ applying Lemma C.2 we get $C_{d}\sqsubseteq C_{e_{1}}$. Combining these with $P_{e_{2}}\sqsubseteq C_{e_{2}}\sqsubseteq C_{b}$ (from Lemmas C.4 and C.2) we get $C_{d}\sqsubseteq C_{b}$.

Before moving ahead with the above argument we elaborate how the queues are manipulated. Each ${\mathtt{acq(l)}}$ event performed by a thread $t$ has its time $\mathbb{C}_{t}$ inserted into the stack $Acq_{l}(u)$ for every $u\neq t$ (Line 3) and similarly for release the time $H_{t}$ is inserted into the the queue $Rel_{l}(u)$ (Line 10). These times are inserted in chronological order (earlier first) as these events are seen, and they are inserted exactly once. The only event that prompts deque from the queue $Acq_{l}(u)$ and $Rel_{l}(u)$ are ${\mathtt{rel(l)}}$ events in thread $u$. Entries from the two queues are always dequed together to ensure that if a acquire is removed then its matching release is also removed. Note that if an acquire/release pair $a^{\prime}/r^{\prime}$ has already been removed from the respective queues during a previous release event $r_{1}$ in thread $u$ then we can inductively obtain that $H_{r^{\prime}}\sqsubseteq P_{r_{1}}$ and use $P_{r_{1}}\sqsubseteq P_{r}$ (Lemma C.2) to get $H_{r^{\prime}}\sqsubseteq P_{r}$. The base case of this induction involves considering the situation when a pair $a^{\prime}/r^{\prime}$ is removed during the state update of the current release $r$ (and not a previous release $r_{1}$ in $u$). Such an $a^{\prime}$ is removed if and only if $C_{a^{\prime}}\sqsubseteq C_{r}$ (Line 4), and if it is removed then Line 6 ensures $H_{r^{\prime}}\sqsubseteq P_{r}$.

Continuing our argument in the paragraph before now we get that $H_{a}\sqsubseteq P_{b}$ because the matching acquire of $a$ which is $d$ is such that $C_{d}\sqsubseteq C_{b}$. This completes the induction step corresponding to Rule (b) being the last step of the derivation.

Now the final step is to consider the induction step corresponding to last step of the derivation being Rule (c). First consider when there exists $c$ such that $a\prec_{\textit{WCP}}c\leq_{\textit{HB}}b$ then applying induction hypothesis on $a\prec_{\textit{WCP}}c$ we have $H_{a}\sqsubseteq P_{c}$ and then applying Lemma C.3 on $c\leq_{\textit{HB}}b$ we get $P_{c}\sqsubseteq P_{b}$ and using transitivity of $\sqsubseteq$ we get $H_{a}\sqsubseteq P_{b}$. Next consider the other case when there exists $c$ such that $a\leq_{\textit{HB}}c\prec_{\textit{WCP}}b$ then applying Lemma C.3 on $a\leq_{\textit{HB}}c$ we get $H_{a}\sqsubseteq H_{c}$, and applying the induction hypothesis on $c\prec_{\textit{WCP}}b$ gives us $H_{c}\sqsubseteq P_{b}$. Once again using transitivity of $\sqsubseteq$ we obtain $H_{a}\sqsubseteq P_{b}$. ∎

Corollary C.2**.**

For any two events $a,b$ if $a\leq_{\textit{WCP}}b$ then $C_{a}\sqsubseteq C_{b}$

Proof.

If $a\leq_{\textit{TO}}b$ then we have $C_{a}\sqsubseteq C_{b}$ from Lemma C.2. Otherwise we have $a\prec_{\textit{WCP}}b$ by definition of $\leq_{\textit{WCP}}=(\prec_{\textit{WCP}}\cup\leq_{\textit{TO}})$, and applying Lemma C.9 we get $H_{a}\sqsubseteq P_{b}$ but we have $P_{b}\sqsubseteq C_{b}$ and $C_{a}\sqsubseteq H_{a}$ (Lemma C.4) which gives us $C_{a}\sqsubseteq C_{b}$ (transitivity of $\sqsubseteq$). ∎

Theorem 2 follows from Corollaries C.1 and C.2.

Appendix D Running time analysis of algorithm

First note that the join operation on two vector clocks takes $O({\mathcal{T}})$ time (assuming arithmetic can be done in constant time), as this amounts to taking the pointwise maximum across ${\mathcal{T}}$ different components of the vector clock. Each call to the procedure acquire takes $O({\mathcal{T}}^{2})$ time (Lines 1 and 2 takes $O({\mathcal{T}})$, Line 3 takes $O({\mathcal{T}}^{2})$). For the release procedure, we analyze the total running time of all the invocation of release procedure. Note that the total running time of the while loop for all the release calls simply depends on the number of entries (acquire/release times) removed from the queues, which can be bounded by the number of such entries ever added to the queues. Note that an entry corresponding to a critical section is added to ${\mathcal{T}}-1$ queues (Line 3). Hence the while oopin total takes at most $\mathcal{N}{\mathcal{T}}$ (as there are at most $\mathcal{N}$ acquire/release events in the trace) steps and each step takes $O({\mathcal{T}})$ time since we are dealing with vector clocks, therefore the while loop takes $O(\mathcal{N}{\mathcal{T}}^{2})$ time in total across all release calls. A similar aggregate analysis can be done for Lines 7 and 8 to conclude that they take $O(\mathcal{N}{\mathcal{T}})$ time in total. Line 9 takes $O(\mathcal{N}{\mathcal{T}})$ in total. The for loop on Line 10 takes $O(\mathcal{N}{\mathcal{T}}^{2})$ in total. The total time spent in processing acquires is therefore $O(\mathcal{N}{\mathcal{T}}^{2})$. Each $\textnormal{{read}}/\textnormal{{write}}$ procedure take time proportional to the number of critical sections it is contained in, which can be at most $\mathcal{L}$ and hence the total time spend in them amounts to $O(\mathcal{N}\mathcal{L})$. The local clock increment not mentioned in the pseudocode takes takes $O(\mathcal{N})$ time in total (each individual increment in assumed to be constant) In total therefore the running time of the vector clock algorithm comes to $O(\mathcal{N}({\mathcal{T}}^{2}+\mathcal{L}))$.

Appendix E Lower Bounds

Proof of Theorem 4: Consider the language $L_{n}=\{uv\>|\>u,v\in\{0,1\}^{n}\mbox{ and }u=v\}$. Observe that any (finite) automaton recognizing $L_{n}$ must have $2^{n}$ states. This is because if there is an automaton $M$ with $<2^{n}$ states that recognizes $L_{n}$, then there are two strings $u_{1}\neq u_{2}\in\{0,1\}^{n}$ such that $M$ is in the same state after reading $u_{1}$ and $u_{2}$. This means either $M$ accepts both $u_{1}u_{1}$ and $u_{1}u_{2}$ or rejects both $u_{1}u_{1}$ and $u_{1}u_{2}$, which contradicts the fact that $M$ recognizes $L_{n}$. Thus, any one pass TM for $L_{n}$ must use space $n$.

We will essentially show how to “reduce” checking membership in $L_{n}$ to checking WCP. The reduction uses constantly many threads, locks and variables. Let us consider the special case of $n=3$. Suppose the input to $L_{3}$ is $w=b_{0}b_{1}b_{2}c_{0}c_{1}c_{2}$. For this input $w$, we will construct the trace shown in Figure 8 (which is a parameterized and extended version of the trace in Figure 6), where in the trace, the lock $b_{i},c_{j}\in\{\ell_{0},\ell_{1}\}$, depending on what the corresponding bit in $w$ is. Once again the edges shown in the graph correspond to edges produced by Rules (a) or (b), but in this case the edges are contingent on the values of $b_{i}$s and $c_{i}$s. For example the edge from ${\mathtt{rel(b_{0})}}$ to ${\mathtt{rel(c_{0})}}$ and the edge between ${\mathtt{rel(m)}}$ (call this edge $m_{0}$) on Lines 10 and 29 are dependent on $b_{0}=c_{0}$. Going forward the the edge from ${\mathtt{rel(b_{1})}}$ to ${\mathtt{rel(c_{1})}}$ depends on the edge $m_{0}$ ($b_{0}=c_{0}$) and $b_{1}=c_{1}$. The argument continues till you reach the edge between ${\mathtt{rel(m)}}$ between Lines 24 and 37 which requires $b_{0}b_{1}b_{2}=c_{0}c_{1}c_{2}$. This implies the two w(z) events are WCP ordered iff $b_{i}=c_{i}$ for all $i$. Therefore checking whether the word $w=b_{0}b_{1}b_{2}c_{0}c_{1}c_{2}$ boils down to checking whether there is a WCP-race.

Proof of Theorem 5: Note that the lower bound we initially proved in Section 3 applies to algorithms that do a single pass over the trace. But the above argument can in fact be generalized to prove a combined time and space trade-off on any algorithm as follows. Note that the communication complexity of checking if two $n$-bit strings are equal is $\Omega(n)$. Consider the language $L_{n}=\{u\#^{n}v\>|\>u,v\in\{0,1\}^{n}\mbox{ and }u=v\}$ and its membership problem. Now consider any Turing Machine $M$ that is allowed to solve $L_{n}$ by going back and forth. If $M$ takes $T(n)$ time then we know it has to make at most $\frac{T(n)}{n}$ “rounds” of $\#^{n}$. If the space requirement of $M$ is $S(n)$ then we know it can carry at most $S(n)$ bits in each rounds, implying it communicated $\frac{T(n)S(n)}{n}$ bits across the channel of $\#^{n}$. The total number of bits it needs to communicate in the end is $n$, which means $T(n)S(n)\in\Omega(n^{2})$. The words $u\#^{n}v$ can once again be modeled in a trace as before with $\#^{n}$ being junk events in the trace and correspondence between membership in $L_{n}$ and WCP race detection can be shown exactly in the same way as before.