Fast, Sound and Effectively Complete Dynamic Race Prediction

TL;DR

This paper introduces M2, a novel polynomial-time algorithm for dynamic data race prediction in lock-based concurrent programs that is both sound and complete for two-process traces, outperforming existing methods.

Contribution

The paper presents M2, the first sound and complete polynomial-time algorithm for dynamic race prediction in two-process traces, with effective partial completeness for more processes.

Findings

M2 detects all races in two-process traces.

The tool reports thousands of races with at most one miss.

Running times are comparable or better than existing methods.

Abstract

Writing concurrent programs is highly error-prone due to the nondeterminism in interprocess communication. The most reliable indicators of errors in concurrency are data races, which are accesses to a shared resource that can be executed consecutively. We study the problem of predicting data races in lock-based concurrent programs. The input consists of a concurrent trace $t$, and the task is to determine all pairs of events of $t$ that constitute a data race. The problem lies at the heart of concurrent verification and has been extensively studied for over three decades. However, existing polynomial-time sound techniques are highly incomplete and can miss many simple races. In this work we develop M2: a new polynomial-time algorithm for this problem, which has no false positives. In addition, our algorithm is complete for input traces that consist of two processes, i.e., it provably detects all races in the trace. We also develop sufficient conditions for detecting completeness dynamically in cases of more than two processes. We make an experimental evaluation of our algorithm on a standard set of benchmarks taken from recent literature on the topic. Our tool soundly reports thousands of races and misses at most one race in the whole benchmark set. In addition, our technique detects all racy memory locations of the benchmark set. Finally, its running times are comparable, and often smaller than the theoretically fastest, yet highly incomplete, existing methods. To our knowledge, M2 is the first sound algorithm that achieves such a level of performance on both running time and completeness of the reported races.

Equations

$$\mathsf{loc}(r)=\mathsf{loc}(w)\text{and}w{<}_{t}r\text{and}\forall w^{\prime }\in \mathcal{W}(t)\setminus \{w\}\text{ with }w\bowtie w^{\prime }:w^{\prime }{<}_{t}r\Rightarrow w^{\prime }{<}_{t}w$$

$$\text{if }{w}^{\prime }{<}_{P}r\text{ then }{w}^{\prime }{<}_{P}w\text{and}\text{if }w{<}_P{w}^{\prime }\text{ then }r{<}_P{w}^{\prime }$$

$${\mathsf{RCone}}_t(e_6,p_3)=\{e_i{\}}_{i=1}^5\text{and}{\mathsf{RCone}}_t(e_{16},p_1)=\{e_i{\}}_{i=8}^{15}$$

$${\mathsf{RCone}}_t(e_5,p_3)=\{e_i{\}}_{i=1}^4\text{and}{\mathsf{RCone}}_t(e_{13},p_1)=\{e_1\}\cup \{e_i{\}}_{i=7}^{12}$$

$${\mathsf{RCone}}_t(e_2,p_2)=\{e_1\}\text{and}{\mathsf{RCone}}_t(e_7,p_1)=\{e_i{\}}_{i=4}^6$$

$${\mathsf{RCone}}_t(e_2,p_3)=\{e_1\}\text{and}{\mathsf{RCone}}_t(e_{14},p_1)=\{e_i{\}}_{i=5}^{13}$$

$$\displaystyle A=\{(e_{1},e_{2}):\leavevmode\nobreak\$$

Full text

In this work we develop $\mathsf{M2}$: a new polynomial-time algorithm for this problem, which has no false positives. In addition, our algorithm is complete for input traces that consist of two processes, i.e., it provably detects all races in the trace. We also develop sufficient criteria for detecting completeness dynamically in cases of more than two processes. We make an experimental evaluation of our algorithm on a challenging set of benchmarks taken from recent literature on the topic. Our algorithm soundly reports hundreds of real races, many of which are missed by existing methods. In addition, using our dynamic completeness criteria, $\mathsf{M2}$ concludes that it has detected all races in the benchmark set, hence the reports are both sound and complete. Finally, its running times are comparable, and often smaller than the theoretically fastest, yet highly incomplete, existing methods. To our knowledge, $\mathsf{M2}$ is the first sound algorithm that achieves such a level of performance on both running time and completeness of the reported races.

concurrency, race detection, predictive analyses

††copyright: none††ccs: Software and its engineering Software verification and validation††ccs: Theory of computation Theory and algorithms for application domains††ccs: Theory of computation Program analysis

1. Introduction

Verification of concurrent programs. Writing concurrent software is notoriously hard due to the inherent nondeterminism in the way that accesses to shared resources are scheduled. Accounting for all possible nondeterministic choices is hard, even to experienced developers. This makes the development of concurrent software prone to concurrency bugs (Lu et al., 2008; Shi et al., 2010), i.e., bugs that are present only in a few among the (possibly exponentially) many executions of the program. Since developers have no control over the scheduler, concurrency bugs are also hard to reproduce by testing (often categorized as Heisenbugs (Gray, 1985; Musuvathi et al., 2008)). Consequently, testing alone is considered an ineffective approach for detecting bugs in concurrent programs. To circumvent this difficulty, testing techniques are often combined with model checking. First, a testing phase produces a set of concrete program executions. Then, a verification phase makes a formal treatment of these executions and identifies whether there exist other “neighboring” executions that are not present in the test set but (i) constitute valid executions of the program and (ii) manifest a bug. Hence, even though the scheduler might “hide” a bug in the test set, this bug can be effectively caught by formal techniques applied on the test set.

Data races. Two events $(e_{1},e_{2})$ of a concurrent program are called conflicting if they access the same shared resource (e.g., the same global variable $x$) and at least one of them modifies the resource (e.g., writes to $x$). A data race is typically defined as a conflicting pair $(e_{1},e_{2})$ that can be executed concurrently (Helmbold et al., 1991; O’Callahan and Choi, 2003; Flanagan and Freund, 2009; Bond et al., 2010). Data races are the prime suspects of erroneous behavior, and there have been significant efforts spanning across several decades towards detecting data races efficiently, starting with seminal papers found in (Schonberg, 1989; Helmbold et al., 1991; Dinning and Schonberg, 1991; Savage et al., 1997).

Dynamic race detection. Dynamic algorithms for race detection operate on a single execution (i.e., a trace) of the concurrent program, and their task is to identify pairs of events of the trace that constitute a race, even though the race might not be manifested in the input trace. Dynamic race detection is a popular technique that combines testing with formal reasoning. Existing dynamic algorithms typically fall into one of the following three categories.

Lockset-based techniques (Dinning and Schonberg, 1991; Savage et al., 1997; Elmas et al., 2007) report races by comparing the sets of locks which guard conflicting data accesses. This approach typically reports spurious races, as data accesses protected by different locks can nevertheless be separated by other control-flow and data dependencies, and thus not constitute a race.

Exhaustive predictive-runtime techniques (Savage et al., 1997; Sen et al., 2005; Chen and Roşu, 2007; Said et al., 2011; Huang et al., 2014) report races by exploring all possible valid reorderings of the input trace. These techniques typically rely on SAT/SMT solvers and are sound and complete in theory; however, as there are exponentially many valid reorderings, they have exponential complexity. In practice, completeness is traded for runtime, by using windowing techniques which slice the input trace into small fragments and analyze each fragment separately.

Partial-order-based techniques are probably the most well-known and widely-used. The underlying principle is to construct a partial order $P$ on the events of the input trace. Afterwards, a race is reported between a pair of events if the two events are unordered by $P$. These techniques are usually efficient, as constructing the partial order typically requires polynomial time. However, in order for $P$ to admit a linearization to a valid witness trace that exposes the race, $P$ enforces many arbitrary orderings between events. These arbitrary orderings often result in an ordering between the events of an actual race, and thus $P$ misses the race.

Most of the above techniques are based on Lamport’s happens-before ($\mathsf{HB}$) partial order (Lamport, 1978) which is implemented in various tools (Schonberg, 1989; Christiaens and Bosschere, 2001; Pozniansky and Schuster, 2003; Yu et al., 2005; Flanagan and Freund, 2009; Bond et al., 2010). As $\mathsf{HB}$ is highly incomplete, there have been several efforts for constructing weaker partial orders that are efficiently computable, such as the causally-precedes partial order $\mathsf{CP}$ (Smaragdakis et al., 2012). Partial-order techniques recently led to important advances in predictive race detection, based on the weakly-causally-precedes $\mathsf{WCP}$ (Kini et al., 2017), schedulably-happens-before $\mathsf{SHB}$ (Mathur et al., 2018) and doesn’t-commute $\mathsf{DC}$ (Roemer et al., 2018) partial orders. We next discuss these approaches in more detail and outline the motivation behind our work.

1.1. Motivating Examples

We illustrate the motivation behind our work with a few simple examples (Figure 1) which highlight some completeness issues that the existing approaches based on $\mathsf{HB}$, $\mathsf{WCP}$ and $\mathsf{DC}$ partial orders suffer from. We focus on single races here, in which case $\mathsf{SHB}$ is subsumed by $\mathsf{HB}$. We remark that we focus on polynomial-time, sound methods here, and hence we do not consider unsound techniques (e.g., lockset-based (Savage et al., 1997)) or techniques that rely on SAT/SMT solvers and are thus not polynomial time (e.g., (Huang et al., 2014)). In each example, we use the notation $\tau_{i}$ to refer to the local trace of the $i$-th process, and $e_{j}$ to refer to the $j$-th event in the concurrent trace. We note that the underlying memory model is sequentially consistent, i.e., in every trace, a read event observes the value of the last write event that writes to the location read by the read event.

To develop some context, we briefly outline how each of these techniques works by ordering events of the input trace. We refer to Appendix B for the formal definitions. In all cases, events that belong to the same process are always totally ordered according to their order in the input trace.

1. (1)

The $\mathsf{HB}$ and $\mathsf{WCP}$ techniques operate in a similar manner. They perform a single pass of $t$ and construct a partial order $\leq_{\mathsf{HB}}$ (resp., $\leq_{\mathsf{WCP}}$). A race $(e,e^{\prime})$ is reported if $e,e^{\prime}$ are conflicting and $e\not\leq_{\mathsf{HB}}e^{\prime}$ (resp., $e\not\leq_{\mathsf{WCP}}e^{\prime}$), i.e., the two events are unordered by the respective partial order. 2. (2)

$\mathsf{DC}$ operates in three phases, which all have to succeed for $(e,e^{\prime})$ to be reported as a race.

1. (a)

In Phase 1, a $\mathsf{DC}$ partial order is constructed, similarly to $\mathsf{HB}$ and $\mathsf{WCP}$. If $e\leq_{\mathsf{DC}}e^{\prime}$ then $(e,e^{\prime})$ is reported as a non-race. 2. (b)

In Phase 2, a constraint graph $G$ is constructed which contains the $\mathsf{DC}$ orderings. Then, more ordering constraints are inserted in $G$. If $G$ becomes cyclic during this process, $(e,e^{\prime})$ is reported as a non-race. If $t^{*}$ fails to respect lock semantics, $(e,e^{\prime})$ is reported as a non-race.

Incompleteness. Each of $\mathsf{HB}$, $\mathsf{WCP}$ and $\mathsf{DC}$ methods are incomplete i.e., the input trace $t$ can have arbitrarily many predictable races, however each of these methods falsely reports that there is no race in $t$. We present a couple of examples where $\mathsf{HB}$, $\mathsf{WCP}$ and $\mathsf{DC}$ fail to detect simple races.

Figure 1(a)**. There is a predictable race $(e_{2},e_{7})$. $\mathsf{HB}$ defines $e_{3}\leq_{\mathsf{HB}}e_{4}$, and thus $e_{2}\leq_{\mathsf{HB}}e_{7}$, hence missing the race. Similarly, $\mathsf{WCP}$ (resp., $\mathsf{DC}$ ) defines $e_{3}\leq_{\mathsf{WCP}}e_{5}$ (resp., $e_{3}\leq_{\mathsf{DC}}e_{5}$) and thus $e_{2}\leq_{\mathsf{WCP}}e_{7}$ (resp., $e_{2}\leq_{\mathsf{DC}}e_{7}$), hence missing the race. Intuitively, $\mathsf{WCP}$ and $\mathsf{DC}$ fail to swap the two critical sections because they contain the conflicting events $w(x)$. Note that here $\mathsf{DC}$ fails in Phase 1. However, $(e_{2},e_{7})$ is a true race that is detected by the techniques developed in this work, exposed by the witness trace $t^{*}=e_{4},e_{5},e_{6},e_{1},e_{2},e_{7}$.

Figure 1(b)**. There is a predictable race $(e_{2},e_{14})$. $\mathsf{HB}$ defines $e_{4}\leq_{\mathsf{HB}}e_{5}$ and $e_{8}\leq_{\mathsf{HB}}e_{11}$, and thus $e_{2}\leq_{\mathsf{HB}}e_{14}$, hence missing the race. Similarly, $\mathsf{WCP}$ defines $e_{4}\leq_{\mathsf{WCP}}e_{5}$ and $e_{8}\leq_{\mathsf{WCP}}e_{12}$ and thus $e_{2}\leq_{\mathsf{WCP}}e_{14}$, hence missing the race. Intuitively, $\mathsf{WCP}$ fails to swap the critical sections of $\tau_{1}$ and $\tau_{2}$ on $\ell_{1}$ because $\mathsf{WCP}$ is closed under composition with $\mathsf{HB}$, and in turn $\mathsf{HB}$ totally orders critical sections as in the input trace. On the other hand, $\mathsf{DC}$ does not compose with $\mathsf{HB}$, and the only enforced orderings are $e_{4}\leq_{\mathsf{DC}}e_{9}$ and $e_{8}\leq_{\mathsf{DC}}e_{12}$. Hence $\mathsf{DC}$ proceeds with Phase 2, where it constructs a constraint graph $G$. Since $e_{4}\leq_{\mathsf{DC}}e_{9}$ and $e_{9}$ belongs in a critical section on lock $\ell_{1}$ which is released by $e_{4}$, in order to not violate lock semantics, $G$ forces the ordering $e_{4}\rightsquigarrow e_{5}$. In addition, $G$ forces the ordering $e_{5}\rightsquigarrow e_{2}$, since $e_{2}$ is the racy event and must appear last in the witness trace. Note that this creates a cycle and hence $\mathsf{DC}$ fails in Phase 2. However, $(e_{2},e_{14})$ is a true race that is detected by the techniques developed in this work, exposed by the witness trace $t^{*}=e_{5},e_{6},e_{7},e_{8},e_{9},e_{10},e_{11},e_{12},e_{13},e_{1},e_{2},e_{14}$.

Algorithmic challenge. We have seen that state-of-the-art approaches fail to catch simple races. Intuitively, the algorithmic challenge that underlies race detection is that of constructing a partial order $P$ with the following properties.

1. (1)

$P$ is as weak as possible, so that a race $(e_{i},e_{j})$ remains unordered in $P$. 2. (2)

$P$ is efficiently linearizable to a valid trace that exposes the race.

These two features are opposing each other, as the weaker the partial order, the more linearizations it admits, and finding a valid one becomes harder. Intuitively, existing techniques solve the efficiency problem by ordering conflicting accesses in $P$ in the same way as in $t$. As we have seen, this results in strong partial orders that miss simple races.

Our approach. In this work we develop a new predictive technique for race detection. At its core, our algorithm constructs partial orders that are much weaker than existing approaches (hence detecting more races), while these partial orders are efficiently (polynomial-time) linearizable to valid traces (hence the reported races are exposed efficiently). To give a complete illustration of our insights, we use the more involved example in Figure 2.

The task is to decide whether $(e_{10},e_{19})$ is a predictable race of the input trace $t$ (Figure 2(a)). To keep the presentation simple, we ignore the other data races that occur, which can be trivially avoided by inserting additional lock events. Note that $\mathsf{HB}$, $\mathsf{WCP}$ and $\mathsf{DC}$ report no race in $t$, as they all order $e_{11}\leq e_{14}$. In order to detect this race, we need to make some non-trivial reasoning about reordering certain events in $t$. Our reasoning can be summarized in the following steps.

1. (1)

If $(e_{10},e_{19})$ is a race of $t$, a witness trace $t^{*}$ can be constructed in which both $e_{10}$ and $e_{19}$ are the last events. Observe that $t^{*}$ will not contain the $\mathsf{rel}(\ell)$ event $e_{11}$. 2. (2)

Since we ignore event $e_{11}$, that critical section of $\tau_{1}$ remains open in $t^{*}$. Hence the $\mathsf{rel}(\ell)$ event $e_{15}$ must be ordered before the $\mathsf{acq}(\ell)$ event $e_{8}$. In addition, the $w(x_{2})$ event $e_{2}$ is observed by the $r(x_{2})$ event $e_{17}$, hence $e_{2}$ must be ordered before $e_{17}$. These constraints, together with the program order which requires events of each process to occur in the same order as in the input trace, are captured by the partial order shown in solid edges in Figure 2(b). Note that several conflicting accesses to $x_{1}$, $x_{3}$ and $x_{4}$ are still unordered. How can we obtain a valid linearization? First, we can infer a few more orderings. 3. (3)

The $r(x_{4})$ event $e_{9}$ must observe the same write event as in $t$. Due to the previous step, the $w(x_{4})$ event $e_{14}$ now is ordered before $e_{9}$. To avoid $e_{9}$ observing $e_{14}$, we perform an observation-closure step, by ordering $e_{14}$ before the observation $e_{5}$ of $e_{9}$ (see dashed edge in Figure 2(b)). 4. (4)

Due to the previous step, the $\mathsf{acq}(\ell)$ event $e_{13}$ is now ordered before the $\mathsf{rel}(\ell)$ event $e_{7}$. In order to not violate lock semantics, the critical section of the second process must be ordered before the first critical section of the first process. Hence we perform a lock-closure step, by ordering the $\mathsf{rel}(\ell)$ event $e_{15}$ before the lock-acquire event $e_{4}$ (see dashed edge in Figure 2(b)). 5. (5)

At this point, no other closure step is performed, and the partial order is called trace-closed. Note that there still exist conflicting accesses to variables $x_{1}$ and $x_{3}$ which are pairwise unordered and quite distant, hence not every linearization produces a valid trace, and a correct linearization is not obvious. We observe that we can obtain a valid trace by starting from the beginning of $\tau_{1}$ and $\tau_{2}$, and execute the former maximally and the latter minimally, according to the partial order. That is, we repeatedly execute $\tau_{1}$ until we reach an event that is preceded by an event of $\tau_{2}$, and then execute $\tau_{2}$ only until an event of $\tau_{1}$ becomes enabled again. This max-min linearization produces a valid witness trace (see Figure 2(c)).

In this work we make the above insights formal. We define the notion of trace-closed partial orders, which captures observation and lock-closure steps, and develop an efficient (polynomial-time) algorithm for computing the closure. For two processes, we show that max-min linearizations always produce valid traces, as long as the partial order is trace-closed. Hence, in this case, we have a sound and complete algorithm. The case of three or more processes is more complicated, and our algorithm might eventually order some (but crucially, not all) conflicting events arbitrarily. Although these choices might sacrifice completeness, the resulting partial orders are much weaker than before, so that complex races can still be exposed soundly by a max-min linearization.

1.2. Our Contributions

In summary, the contributions of this work are as follows.

A new algorithm for dynamic race detection. Our main contribution is a polynomial-time and sound algorithm for detecting predictable races present in the input trace. In addition, our algorithm is complete for input traces that consist of events of two processes. First we study the decision problem, that is, given an input trace $t$ and a pair of events $(e_{1},e_{2})$ of $t$, decide whether the pair constitutes a data race of $t$. We present a sound algorithm for the problem that operates in $O(n^{2}\cdot\log n)$ time, where $n$ is the length of $t$. Since all data races can be computed by solving the decision problem for each of the $\binom{n}{2}$ event pairs, we obtain a sound algorithm for reporting all races that requires $O(n^{4}\cdot\log n)$ time. In all cases, if the input trace consists of events of two processes, our race reports are also complete.

Our techniques rely on a new notion of trace-closed partial orders, which might be of independent interest. Informally, a closed partial order wrt a trace $t$ is a partial order over a subset of events of $t$ that respects (i) the observation $w(x)$ of each read event $r(x)$ in $t$, and (ii) the lock semantics. We define max-min linearizations of closed partial orders, and prove sufficient conditions under which a max-min linearization produces a valid trace. Finally, we show that given a partial order of small width, its closure can be computed in $O(n^{2}\cdot\log n)$ time. To this end, we develop a data structure $\mathsf{DS}$ for maintaining the incremental transitive closure of directed acyclic graphs of small width. $\mathsf{DS}$ requires $O(n)$ initialization time, after which it supports edge insertions and reachability queries in $O(\log n)$ time. Here, the width of partial orders is bounded by the number of processes, which is a small constant compared to the length of the trace, and hence our data structure is relevant.

A practical algorithm and implementation. We develop an algorithm for the function problem of race detection that is more practical than simply solving the decision problem for all possible pairs. The efficiency of the algorithm comes while retaining the soundness and completeness guarantees. We also develop sufficient conditions for detecting dynamically that our algorithm is complete for a given input, even in cases where completeness is not guaranteed theoretically.

We make a prototype implementation of our practical algorithm and evaluate it on a standard set of benchmark traces that contain hundreds of millions of events. We compare the performance of our tool against state-of-the-art, polynomial-time, partial-order-based methods, namely the $\mathsf{HB}$ (Lamport, 1978), $\mathsf{WCP}$ (Kini et al., 2017), $\mathsf{DC}$ (Roemer et al., 2018) and $\mathsf{SHB}$ (Mathur et al., 2018) methods. Our approach detects significantly more races than each of these methods, while it has comparable running time, and typically being faster. In fact, our algorithm does not simply detect more races; it detects all races in the benchmark traces, and soundly reports that no more races (other than the detected ones) exist. To our knowledge, this is the first sound algorithm that achieves such a level of performance on both running time and completeness of the reported races.

2. Preliminaries

In this section we introduce useful notation and define the problem of dynamic race detection for lock-based concurrent programs. The model follows similar recent works (e.g., (Kini et al., 2017)).

Concurrent program. Given a natural number $k$, let $[k]$ denote the set $\{1,\dots,k\}$. We consider a shared-memory concurrent program $\mathcal{P}$ that consists of $k$ processes $\{p_{i}\}_{i\in[k]}$, under sequential consistency semantics. For simplicity of presentation we assume that $k$ is fixed a-priori, and no process is created dynamically. All results presented here can be extended to a setting with dynamic process creation. Communication between processes occurs over a set of global variables $\mathcal{G}$, and synchronization over a set of locks $\mathcal{L}$. We let $\mathcal{V}=\mathcal{G}\cup\mathcal{L}$ be the set of all variables of $\mathcal{P}$. Each process is deterministic, and performs a sequence of operations on execution. We are only interested in the operations that access a global variable or a lock, which are called events.

1. (1)

Given a global variable $x\in\mathcal{G}$, a process can write/read to $x$ via an event $w(x)$/$r(x)$. 2. (2)

Given a lock $l\in\mathcal{L}$, a process can acquire $\ell$ via an event $\mathsf{acq}(l)$ and release $l$ via an event $\mathsf{rel}(l)$.

Each such event is atomic. Given an event $e$, we let $\mathsf{loc}(e)$ denote the global variable (or lock) that $e$ accesses. We denote by $\mathcal{W}_{p}$ (resp. $\mathcal{R}_{p}$, $\mathcal{L}^{A}_{p}$, $\mathcal{L}^{R}_{p}$) the set of all write (resp. read, acquire, release) events that can be performed by process $p$. We let $\mathcal{E}_{p}=\mathcal{W}_{p}\cup\mathcal{R}_{p}\cup\mathcal{L}^{A}_{p}\cup\mathcal{L}^{R}_{p}$, and assume that $\mathcal{E}_{p}\cap\mathcal{E}_{p^{\prime}}=\emptyset$ for every $p\neq p^{\prime}$. We denote by $\mathcal{E}=\bigcup_{p}\mathcal{E}_{p}$, $\mathcal{W}=\bigcup_{p}\mathcal{W}_{p}$, $\mathcal{R}=\bigcup_{p}\mathcal{R}_{p}$, $\mathcal{L}^{A}=\bigcup_{p}\mathcal{L}^{A}_{p}$, $\mathcal{L}^{R}=\bigcup_{p}\mathcal{L}^{R}_{p}$ the events, write, read, acquire and release events of the program $\mathcal{P}$, respectively. Given an event $e\in\mathcal{E}$, we denote by $\mathsf{p}(e)$ the process that $e$ belongs to. Finally, given a set of events $X\subseteq\mathcal{E}$, we denote by $\mathcal{R}(X)$ (resp., $\mathcal{W}(X)$, $\mathcal{L}^{A}(X)$, $\mathcal{L}^{R}(X)$) the set of read (resp., write, lock-acquire, lock-release) events of $X$.

Conflicting events. Given two distinct events $e_{1},e_{2}\in\mathcal{W}\cup\mathcal{R}$, we say that $e_{1}$ and $e_{2}$ are conflicting, denoted by $e_{1}\Join e_{2}$, if (i) $\mathsf{loc}(e_{1})=\mathsf{loc}(e_{2})$ (i.e., they access the same global variable) and (ii) $\{e_{1},e_{2}\}\cap\mathcal{W}\neq\emptyset$ (i.e., at least one is a write event). We extend the notion of conflict to locks, and say that two events $e_{1},e_{2}\in\mathcal{L}^{A}\cup\mathcal{L}^{R}$ are conflicting if $\mathsf{loc}(e_{1})=\mathsf{loc}(e_{2})$ (i.e., they use the same lock).

Event sequences. Let $t$ be a sequence of events. We denote by $\mathcal{E}(t)$ the set of events, by $\mathcal{L}(t)$ the set of locks, and by $\mathcal{G}(t)$ the set of global variables in $t$. We let $\mathcal{W}(t)$ (resp., $\mathcal{R}(t)$, $\mathcal{L}^{A}(t)$, $\mathcal{L}^{R}(t)$) denote the set $\mathcal{W}(\mathcal{E}(t))$ (resp., $\mathcal{R}(\mathcal{E}(t))$, $\mathcal{L}^{A}(\mathcal{E}(t))$, $\mathcal{L}^{R}(\mathcal{E}(t))$). Given two distinct events $e_{1},e_{2}\in\mathcal{E}(t)$, we say that $e_{1}$ is earlier than $e_{2}$ in $t$, denoted by $e_{1}<_{t}e_{2}$ iff $e_{1}$ appears before $e_{2}$ in $t$. We say that $e_{1}$ is program-ordered earlier than $e_{2}$, denoted by $e_{1}<_{\mathsf{PO}(t)}e_{2}$, to mean that $e_{1}<_{t}e_{2}$ and $\mathsf{p}(e_{1})=\mathsf{p}(e_{2})$. When $t$ is clear from the context, we simply write $\mathsf{PO}$ to denote $\mathsf{PO}(t)$. We let $=^{t}$ be the identity relation on $\mathcal{E}(t)$, and denote by $\leq_{t}$, $\leq_{\mathsf{PO}}$ the relations $<_{t}\cup=_{t}$ and $<_{\mathsf{PO}}\cup=_{t}$ respectively. Given a set of events $X\subseteq\mathcal{E}$, we denote by $t|X$ the projection of $t$ onto $X$, i.e., it is the sub-sequence of events of $t$ that belong to $X$. Given two event sequences $t_{1}$, $t_{2}$, we denote by $t_{1}\circ t_{2}$ the concatenation of $t_{1}$ with $t_{2}$. Finally, given a process $p_{i}$, we let $t|p_{i}=t|\mathcal{E}_{p_{i}}$.

Lock events. Given a sequence of events $t$ and a lock-acquire event $\mathsf{acq}\in\mathcal{L}^{A}(t)$, we denote by $\mathsf{match}_{t}(\mathsf{acq})$ the earliest lock-release event in $\mathsf{rel}\in\mathcal{L}^{R}(t)$ such that $\mathsf{rel}\Join\mathsf{acq}$ and $\mathsf{acq}<_{t}\mathsf{rel}$, and let $\mathsf{match}_{t}(\mathsf{acq})=\bot$ if no such lock-release event exists. If $\mathsf{match}_{t}(\mathsf{acq})\neq\bot$, we require that $\mathsf{p}(\mathsf{acq})=\mathsf{p}(\mathsf{match}_{t}(\mathsf{acq}))$, i.e., the two lock events belong to the same process. Similarly, given a lock-release event $\mathsf{rel}\in\mathcal{L}^{R}(t)$, we denote by $\mathsf{match}_{t}(\mathsf{rel})$ the acquire event $\mathsf{acq}\in\mathcal{L}^{A}(t)$ such that $\mathsf{match}_{t}(\mathsf{acq})=\mathsf{rel}$ and require that such a lock-acquire event always exists.

Traces and observation functions. A sequence $t$ is called a trace if it satisfies the following.

1. (1)

For every read event $r\in\mathcal{R}(t)$, there exists a write event $w\in\mathcal{W}(t)$ such that $\mathsf{loc}(r)=\mathsf{loc}(w)$ and $w<_{t}r$. 2. (2)

For any two lock-acquire events $\mathsf{acq}_{1},\mathsf{acq}_{2}\in\mathcal{L}^{A}(t)$, if $\mathsf{loc}(\mathsf{acq}_{1})=\mathsf{loc}(\mathsf{acq}_{2})$ and $\mathsf{acq}_{1}<_{t}\mathsf{acq}_{2}$, then $\mathsf{rel}_{1}=\mathsf{match}_{t}(\mathsf{acq}_{1})\in\mathcal{L}^{R}(t)$ and $\mathsf{rel}_{1}<_{t}\mathsf{acq}_{2}$.

Given a trace $t$, we define its observation function $\mathcal{O}_{t}:\mathcal{R}(t)\to\mathcal{W}(t)$ as follows: $\mathcal{O}_{t}(r)=w$ iff

[TABLE]

In words, $\mathcal{O}_{t}$ maps every read event $r$ to the write event $w$ that $r$ observes in $t$. For simplicity, we assume that $t$ starts with a write event to every location, hence $\mathcal{O}_{t}$ is well-defined.

Enabled events and races. An event $e\in\mathcal{E}$ is said to be enabled in a trace $t$ if $t^{*}=t\circ e$ is a trace of $\mathcal{P}$. A trace $t$ is said to exhibit a race if there exist two consecutive conflicting events in $t$ that belong to different processes. Formally, there exist two events $e_{1},e_{2}\in\mathcal{R}\cup\mathcal{W}$ such that (i) $\mathsf{p}(e_{1})\neq\mathsf{p}(e_{2})$, (ii) $e_{1}\Join e_{2}$, (iii) $e_{1}<_{t}e_{2}$, and (iv) for every $e\in\mathcal{E}(t)\setminus\{e_{1},e_{2}\}$, we have that $e<_{t}e_{2}\Rightarrow e<_{t}e_{1}$.

Predictable races. A trace $t^{\prime}$ is a (prefix) correct reordering of another trace $t$ if (i) for every process $p_{i}$, we have that $t^{\prime}|p_{i}$ is a prefix of $t|p_{i}$ and (ii) $\mathcal{O}_{t^{\prime}}\subseteq\mathcal{O}_{t}$, i.e., the observation functions of $t^{\prime}$ and $t$ agree on their common read events. We say that $t$ has a predictable race on a pair of events $e_{1},e_{2}\in\mathcal{E}(t)$ if there exists a correct reordering $t^{\prime}$ of $t$ such that $t^{*}=t^{\prime}\circ e_{1}\circ e_{2}$ is a trace that exhibits the race $(e_{1},e_{2})$.

Computational problems. The aim of this work is to present sound and fast algorithms for race detection, that also have certain completeness guarantees. As usual in algorithmic parlance, we are concerned with two versions of the problem, namely the following. Given an input trace $t$,

1. (1)

the decision problem is stated on two events $e_{1},e_{2}\in\mathcal{E}(t)$, and asks whether $(e_{1},e_{2})$ is a predictable race of $t$, and 2. (2)

the function problem asks to compute the set of all pairs $\{(e_{1}^{i},e_{2}^{i})\}_{i}$ such that each $(e_{1}^{i},e_{2}^{i})$ is a predictable race of $t$.

Soundness, completeness and complexity. A predictive race-detection algorithm is called sound if on every input trace $t$, every reported race is a predictable race of $t$. The algorithm is called complete if it reports all predictable races of $t$. We note that these notions are often used in reverse in program verification. However, here we align with the terminology used in predictive techniques, hence soundness (resp., completeness) means the absence of false positives (resp., false negatives). We measure complexity in terms of the length $n$ of $t$. Other important parameters are the number of processes $k$ and the number of global variables $\mathcal{G}$. Typically $k$ is much smaller than $n$, and is treated as a constant. For simplicity, we also ignore $\mathcal{G}$ in our complexity statements. In all cases, our algorithms have a dependency of factor $k^{2}\cdot|\mathcal{G}|$ (and hence polynomial) on these parameters.

Dynamic process creation and other synchronization primitives. To keep the presentation simple, in the theoretical part of this work we neglect dynamic process creation (i.e., fork/join events). We note that such events can be handled naturally in our framework. In our experiments (Section 6) we explain how we handle dynamic process creation, which is present in our benchmark set. Similarly, our focus on locks is for simplicity of presentation and not restrictive to our model. For dynamic race detection, other synchronization primitives, such as compare-and-swap, intrinsic locks and synchronized methods can be simulated with locks and extra orderings in the partial orders. Indeed, this modeling approach has been taken in many other works, as e.g. in (Smaragdakis et al., 2012; Kini et al., 2017; Mathur et al., 2018; Roemer et al., 2018).

Due to limited space, all proofs are relegated to Appendix C.

3. Trace-closed Partial Orders

In this section we present relevant notation on partial orders, and introduce the concept of closed partial orders. We also present max-min linearizations which linearize closed partial orders to valid traces. Since this our most technical section, we provide here an overview to assist the reader.

1. (1)

In Section 3.1 we define general notation on partial orders. Since these are partial orders over sets of events $X$ of an input trace $t$, we introduce a feasibility criterion for these sets, which requires that certain events are present in the partial order. For example, for every two conflicting lock-acquire events in $X$, at least one corresponding lock-release event must also be in $X$. 2. (2)

In Section 3.2 we define trace-closed partial orders. Intuitively, this notion requires certain orderings between conflicting events to be present in the partial order. Note that not every linearization of a partial order leads to a valid trace (e.g., some linearizations might not respect the lock semantics). Nevertheless, we show that for a specific class of trace-closed partial orders, a specific type of max-min linearization is guaranteed to always produce a valid trace. 3. (3)

In Section 3.3 we develop an algorithm that computes the trace-closure of a partial order efficiently. To this end, we develop a data structure $\mathsf{DS}$ for the efficient representation of partial orders. For ease of presentation, we relegate the technical description of $\mathsf{DS}$ in Appendix A.

3.1. Partial Orders

Feasible sets. Given a set of events $X\subseteq\mathcal{E}(t)$, we say that $X$ is prefix-closed for $t$ if for every pair of events $e_{1},e_{2}\in\mathcal{E}(t)$ if $e_{1}\leq_{\mathsf{PO}}e_{2}$ and $e_{2}\in X$, then $e_{1}\in X$ (i.e., $X$ is an ideal of $\leq_{\mathsf{PO}}$). We define the open acquires of $X$ under $t$ as $\mathsf{OpenAcqs}_{t}(X)=\{\mathsf{acq}\in\mathcal{L}^{A}(X):\leavevmode\nobreak\ \mathsf{match}_{t}(\mathsf{acq})\not\in X\}$.

We call $X$ observation-feasible for $t$ if for every read event $r\in\mathcal{R}(X)$, we have $\mathcal{O}_{t}(r)\in X$. We call $X$ lock-feasible for $t$ if (i) for every lock-release event $\mathsf{rel}\in\mathcal{L}^{R}(X)$, we have $\mathsf{match}_{t}(\mathsf{rel})\in X$, and (ii) for every distinct pair of lock-acquire events $\mathsf{acq}_{1},\mathsf{acq}_{2}\in\mathsf{OpenAcqs}_{t}(X)$, we have $\mathsf{loc}(\mathsf{acq}_{1})\neq\mathsf{loc}(\mathsf{acq}_{2})$. In words, $X$ is lock-feasible if every release event of $X$ has its matching acquire event also in $X$, and every open lock of $X$ remains open by exactly one acquire event of $X$. Finally, we call $X$ feasible for $t$ if $X$ is prefix-closed, observation-feasible, and lock-feasible for $t$.

Partial orders. Given a trace $t$ and a set $X\subseteq\mathcal{E}(t)$, a partial order $P(X)$ over $X$ is a reflexive, antisymmetric and transitive relation over $X$ (i.e., $\leq_{P(X)}\subseteq X\times X$). When $X$ is clear from the context, we will simply write $P$ instead of $P(X)$. Given two events $e_{1},e_{2}$ we write $e_{1}<_{P}e_{2}$ to denote that $e_{1}\leq_{P}e_{2}$ and $e_{1}\neq e_{2}$. Given two distinct events $e_{1},e_{2}\in X$, we say that $e_{1}$ and $e_{2}$ are unordered by $P$, denoted by $e_{1}\parallel_{P}e_{2}$, if neither $e_{1}<_{P}e_{2}$ nor $e_{2}<_{P}e_{1}$. Given a set $Y\subseteq X$, we denote by $P|Y$ the projection of $P$ on $Y$, i.e., we have $\leq_{P|Y}\subseteq Y\times Y$, and for all $e_{1},e_{2}\in Y$, $e_{1}\leq_{P|Y}e_{2}$ iff $e_{1}\leq_{P}e_{2}$. Given two partial orders $P$ and $Q$ over a common set $X$, we say that $Q$ refines $P$, denoted by $Q\sqsubseteq P$, if for every pair of events $e_{1},e_{2}\in X$, if $e_{1}\leq_{P}e_{2}$ then $e_{1}\leq_{Q}e_{2}$. If $Q$ refines $P$, we say that $P$ is weaker than $Q$. A linearization of $P$ is a total order that refines $P$. We make the following remark.

Remark 1.

*Not every linearization of a partial order $P$ is a valid trace, and generally, $P$ is not guaranteed to have such a linearization. Our algorithm for dynamic race detection relies on developing sufficient conditions under which $P$ indeed has a linearization to a valid trace. *

Width and Mazurkiewicz traces. Let $P$ be a partial order over a set $X\subseteq\mathcal{E}(t)$. The width $\mathsf{width}(P)$ of $P$ is the length of its longest antichain. i.e., it is the largest size of a set $Y\subseteq X$ such that for every pair of distinct elements $e_{1},e_{2}\in Y$ we have $e_{1}\parallel_{P}e_{2}$. The partial order $P$ is called a Mazurkiewicz trace (or M-trace for short) if for every two conflicting events $e_{1},e_{2}\in X$, we have $e_{1}\not\parallel_{P}e_{2}$ (Mazurkiewicz, 1987). Note that if $\mathsf{width}(P)=1$ then $P$ is trivially an M-trace.

3.2. Trace-closed Partial Orders

In this section we define the notion of trace-closed partial orders. This is a central concept in this work, as our race-detection algorithm is based on computing trace-closed partial orders efficiently.

Trace-respecting partial orders. Let $t$ be a trace, and $P$ a partial order over a feasible set $X\subseteq\mathcal{E}(t)$. We say that $P$ respects $t$ if the following conditions hold.

1. (1)

$P\sqsubseteq\mathsf{PO}|X$, i.e., $P$ refines the program order when restricted to the set $X$. 2. (2)

For every read event $r\in\mathcal{R}(X)$ we have $\mathcal{O}_{t}(r)<_{P}r$. 3. (3)

For every lock-acquire event $\mathsf{acq}\in\mathcal{L}^{A}(X)$, if $\mathsf{match}_{t}(\mathsf{acq})\not\in X$, then for every lock-release event $\mathsf{rel}\in\mathcal{L}^{R}(X)$ such that $\mathsf{rel}\Join\mathsf{acq}$, we have $\mathsf{rel}<_{P}\mathsf{acq}$.

We denote by $R_{t}(X)$ the weakest partial order over $X$ that respects $t$.

Trace-closed partial orders. Let $t$ be a trace, and $P$ a partial order over a feasible set $X\subseteq\mathcal{E}(t)$ such that $P$ respects $t$. We call $P$ observation-closed if the following condition holds. For every read event $r\in\mathcal{R}(X)$, let $w=\mathcal{O}_{t}(r)$. For every write event $w^{\prime}\in\mathcal{W}(X)\setminus\{w\}$ such that $w^{\prime}\Join r$, we have

[TABLE]

For a pair of lock-release events $\mathsf{rel}_{1},\mathsf{rel}_{2}\in\mathcal{L}^{R}(X)$, let $\mathsf{acq}_{i}=\mathsf{match}_{t}(\mathsf{rel}_{i})$. We call $P$ lock-closed if for every $\mathsf{acq}_{1},\mathsf{acq}_{2}\in\mathcal{L}^{A}$ and $\mathsf{rel}_{1},\mathsf{rel}_{2}\in\mathcal{L}^{R}$, if $\mathsf{rel}_{2}\Join\mathsf{acq}_{1}$ and $\mathsf{acq}_{1}\leq_{P}\mathsf{rel}_{2}$, then $\mathsf{rel}_{1}\leq_{P}\mathsf{acq}_{2}$. Finally, we call $P$ trace-closed (or simply closed) if it is both observation-closed and lock-closed. See Figure 3 for an illustration. Note that a closed partial order can still contain conflicting events that are unordered. In addition, it does not necessarily admit a linearization to a valid trace. In the next paragraph we develop sufficient conditions for when such a linearization exists.

Max-min linearizations. The key technical challenge in race prediction is, given a trace $t$, to construct a partial order $P$ over $\mathcal{E}(t)$ such that $P$ is efficiently linearizable to a correct reordering of $t$ that manifests the race. Here we use trace-closed partial orders to provide a sufficient condition for efficient linearization, which we call the max-min linearization. In later sections, our race-detection algorithm constructs trace-closed partial orders. The max-min linearization of such partial orders will guarantee that the races exposed by these partial orders are indeed valid races, which are exhibited by a trace constructed using the max-min linearization.

Let $t$ be a trace, and consider a partial order $P$ over a feasible set $X\subseteq\mathcal{E}(t)$ such that $P$ is trace-closed for $t$ and $X$ can be partitioned into two sets $X_{1},X_{2}\subseteq X$ such that (i) $\mathsf{width}(P|X_{1})=1$ and (ii) $P|X_{2}$ is an M-trace. The max-min linearization $t^{*}$ is a linearization of $P$ given by Algorithm 1. In words, first every event of $X_{1}$ is ordered before every event of $X_{2}$, as long as this is allowed by $P$, and then the resulting partial order is linearized arbitrarily. Intuitively, we obtain the sequence $t^{*}$ by linearizing $X_{1}$ maximally, and $X_{2}$ minimally. See Figure 4 for an illustration.

Intuition. First, observe that $P$ can contain pairs of conflicting events that are unordered, i,.e., between the sets $X_{1}$ and $X_{2}$. Conceptually, $\mathsf{MaxMin}$ shows that as we attempt to linearize $P$, we do not have to make an exhaustive search over all the possible (exponentially many) orderings of such pairs. Instead, the specific orderings made by $\mathsf{MaxMin}$ are guaranteed to produce a correct linearization. The intuition behind the correctness of $\mathsf{MaxMin}$ can be summarized as follows.

1. (1)

Since $\mathsf{width}(P|X_{1})=1$, ordering every two events $e_{1}\in X_{1}$, $e_{2}\in X_{2}$ as $e_{1}\to e_{2}$ (provided that $e_{2}\not<_{P}e_{1})$ creates a partial order (i.e., no cycle is formed). 2. (2)

Since $P$ is closed and $P|X_{2}$ is an M-trace, this ordering respects the observation $w$ of every read event $r$. Indeed, if the ordering was forcing some other conflicting write event $w^{\prime}$ between $w$ and $r$, then $w^{\prime}$ must be ordered with at least one of $w$ and $r$, and then the corresponding closure rule (Figure 3) would have resolved this conflict entirely.

Theorem 3.1.

Let $t$ be a trace and $P$ a partial order over a feasible set $X\subseteq\mathcal{E}(t)$ such that $P$ is trace-closed for $t$ and $X$ can be partitioned into two sets $X_{1},X_{2}$ so that (i) $\mathsf{width}(P|X_{1})=1$ and (ii) $P|X_{2}$ is a Mazurkiewicz trace. The max-min linearization of $P$ produces a correct reordering of $t$.

3.3. Computing the Closure of a Partial Order

In this section we define the trace-closure of partial orders, and develop an efficient algorithm that, given a partial order $P$, either computes the closure of $P$ or concludes that the closure does not exist. In the next section we will solve the decision problem of race detection by constructing specific partial orders and computing their closure.

Feasible partial orders. Let $t$ be a trace and $P$ a partial order over a feasible set $X\subseteq\mathcal{E}(t)$ such that $P$ respects $t$. If there exists a partial order $Q$ over $X$ such that (i) $Q\sqsubseteq P$ and (ii) $Q$ is closed, we define the closure of $P$ as the smallest such partial order $Q$. If no such partial order $Q$ exists, then the closure of $P$ is undefined (i.e., $P$ does not have a closure). We call $P$ feasible iff it has a closure. The following lemma states that $P$ has a unique closure.

Lemma 3.2.

There exists at most one smallest partial order $Q$ such that (i) $Q\sqsubseteq P$ and (ii) $Q$ is closed.

Computing the closure of a partial order. It is straightforward to verify that, given a partial order $P$, the closure of $P$ (or deducing that $P$ is not feasible) can be computed in polynomial time. This is simply achieved by iteratively detecting whether one of the cases shown in Figure 3 is violated, and strengthening $P$ with the appropriate orderings. However, since our goal is to handle large traces with hundreds of millions of events, polynomial-time guarantees are not enough, and the goal is to develop an algorithm with low polynomial complexity. Here we develop such an algorithm called, $\mathsf{Closure}$, that computes the closure of a partial order in $O(n^{2}\cdot\log n)$ time.

The data structure $\mathsf{DS}$. To make the closure computation efficient, we develop a data structure $\mathsf{DS}$ for manipulating partial-orders efficiently. Given a partial order $P$ over $n$ events such that $P$ has width $k=O(1)$, $\mathsf{DS}$ represents $P$ in $O(n)$ space and supports the following operations: (i) initialization in $O(n)$ time, (ii) querying whether $e_{1}\leq_{P}e_{2}$, for any two events $e_{1},e_{2}$ in $O(\log n)$ time, and (iii) inserting an ordering $e_{1}\leq_{P}e_{2}$, for any two events $e_{1},e_{2}$ in $O(\log n)$ time. For ease of presentation, we relegate the formal description of $\mathsf{DS}$ to Appendix A.

The event maps $\mathsf{After}$, $\mathsf{Before}$ and $\mathcal{F}$. Consider a trace $t$. For every lock $l\in\mathcal{L}(t)$, we define the maps $\mathsf{After}_{l}^{\mathcal{L}^{A}},\mathsf{After}_{l}^{\mathcal{L}^{R}},\mathsf{Before}_{l}^{\mathcal{L}^{A}},\mathsf{Before}_{l}^{\mathcal{L}^{R}}:\mathcal{E}(t)\to\mathcal{E}(t)\cup\{\bot\}$, as follows. Given an event $e\in\mathcal{E}(t)$, the maps $\mathsf{After}_{l}^{\mathcal{L}^{A}}(e)$ and $\mathsf{Before}_{l}^{\mathcal{L}^{A}}(e)$ point to the first lock-acquire event $\mathsf{acq}$ after $e$ in $t$, and last lock-acquire event $\mathsf{acq}$ before $e$ in $t$, respectively, such that $\mathsf{p}(e)=\mathsf{p}(\mathsf{acq})$ and $\mathsf{loc}(\mathsf{acq})=l$. The maps $\mathsf{After}_{l}^{\mathcal{L}^{R}}(e)$ and $\mathsf{Before}_{l}^{\mathcal{L}^{R}}(e)$ are defined analogously, pointing to lock-release instead of lock-acquire events. Similarly, for every global variable $x\in\mathcal{G}(t)$, we define the maps $\mathsf{After}_{x}^{\mathcal{W}},\mathsf{After}_{x}^{\mathcal{R}},\mathsf{Before}_{x}^{\mathcal{W}},\mathsf{Before}_{x}^{\mathcal{R}}:\mathcal{E}(t)\to\mathcal{E}(t)\cup\{\bot\}$, as follows. Given an event $e\in\mathcal{E}(t)$, the map $\mathsf{After}_{x}^{\mathcal{W}}(e)$ (resp. $\mathsf{Before}_{x}^{\mathcal{W}}(e)$) points to the first write event $w$ after (resp., before) $e$ in $t$ such that $\mathsf{p}(e)=\mathsf{p}(w)$ and $\mathsf{loc}(w)=x$. The maps $\mathsf{After}_{l}^{\mathcal{R}}(e)$ and $\mathsf{Before}_{l}^{\mathcal{R}}(e)$ are defined analogously, pointing to read instead of write events. Finally, the flow map $\mathcal{F}_{p}:\mathcal{W}(t)\to\mathcal{R}(t)\cap\mathcal{R}_{p}$ of $t$ is a partial function that maps each write event $w$ to the last read event of $p$ that observes $w$. In all the above cases, if no corresponding event exists, the respective map points to $\bot$. Observe that each of these maps has size $O(|G|\cdot n)$, where $|G|$ is the number of memory locations of $t$. The maps can be constructed in $O(|G|\cdot n)$ time, simply by traversing $t$ and maintaining on-the-fly each map.

The algorithm $\mathsf{Closure}$. We now present $\mathsf{Closure}$ for computing the closure of a partial order $P$ over a set $X$, or concluding that $P$ is not feasible. The algorithm maintains a partial order as a DAG represented by the data structure $\mathsf{DS}$. Conceptually, $\mathsf{DS}$ consists of $k$ total orders, $\tau_{1},\dots,\tau_{k}$, where $k=\mathsf{width}(P)$, with some extra orderings that go across the $\tau_{i}$. Each total order $\tau_{i}$ contains the events of process $p_{i}$ in $X$. Initially $\mathsf{DS}$ represents $P$. The main computation iterates over a worklist $\mathcal{Q}$ which holds edges to be inserted in $\mathsf{DS}$. Upon extracting such an edge $(\overline{e}_{1},\overline{e}_{2})$ from $\mathcal{Q}$, the algorithm inserts the edge in $\mathsf{DS}$ using the operation $\mathsf{DS}.\mathsf{insert}$. This operation results in various edges $(e_{1},e_{2})$ inserted in the graph, transitively through $(\overline{e}_{1},\overline{e}_{2})$. For every $(e_{1},e_{2})$, the algorithm calls methods $\mathsf{ObsClosure}$ and $\mathsf{LockClosure}$ to resolve any violation of observation and lock constraints created by the insertion of $(e_{1},e_{2})$. Figure 5 illustrates $\mathsf{ObsClosure}$ and $\mathsf{LockClosure}$. Algorithm 2, Algorithm 3 and Algorithm 4 give the description of $\mathsf{Closure}$, $\mathsf{ObsClosure}$ and $\mathsf{LockClosure}$, respectively.

Correctness and complexity. It is rather straightforward that if $P$ has a closure $Q$, then for each $\mathcal{Q}.\mathsf{push}(e_{1},e_{2})$ operation performed by $\mathsf{Closure}$, we have $e_{1}<_{Q}e_{2}$. It follows that if $\mathsf{Closure}$ returns $\bot$, then $P$ is unfeasible. On the other hand, if $\mathsf{Closure}$ does not return $\bot$, then the partial order $Q$ stored in the data structure $\mathsf{DS}$ is the closure of $P$. Indeed, each of the closure rules can only be violated by an ordering $e_{1}<_{Q}e_{2}$. The algorithm guarantees that every such edge is processed by the methods $\mathsf{ObsClosure}$ and $\mathsf{LockClosure}$, and new edges will be inserted in $\mathsf{DS}$ according to the rules of Figure 5. After such edges have been inserted, the ordering $e_{1}<_{Q}e_{2}$ can no longer violate any of the conditions of closure. Regarding the time complexity, the algorithm inserts at most $n^{2}$ edges in the partial order represented by $\mathsf{DS}$. Using the algorithms for $\mathsf{DS}$ (see Lemma A.1 in Appendix A), for every edge inserted by the algorithm, identifying which other edges are imposed by the closure rules requires only $O(\log n)$ time. We have the following theorem.

Theorem 3.3.

Let $t$ be a trace and $P$ a partial order over a feasible set $X\subseteq\mathcal{E}(t)$ such that $P$ respects $t$. $\mathsf{Closure}$ correctly computes the closure of $P$ and requires $O(n^{2}\cdot\log n)$ time.

Incremental closure. In our race detection algorithm, we also make use of the following operation on partial orders. Let $t$ be a trace and $P$ a partial order over a feasible set $X\subseteq\mathcal{E}(t)$ and such that $P$ is closed wrt $t$ and is represented as a DAG using the data structure $\mathsf{DS}$. Given a pair of events $e_{1},e_{2}\in X$, we define the operation $\mathsf{InsertAndClose}(P,e_{1}\to e_{2})$ as follows. We execute the algorithm $\mathsf{Closure}$ starting from Algorithm 2, performing a $\mathsf{DS}.\mathsf{insert}(e_{1},e_{2})$. Hence we perform the $\mathsf{ObsClosure}$ and $\mathsf{LockClosure}$ only for the new orderings added due to $(e_{1},e_{2})$.

Lemma 3.4.

Let $\Sigma$ be a sequence of $\mathsf{InsertAndClose}$ operations. Performing all operations of $\Sigma$ requires $O(n^{2}\cdot\log n+|\Sigma|\cdot\log n)$ time in total, and produces a closed partial order.

4. The Decision Problem of Race Detection

Here we present a polynomial-time algorithm for the decision problem of dynamic race detection, i.e., given an input trace $t$ and two events $e_{1},e_{2}\in\mathcal{E}(t)$, decide whether $(e_{1},e_{2})$ is a predictable race of $t$. Our algorithm is sound but incomplete in general, and it becomes complete if the input trace contains events of only two processes. To assist the reader, we provide an outline of this section.

1. (1)

First, we introduce the notion of relative causal cone of an event $e$, which is a subset of events of $t$. Intuitively, it can be thought of as a trace slice of $t$ up to $e$. When deciding whether $(e_{1},e_{2})$ is a race of $t$, our algorithm tries to find a witness trace for the race, such that the witness consists of events of the causal cones of $e_{1}$ and $e_{2}$. 2. (2)

Second, we present our main algorithm $\mathsf{RaceDecision}$ for deciding whether $(e_{1},e_{2})$ is a predictable race of $t$. In high level, the algorithm computes the causal cones of $e_{1}$ and $e_{2}$, and constructs a partial order $P$ over events of the causal cones. Afterwards, it computes the closure $Q$ of $P$ using algorithm $\mathsf{Closure}$ from the previous section, and resolves certain orderings of conflicting events in $Q$ according to the trace order in $t$. Finally, it uses algorithm $\mathsf{MaxMin}$ to linearize $Q$ to a witness trace that exhibits the race. We also prove that this process is sound, i.e., if $(e_{1},e_{2})$ is reported as a race, then it is a true predictable race of $t$. 3. (3)

Third, we prove that the above process is also complete for traces that consist of events of two processes, i.e., it detects all predictable races. 4. (4)

Finally, we illustrate $\mathsf{RaceDecision}$ on a few examples.

Relative causal cones. Given a trace $t$, an event $e\in\mathcal{E}(t)$ and a process $p$, the causal past cone $\mathsf{RCone}_{t}(e,p)$ of $e$ relative to $p$ in $t$ is the smallest set that contains the following events:

1. (1)

For every event $e^{\prime}\in\mathcal{E}(t)$ with $e^{\prime}<_{\mathsf{PO}}e$, we have that $e^{\prime}\in\mathsf{RCone}_{t}(e,p)$. 2. (2)

For every pair of events $e_{1}\in\mathsf{RCone}_{t}(e,p)$ and $e_{2}\in\mathcal{E}(t)$, if $e_{2}\leq_{\mathsf{PO}}e_{1}$ then $e_{2}\in\mathsf{RCone}_{t}(e,p)$. 3. (3)

For every read event $r\in\mathcal{R}(\mathsf{RCone}_{t}(e,p))$, we have that $\mathsf{O}_{t}(r)\in\mathsf{RCone}_{t}(e,p)$. 4. (4)

For every lock-acquire event $\mathsf{acq}\in\mathsf{RCone}_{t}(e,p)$, if $\mathsf{p}(\mathsf{acq})\neq\mathsf{p}(e)$ and $\mathsf{p}(\mathsf{acq})\neq p$, then $\mathsf{match}_{t}(\mathsf{acq})\in\mathsf{RCone}_{t}(e,p)$.

It is easy to verify that $\mathsf{RCone}_{t}(e,p)$ is always observation-feasible but not necessarily lock-feasible.

Intuition and example on relative causal cones. In order to decide whether an event pair $(e_{1},e_{2})$ is a predictable race of an input trace $t$, we first need to decide the events that will constitute a witness trace $t^{*}$ that exposes the race. In our race-detection algorithm, we take this set to be $\mathsf{RCone}_{t}(e_{1},\mathsf{p}(e_{2}))\cup\mathsf{RCone}_{t}(e_{2},\mathsf{p}(e_{1}))$, i.e., it is the causal past cone of each focal event relative to the process of the other focal event. Conditions 1-3 ensure that the cones are closed wrt the program order, and the observation of every read event is present, which is required for $t^{*}$ to be a correct reordering of $t$. The intuition behind condition 4 is a bit more subtle. To avoid having two critical sections on the same lock open, we include the matching release event of every lock-acquire event. However, this rule does not apply for the processes of the focal events, since for these processes the events we have to include in $t^{*}$ are precisely the predecessors of the corresponding focal event.

Consider the input trace in Figure 6, where our task is to detect the race $(e_{2},e_{10})$. We outline here the computation of the relative causal cones $\mathsf{RCone}_{t}(e_{1},\mathsf{p}(e_{2}))$ and $\mathsf{RCone}_{t}(e_{2},\mathsf{p}(e_{1}))$. Item 1 of relative causal cones leads to $\mathsf{RCone}_{t}(e_{2},p_{3})=\{e_{1}\}$. For $\mathsf{RCone}_{t}(e_{10},p_{1})$, Item 1 makes $e_{9}\in\mathsf{RCone}_{t}(e_{10},p_{1})$. Since $e_{9}$ is a read event, Item 3 makes $\mathcal{O}_{t}(e_{9})=e_{5}\in\mathsf{RCone}_{t}(e_{10},p_{1})$, and then Item 2 makes $e_{4}\in\mathsf{RCone}_{t}(e_{10},p_{1})$. Since $e_{4}$ is a lock-acquire event and $\mathsf{p}(e_{4})\neq p_{1},p_{3}$ (i.e., the process of $e_{4}$ is neither the process of $e_{10}$, nor the process relative to which we are computing the causal cone of $e_{10}$), Item 4 makes $\mathsf{match}_{t}(e_{4})=e_{6}\in\mathsf{RCone}_{t}(e_{10},p_{1})$. Hence, in the end, $\mathsf{RCone}_{t}(e_{10},p_{1})=\{e_{9},e_{6},e_{5},e_{4}\}$.

The algorithm $\mathsf{RaceDecision}$. We now describe our algorithm for reporting whether $t$ has a predictable race on a given pair $(e_{1},e_{2})$. In words, the algorithm constructs a set $X$ that is the union of the causal cones of each $e_{i}$ relative to the process of $e_{3-i}$. Afterwards, the algorithm constructs a partial order $P$ that respects $X$, and computes the closure $Q$ of $P$. Finally, the algorithm non-deterministically chooses some $i\in[2]$, and examines all events that belong to processes other than $p_{i}$. For every two such events $\overline{e}_{1},\overline{e}_{2}$, if they conflict and are unordered by $Q$, the algorithm orders them according to their order in $t$. If a cycle is created in $Q$ during this process, the algorithm returns $\mathsf{False}$. Otherwise, at the end of this process, the set $X$ can be naturally partitioned into two sets $X_{1},X_{2}$ such that $\mathsf{width}(Q|X_{1})=1$ and $Q|X_{2}$ is an M-trace. The first set is $X_{1}|\mathsf{p}(e_{i})$, i.e., it contains the events of the process in which $e_{i}$ belongs to, and thus is a totally ordered set under $Q$. The second set is $X_{2}=X\setminus X_{1}$, and note that all pairs of conflicting events of $X_{2}$ are now ordered under $Q$. Hence, according to Theorem 3.1, the partial order $Q$ is linearizable to a valid trace, and the algorithm returns $\mathsf{True}$. See Algorithm 5 for a formal description.

The complexity of the algorithm is $O(n^{2}\cdot\log n)$, which is the time required for computing the closure of the partial order $Q$ in Algorithm 5 and Algorithm 5 (due to Theorem 3.3 and Lemma 3.4, respectively).

Note that the algorithm is sound, i.e., if it returns $\mathsf{True}$ then $(e_{1},e_{2})$ is a true predictable race of $t$. On the other hand, the algorithm is incomplete in general, i.e., it might return $\mathsf{False}$ even though $(e_{1},e_{2})$ is a true predictable race of $t$. For example, in Algorithm 5, the algorithm orders some pairs of conflicting events $(\overline{e}_{1},\overline{e}_{2})$ in the same order as in the input trace. Although these orderings are expected to work most of the time, this choice might not always be correct. In such cases, a cycle will be created in $Q$, and the algorithm will return $\mathsf{False}$ (see Appendix D for an example). As we discuss next, the algorithm becomes complete if the input trace consists of only two processes.

Completeness for two processes. We now discuss the completeness properties of $\mathsf{RaceDecision}$ for reporting races on input traces of two processes. Assume that $(e_{1},e_{2})$ is a race of the input trace. The key insight is that Algorithm 5 of $\mathsf{RaceDecision}$ is not executed, as every pair of events $\overline{e}_{1},\overline{e}_{2}$ in that line belong to the same process, and thus are already ordered. Up until that point, all orderings used in constructing the partial order $R_{t}(X)$ and computing the closure of $R_{t}(X)$ are necessarily present in every trace that witnesses the race $(e_{1},e_{2})$. Hence the closure computation cannot return $\bot$, and $\mathsf{RaceDecision}$ returns $\mathsf{True}$. The following theorem concludes the results of this section.

Theorem 4.1.

Let $t$ be a trace of $k\geq 2$ processes, and $n=|\mathcal{E}(t)|$. Let $e_{1},e_{2}\in\mathcal{E}(t)$ be two conflicting events of $t$. The algorithm $\mathsf{RaceDecision}$ requires $O(n^{2}\cdot\log n)$ time and soundly reports whether $(e_{1},e_{2})$ is a predictable race of $t$. If $k=2$, $\mathsf{RaceDecision}$ is also complete. If $\mathsf{RaceDecision}$ reports a race, a witness trace can be constructed in $O(n\cdot\log n)$ time.

As there are $O(n^{2})$ pairs of events in $t$, Theorem 4.1 yields the following corollary.

Corollary 4.2.

Let $t$ be a trace of $k\geq 2$ processes. There exists a sound algorithm that requires $O(n^{4}\cdot\log n)$ time and soundly reports predictable races of $t$. If $k=2$, the algorithm is also complete (i.e., it reports all predictable races).

Remark 2.

We note that the dependency of Corollary 4.2 on the number of variables $|\mathcal{G}|$ and number of threads $k$ is $O(|\mathcal{G}|\cdot k^{2}\cdot n^{4}\cdot\log n)$. To keep the presentation simple, we have neglected the dependency on $|\mathcal{G}|$ and $k$ in the analysis of the algorithm.

4.1. Examples

We now illustrate the algorithm $\mathsf{RaceDecision}$ on a few examples.

Example of a race (Figure 7). Consider the trace $t$ shown in Figure 7(a), and the task is to decide whether $(e_{6},e_{16})$ is a predictable race of $t$. The algorithm constructs the causal cones

[TABLE]

and the partial order $P$ that respects $t$, shown in Figure 7(b) in solid edges. Afterwards, the algorithm computes the closure $Q$ of $P$ by inserting the dashed edges in Figure 7(b). In particular, since for the write event $e_{4}$ we have $e_{9}<_{P}e_{4}$ and $e_{9}$ is observed by the read event $e_{14}$, we have $e_{14}<_{Q}e_{4}$ (i.e., this is an observation-closure edge). After this ordering is inserted, for the lock-acquire event $e_{13}$ we have $e_{13}<_{Q}e_{5}$ and $e_{5}$ is a lock-release event on the same lock, we also have $e_{15}<_{Q}e_{3}$, where $e_{15}=\mathsf{match}_{t}(e_{13})$ and $e_{3}=\mathsf{match}_{t}(e_{5})$ (i.e., this is a lock-closure edge). Now consider the nondeterministic choice made in Algorithm 5 of $\mathsf{RaceDecision}$ such that $i=1$. The algorithm also orders $e_{10}<_{Q}e_{11}$ by performing $\mathsf{InsertAndClose}(Q,e_{10}\to e_{11})$. Notice that, after this operation, $Q$ is a closed partial order. In addition, the $w(x)$ event $e_{1}$ is unordered with the conflicting events $e_{9}$ and $e_{10}$, i.e., $Q$ is not an M-trace. However, by taking $X_{1}=X|p_{1}$ and $X_{2}=X\setminus X_{2}$, we have that $\mathsf{width}(Q|X_{1})=1$ and $Q|X_{2}$ is an M-trace. Hence, by Theorem 3.1 $Q$ is linearizable to a correct reordering, constructed as the max-min linearization $t^{*}=\mathsf{MaxMin}(Q)$. This illustrates the advantage of our technique over existing methods, as here a correct reordering is exposed even though the initial partial order $P$ contains several pairs of conflicting events that are unordered. Indeed, this race is missed by all $\mathsf{HB}$, $\mathsf{WCP}$, $\mathsf{DC}$ and $\mathsf{SHB}$. Finally, the witness trace in is constructed by extending $t^{*}$ with the racy events $e_{6}$, $e_{16}$, shown in Figure 7(c).

Example of a non-race (Figure 8). Consider the trace $t$ shown in Figure 8(a), and the task is to decide whether $(e_{5},e_{13})$ is a predictable race of $t$. The algorithm constructs the causal cones

[TABLE]

and the partial order $P$ that respects $t$, shown in Figure 8(b) in solid edges. Afterwards, the algorithm computes the closure $Q$ of $P$ by inserting the dashed edges in Figure 8(b). Observe that $Q$ contains a cycle and thus $P$ is not feasible, hence the algorithm reports that $(e_{4},e_{13})$ is not a race111While computing the closure different cycles might appear, depending on the order in which the closure rules are applied..

Examples from Section 1. Finally, we outline $\mathsf{RaceDecision}$ on the two races from Figure 1.

Example from Figure 1(a). The algorithm constructs the causal cones

[TABLE]

and the partial order $P$ that respects $t$ by forcing the ordering $e_{6}<_{P}e_{1}$. Note that $P$ is already closed, hence $Q=P$ by the algorithm $\mathsf{Closure}$. Finally, the witness trace is constructed by obtaining the max-min linearization $t^{*}=\mathsf{MaxMin}(Q)$ and extending $t^{*}$ with the racy events $e_{2}$, $e_{7}$, thereby witnessing the race by the trace $t^{*}=e_{4},e_{5},e_{6},e_{1},e_{2},e_{7}$.

Example from Figure 1(b). The algorithm constructs the causal cones

[TABLE]

and the partial order $P$ that respects $t$ by forcing the orderings $e_{10}<_{P}e_{1}$ and $e_{7}<_{P}e_{12}$. Afterwards, the algorithm computes the closure of $Q$ by inserting $e_{8}<_{Q}e_{11}$. Finally, the witness trace is constructed by obtaining the max-min linearization $t^{*}=\mathsf{MaxMin}(Q)$ and extending $t^{*}$ with the racy events $e_{2}$, $e_{14}$, thereby witnessing the race by the trace $t^{*}=e_{5},e_{6},e_{7},e_{8},e_{9},e_{10},e_{1},e_{11},e_{12},e_{13},e_{2},e_{14}$.

5. The Function Problem in Practice

Corollary 4.2 solves the function problem by solving the decision problem on every pair of events of the input trace. Here we present an explicit algorithm for the function problem, called $\mathsf{M2}$, which is the main contribution of this work. Although $\mathsf{M2}$ does not improve the worst-case complexity, it is faster in practice. The algorithm relies on the following simple lemma.

Lemma 5.1.

Consider two conflicting events $e_{1},e_{2}$ and let $X=\mathsf{RCone}_{t}(e_{1},\mathsf{p}(e_{2}))\cup\mathsf{RCone}_{t}(e_{2},\mathsf{p}(e_{1}))$. If $X\cap\{e_{1},e_{2}\}=\emptyset$ and $\mathsf{OpenAcqs}_{t}(X)=\emptyset$ then $(e_{1},e_{2})$ is a predictable race of $t$.

Intuitively, if the conditions of Lemma 5.1 are met, we can postpone the execution of $e_{1}$ in $t$ until $e_{2}$, and the trace witnessing the race is simply $t|X\circ e_{1},e_{2}$.

The algorithm $\mathsf{M2}_{e_{1}}^{p}$. We are now ready to describe an algorithm for partially solving the function problem on an input trace $t$. In particular, we present the algorithm $\mathsf{M2}_{e_{1}}^{p}$ given an event $e_{1}\in\mathcal{E}(t)$ and a process $p\neq\mathsf{p}(e_{1})$. The algorithm returns the set $\mathcal{Z}\subseteq\{e_{1}\}\times\mathcal{E}(t)|p$ of races detected between $e_{1}$ and events of process $p$. The algorithm simply iterates over all events $e_{2}$ of $p$ in increasing order and computes the causal cone $\mathsf{RCone}_{t}(e_{2},\mathsf{p}(e_{1}))$. Let $X=\mathsf{RCone}_{t}(e_{1},\mathsf{p}(e_{2}))\cup\mathsf{RCone}_{t}(e_{2},\mathsf{p}(e_{1}))$. If there are open lock-acquire events in $X$, the algorithm invokes $\mathsf{RaceDecision}$ for solving the decision problem on $(e_{1},e_{2})$. Otherwise, a race $(e_{1},e_{2})$ is directly inferred, due to Lemma 5.1. Algorithm 6 gives the formal description.

The efficiency of $\mathsf{M2}_{e_{1}}^{p}$ lies on two observations:

1. (1)

Since critical sections tend to be small, we expect the condition in Algorithm 6 to be $\mathsf{False}$ only a few times, thus Lemma 5.1 allows to soundly report a race without constructing a partial order. 2. (2)

The causal cones are closed wrt the program order. That is, given two events $e_{2}$ and $e^{\prime}_{2}$ with $e_{2}<_{\mathsf{PO}}e^{\prime}_{2}$, we have that $\mathsf{RCone}_{t}(e_{2},\mathsf{p}(e_{1}))\subset\mathsf{RCone}_{t}(e^{\prime}_{2},\mathsf{p}(e_{1}))$, and thus we only need to consider the difference $\mathsf{RCone}_{t}(e^{\prime}_{2},\mathsf{p}(e_{1}))\setminus\mathsf{RCone}_{t}(e_{2},\mathsf{p}(e_{1}))$ in Algorithm 6. This decreases the total time for constructing all causal cones from quadratic to linear.

The algorithm $\mathsf{M2}$. Finally, we outline the algorithm $\mathsf{M2}$ for solving the function problem. Given an input trace $t$, the algorithm simply invokes $\mathsf{M2}_{e_{1}}^{p}$ for every event $e_{1}\in\mathcal{E}(t)$ and process $p\neq\mathsf{p}(e_{1})$ and obtains the returned race set $\mathcal{Z}_{e_{1}}^{p}$. Since there are $O(n)$ such events, the algorithm makes $O(n)$ invocations. The reported set of predictable races of $t$ is then $\mathcal{Z}=\bigcup_{e_{1},p}\mathcal{Z}_{e_{1}}^{p}$.

Detecting completeness dynamically. Assume that we execute $\mathsf{RaceDecision}$ on input events $e_{1},e_{2}$ and the algorithm returns $\mathsf{False}$. It can be easily shown that if the following conditions hold, then $(e_{1},e_{2})$ is not a predictable race of $t$ (and hence correctly rejected by $\mathsf{RaceDecision}$).

1. (1)

When computing the relative causal past cones in Algorithm 5 of $\mathsf{RaceDecision}$, no event is added to the cones due to Item 4 of the definition of relative causal past cones. 2. (2)

$\mathsf{RaceDecision}$ returns $\mathsf{False}$ before executing Algorithm 5.

Let $\mathcal{C}$ be the set of races that are rejected by $\mathsf{M2}$ on input trace $t$ such that at least one of the conditions above does not hold. It follows that $\mathcal{C}$ over-approximates the set of false negatives of $\mathsf{M2}$. The algorithm is dynamically complete for $t$ if $\mathcal{C}_{t}=\emptyset$.

6. Experiments

In this section we report on an implementation and experimental evaluation of our techniques.

6.1. Implementation

We have implemented our algorithm $\mathsf{M2}$ in Java and evaluated its performance on a standard set of benchmarks. We first discuss some details of the implementation.

Handling dynamic processes creation. In the theoretical part of this paper we have neglected dynamic process creation events. In practice such events are common, and all our benchmark traces contain $\mathsf{fork}(i)$ and $\mathsf{join}(j)$ events (for forking process $p_{i}$ and joining with process $p_{j}$, respectively). To handle such events, we include in the program order $\mathsf{PO}$ the following order relationships: If $e_{1}$ is a $\mathsf{fork}(i)$ event and $e_{2}$ is a $\mathsf{join}(j)$ event, then we include the order relationship $(e_{1}<_{\mathsf{PO}}e^{\prime}_{1})$ and $(e^{\prime}_{2}<_{\mathsf{PO}}e_{2})$, where $e^{\prime}_{1}$ is the first event of $p_{i}$ and $e^{\prime}_{2}$ is the last event of $p_{j}$ such that $e^{\prime}_{2}<_{t}e_{2}$.

Optimizations. We make two straightforward optimizations, namely, ignoring non-racy locations and over-approximating the racy events. Recall that $R_{t}(X)$ is the weakest partial order over the events of $t$ that respects $t$. $R_{t}(X)$ can be constructed efficiently by a single pass of $t$. For the first optimization, we simply remove from $t$ all events to a location $x$ if every pair of conflicting events on $x$ is ordered by $R_{t}(X)$. For the second optimization, we construct the set

[TABLE]

which over-approximates the races of $t$, and, we only consider the pairs $(e_{1},e_{2})\in A$ for races.

6.2. Experimental Setup

Benchmarks. Our benchmark set is a standard one found in recent works on race detection (Huang et al., 2014; Kini et al., 2017; Yu et al., 2018; Mathur et al., 2018), and parts of it also exist in other works (Flanagan and Freund, 2009; Bond et al., 2010; Zhai et al., 2012; Roemer et al., 2018). It contains concurrent traces of various sizes, which are concrete executions of concurrent programs taken from standard benchmark suits: (i) the IBM Contest benchmark suite (Farchi et al., 2003), (ii) the Java Grande forum benchmark suite (Smith et al., 2001), (iii) the DaCapo benchmark suite (Blackburn et al., 2006), and (iv) some standalone, real-world software. We have also included the benchmark cryptorsa from the SPEC JVM08 benchmark suite (SPEC, 2008) which we have found to be racy. We refer to Table 1 for various interesting statistics on each benchmark trace. The columns $k$ and $n$ denote the number of processes and number of events in each input trace. In each case, $k$ is also used as the bound of the width of the partial orders constructed by our algorithm.

Comparison with $\mathsf{HB}$, $\mathsf{WCP}$, $\mathsf{DC}$ and $\mathsf{SHB}$. We compare $\mathsf{M2}$ against the standard $\mathsf{HB}$, as well as $\mathsf{WCP}$ (Kini et al., 2017), $\mathsf{DC}$ (Roemer et al., 2018), and $\mathsf{SHB}$ (Mathur et al., 2018) which, to our knowledge, are the most recent advances in race prediction. These are partial-order methods based on vector clocks. All implementations are in Java: we rely on the tool Rapid (Mathur et al., 2018) for running $\mathsf{HB}$, $\mathsf{WCP}$ and $\mathsf{SHB}$, and on our own implementation of $\mathsf{DC}$. To obtain all race reports for an input trace $t$, we use the following process. We construct the corresponding partial order incrementally, by inserting new events in the order they appear in $t$. In addition, we use an extra vector clock $R_{x}$, $W_{x}$, for every location $x$, which records the vector clock of the last read and write event, respectively, that accessed the respective location. These vector clocks are used to determine whether the current event is racy. After inserting an event $e_{1}$ in the partial order, we iterate over each conflicting event $e_{2}$ that precedes $e_{1}$ in $t$, and determine whether $e_{2}<e_{1}$. If not, we report a race $(e_{1},e_{2})$, and join the vector clock of $e_{1}$ with the vector clock of the corresponding location.

As $\mathsf{HB}$ and $\mathsf{WCP}$ are only sound on the first race, and $\mathsf{DC}$ is unsound, the above process creates, in general, false positives. In order to have a basis for comparison on sound reports, $(e_{1},e_{2})$ is regarded as a reported race by each of these methods only if $\mathsf{M2}$ reports it either as a race, or a possibly false negative (i.e., either $(e_{1},e_{2})\in\mathcal{Z}$ or $(e_{1},e_{2})\in\mathcal{C}$, the sets $\mathcal{Z}$ and $\mathcal{C}$ as defined in Section 5) 222$\mathsf{SHB}$ is sound on all race reports, and hence this filtering is not performed..

Race reports. Recall that a race is defined as a pair of events $(e_{1},e_{2})$ of the input trace. However, the interest of the programmer is on the actual code lines $(l_{1},l_{2})$ that these events correspond to. Since long traces typically come from code that executes repeatedly in a loop, we expect to have many racy pairs of events $\{(e^{i}_{1},e^{i}_{2})\}_{i}$ that correspond to the same racy pair of code lines $(l_{1},l_{2})$, and hence all such pairs $(e^{i}_{1},e^{i}_{2})$ require a single fix. Hence, although the input trace might contain many different event pairs that correspond to the same line pair, these will result in a single race report.

6.3. Experimental Results

Our evaluation is summarized in Table 2. The columns $\mathsf{Races}$ and $\mathsf{Time}$ show the number of reported races, and the time taken, respectively by each method. The column $\mathsf{FN}$ reports the size of the set $\mathcal{C}$, which gives an upper-bound on the number of false negatives of $\mathsf{M2}$ (see Section 5).

Race detection capability. We see that $\mathsf{M2}$ is very effective: overall, it discovers hundreds of real races on all benchmarks, regardless of their size and number of processes. In addition, $\mathsf{M2}$ is found complete on all benchmarks (i.e., our over-approximation of the false negatives in column $\mathsf{FN}$ always reports at most [math] false negatives). Hence, $\mathsf{M2}$ manages to detect all races in our benchmark set. To our knowledge, this is the first sound technique that reaches such a level of completeness.

On the other hand, the capability of $\mathsf{HB}$, $\mathsf{WCP}$, $\mathsf{DC}$ and $\mathsf{SHB}$ is more limited, as they all miss several races on several benchmarks. We observe that $\mathsf{WCP}$ catches more races than $\mathsf{HB}$, and $\mathsf{DC}$ more races than $\mathsf{WCP}$. This is predicted by theory, as $\mathsf{HB}$ races are $\mathsf{WCP}$ races (Kini et al., 2017), and $\mathsf{WCP}$ races are $\mathsf{DC}$ races (Roemer et al., 2018). On the other hand, although $\mathsf{SHB}$ captures provably more races than $\mathsf{HB}$, $\mathsf{SHB}$ is incomparable with $\mathsf{DC}$. In either case, $\mathsf{M2}$ captures more races than $\mathsf{DC}$ on 10 benchmarks, and than $\mathsf{SHB}$ on 6 benchmarks. In addition, on 5 benchmarks (shown in bold), $\mathsf{M2}$ captures more races than any other algorithm. In total, $\mathsf{M2}$ detects 71 more races than $\mathsf{DC}$ and 25 more races than $\mathsf{SHB}$.

We also remark that our algorithm provides more information than the baseline methods even on benchmarks where the number of reported races is the same. This is because $\mathsf{M2}$ manages to detect that the reports in such benchmarks are complete (i.e., no races are missed).

In terms of race distances, we have found that $\mathsf{M2}$ is able to detect races that are very far apart in the input trace. We refer to Table 4 for a few interesting examples, where the distance of a race $(e_{1},e_{2})$ is counted as the number of intervening events between $e_{1}$ and $e_{2}$ in the input trace. For instance, in lusearch, the maximum race distance detected by $\mathsf{M2}$ is 125M events. Note that, in general, the same memory location can be reported as racy by many data-race pairs $(e_{1},e_{2})$. To assess the significance of the new races detected by $\mathsf{M2}$, we have also computed the number of racy memory locations that are missed by each method. We see that $\mathsf{M2}$ misses [math] memory locations (i.e., it detects all racy memory locations). For each of $\mathsf{HB}$, $\mathsf{WCP}$, $\mathsf{DC}$ and $\mathsf{SHB}$, this number has been computed by counting how many locations have been detected by $\mathsf{M2}$ and missed by the corresponding method. We refer to Table 4 for the cases where at least one method missed some racy memory location. In total, each of the baseline methods misses tens of racy memory locations. Finally, we have also computed location-specific race distances, as follows. For each location $x$, we computed the minimum distance $d_{x}$ between all races on location $x$. Hence, $d_{x}$ holds the smallest distance of a race which reveals that the location $x$ is racy. The mean and maximum location-specific race distances in eclipse are 3M and 38M events, respectively, while in lusearch, they are 33M and 125M events, respectively. These numbers indicate that windowing techniques, which are typically restricted to windows of a few hundreds/thousands of events, are likely to produce highly incomplete results, and even fail to detect that certain memory locations are racy. Similar observations have also been made in recent works (Kini et al., 2017; Roemer et al., 2018).

Scalability. We see that $\mathsf{M2}$ has comparable running time to the baseline methods, and is sometimes faster. One clear exception is on eclipse, where $\mathsf{M2}$ requires about 45m, whereas the other methods spend between 7m and 14m. However, this is the benchmark on which all other methods miss both the most races (at least 13, see Table 2) and the most racy memory locations (at least 8, see Table 4). Hence, the completeness of our race reports comes at a relatively small increase in running time.

To better understand the efficiency of $\mathsf{M2}$, recall that its worst-case complexity is a product of two factors, $O(\alpha\cdot\beta)$, where $\alpha$ is the number of calls to $\mathsf{RaceDecision}$ for verifying race pairs, and $\beta$ is the time taken by $\mathsf{Closure}$ to compute the closure of the underlying partial order $P$. In the worst case, both $\alpha$ and $\beta$ are $\Theta(n^{2})$ (ignoring log-factors). In practice, we have observed that $\mathsf{M2}$ resorts on calling $\mathsf{RaceDecision}$ only a small number of times, hence $\alpha$ is small. This illustrates the practical advantage of $\mathsf{M2}$ over the naive approach that just uses $\mathsf{RaceDecision}$ on all $\binom{n}{2}$ event pairs. In addition, we can express $\beta$ as roughly $\beta=n+m\cdot\gamma$, where $m$ is the number of edges inserted in $P$ during closure, and $\gamma$ is the time spent for each such edge. Using our data structure $\mathsf{DS}$ for representing $P$, we have $\gamma=O(\log n)$, and, although $m=\Theta(n^{2})$ in the worst-case, we have observed that $m$ behaves as a constant in practice.

Finally, we note that the baseline methods may admit further engineering optimizations that reduce their running time. Such optimizations exist for $\mathsf{HB}$, but we are unaware of any attempts to optimize $\mathsf{WCP}$, $\mathsf{DC}$ or $\mathsf{SHB}$ further. In any case, although our tool is not faster, the take-home message is well-supported: $\mathsf{M2}$ makes sound and effectively complete race predictions, at running times comparable to the theoretically fastest, yet highly incomplete, state-of-the-art methods.

7. Related Work

In this section we briefly review related work on dynamic race detection.

Predictive analyses. Predictive techniques aim at inferring program behavior simply by looking at given traces. In the context of race detection, the $\mathsf{CP}$ partial order (Smaragdakis et al., 2012) and $\mathsf{WCP}$ partial order (Kini et al., 2017) are sound but incomplete predictive techniques based on partial orders. A somewhat different approach was proposed recently in (Roemer et al., 2018), based on the $\mathsf{DC}$ partial order. $\mathsf{DC}$ imposes fewer orderings than $\mathsf{WCP}$, but is generally unsound. To create sound warnings, a $\mathsf{DC}$-race is followed by a vindication phase, which is sound but incomplete.

Other works in this domain include (Said et al., 2011; Huang et al., 2014; Liu et al., 2016; Wang et al., 2009), which typically approach the problem based on SAT/SMT encodings. These works are sound and complete in theory, but require exponential time. In practice, techniques such as windowing make these methods operate fast, at the cost of sacrificing completeness. Predictive techniques have also been used for atomicity violations and synchronization errors (Sorrentino et al., 2010; Chen et al., 2008; Sen et al., 2005; Huang and Rauchwerger, 2015), as well as in lock-based communication (Kahlon et al., 2005; Farzan et al., 2009; Sorrentino et al., 2010).

Happens-before techniques. A large pool of race detectors are based on Lamport’s happens-before relation (Lamport, 1978), which yields the $\mathsf{HB}$ partial order. $\mathsf{HB}$ can be computed in linear time (Mattern, 1989) and has been the technical basis behind many approaches (Schonberg, 1989; Christiaens and Bosschere, 2001; Pozniansky and Schuster, 2003; Flanagan and Freund, 2009; Bond et al., 2010). The tradeoff between runtime and space usage in race-detection using the happens-before relation was studied in (Banerjee et al., 2006). Recently, the $\mathsf{SHB}$ partial order was proposed as an extension to $\mathsf{HB}$ in order to effectively detect multiple races per trace (Mathur et al., 2018).

Lockset-based techniques. A lockset of a variable is the set of locks that guard critical regions in which the variable is accessed. Lockset-based techniques report races by comparing the locksets of the variables accessed by the corresponding events. They were introduced in (Dinning and Schonberg, 1991) and equipped by the tool of (Savage et al., 1997). Lockset-based techniques tend to produce many false positives and this problem has been targeted by various enhancements such as random testing (Sen, 2008) and static analysis (von Praun and Gross, 2001; Choi et al., 2002).

Other approaches. To reduce unsound reports, lockset-based techniques have been combined with happens-before techniques (Elmas et al., 2007; O’Callahan and Choi, 2003; Yu et al., 2005). Other approaches include statistical techniques (Marino et al., 2009; Bond et al., 2010) and static race-detectors (Naik et al., 2006; Voung et al., 2007; Pratikakis et al., 2011). Recently, (Genç et al., 2019) applied a combination of static and dynamic techniques to allow for correct reorderings in which the observation of some read events is allowed to differ between the input and witness trace, as long as the read does not affect the control-flow of the respective thread. Such static information can be directly incorporated in the techniques we have developed in this paper, and is left for interesting follow-up work. Dynamic race detection has also been studied under structured parallelism (Raman et al., 2012) and relaxed memory models (Kim et al., 2009; Lidbury and Donaldson, 2017).

8. Conclusion

We have presented $\mathsf{M2}$: a new polynomial-time algorithm for the problem that has no false positives. In addition, our algorithm is complete for input traces that consist of two processes, i.e., it provably detects all races in the trace. We have also developed criteria for detecting completeness dynamically, even in the case of more than two processes. Our experimental validation found that $\mathsf{M2}$ is very effective in practice, as it soundly reported all races in the input benchmark set. Although $\mathsf{M2}$ is not theoretically complete in the general case, we believe that its completeness guarantee on two processes provides some explanation of why it performs so well in practice.

Acknowledgements.

I am grateful to Umang Mathur for his valuable assistance in the experimental part of the paper, to Viktor Kunčak for his insightful comments in earlier drafts, and to anonymous reviewers for their constructive feedback. This work is partly supported by the Sponsor Austrian Science Fund (FWF) Schrödinger grant Grant #J-4220.

Appendix A Incremental DAG Reachability

In this section we target the problem of solving incremental reachability on Directed Acyclic Graphs (DAGs). Informally, we are given a DAG and an online sequence of (i) edge-insertion and (ii) reachability query operations. The task is to answer each reachability query correctly, accounting for all preceding edge-insertion operations. Here we develop a data structure $\mathsf{DS}$ for solving the problem efficiently on DAGs of small width. In the main paper we use $\mathsf{DS}$ to compute the closure of partial orders efficiently. We expect that $\mathsf{DS}$ might be of relevance also to other race-detection techniques that are graph-based.

Directed acyclic graphs of small width. Let $G=(V,E)$ be a DAG and $E^{*}$ be the transitive closure of $E$. Note that $E^{*}$ is a partial order, and we let $\mathsf{width}(G)=\mathsf{width}(E^{*})$. Our focus is on DAGs of small width, i.e., we take $\mathsf{width}(G)=k=O(1)$. For $u,v\in V$, we write $u\rightsquigarrow v$ if $v$ is reachable from $u$. We represent $G$ as $k$ (totally ordered) chains with extra edges between them. We let $V\subseteq[k]\times[n]$, so that a node of $G$ is represented as a pair $(i,j)$, meaning that it is the $j$-th node in the $i$-th chain. For two nodes $\langle i,j_{1}\rangle,\langle i,j_{2}\rangle\in V$ with $j_{2}=j_{1}+1$, we have $((i,j_{1}),(i,j_{2}))\in E$. Given two nodes $\langle i,j_{1}\rangle,\langle i,j_{2}\rangle$, we say that $\langle i,j_{1}\rangle$ is higher than $\langle i,j_{2}\rangle$ if $j_{1}\leq j_{2}$. In such a case, we say that $\langle i,j_{2}\rangle$ is lower than $\langle i,j_{1}\rangle$. The edge set is represented as a set of arrays $\mathsf{Out}_{i_{1}}^{i_{2}}\to[n]\cup\{\infty\}$, where $i_{1},i_{2}\in[k]$ and $i_{1}\neq i_{2}$. We have that $\mathsf{Out}_{i_{1}}^{i_{2}}[j_{1}]=j_{2}\in[k]$ iff $(\langle i_{1},j_{1}\rangle,\langle i_{2},j_{2}\rangle)\in E$. Note that since $k=O(1)$, such a representation requires $O(n)$ space even if $G$ is a dense graph.

Incremental reachability on DAGs of small width. The incremental reachability problem on a DAG $G=(V,E)$ is defined on an online sequence of operations of the following types.

1. (1)

An $\mathsf{insert}(u,v)$ operation, such that $v\not\rightsquigarrow u$, inserts the edge $u,v$ in $G$. 2. (2)

A $\mathsf{query}(u,v)$ operation returns $\mathsf{True}$ iff $u\rightsquigarrow v$. 3. (3)

A $\mathsf{successor}(u,i)$ operation returns the highest successor of $u$ in the $i$-th chain. 4. (4)

A $\mathsf{predecessor}(u,i)$ operation returns the lowest predecessor of $u$ in the $i$-th chain.

The task is to answer $\mathsf{query}$ operations correctly, taking into consideration all preceding $\mathsf{insert}$ operations. Note that the width of $G$ does not increase after any operation. We will present a data structure that handles each such query in $O(\log n)$ time. Our data structure is based on the dynamic suffix minima problem, presented below.

Dynamic suffix minima and Fenwick-trees. The dynamic suffix minima problem is defined given an integer array $A$ of length $n$, and an online sequence of operations of the following types.

1. (1)

An $\mathsf{update}(i,x)$ operation, for $1\leq i\leq n$ and $x\in\mathbb{Z}$, sets $A[i]=x$. 2. (2)

A $\min(i)$ operation, for $1\leq i\leq n$, returns $\min_{i\leq j\leq n}A[j]$. 3. (3)

An $\arg\mathsf{leq}(i)$ operation, for $1\leq i\leq n$, returns $\max_{j\colon A[j]\leq i}j$.

The task is to answer $\min$ and $\arg\mathsf{leq}$ operations correctly, taking into consideration all preceding $\mathsf{update}$ operations. The Fenwick-tree data structure solves the dynamic suffix minima problem in $O(\log n)$ time per operation, after $O(n)$ preprocessing time (Fenwick, 1994).

The data structure $\mathsf{DS}$ for solving the incremental reachability problem. We are now ready to describe our data structure $\mathsf{DS}$ for solving the incremental reachability problem given a DAG $G=(V,E)$ of width $k$, and an online sequence $\Sigma$ of $\mathsf{insert}$ and $\mathsf{query}$ operations. We consider that $G$ is given in a sparse representation form, where outgoing edges are represented using the arrays $\mathsf{Out}_{i_{1}}^{i_{2}}$, for each $i_{1},i_{2}\in[k]$ and $i_{1}\neq i_{2}$.

In the initialization phase, $\mathsf{DS}$ performs the following steps. For each $i_{1},i_{2}\in[k]$ such that $i_{1}\neq i_{2}$, we initialize a Fenwick-tree data structure $\mathsf{FenwickTree}_{i_{1}}^{i_{2}}$ with array $\mathsf{Out}_{i_{1}}^{i_{2}}$. This data structure stores forward reachability information from nodes of the $i_{1}$-th chain to nodes in the $i_{2}$ chain, by maintaining the invariant that $\mathsf{FenwickTree}_{i_{1}}^{i_{2}}.\min(j_{1})=j_{2}$ iff $\langle i_{2},j_{2}\rangle$ is the highest node of the $i_{2}$-th chain reachable from $\langle i_{1},j_{2}\rangle$. A $\mathsf{successor}(\langle i_{1},j_{1}\rangle,i)$ (resp., $\mathsf{predecessor}(\langle i_{1},j_{1}\rangle,i)$) operation is handled by $\mathsf{DS}$ by returning $\mathsf{FenwickTree}_{i_{1}}^{i}.\min(j_{1})$ (resp., $\mathsf{FenwickTree}_{i_{1}}^{i}.\arg\mathsf{leq}(j_{1})$). Finally, the operations $\mathsf{DS}.\mathsf{insert}$ and $\mathsf{DS}.\mathsf{query}$ are handled by Algorithm 7 and Algorithm 8, respectively. The following lemma establishes the correctness and complexity of the data structure $\mathsf{DS}$.

Lemma A.1.

Let $\Sigma$ be an online sequence of incremental reachability operations. The data structure $\mathsf{DS}$ correctly handles $\Sigma$ and spends (i) $O(n)$ preprocessing time and (ii) $O(\log n)$ time per operation.

Appendix B Definition of $\mathsf{HB}$, $\mathsf{SHB}$, $\mathsf{WCP}$ and $\mathsf{DC}$

For the sake of completeness, here we give the definitions of the partial orders $\mathsf{HB}$, $\mathsf{SHB}$, $\mathsf{WCP}$ and $\mathsf{DC}$, based on (Kini et al., 2017; Mathur et al., 2018; Roemer et al., 2018). In each case, we consider given a trace $t$, and the respective partial order is over the set of events $\mathcal{E}(t)$ of $t$.

**The $\mathsf{HB}$ partial order ** is the smallest partial order that satisfies the following conditions .

1. (1)

$\mathsf{HB}\sqsubseteq\mathsf{PO}$. 2. (2)

For every lock-acquire and lock-release events $\mathsf{acq}$ and $\mathsf{rel}$ such that $\mathsf{rel}<_{t}\mathsf{acq}$, if $\mathsf{acq}\Join\mathsf{rel}$ then $\mathsf{rel}<_{\mathsf{HB}}\mathsf{acq}$.

**The $\mathsf{SHB}$ partial order ** is the smallest partial order that satisfies the following conditions.

1. (1)

$\mathsf{SHB}\sqsubseteq\mathsf{HB}$. 2. (2)

For every read event $r$ we have $\mathcal{O}_{t}(r)<_{\mathsf{SHB}}r$. Recall that $\mathcal{O}_{t}(r)$ is the observation of $r$ in $t$.

**The $\mathsf{WCP}$ partial order ** is the smallest partial order that satisfies the following conditions.

1. (1)

$\mathsf{WCP}\sqsubseteq\mathsf{PO}$. 2. (2)

For every lock-release event $\mathsf{rel}$ and write/read event $e$ such that $\mathsf{rel}<_{t}e$, if (i) $e$ is protected by a lock $\ell=\mathsf{loc}(\mathsf{rel})$ and (ii) $e$ conflicts with an event in the critical section of $\mathsf{rel}$, then $\mathsf{rel}<_{\mathsf{WCP}}e$. 3. (3)

For every two lock-release events $\mathsf{rel}_{1},\mathsf{rel}_{2}$ such that $\mathsf{rel}_{1}<_{t}\mathsf{rel}_{2}$, if the critical sections of $\mathsf{rel}_{1}$ and $\mathsf{rel}_{2}$ contain $\mathsf{WCP}$-ordered events, then $\mathsf{rel}_{1}<_{\mathsf{WCP}}\mathsf{rel}_{2}$. 4. (4)

$\mathsf{WCP}$ is closed under left and right composition with $\mathsf{HB}$.

**The $\mathsf{DC}$ partial order ** is the smallest partial order that satisfies conditions 1, 2 and 3 of $\mathsf{WCP}$.

Appendix C Missing Proofs

C.1. Proofs of Section 3

See 3.1

Proof.

We first argue that the partial order $Q$ defined in Algorithm 1 is indeed a partial order, and thus the linearization $t^{*}$ is well-defined. Assume towards contradiction otherwise, hence there exist two events $e_{1},e_{2}\in X$ such that $e_{i}\in X_{i}$ for each $i\in[2]$ and the algorithm inserts an edge $e_{1}\to e_{2}$ in $Q$. Since all edges inserted in $Q$ go from $X_{1}$ to $X_{2}$, there exists an event $e^{\prime}_{1}\in X_{2}$ such that $e_{1}<_{P}e^{\prime}_{1}$ and $e^{\prime}_{1}<_{P}e_{2}$. But then $e_{1}\not\parallel_{P}e_{2}$, and the algorithm could not have inserted the edge $e_{1}\to e_{2}$ in $Q$, a contradiction. Hence $Q$ is a partial order.

Note that $Q\sqsubseteq P$ and thus $t^{*}$ is a linearization of $P$. We show that (i) the observation function of $t^{*}$ agrees with the observation function of $t$ and (ii) $t^{*}$ respects the lock semantics.

Observations. Consider any read event $r\in\mathcal{R}(X)$, and let $w=\mathcal{O}_{t}(r)$. Since $P$ respects $t$, we have that $w\in X$ and $w<_{P}r$, and since $t^{*}$ is a linearization of $P$, we have $w<_{t^{*}}r$. Let $w^{\prime}\in\mathcal{W}(X)$ be any write event such that $w\Join r$ and $w^{\prime}\neq w$, and we will argue that if $w^{\prime}<_{t^{*}}r$ then $w^{\prime}<_{t^{*}}w$. We distinguish the following cases.

1. (1)

If $w^{\prime}\not\parallel_{P}r$ or $w^{\prime}\not\parallel_{P}w$, we have $w^{\prime}<_{P}r$ and since $P$ is observation closed we have $w^{\prime}<_{P}w$. 2. (2)

Otherwise, since $(P|X_{i})$ is an M-trace for each $i\in[2]$, it follows that $r,w\in X_{i}$ and $w^{\prime}\in X_{3-i}$, for some $i\in[2]$. Since $w^{\prime}<_{t^{*}}r$, we have that $w^{\prime}\in X_{1}$, and Algorithm 1 guarantees that $w^{\prime}<_{Q}w$, and thus $w^{\prime}<_{t^{*}}w$.

Locks. Consider two lock acquire events $\mathsf{acq}_{1},\mathsf{acq}_{2}\in\mathcal{L}^{A}(X)$ with $\mathsf{loc}(\mathsf{acq}_{1})=\mathsf{loc}(\mathsf{acq}_{2})=\ell$. Let $\mathsf{rel}_{i}=\mathsf{match}_{t}(\mathsf{acq}_{i})$ for each $i\in\{1,2\}$. Assume wlog that $\mathsf{acq}_{1}<_{t^{*}}\mathsf{acq}_{2}$, and observe that $\mathsf{rel}_{1}\in X$. Indeed, since $P$ respects $t$, if $\mathsf{rel}_{1}\not\in X$, we would have $\mathsf{rel}_{2}\in X$ and $\mathsf{rel}_{2}<_{P}\mathsf{acq}_{1}$, and since $P$ is lock closed, we would also have $\mathsf{acq}_{2}<_{P}\mathsf{acq}_{1}$, a contradiction. We will argue that $\mathsf{rel}_{1}<_{t^{*}}\mathsf{acq}_{2}$. We consider the following cases.

1. (1)

If $\mathsf{rel}_{2}\not\in X$ or $\mathsf{rel}_{2}\in X$ and $\mathsf{acq}_{1}<_{P}\mathsf{rel}_{2}$, since $P$ is lock-closed, we have $\mathsf{rel}_{1}<_{P}\mathsf{acq}_{2}$, and since $t^{*}$ is a linearization of $P$, we conclude that $\mathsf{rel}_{1}<_{t^{*}}\mathsf{acq}_{2}$. 2. (2)

Otherwise, if $\mathsf{acq}_{2}<_{P}\mathsf{rel}_{1}$, since $P$ is lock closed, we have $\mathsf{rel}_{2}<_{P}\mathsf{acq}_{1}$ and thus $\mathsf{acq}_{2}<_{P}\mathsf{acq}_{1}$, a contradiction. 3. (3)

Finally, we have $\mathsf{acq}_{i}\parallel_{P}\mathsf{rel}_{3-i}$ for each $i\in\{1,2\}$. Since for each $i\in[2]$ we have that each $Q|X_{i}$ is an M-trace, we have that $\mathsf{acq}_{i}$ and $\mathsf{rel}_{3-i}$ do not belong to the same set $X_{j}$. Since $\mathsf{acq}_{1}<_{t^{*}}\mathsf{acq}_{2}$, we have that $\mathsf{acq}_{1}\in X_{1}$ and thus $\mathsf{rel}_{1}\in X_{1}$ and $\mathsf{acq}_{2}\in X_{2}$. Hence, Algorithm 1 ensures that $\mathsf{rel}_{1}<_{Q}\mathsf{acq}_{2}$, as desired.

∎

See 3.2

Proof.

Assume towards contradiction otherwise, and consider two partial orders $Q_{1},Q_{2}$ with properties (i) and (ii), and such that $Q_{i}\not\sqsubseteq Q_{3-i}$ for each $i\in[2]$. Let $Q=Q_{1}\cap Q_{2}$, and hence $Q_{1},Q_{2}\sqsubseteq Q$. We argue that $Q$ is closed. First, observe that each $Q_{i}$ respects $t$, and hence $Q$ respects $t$.

We now argue that $Q$ is observation-closed. For every read event $r\in\mathcal{R}(X)$ and write event $w\in\mathcal{W}(X)$ such that $w\Join r$ and $w\neq\mathcal{O}_{t}(r)$, if $w<_{Q}r$ then $w<_{Q_{i}}r$ for each $i\in[2]$. Since each $Q_{i}$ is closed, we have $w<_{Q_{i}}\mathcal{O}_{t}(r)$ for each $i$, and thus $w<_{Q}\mathcal{O}_{t}(r)$. Similarly if $\mathcal{O}_{t}(r)<_{Q}w$, we conclude that $r<_{Q}w$.

Finally, we argue that $Q$ is lock-closed. Consider any pair of lock-release events $\mathsf{rel}_{1},\mathsf{rel}_{2}\in\mathcal{L}^{R}(X)$, and let $\mathsf{acq}_{i}=\mathsf{match}_{t}(\mathsf{rel}_{i})$ for each $i\in[2]$. If $\mathsf{acq}_{1}<_{Q}\mathsf{rel}_{2}$, then $\mathsf{acq}_{1}<_{Q_{i}}\mathsf{rel}_{2}$ for each $i\in[2]$. Hence $\mathsf{rel}_{1}<_{Q_{i}}\mathsf{acq}_{2}$ for each $i\in[2]$, and thus $\mathsf{rel}_{1}<_{Q}\mathsf{acq}_{2}$. ∎

Lemma C.1.

The algorithm $\mathsf{Closure}$ (Algorithm 2) correctly computes the closure of $P$.

Proof.

We argue that the partial order $Q$ stored in the data structure $\mathsf{DS}$ returned in Algorithm 2 represents the closure of $P$. Because of Algorithm 2, it is easy to see that $\mathsf{DS}$ represents indeed a partial order $Q$, and due to Algorithm 2, we have that $Q\sqsubseteq P$. We will argue that $Q$ is closed.

We start by showing that $Q$ is observation-closed. Consider any read event $r\in\mathcal{R}(X)$, and let $\mathsf{loc}(r)=x$ and $w=\mathcal{O}_{t}(r)$. Consider any write event $w^{\prime}\in\mathcal{W}(X)$ such that $w^{\prime}\Join r$ and $w^{\prime}\neq w$.

1. (1)

Assume that $w^{\prime}<_{Q}r$, and we will show that $w^{\prime}<_{Q}w$. We prove the claim for $w^{\prime}$ being any last such event, i.e., for every other $w^{\prime\prime}$ with $w^{\prime\prime}\Join r$, $w^{\prime\prime}\neq\mathcal{O}_{t}(r)$ and $w^{\prime\prime}<_{Q}r$, we have that $w^{\prime}\not<_{Q}w^{\prime\prime}$. Clearly, this establishes the claim for all $w^{\prime}$. Note that there exist two events $e_{1},e_{2}$ such that

1. (a)

$w^{\prime}<_{\mathsf{PO}}e_{1}$ and $e_{2}<_{\mathsf{PO}}r$ (possibly $e_{1}=w^{\prime}$ and $e_{2}=r$), and 2. (b)

either $e_{1}<_{P}e_{2}$ or the algorithm performs a $\mathsf{DS}.\mathsf{insert}(e_{1},e_{2})$ in Algorithm 2.

By the choice of $w^{\prime}$, we have that (i) $w^{\prime}=\mathsf{Before}_{x}^{\mathcal{W}}(e_{1})$ and (ii) $\mathcal{O}_{t}(r)=\mathcal{O}_{t}(\mathsf{After}_{x}^{\mathcal{R}}(e_{2}))=w$. To see(i), note that if $w\neq\mathsf{Before}_{x}^{\mathcal{W}}(e_{1})$, this violates our choice of $w^{\prime}$ being a last conflicting write. To see (ii), let $\mathcal{O}_{t}(\mathsf{Before}_{x}^{\mathcal{R}}(e_{2}))=w^{\prime\prime}$ and observe that $w^{\prime\prime}<_{Q}r$. Because of Algorithm 3 in $\mathsf{ObsClosure}$, we have $w^{\prime}<_{Q}w^{\prime\prime}$, and thus if $w\neq w^{\prime\prime}$, this violates our choice of $w^{\prime}$ being a last conflicting write. After Algorithm 2 of $\mathsf{ObsClosure}$ is executed, we have $w<_{Q}w$, as desired. 2. (2)

Assume that $w<_{Q}w^{\prime}$, and we will show that $r<_{Q}w^{\prime}$. We prove the claim for $w^{\prime}$ being any first such event, i.e., for every other $w^{\prime\prime}$ with $w^{\prime\prime}\Join r$, $w^{\prime\prime}\neq\mathcal{O}_{t}(r)$ and $w<_{Q}w^{\prime\prime}$, we have that $w^{\prime\prime}\not<_{Q}w^{\prime}$. Clearly, this establishes the claim for all $w^{\prime}$. Note that there exist two events $e_{1},e_{2}$ such that

1. (a)

$w<_{\mathsf{PO}}e_{1}$ and $e_{2}<_{\mathsf{PO}}w^{\prime}$ (possibly $e_{1}=w$ and $e_{2}=w^{\prime}$), and 2. (b)

either $e_{1}<_{P}e_{2}$ or the algorithm performs a $\mathsf{DS}.\mathsf{insert}(e_{1},e_{2})$ in Algorithm 2.

By the choice of $w^{\prime}$, we have that (i) $w=\mathsf{Before}_{x}^{\mathcal{W}}(e_{1})$ and (ii) $w^{\prime}=\mathsf{After}_{x}^{\mathcal{W}}(e_{2})$. To see (i), note that if $w\neq\mathsf{Before}_{x}^{\mathcal{W}}(e_{1})$, this violates our choice of $w^{\prime}$ being a first conflicting write. Similarly, to see (ii), note that if $w^{\prime}\neq\mathsf{After}_{x}^{\mathcal{W}}(e_{2})$, this also violates our choice of $w^{\prime}$ being a first conflicting write. After Algorithm 3 of $\mathsf{ObsClosure}$ is executed, we have $r^{\prime}<_{Q}w^{\prime}$, where $r^{\prime}=\mathcal{F}_{t}^{i}(w)$ for $i$ such that $p_{i}=\mathsf{p}(r)$. By construction, we have $r<_{\mathsf{PO}}r^{\prime}$, and since $Q\sqsubseteq\mathsf{PO}|X$, we have $r<_{Q}w^{\prime}$, as desired.

We now show that $Q$ is lock-closed. Consider any pair of lock-release events $\mathsf{rel}_{1},\mathsf{rel}_{2}\in\mathcal{L}^{R}(X)$, let $\mathsf{acq}_{i}=\mathsf{match}_{t}(\mathsf{rel}_{i})$, for $i\in[2]$, and assume that $\mathsf{rel}_{2}\Join\mathsf{acq}_{1}$ and $\mathsf{acq}_{1}<_{Q}\mathsf{rel}_{2}$ We will show that $\mathsf{rel}_{1}<_{Q}\mathsf{acq}_{2}$. Observe that in this case, there exist two events $e_{1},e_{2}$ with $\mathsf{acq}_{1}<_{\mathsf{PO}}e_{1}$ and $e_{2}<_{\mathsf{PO}}\mathsf{rel}_{2}$, and either $e_{1}<_{P}e_{2}$ or the algorithm performs a $\mathsf{DS}.\mathsf{insert}(e_{1},e_{2})$ in Algorithm 2. In either case, the algorithm calls $\mathsf{LockClosure}(e_{1},e_{2})$ (in Algorithm 2 for the former case, and in Algorithm 2 for the latter). The well-nestedness of locks in $t$ guarantees that $\mathsf{rel}_{1}=\mathsf{After}_{l}^{\mathcal{L}^{R}}(e_{1})$ and $\mathsf{rel}_{2}=\mathsf{After}_{l}^{\mathcal{L}^{R}}(e_{2})$. If $e_{2}<_{\mathsf{PO}}\mathsf{acq}_{2}$, then by transitivity we have $\mathsf{rel}_{1}<_{Q}\mathsf{acq}_{2}$, and we are done. Otherwise, Algorithm 4 of $\mathsf{LockClosure}$ will be executed, and thus $\mathsf{rel}_{1}<_{Q}\mathsf{acq}_{2}$.

Hence, we have shown that the partial order $Q$ represented by the data structure $\mathsf{DS}$ at the end of $\mathsf{Closure}$ is closed. ∎

We now turn our attention to complexity.

Lemma C.2.

$\mathsf{Closure}$* (Algorithm 2) requires $O(n^{2}\cdot\log n)$ time.*

Proof.

First, by Lemma A.1, the initialization of $\mathsf{DS}$ requires $O(n)$ time. Observe that every invocation to $\mathsf{ObsClosure}$ and $\mathsf{LockClosure}$ requires $O(k\cdot|\mathcal{G}|)=O(1)$ time. Hence the initialization of $\mathsf{Closure}$ in Algorithm 2 requires $O(n\cdot\log n)$ time. We now turn our attention to the main computation in Algorithm 2, and consider an edge $(\overline{e}_{1},\overline{e}_{2})$ extracted in Algorithm 2. By Lemma A.1, every $\mathsf{DS}.\mathsf{query}$ requires $O(\log n)$ time, and the loop in Algorithm 2 will iterate over $O(1)$ edges $(e_{1},e_{2})$. Since every invocation to $\mathsf{ObsClosure}$ and $\mathsf{LockClosure}$ requires $O(1)$ time, we conclude that the cost of every edge $(\overline{e}_{1},\overline{e}_{2})$ is $O(\log n)$. Finally, observe that for every edge $z=(\overline{e}_{1},\overline{e}_{2})$ every held in $\mathcal{Q}$ there exists an edge $z^{\prime}=(\overline{e}^{\prime}_{1},\overline{e}^{\prime}_{2})$ which was inserted for the first time in $\mathsf{DS}$. Since there are are $O(n^{2})$ such edges $z^{\prime}$, we have that $\mathcal{Q}$ will hold $O(n^{2})$ elements in total. Hence the total running time of $\mathsf{Closure}$ is $O(n^{2}\cdot\log n)$. ∎

See 3.4

Proof (Sketch).

Similarly to Lemma C.2, the time required for handling $\Sigma$ is proportional to the size of $\Sigma$ times $O(\log n)$ for querying whether each edge of $\Sigma$ is already present in $\mathsf{DS}$, plus $O(\log)$ for every new edge inserted in $\mathsf{DS}$. Since there can be $O(n^{2})$ new edges inserted, the time bound is $O(n^{2}\cdot\log n+|\Sigma|\cdot\log n)$ for the whole sequence $\Sigma$. ∎

C.2. Proofs of Section 4

Lemma C.3.

If $\mathsf{RaceDecision}$ returns $\mathsf{True}$ then $(e_{1},e_{2})$ is a predictable race of $t$.

Proof.

Observe that if $\mathsf{RaceDecision}$ returns $\mathsf{True}$ then at that point $X$ is a feasible set and by Theorem 3.3, $Q$ is a closed partial order. Additionally, due to the loop in Algorithm 5, $X$ can be naturally partitioned into two sets $X_{1}$ and $X_{2}$ such that $\mathsf{width}(Q|X_{1})=1$ and $Q|X_{2}$ is an M-trace. In particular, we have $X_{1}$ be the set of events of $p_{i}$ and $X_{2}=X\setminus X$. By Theorem 3.1, the sequence $t^{*}$ returned by $\mathsf{MaxMin}$ on $Q$ is a correct reordering of $t$. Finally, by the definition of relative causal cones, the events $e_{1},e_{2}$ are enabled in their respective processes when $t^{*}$ is executed. ∎

Lemma C.4.

Let $t$ be a trace of a program with $k=2$ processes, and let $(e_{1},e_{2})$ be a predictable race of $t$. Then $\mathsf{RaceDecision}$ returns $\mathsf{True}$ for the pair $(e_{1},e_{2})$.

Proof.

First, note that since $(e_{1},e_{2})$ is a predictable race of $t$, there exists a correct reordering $t^{*}$ of $t$ such that after $t^{*}$ is executed, $e_{1}$ and $e_{2}$ are the enabled events in their respective processes. It is easy to see that $\mathcal{E}(t^{*})=\mathsf{RCone}_{t}(e_{1},\mathsf{p}(e_{2}))\cup\mathsf{RCone}_{t}(e_{2},\mathsf{p}(e_{1}))$, and thus $\mathsf{OpenAcqs}_{t}(\mathcal{E}(t^{*}))=\mathsf{OpenAcqs}_{t}(X)$, for the set $X$ constructed in Algorithm 5 of $\mathsf{RaceDecision}$. Hence $X$ is feasible, and $\{e_{1},e_{2}\}\cap X=\emptyset$. Viewed as a partial order, $t^{*}$ must respect $t$, and as $\mathcal{E}(t^{*})=X$, we have that $t^{*}$ is a linearization of $P$ which is constructed in Algorithm 5. Additionally, $t^{*}$ must be closed, hence $P$ is feasible and $Q$ is a valid partial order in Algorithm 5. Since $k=2$, for every pair of events $\overline{e}_{1},\overline{e}_{2}$ in the loop in Algorithm 5 of $\mathsf{RaceDecision}$ we have $\mathsf{p}(e_{1})=\mathsf{p}(e_{2})$ and thus $e_{1}\not\parallel_{Q}e_{2}$ and the loop inserts no new edges in $Q$. Thus the algorithm returns $\mathsf{True}$. ∎

See 4.1

Proof.

Lemma C.3 shows that $\mathsf{RaceDecision}$ is sound and Lemma C.4 shows that $\mathsf{RaceDecision}$ is complete for $k=2$. Now we turn our attention to complexity. It is easy to see that computing $\mathsf{RCone}_{t}(e_{i},\mathsf{p}(e_{-i}))$ requires $O(n)$ time, and by Lemma A.1, constructing $P$ in Algorithm 5 using our data structure $\mathsf{DS}$ requires $O(n\cdot\log n)$ time. By Theorem 3.3, computing the closure $Q$ of $P$ in Algorithm 5 requires $O(n^{2}\cdot\log n)$ time. The loop in Algorithm 5 can also be executed in $O(n^{2}\cdot\log n)$ time, since by Lemma 3.4 all $\mathsf{InsertAndClose}$ operations are handled in $O(n^{2}\cdot\log n)$ time in total. If $\mathsf{RaceDecision}$ returns $\mathsf{True}$, then $\mathsf{MaxMin}$ produces a witness trace $t^{*}$ that linearizes $Q$ in $O(n\cdot\log n)$ time. ∎

C.3. Proofs of Section 5

See 5.1

Proof.

Indeed, observe that $t|X$ is a trace where there are no open lock-acquire events and $e_{1},e_{2}$ are enabled in their respective processes. Hence, $t^{*}=t|\left(X\cup\{e_{1},e_{2}\}\right)$ is a correct reordering of $t$ that exhibits the race $(e_{1},e_{2})$. ∎

C.4. Proofs of Section A

See A.1

Proof.

We treat the correctness and complexity separately.

Correctness. It is straightforward to establish that the data structure maintains the following invariant. At the end of each $\mathsf{insert}(\langle i,j\rangle,\langle i^{\prime},j^{\prime}\rangle)$ operation of $\Sigma$, for every $i_{1},i_{2}\in[k]$ and $j_{1}\in[n]$,

1. (1)

if $j_{2}=\mathsf{FenwickTree}_{i_{1}}^{i_{2}}.\mathsf{query}(j_{1})$, then $\langle i_{2},j_{2}\rangle$ is the highest node of the $i_{2}$-th chain that can be reached from $\langle i_{1},j_{1}\rangle$, and 2. (2)

if $j_{2}=\mathsf{FenwickTree}_{i_{1}}^{i_{2}}.\arg\min(j_{1})$, then $\langle i_{2},j_{2}\rangle$ is the lowest node of the $i_{2}$-th chain that can be reached from $\langle i_{1},j_{1}\rangle$.

Complexity. Initializing every Fenwick tree requires $O(n)$ time (Fenwick, 1994), and since we have $O(1)$ such Fenwick trees in total, the initialization of $\mathsf{DS}$ requires $O(n)$ time. A $\mathsf{DS}.\mathsf{query}$ operation requires $O(\log n)$ time, which is determined by the $\mathsf{DS}.\mathsf{successor}$ operation in Algorithm 8, which is implemented by a query operation in the respective Fenwick tree and thus requires $O(\log n)$ time (Fenwick, 1994). We now turn our attention to the $\mathsf{DS}.\mathsf{insert}$ operation. Notice that this step performs $O(k^{2})=O(1)$ update operations to Fenwick trees. Since each update operation requires $O(\log n)$ time (Fenwick, 1994), the total time spent in this operation is $O(\log n)$. ∎

Appendix D Incompleteness of $\mathsf{RaceDecision}$ for $k\geq 3$ processes

In this section we provide a small example of an input trace for $k\geq 3$ processes which has a predictable race that is not detected by $\mathsf{RaceDecision}$. Consider the input trace $t$ given in Figure 9(a), where the task is to decide whether $(e_{4},e_{16})$ is a predictable race of $t$. To make the notation somewhat simple, given a variable $x$, if $x$ is not read, we denote every write event to $x$ by $w(x)$. If $x$ is read, we denote by $r(x)$ the unique read event to $x$ by $w(x)$ the observation $\mathcal{O}_{t}(r(x))$, and by $\overline{w}(x)$ any other write event to $x$.

We now outline the steps of $\mathsf{RaceDecision}$ on input the potential race $(e_{4},e_{16})$. Observe that the set $X$ constructed in Algorithm 5 of the algorithm contains all events of $t$, since $w(x_{4})$ is read by $r(x_{4})$ which belongs to $\tau_{2}$ and thus $w(x_{4})$ is in the causal past cone of $e_{16}$. Initially, the algorithm constructs a partial order shown in Figure 9(b) in solid edges. Observe that this partial order is closed, hence the algorithm proceeds to make a nondeterministic choice for $i\in[2]$ in Algorithm 5. We argue that for $i=2$, the algorithm reports that $(e_{4},e_{16})$ is not a predictable race of $t$. Indeed, in this case the algorithm will execute $\mathsf{InsertAndClose}(e_{8}\to e_{11})$ in Algorithm 5, since $e_{8}<_{t}e_{11}$. This inserts the dotted edge in the partial order of Figure 9(b). Observe that this edge imposes the ordering $w(x_{2})\to\overline{w}(x_{2})$, hence by the rules of observation closure, the algorithm inserts the edge $r(x_{2})\to\overline{w}(x_{2})$, shown in dashed in Figure 9(b). However, this edge imposes the ordering $\overline{w}(x_{1})\to r(x_{1})$, hence by the rules of the observation closure, the algorithm inserts the edge $\overline{w}(x_{2})\to w(x_{1})$, shown in dashed in Figure 9(b). Observe that this edge creates a cycle in the partial order, hence for $i=2$, the algorithm reports that $(e_{4},e_{16})$ is not a predictable race of $t$.

On the other hand, Figure 9(c) shows a correct reordering of $t$ that exposes the race. As a final remark, we note that the nondeterministic choice for $i\in[2]$ in Algorithm 5 of $\mathsf{RaceDecision}$ will also try $i=1$. In this case, $\mathsf{RaceDecision}$ will detect the race and produce the witness trace shown in Figure 9(c). It is not hard to extend this example so that the algorithm misses the race also for $i=1$.