ThreadSanitizer reports a data race when using the code from Boost.Atomic's "reference counting" example

[romane...@gmail.com]

Hi!

I'd like to draw your attention to an issue with atomics that I encountered when using ThreadSanitizer. The problem is that when using the code shown in "reference counting" example [1] from the Boost.Atomic documentation, the ThreadSanitizer reports a data race. Everything is described in detail in a StackOverflow thread [2] so I don't want to repeat all that here.

Please help me determine whether it's a false positive or an actual defect in my code. 

Additionally, I don't understand this:

Write of size 1 at 0x7d040000f7f0 by thread T2:
    #0 operator delete(void*) <null>:0 (a.out+0x00000004738b)

What kind of write does ThreadSanitizer might refer to?

WBR,
Adam Romanek

[1] http://www.boost.org/doc/libs/1_55_0/doc/html/atomic/usage_examples.html#boost_atomic.usage_examples.example_reference_counters
[2] http://stackoverflow.com/questions/24446561/threadsanitizer-reports-data-race-on-operator-deletevoid-when-using-embedde 

[Konstantin Serebryany]

On Tue, Jul 1, 2014 at 11:24 AM, <romane...@gmail.com> wrote:

Hi!

I'd like to draw your attention to an issue with atomics that I encountered when using ThreadSanitizer. The problem is that when using the code shown in "reference counting" example [1] from the Boost.Atomic documentation, the ThreadSanitizer reports a data race. Everything is described in detail in a StackOverflow thread [2] so I don't want to repeat all that here.

I don't have much experience with boost, but I suspect that the relevant part of boost comes as a pre-compiled library and thus is not instrumented with tsan.

All code that uses atomic synchronization must be instrumented with tsan to avoid false positives. 

 

Please help me determine whether it's a false positive or an actual defect in my code. 

Additionally, I don't understand this:

Write of size 1 at 0x7d040000f7f0 by thread T2:
    #0 operator delete(void*) <null>:0 (a.out+0x00000004738b)

tsan treats free() as a write memory access to the memory being freed, this allows us to detect racy use-after-free 

https://code.google.com/p/thread-sanitizer/wiki/PopularDataRaces#Race_on_free

hth, 

--kcc 

 

What kind of write does ThreadSanitizer might refer to?

WBR,
Adam Romanek

[1] http://www.boost.org/doc/libs/1_55_0/doc/html/atomic/usage_examples.html#boost_atomic.usage_examples.example_reference_counters
[2] http://stackoverflow.com/questions/24446561/threadsanitizer-reports-data-race-on-operator-deletevoid-when-using-embedde 

--
You received this message because you are subscribed to the Google Groups "thread-sanitizer" group.
To unsubscribe from this group and stop receiving emails from it, send an email to thread-sanitiz...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Dmitry Vyukov]

On Tue, Jul 1, 2014 at 11:24 AM, <romane...@gmail.com> wrote:

> Hi!
>
> I'd like to draw your attention to an issue with atomics that I encountered
> when using ThreadSanitizer. The problem is that when using the code shown in
> "reference counting" example [1] from the Boost.Atomic documentation, the
> ThreadSanitizer reports a data race. Everything is described in detail in a
> StackOverflow thread [2] so I don't want to repeat all that here.
>
> Please help me determine whether it's a false positive or an actual defect
> in my code.

This is a false positive due the fact that tsan ignores stand-alone
memory fences ATM.
Try to do:
if (x->refcount_.fetch_sub(1, boost::memory_order_acq_rel) == 1) {
as mentioned in the docs.