EventRacer: Finding Concurrency Errors in Event-Driven Applications Pavol Bielik
Android Errors Caused by Concurrency Display article twice Display wrong directory Display wrong order Rate wrong card 1
Web Page Errors Caused by Concurrency Incomplete form jQuery version used non- submitted Non-operational menu deterministically 2
Event-Driven Applications designed to hide latency, various asynchronous APIs network, disk, database, timers, UI events highly asynchronous and complex control flow scheduling non-determinism asynchrony is not intuitive 3
Trouble with Asynchrony Background task, progress dialog, orientation change - is there any 100% working solution? JavaScript function sometimes called, sometimes not Avoiding race conditions in Google Analytics asynchronous tracking Ajax Call Sometimes Works, Sometime works and refreshes, Sometimes refreshes and fails …? Is AsyncTask really conceptually flawed or am I just missing something? 4
“Hello World” of web page concurrency <html><body> < script > Browser Server var v=undefined; v:undefined fetch img1.png </ script > fetch img2.png < img src="img1.png" onload ="v='Hi!';"> load img1.png < img src="img2.png" onload ="alert(v);"> v:’Hi!’ load img2.png Hi! </body></html> 5
Bad interleaving <html><body> < script > Browser Server var v=undefined; v:undefined fetch img1.png </ script > fetch img2.png < img src="img1.png" onload ="v='Hi!';"> load img2.png < img src="img2.png" onload ="alert(v);"> undefined </body></html> 5
Understanding the problem <html><body> Event Actions < script > var v=undefined; </ script > < img src=”img1.png” onload =”v=’Hi!’;”> < img src=”img2.png” onload =”alert(v);”> </body></html> 6
Understanding the problem <html><body> Event Actions < script > var v=undefined; </ script > Happens-before < img src=”img1.png” onload =”v=’Hi!’;”> < img src=”img2.png” onload =”alert(v);”> </body></html> 6
Understanding the problem <html><body> Event Actions < script > var v=undefined; Race </ script > Happens-before write v < img src=”img1.png” onload =”v=’Hi!’;”> < img src=”img2.png” onload =”alert(v);”> read v </body></html> 6
Online Analysis http://www.eventracer.org 7
EventRacer end-to-end System Android App, Instrumented Execution Happens-before Race Race Race Filtering Web Page System Trace Graph Detector Explorer and Grouping ? ? ? 7
EventRacer end-to-end System Android App, Instrumented Execution Happens-before Race Race Race Filtering Web Page System Trace Graph Detector Explorer and Grouping ? ? ? What are the memory locations on DOM nodes and attributes which asynchronous events can race? < img id="img1" src="img1.png" ↦ write(#img1) JS variables, functions, arrays onload ="v='Hi!';"> ↦ write(#img1.onload) < script > v='Hi!'; ↦ write(v) < script > function f() {} ↦ write(f) document.getElementById("img1") ↦ read(#img1) messages[2] = 42; ↦ write(messages[2]) .addEventListener("click", f); ↦ write(#img1.click) </ script > </ script > 8
EventRacer end-to-end System Android App, Instrumented Execution Happens-before Race Race Race Filtering Web Page System Trace Graph Detector Explorer and Grouping ? ? ? What are the atomic events used in < script > event-driven applications? var v=undefined; </ script > Web - parsing an HTML element < img src=”img1.png” onload =”v=’Hi!’;”> - executing a script - handling user input < img src=”img2.png” onload =”alert(v);”> - ... 9
EventRacer end-to-end System Android App, Instrumented Execution Happens-before Race Race Race Filtering Web Page System Trace Graph Detector Explorer and Grouping ? ? ? What is the event happens-before? < script > var v=undefined; </ script > Happens-before Web < img src=”img1.png” onload =”v=’Hi!’;”> setInterval, SetTimeout, AJAX, … Android postDelayed, postAtFront, postIdle, ... < img src=”img2.png” onload =”alert(v);”> 10
EventRacer end-to-end System Android App, Instrumented Execution Happens-before Race Race Race Filtering Web Page System Trace Graph Detector Explorer and Grouping ? ? ? How to make scalable race detection in < script > event-based setting? var v=undefined; Race </ script > (Naive algorithms have asymptotic complexity O(N 3 ) and require O(N 2 ) space) write v < img src=”img1.png” onload =”v=’Hi!’;”> State of the art EventRacer runtime TIMEOUT 2.4sec < img src=”img2.png” onload =”alert(v);”> read v memory 25181MB 171MB 11
EventRacer end-to-end System Android App, Instrumented Execution Happens-before Race Race Race Filtering Web Page System Trace Graph Detector Explorer and Grouping ? ? ? Is the system effective at finding Web Android harmful races while reporting few # races found 646 1328 benign races? # races reported 17.3 13 We filter common classes of benign reduction 37x 100x races: commutative operations, recycled objects, lazy initialization, local reads, ... 13
Manual evaluation Web (314 reports) Android (104 reports) Fortune 100 Web Pages 8 Play Store Applications 24.6% 25% 58.4% 17.3% 17% 57.7% Harmful bugs synchronization races harmless races unhandled exceptions various idioms: commutative ✓ ✓ UI glitches if (ready) … operations ✓ ✓ broken analytics try { … } catch { retry } benign races ✓ ✓ ✓ page needs refresh to array of callbacks framework related ✓ ✓ ✓ work normally etc. ✓ 14
Simple GPS Tracker protected void onCreate() { locationManager.requestLocationUpdates(GPS_PROVIDER, 0, 0, mListener); mDbHelper = new SQLiteOpenHelper(this, DB_NAME, DB_VERSION); } LocationListener mListener = new LocationListener() { public void onLocationChanged(Location location) { //show location on map mDbHelper.getWritableDatabase().insert(loc); } }; protected void onStop() { locationManager.removeUpdates(mListener); mDbHelper.close(); } 15
Simple GPS Tracker protected void onCreate() { locationManager.requestLocationUpdates(GPS_PROVIDER, 0, 0, mListener); mDbHelper = new SQLiteOpenHelper(this, DB_NAME, DB_VERSION); } public void removeUpdates (LocationListener listener) LocationListener mListener = new LocationListener() { Added in API level 1 public void onLocationChanged(Location location) { //show location on map Removes all location updates for the specified LocationListener. mDbHelper.getWritableDatabase().insert(loc); Following this call, updates will no longer occur for this listener. } }; protected void onStop() { protected void onStop() { locationManager.removeUpdates(mListener); locationManager.removeUpdates(mListener); mDbHelper.close(); mDbHelper.close(); } } 15
http://www.eventracer.org/android 16
Analysis Results onLocationChanged and onStop are reported as not ordered event 1 source event 2 source async IPC, interface(android.location.ILocationListener), async IPC, interface(android.app.IApplicationThread), code code(onLocationChanged)) (SCHEDULE_STOP_ACTIVITY)) →calling context → calling context Landroid/database/sqlite/SQLiteDatabase;.insert(...) Landroid/database/sqlite/SQLiteClosable;.close(...) → UPDATE-UPDATE - 63568 Landroid/database/sqlite/SQLiteConnectionPool;.mAvailablePrimaryConnection → READ-UPDATE - 63568 Landroid/database/sqlite/SQLiteConnectionPool;.mIsOpen → READ-UPDATE - 63576 Landroid/database/sqlite/SQLiteConnection;.mConnectionPtr → READ-UPDATE - 63576 Landroid/database/sqlite/SQLiteConnection;.mPreparedStatementPool 16
Is the Alternative Interleaving Feasible? D/GPS: onCreate D/GPS: insert: Location[gps 47.284646,8.632389 acc=10 et=0 vel=2.0 mock] D/GPS: insert: Location[gps 47.284656,8.632598 acc=10 et=0 vel=2.0 mock] D/GPS: insert: Location[gps 47.284712,8.632722 acc=10 et=0 vel=2.0 mock] D/GPS: insert: Location[gps 47.284832,8.632837 acc=10 et=0 vel=2.0 mock] D/GPS: onStop D/GPS: insert: Location[gps 47.285022,8.633205 acc=10 et=0 vel=2.0 mock] E/AndroidRuntime: FATAL EXCEPTION: main E/AndroidRuntime: Process: com.example.gps, PID: 2249 E/AndroidRuntime: java.lang.IllegalStateException: attempt to re-open an already-closed object: SQLiteDatabase: /data/data/com.example.gps/test.db 16
Current Directions Google Chromium port V8 javascript engine instrumentation Testing tools based on EventRacer Integration with Selenium PhantomJS Application for Parallelization Other Application Domains (beyond Web Pages, Android) Node.js 17
Android App, Instrumented Execution Happens-before Race Race Race Filtering Web Page System Trace Graph Detector Explorer and Grouping ? ? ? www.eventracer.org www.eventracer.org/android Martin Vechev, Veselin Raychev, Pavol Bielik Anders Møller, Casper Jensen Manu Sridharan Boris Petrov, Yasen Trifonov Julian Dolby
Recommend
More recommend
