Concurrency software testing with probabilistic bounds on finding bugs

Described is a probabilistic concurrency testing mechanism for testing a concurrent software program that provides a probabilistic guarantee of finding any concurrent software bug at or below a bug depth (that corresponds to a complexity level for finding the bug). A scheduler/algorithm inserts priority lowering points into the code and runs the highest priority thread based upon initially randomly distributed priorities. When that thread reaches a priority lowering point, its priority is lowered to a value associated (e.g., by random distribution) with that priority lowering point, whereby a different thread now has the currently highest priority. That thread is run until its priority is similarly lowered, and so on, whereby all schedules needed to find a concurrency bug are run.

BACKGROUND

Concurrent software programs are known to be prone to having software bugs, including bugs that result from the concurrent nature of the programs. In general, concurrency bugs occur when instructions are scheduled in an order not envisioned by the programmer. Concurrency software bugs are thus those that appear only on particular thread schedules. Many concurrent bugs are difficult to find because they are often dependent upon rare thread schedules.

A concurrent software program contains one or more threads of control, (referred to simply as “threads” hereinafter). In specific circumstances, these threads may refer to processes, threads within a process, processors in the computer hardware, and/or nodes in a distributed system. Common names for concurrent threads of control include, but are not limited to, threads, processes, nodes, agents, tasks and components,

A general goal of concurrency testing is to effectively identify which schedules, of the exponentially many possible schedules, are those in which concurrency bugs appear. Known testing methods involve various forms of stress testing, in which the program being tested is run for days or even weeks under heavy loads with the hope of hitting buggy schedules. This is a slow and expensive process. Moreover, any bugs that are found via stress testing are difficult to reproduce and/or debug.

SUMMARY

Briefly, various aspects of the subject matter described herein are directed towards a technology by which a probabilistic concurrency testing mechanism tests a concurrent software program, while providing a probabilistic guarantee of finding any concurrent software bug at or below a bug depth (that corresponds to a complexity level for finding the bug). The mechanism includes a scheduler associated with an algorithm, which operates by scheduling a currently highest priority thread (that is enabled to run) until a priority lowering point inserted into the code is reached. At that point, the mechanism lowers the priority of the thread that reached the priority lowering point, whereby a different thread now has the currently highest priority. That thread is run until its priority is similarly lowered, and so on, whereby all schedules needed to find a bug are run.

In one implementation, the priority lowering points are inserted into the concurrent program and assigned priority values based upon random mathematical distribution. Threads are also assigned initial priorities based upon random mathematical distribution. The priority lowering point insertions may be optimized so as to only be present when there is a chance of having a concurrency bug, e.g., relative to synchronized operations and in non-sequential execution paths.

In one implementation, the probabilistic algorithm is “derandomized” (which is a commonly known transformation of probabilistic algorithms) in the that instead of using randomly selected values according to a uniform mathematical distribution, the algorithm is repeated in such a way as to enumerate exhaustively all possible random choices, or a suitable selected subset of those random choices.

DETAILED DESCRIPTION

Various aspects of the technology described herein are generally directed towards a randomized scheduler/probabilistic concurrency testing algorithm for finding concurrency bugs that provides a probabilistic guarantee of finding bugs. Repeated independent execution of the probabilistic concurrency testing algorithm by the scheduler (e.g., on a general purpose computer system) can arbitrarily decrease the probability of missing a bug. The scheduler improves upon current stress testing methods by finding bugs more effectively, and by quantifying the probability of missing any bugs.

As described below, the randomized scheduler is based on manipulating thread priorities, where threads with lower priorities run only when all higher priority threads are disabled. In other words, of the threads that are able to run, only the highest priority thread runs. In one aspect, a scheduling algorithm of the randomized scheduler initially assigns thread priorities at random. During execution, the scheduling algorithm lowers thread priorities at certain randomly-selected steps, whereby all thread schedules are probabilistically guaranteed to run to a determinable probability. Note that as used herein, “random” and its variations (“randomly” and the like) do not mean arbitrary, but rather refer to a uniformly random mathematical distribution within a range.

It should be understood that any of the examples herein are non-limiting. As such, the present invention is not limited to any particular embodiments, aspects, concepts, structures, functionalities or examples described herein. Rather, any of the embodiments, aspects, concepts, structures, functionalities or examples described herein are non-limiting, and the present invention may be used various ways that provide benefits and advantages in computing and program testing in general.

Turning toFIG. 1, there is shown a program102being tested by a scheduler104that includes or is otherwise associated with a probabilistic concurrency testing algorithm106to probabilistically find bugs in basically every run of the program. As described below, the scheduler104is priority-based, in that the scheduler104maintains a priority for every thread, wherein in one implementation, lower numbers indicate lower priorities. During execution, the scheduler104schedules a low priority thread only when all high priority threads are disabled. Note that a thread may be disabled if it is waiting for a resource, such as a lock, currently held by another thread.

Threads can change priorities during execution when they pass a priority lowering point that has been inserted into the program, as described below. Each such point is a step in the dynamic execution. When a thread passes a lowering point, the scheduler104lowers the thread priority to the priority of the lowering point.

In one aspect, a depth-metric is used, which characterizes the difficulty of finding a bug. The depth of a concurrency software bug is characterized as the minimum number of scheduling constraints required to find the bug. Given a program and a concurrency bug, a set of instruction-ordering constraints is said to find the bug, if any schedule satisfying the ordering constraints results in the bug.

Concurrency bugs may thus be classified according to a depth metric. The scheduler is designed to provide better probabilistic guarantees for bugs with smaller depth by biasing the distribution of schedules. Note that it is possible for different sets of ordering constraints to trigger the same bug, in which case the probability of satisfying at least one of these sets (and thus exposing the bug) increases accordingly.

By way of example,FIGS. 2-4show examples of common concurrency errors with ordering constraints (represented by the arrows) that are sufficient to find the bug. Any schedule that satisfies these ordering constraints is guaranteed to find the bug irrespective of how it schedules instructions not relevant to the bug. Note that inFIGS. 2-4, the bug depths of one, two and two, respectively, are represented by the “d=1” “d=2” and “d=2” notation at the top of each example. In practice, many concurrency software bugs have small such bug-depths.

FIG. 2shows one well-known type of bug referred to as an ordering error, in which one thread (Thread1) needs to execute (e.g., to initialize a value) before another thread (Thread2) executes (e.g., to operate on the initialized value). This bug is only found if the ordering is such that Thread2executes before Thread1executes.

FIG. 3illustrates another well-known type of concurrency software bug, namely an atomicity violation, in which, for example Thread2tests for a condition (x!=null)) and performs an instruction (x->print( )) if met. The bug occurs if between the test and the next instruction, which should be atomic operations, another thread (Thread1) changes the condition that was evaluated.

FIG. 4illustrates another well-known concurrency software bug, namely a deadlock. Deadlocks are caused by circular lock acquisition, and in the example ofFIG. 4have depth two; more generally, however, deadlocks are depth n if n threads are involved.

Thus, in general, ordering bugs have depth one, atomicity violations and non-serializable interleavings, in general, have depth two, and deadlocks caused by circular lock acquisition have depth n for n threads. However, these depth classifications are not strict. For instance, not all atomicity violations have a depth two, as in practice, some reported atomicity violations have a depth of one. In any event, the concept of bug-depths is more general than these examples, and can capture concurrency bugs not classified before.

FIG. 5shows an example of a bug of depth two that surfaces if the mutex is unlocked after it is freed, and the mutex is unlocked before the main thread terminates the process by calling exit.

FIG. 6shows an example of a bug of depth two that does not directly fall into any of the above-described categories. In particular, the ordering constraints do not have to be between instructions that access the same variable. Because of interaction with control flow, in the example ofFIG. 6the program (incorrectly) maintains a Boolean variable “init” to indicate whether t is initialized or not. The single ordering constraint (the black arrow) between the initialization and access of t is not sufficient to find the bug. Although it may seem as if one constraint (black arrow) is sufficient to find this bug, an extra constraint (the gray arrow) is needed to ensure that thread2really executes the access of t. Thus, the depth of this bug is two because of the presence of control flow, and the scheduler needs to also ensure the ordering constraint between init accesses, that is, the grey arrow.

As can be seen, bug-depth is inherently tied to the difficulty of finding the concurrency bug. In a program with complex control flow, the depth of a bug may not be readily apparent to the programmer. However, the technology described herein does not require the programmer or a prior program analysis to identify these constraints explicitly, but rather relies on the mere existence of the correct number of ordering constraints.

Bug depth is thus fundamentally different than the concept of a preemption bound of a bug, which is the smallest number of preemptions sufficient to find the bug and is a property of a single schedule. In contrast to a preemption bound, bug depth is a property of all schedules that share the same root cause of the bug. This universality allows the scheduler to provide a probabilistic guarantee on every run of the program, unlike a preemption bound that is useful for providing absolute coverage guarantees, but only after systematically enumerating all schedules with a given preemption bound.

Probabilistic concurrency testing (PCT) is a method that may implemented by the scheduler of a general purpose computer that provides probabilistic guarantees on finding concurrency bugs. On each run of a program, probabilistic concurrency testing schedules the threads in the program such that any concurrency bug is hit with a given probability. This probability is based on the number of threads t in the program, the number of synchronization operations n performed by the program, and the depth-metric d of the bug that determines the difficulty of finding the bug. Running probabilistic concurrency testing repeatedly with different random seeds ensures that a concurrency bug can be found with an arbitrarily large probability.

More particularly, given a program with n threads that executes k instructions, the probabilistic concurrency testing scheduler can find a bug with depth d with a probability of

1nkd-1.
This guarantee is provided as follows:a) The scheduler picks random initial thread priorities for the n threads in the range [d, d+1, d+2, . . . d+n].b) The scheduler also picks d−1 random priority lowering points k1, . . . , kd−1at random steps in the range [1 . . . k]. Each lowering point kiis assigned the priority i.c) The scheduler schedules the threads by honoring their priorities. When a thread reaches the lowering point ki, it sets the priority of the thread to i.

It should be noted that naive randomized schedulers, which effectively “flip a coin” in each step to decide which thread to schedule next, are not adequate. By way of example, consider the example program ofFIG. 7with two bugs of depth one, shown by the black arrow; (the grey arrow is considered later). A naive randomized scheduler is very unlikely to detect the bug inFIG. 7even though its depth is only one. This is because to force the black arrow constraint, such a scheduler has to consistently schedule Thread1for m+2 steps, resulting in a probability that is inverse exponential in m, which is a very small quantity even for a moderate m. To try to improve such a scheduler by biasing the execution towards Thread1, and thereby increase the likelihood of hitting this bug, not only still contains an exponential in m, but also biases against finding the second bug represented by the grey constraint.

FIG. 2also represents how the probabilistic concurrency testing algorithm finds the ordering error, and illustrates the probabilistic guarantee.FIG. 2shows the initial thread priorities in white circles. To understand the working of the scheduler, observe that a high priority thread runs faster than a low priority thread. So, barring priority inversion issues, an ordering constraint a→b is satisfied if a is executed by a higher priority thread. InFIG. 2, the bug is found if the scheduler chooses a lower priority for Thread1than Thread2. The probability of this is 1/2 and thus the scheduler is expected to find this bug within the first two runs.

If there are more than two threads in the program, then the algorithm has to perform more work because of priority inversion issues. For example, even if Thread1has a lower priority than Thread2, Thread2can be blocked on a resource held by another thread, Thread3. If Thread3has a priority lower than Thread1, then this priority inversion can allow Thread1to execute the initialization before Thread2reads t. However, such a priority inversion cannot happen if Thread1has the lowest priority of all threads in the program. The probability of this happening is 1/n, which is the guarantee. This is a worst-case analysis and the algorithm performs much better than 1/n in practice.

For bugs with depth greater than one, priority lowering points are used, as represented by the shaded circles inFIGS. 3 and 4. Note that in one implementation, the algorithm does not introduce priority lowering points when d=1.

InFIG. 3, the atomicity violation is induced if the scheduler inserts a priority lowering point after the null check but before executing the branch. The probability of this is 1/k as the scheduler picks the lowering point uniformly over all dynamic instructions. In addition, the scheduler needs to ensure the first constraint by running Thread1with lowest priority until Thread2performs the null check. Together, the probability of finding this atomicity violation is at least 1/nk.

The same concept applies the deadlock inFIG. 4. The scheduler inserts a priority lowering point after Thread1acquires the first lock before acquiring the second. Note again that this is a worst-case analysis, and there are many random choices that can trigger the bug. For instance, Thread1inFIG. 4can perform many instructions between the two acquires. The scheduler will find the deadlock if it picks one of them to be a priority lowering point. Similarly, there exists a symmetric case in which the scheduler inserts a priority lowering point in Thread2. Further, if the same buggy code is executed many times by different threads in different contexts, the scheduler gets multiple opportunities to trigger the bug. Experiments have shown that the scheduler finds bugs with a probability far greater than its worst-case bound.

Note that a program state may be represented abstractly by its schedules, in which each schedule is a sequence of thread identifiers. For example, the sequence1221represents a schedule in which thread1takes one step, followed by two steps by thread2, followed by another step of thread1. Not all threads can be scheduled from all states, as they may be disabled (blocked or waiting).

The following algorithm is one implementation of the randomized scheduler, which is typically called with a conservative estimate for n (number of threads) and k (number of steps). During the progress of the algorithm, the current schedule is stored in the variable S, and the current thread priorities in an array p of size n. The thread priorities are initially assigned random values (chosen by the random permutation π). In each iteration, an enabled thread of maximal priority t is picked and scheduled for one step. The algorithm then checks if a priority lowering point has been reached (determined by the random values ki), and if so, the priority of t is lowered accordingly. This process repeats until no more threads are enabled, that is, a deadlock is reached or the program has terminated.

As described above, the scheduler is based on thread priorities. However, one implementation does not reuse the priority mechanisms already supported by modern operating systems. This is because the guarantees provided by the scheduler rely on a low priority thread proceeding strictly slower than a high priority thread, and operating systems' priorities do not provide this guarantee. In p articular, priority boosting techniques can arbitrarily change user-intended priorities. Similarly, the scheduler would not be able to control the relative speeds of two threads with different priorities running concurrently on different processors.

For fine-grained priority control, one implementation of the scheduler is a user-mode scheduler that works on unmodified x86 binaries. It employs binary instrumentation to insert calls to the scheduler after every instruction that accesses shared memory or makes a system call. The scheduler gains control of a thread the first time the thread calls into the scheduler. From there on, the scheduler ensures that the thread makes progress only when all threads with higher priorities are disabled. Thread priorities are determined by the algorithm as described above.

Note that the scheduler needs to be starvation free. At the same time, it is common for concurrent programs to use spin loops. If, under the scheduler, a high priority thread spins waiting for a low priority thread, the program will livelock; to guarantee strict priorities, the scheduler does not schedule the low priority thread required for the high priority thread to make progress. To handle this case, one implementation employs heuristics to identify such spin loops and recovers from them.

The above-described algorithm is based upon the scheduler inserting a priority lowering point at randomly selected instructions. However, the need to insert a lowering point at an arbitrary instruction requires the scheduler to insert a callback after every instruction, which reduces the performance. Further, by counting the number of instructions executed, the large value for the parameter k can reduce the effectiveness, especially for bugs with depth greater than or equal to two.

One optimization to improve performance is directed towards identifying synchronization operations. As the scheduler uses priority lowering points to enforce ordering constraints in the program, in which the constraints represent effective communication between threads, priority lowering points may be inserted only at these synchronization operations. Such synchronization operations include system calls, calls to synchronization libraries (such as pthreads), hardware synchronization instructions (such as interlocked instructions), and shared memory synchronizations. Accesses to flag variables, volatile variables, and data races (both programmer intended and unintended) are classified as “shared-memory synchronization.” This classification reflects the fact that these memory accesses result in communication between the threads.

In operation, any of a number of known data-race detection tools or hardware mechanisms may be used to identify such shared-memory synchronization points. In one implementation, these points may be supplied manually by the user; other forms of synchronization are straightforward to identify from the program binary. By only inserting priority lowering points at synchronization operations, we effectively reduce k by several orders of magnitude.

Another optimization is directed towards identifying sequential execution. In many applications, a significant portion of a concurrent program sequentially executes, that is, there is only one enabled thread at those portions. These sequential execution portions may be identified, so that priority lowering points need not be unnecessarily inserted. Note that the same effect can be achieved by reducing the priority at the point that the sequential thread enables/creates a second thread.

Programs written with a fork-join paradigm typically have multiple phases in which a single thread waits for a flurry of concurrent activity belonging to one phase to finish before starting the next phase. This is also a typical behavior of long running stress tests that perform multiple iterations of concurrency scenarios. One implementation of the scheduler identifies these phases whenever the program enters a state with one thread enabled. The effective k is the maximum number of synchronization operations performed per phase.

Some concurrency bugs manifest much later than when they occur. The scheduler sometimes misses some of the manifestations as the main thread exits prematurely at the end of the program. Artificially inserting a priority lowering point for the main thread before it exits helps detect such bugs.

FIG. 8summarizes certain steps of the scheduler/algorithm, beginning at step802where the lowering points are inserted, e.g., after each instruction or after optimizing for to insert them following synchronization operations and/or not within serial execution paths. Step804represents assigning the threads with initial priorities, via random distribution.

At step806the thread that currently has the highest priority (and is not disabled) is run. This thread continues to run until the lowering point is reached, as represented by step808. Any concurrency bug that occurs while this thread is run may be abstractly represented by the set of schedules that found it.

As described above, when the lowering point is reached, the thread that was running has its priority changed to the value associated with the lowering point. When this occurs, another thread becomes the thread that currently has the highest priority and is thus run at step806. The scheduling continues in this manner until a stop condition is met as represented by step812, e.g., no more threads are enabled because of a deadlock or program termination.

Exemplary Operating Environment

FIG. 9illustrates an example of a suitable computing and networking environment900on which the examples ofFIGS. 1-8may be implemented. The computing system environment900is only one example of a suitable computing environment and is not intended to suggest any limitation as to the scope of use or functionality of the invention. Neither should the computing environment900be interpreted as having any dependency or requirement relating to any one or combination of components illustrated in the exemplary operating environment900.

With reference toFIG. 9, an exemplary system for implementing various aspects of the invention may include a general purpose computing device in the form of a computer910. Components of the computer910may include, but are not limited to, a processing unit920, a system memory930, and a system bus921that couples various system components including the system memory to the processing unit920. The system bus921may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. By way of example, and not limitation, such architectures include Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus also known as Mezzanine bus.

The system memory930includes computer storage media in the form of volatile and/or nonvolatile memory such as read only memory (ROM)931and random access memory (RAM)932. A basic input/output system933(BIOS), containing the basic routines that help to transfer information between elements within computer910, such as during start-up, is typically stored in ROM931. RAM932typically contains data and/or program modules that are immediately accessible to and/or presently being operated on by processing unit920. By way of example, and not limitation,FIG. 9illustrates operating system934, application programs935, other program modules936and program data937.

The computer910may also include other removable/non-removable, volatile/nonvolatile computer storage media. By way of example only,FIG. 9illustrates a hard disk drive941that reads from or writes to non-removable, nonvolatile magnetic media, a magnetic disk drive951that reads from or writes to a removable, nonvolatile magnetic disk952, and an optical disk drive955that reads from or writes to a removable, nonvolatile optical disk956such as a CD ROM or other optical media. Other removable/non-removable, volatile/nonvolatile computer storage media that can be used in the exemplary operating environment include, but are not limited to, magnetic tape cassettes, flash memory cards, digital versatile disks, digital video tape, solid state RAM, solid state ROM, and the like. The hard disk drive941is typically connected to the system bus921through a non-removable memory interface such as interface940, and magnetic disk drive951and optical disk drive955are typically connected to the system bus921by a removable memory interface, such as interface950.

The drives and their associated computer storage media, described above and illustrated inFIG. 9, provide storage of computer-readable instructions, data structures, program modules and other data for the computer910. InFIG. 9, for example, hard disk drive941is illustrated as storing operating system944, application programs945, other program modules946and program data947. Note that these components can either be the same as or different from operating system934, application programs935, other program modules936, and program data937. Operating system944, application programs945, other program modules946, and program data947are given different numbers herein to illustrate that, at a minimum, they are different copies. A user may enter commands and information into the computer910through input devices such as a tablet, or electronic digitizer,964, a microphone963, a keyboard962and pointing device961, commonly referred to as mouse, trackball or touch pad. Other input devices not shown inFIG. 9may include a joystick, game pad, satellite dish, scanner, or the like. These and other input devices are often connected to the processing unit920through a user input interface960that is coupled to the system bus, but may be connected by other interface and bus structures, such as a parallel port, game port or a universal serial bus (USB). A monitor991or other type of display device is also connected to the system bus921via an interface, such as a video interface990. The monitor991may also be integrated with a touch-screen panel or the like. Note that the monitor and/or touch screen panel can be physically coupled to a housing in which the computing device910is incorporated, such as in a tablet-type personal computer. In addition, computers such as the computing device910may also include other peripheral output devices such as speakers995and printer996, which may be connected through an output peripheral interface994or the like.

The computer910may operate in a networked environment using logical connections to one or more remote computers, such as a remote computer980. The remote computer980may be a personal computer, a server, a router, a network PC, a peer device or other common network node, and typically includes many or all of the elements described above relative to the computer910, although only a memory storage device981has been illustrated inFIG. 9. The logical connections depicted inFIG. 9include one or more local area networks (LAN)971and one or more wide area networks (WAN)973, but may also include other networks. Such networking environments are commonplace in offices, enterprise-wide computer networks, intranets and the Internet.

When used in a LAN networking environment, the computer910is connected to the LAN971through a network interface or adapter970. When used in a WAN networking environment, the computer910typically includes a modem972or other means for establishing communications over the WAN973, such as the Internet. The modem972, which may be internal or external, may be connected to the system bus921via the user input interface960or other appropriate mechanism. A wireless networking component such as comprising an interface and antenna may be coupled through a suitable device such as an access point or peer computer to a WAN or LAN. In a networked environment, program modules depicted relative to the computer910, or portions thereof, may be stored in the remote memory storage device. By way of example, and not limitation,FIG. 9illustrates remote application programs985as residing on memory device981. It may be appreciated that the network connections shown are exemplary and other means of establishing a communications link between the computers may be used.

An auxiliary subsystem999(e.g., for auxiliary display of content) may be connected via the user interface960to allow data such as program content, system status and event notifications to be provided to the user, even if the main portions of the computer system are in a low power state. The auxiliary subsystem999may be connected to the modem972and/or network interface970to allow communication between these systems while the main processing unit920is in a low power state.

Conclusion