tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Yao Qi" <qiyao...@gmail.com>
Subject Some potential data races in tomcat
Date Wed, 18 Jun 2008 05:25:58 GMT
   We have been working on a tool (MTRAT, Multi-Thread Runtime Analysis
 Tool) for finding potential data races and deadlocks in java programs
 and I tried it out on Tomcat 6.0.13.  I found some that look like
 problems; you might be interested in fixing them, and I would like to
 know if my results are correct or not.

 1. accessCount in class org.apache.naming.resources.ResourceCache
 ** Two threads' backtrace to show how race happens,
  Thread http-8081-1 id: 23 : WRITE

      [org.apache.naming.resources.ResourceCache : lookup : 294]
      [org.apache.naming.resources.ProxyDirContext : cacheLookup : 1444]
      [org.apache.naming.resources.ProxyDirContext : lookup : 283]
      [org.apache.tomcat.util.http.mapper.Mapper : internalMapWrapper : 736]
      [org.apache.tomcat.util.http.mapper.Mapper : internalMap : 626]
      [org.apache.tomcat.util.http.mapper.Mapper : map : 516]
      [org.apache.catalina.connector.CoyoteAdapter : postParseRequest : 419]
      [org.apache.catalina.connector.CoyoteAdapter : service : 259]
      [org.apache.coyote.http11.Http11Processor : process : 844]
      [org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler
: process : 581]
      [org.apache.tomcat.util.net.JIoEndpoint$Worker : run : 447]
      [java.lang.Thread : run : 735]

  Thread http-8081-3 id: 25 : WRITE

      [org.apache.naming.resources.ResourceCache : lookup : 294]
      [org.apache.naming.resources.ProxyDirContext : cacheLookup : 1444]
      [org.apache.naming.resources.ProxyDirContext : lookup : 283]
      [org.apache.tomcat.util.http.mapper.Mapper : internalMapWrapper : 782]
      [org.apache.tomcat.util.http.mapper.Mapper : internalMap : 626]
      [org.apache.tomcat.util.http.mapper.Mapper : map : 516]
      [org.apache.catalina.connector.CoyoteAdapter : postParseRequest : 419]

 ** Initial analysis: Since two threads invoke
 org.apache.naming.resources.ResourceCache::lookup(), in which
 accessCount is incremented, there should be a lock to prevent
 concurrent increment to accessCount.

 2. countAllocated in org.apache.catalina.core.StandardWrapper
 ** Two threads' backtrace to show how race happens,

  Thread http-8081-1 id: 23 : READ
      [org.apache.catalina.core.StandardWrapper : allocate : 820]
      [org.apache.catalina.core.StandardWrapperValve : invoke : 129]
      [org.apache.catalina.core.StandardContextValve : invoke : 175]
      [org.apache.catalina.core.StandardHostValve : invoke : 128]
      [org.apache.catalina.valves.ErrorReportValve : invoke : 104]
      [org.apache.catalina.core.StandardEngineValve : invoke : 109]
      [org.apache.catalina.connector.CoyoteAdapter : service : 261]
      [org.apache.coyote.http11.Http11Processor : process : 844]
      [org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler
 : process : 581]
      [org.apache.tomcat.util.net.JIoEndpoint$Worker : run : 447]
      [java.lang.Thread : run : 735]

  Thread http-8081-4 id: 26 : WRITE

      [org.apache.catalina.core.StandardWrapper : deallocate : 871]
      [org.apache.catalina.core.StandardWrapperValve : invoke : 298]
      [org.apache.catalina.core.StandardContextValve : invoke : 175]
      [org.apache.catalina.core.StandardHostValve : invoke : 128]
      [org.apache.catalina.valves.ErrorReportValve : invoke : 104]
      [org.apache.catalina.core.StandardEngineValve : invoke : 109]
      [org.apache.catalina.connector.CoyoteAdapter : service : 261]
      [org.apache.coyote.http11.Http11Processor : process : 844]
      [org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler
 : process : 581]
      [org.apache.tomcat.util.net.JIoEndpoint$Worker : run : 447]
      [java.lang.Thread : run : 735]

 ** Initial analysis: increment and decrement are performed in
 allocate() and deallocate respectively.  Since increment and decrement
 are *not* atomic, they may involve problems.

 3.  hitsCount of class org.apache.naming.resources.ResourceCache,

 ** Two threads' stack backtrace,
  Thread http-8081-1 id: 23 : WRITE
      Lock Set : [ ]
      [org.apache.naming.resources.ResourceCache : lookup : 307]
      [org.apache.naming.resources.ProxyDirContext : cacheLookup : 1444]
      [org.apache.naming.resources.ProxyDirContext : lookupCache : 1377]
      [org.apache.catalina.servlets.DefaultServlet : serveResource : 643]
      [org.apache.catalina.servlets.DefaultServlet : doGet : 325]
      [javax.servlet.http.HttpServlet : service : 690]
      [javax.servlet.http.HttpServlet : service : 803]
      [org.apache.catalina.core.ApplicationFilterChain : internalDoFilter : 290]
      [org.apache.catalina.core.ApplicationFilterChain : doFilter : 206]
      [org.apache.catalina.core.StandardWrapperValve : invoke : 230]
      [org.apache.catalina.core.StandardContextValve : invoke : 175]
      [org.apache.catalina.core.StandardHostValve : invoke : 128]
      [org.apache.catalina.valves.ErrorReportValve : invoke : 104]
      [org.apache.catalina.core.StandardEngineValve : invoke : 109]
      [org.apache.catalina.connector.CoyoteAdapter : service : 261]
      [org.apache.coyote.http11.Http11Processor : process : 844]
      [org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler
 : process : 581]
      [org.apache.tomcat.util.net.JIoEndpoint$Worker : run : 447]
      [java.lang.Thread : run : 735]
  Thread http-8081-2 id: 24 : READ
       Lock Set : [ 705(org/apache/naming/resources/ResourceCache), ]

      [org.apache.naming.resources.ResourceCache : lookup : 307]
      [org.apache.naming.resources.ProxyDirContext : cacheLoad : 1600]
      [org.apache.naming.resources.ProxyDirContext : cacheLookup : 1449]
      [org.apache.naming.resources.ProxyDirContext : lookup : 283]
      [org.apache.tomcat.util.http.mapper.Mapper : internalMapWrapper : 782]
      [org.apache.tomcat.util.http.mapper.Mapper : internalMap : 626]
      [org.apache.tomcat.util.http.mapper.Mapper : map : 516]
      [org.apache.catalina.connector.CoyoteAdapter : postParseRequest : 419]
      [org.apache.catalina.connector.CoyoteAdapter : service : 259]
      [org.apache.coyote.http11.Http11Processor : process : 844]
      [org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler
 : process : 581]
      [org.apache.tomcat.util.net.JIoEndpoint$Worker : run : 447]
      [java.lang.Thread : run : 735]

 ** Initial analysis:  Thread http-8081-2 id acquired a lock in
 org.apache.naming.resources.ProxyDirContext::cacheLoad (line 1598 ~
 line 1603), but
  Thread http-8081-1 does hold any lock to access hitCount of class
ResouceCache.

 4. currentDate of class org.apache.tomcat.util.http.FastHttpDateFormat,
 ** Two threads' stack backtrace,

  Thread http-8081-2 id: 24 : WRITE
       Lock Set : [ 878(UnknownClass), ]

      [org.apache.tomcat.util.http.FastHttpDateFormat : getCurrentDate : 116]
      [org.apache.coyote.http11.Http11Processor : prepareResponse : 1566]
      [org.apache.coyote.http11.Http11Processor : action : 934]
      [org.apache.coyote.Response : action : 183]
      [org.apache.coyote.Response : sendHeaders : 379]
      [org.apache.catalina.connector.OutputBuffer : doFlush : 305]
      [org.apache.catalina.connector.OutputBuffer : close : 273]
      [org.apache.catalina.connector.Response : finishResponse : 486]
      [org.apache.catalina.connector.CoyoteAdapter : service : 285]
      [org.apache.coyote.http11.Http11Processor : process : 844]
      [org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler
 : process : 581]
      [org.apache.tomcat.util.net.JIoEndpoint$Worker : run : 447]
      [java.lang.Thread : run : 735]
  Thread http-8081-1 id: 23 : READ
       Lock Set : [ ]

      [org.apache.tomcat.util.http.FastHttpDateFormat : getCurrentDate : 120]
      [org.apache.coyote.http11.Http11Processor : prepareResponse : 1566]
      [org.apache.coyote.http11.Http11Processor : action : 934]
      [org.apache.coyote.Response : action : 183]
      [org.apache.coyote.Response : sendHeaders : 379]
      [org.apache.catalina.connector.OutputBuffer : doFlush : 305]
      [org.apache.catalina.connector.OutputBuffer : close : 273]
      [org.apache.catalina.connector.Response : finishResponse : 486]
      [org.apache.catalina.connector.CoyoteAdapter : service : 285]
      [org.apache.coyote.http11.Http11Processor : process : 844]

 ** Initial analysis: Write operation (line 116)to currentDate is in
 synchronized block, while read operation (line 120) is *not* in
 synchronization block.  According to our definition to data race,
 which is two threads access the memory without order constraint and at
 least one is write, we believe that this is a data race.  If that read
 operation could be placed within synchronization block, this race
 could go away.

 I'd love to get your feedback on whether our races and my
 understanding of this code are correct or not.

-- 
Yao Qi

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org


Mime
View raw message