public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
From: "pinskia at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug libstdc++/110016] Possible miscodegen when inlining std::condition_variable::wait predicate causes deadlock
Date: Mon, 29 May 2023 14:28:27 +0000	[thread overview]
Message-ID: <bug-110016-4-TWgV1X0tpP@http.gcc.gnu.org/bugzilla/> (raw)
In-Reply-To: <bug-110016-4@http.gcc.gnu.org/bugzilla/>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110016

--- Comment #12 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Let me try again to show the exact events of why I think this is not a
libstdc++/GCC bug here.


time      thread/core 1                       thread/core N
-1                                            grab the mutex
0         atomically load waitingThreads      atomically increment
waitingThreads
1         compare  waitingThreads             atomically load finished
2         atomically set finished to 1        atomically load work.empty()
(queueLength)
3         start of notify_all                 branch on finished/queueLength
4         ...(some code before ...)           start on haveWork.wait
5         notifies all threads finished       .....(some more before ...)
6         .....                               waiting now
7         starts of joins                     still inside wait
8         joins hit thread N                  still inside wait
etc.

You will notice the ordering of loading finished and the wait (and setting of
finished and notify_all) is exactly ordered as you expect them to be ordered
with memory_order_seq_cst on each of the core; that is there is no reordering
going on each thread/core. It is still strictly ordered even. 

The reason why maybe libstdc++ exposes this is that the wait implemention
checks the predicate before it goes into wait system call. or the time between
the start of the call of notify_all call starts and the notifications go out is
shorter than the time it takes to after the atomic load of finished happenes
and the wait system call happens.

Since on thread 1, updating finished to 1  and notify_all is not done
atomically (together), a thread could have read finished before the update and
get into the wait loop after the notifications have gone out.

It is very similar to a TOCTOU issue because the use of the idea of finished is
the wait itself rather than the comparison. and setting of finished and notify
are done atomically (together); right now there is only an atomic ordering of
the two.

  parent reply	other threads:[~2023-05-29 14:28 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-05-28 21:11 [Bug c++/110016] New: [12/13/14] " amy at amyspark dot me
2023-05-28 21:44 ` [Bug libstdc++/110016] " pinskia at gcc dot gnu.org
2023-05-29  0:47 ` [Bug libstdc++/110016] " amy at amyspark dot me
2023-05-29  1:03 ` pinskia at gcc dot gnu.org
2023-05-29  1:05 ` pinskia at gcc dot gnu.org
2023-05-29  1:05 ` pinskia at gcc dot gnu.org
2023-05-29  1:20 ` pinskia at gcc dot gnu.org
2023-05-29  1:27 ` pinskia at gcc dot gnu.org
2023-05-29  1:34 ` pinskia at gcc dot gnu.org
2023-05-29  1:47 ` pinskia at gcc dot gnu.org
2023-05-29  6:43 ` pinskia at gcc dot gnu.org
2023-05-29 13:30 ` rachel at rachelmant dot com
2023-05-29 14:28 ` pinskia at gcc dot gnu.org [this message]
2023-05-29 15:15 ` pinskia at gcc dot gnu.org
2023-05-29 15:18 ` rachel at rachelmant dot com
2023-05-29 15:37 ` pinskia at gcc dot gnu.org
2023-05-29 20:38 ` redi at gcc dot gnu.org

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=bug-110016-4-TWgV1X0tpP@http.gcc.gnu.org/bugzilla/ \
    --to=gcc-bugzilla@gcc.gnu.org \
    --cc=gcc-bugs@gcc.gnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).