RacerX

TLDR

RacerX is a static analysis tool designed to detect race conditions and deadlocks in large, complex multithreaded systems. It uses flow‑sensitive, interprocedural analysis that aggressively infers lock protection, multithreaded contexts, and dangerous shared accesses, tracks code features to rank errors by severity, and applies novel techniques to mitigate analysis mistakes. The tool analyzes a 1.8‑million‑line system in 2–14 minutes and uncovered serious race and deadlock bugs in Linux, FreeBSD, and a large commercial code base.

Abstract

This paper describes RacerX, a static tool that uses flow-sensitive, interprocedural analysis to detect both race conditions and deadlocks. It is explicitly designed to find errors in large, complex multithreaded systems. It aggressively infers checking information such as which locks protect which operations, which code contexts are multithreaded, and which shared accesses are dangerous. It tracks a set of code features which it uses to sort errors both from most to least severe. It uses novel techniques to counter the impact of analysis mistakes. The tool is fast, requiring between 2-14 minutes to analyze a 1.8 million line system. We have applied it to Linux, FreeBSD, and a large commercial code base, finding serious errors in all of them. RacerX is a static tool that uses flow-sensitive, interprocedural analysis to detect both race conditions and deadlocks. It uses novel strategies to infer checking information such as which locks protect which operations, which code contexts are multithreaded, and which shared accesses are dangerous. We applied it to FreeBSD, Linux and a large commercial code base and found serious errors in all of them.