<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - ThreadSanitizer detects race between std::promise and its std::future"
href="https://bugs.llvm.org/show_bug.cgi?id=43984">43984</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>ThreadSanitizer detects race between std::promise and its std::future
</td>
</tr>
<tr>
<th>Product</th>
<td>libc++
</td>
</tr>
<tr>
<th>Version</th>
<td>9.0
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>All Bugs
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedclangbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>jacob@bandes-stor.ch
</td>
</tr>
<tr>
<th>CC</th>
<td>llvm-bugs@lists.llvm.org, mclow.lists@gmail.com
</td>
</tr></table>
<p>
<div>
<pre>It's possible that I misunderstand the thread-safety guarantees of std::promise
and std::future, but because the documentation claims they have a "shared
state" which I understand to be thread-safe, I *think* the following code
should be race-free:
#include <future>
#include <vector>
int main() {
for (size_t i = 0; i < 100000; i++) {
std::promise<void> p;
std::future<void> f = p.get_future();
// The promise is *moved* into the new thread.
std::thread t = std::thread([p = std::move(p)]() mutable {
p.set_value();
});
// Because of the order of these calls,
// the promise may be destroyed before/during the future::get().
f.get();
t.join();
}
return 0;
}
However, compiled with ThreadSanitizer, a race is detected (see below). Note
that:
- No errors seem to occur at runtime if TSan is not enabled
- If t.join() is called *before* f.get(), no race is detected.
- If the move capture "p = std::move(p)" is changed to just "&p", no race is
detected.
- The loop is not actually necessary to trigger the race, it just makes it
easier.
This is either:
- A misunderstanding on my part of the thread safety guarantees of this API
(cppreference.com doesn't seem to explain much about the "shared state")
- A ThreadSanitizer false positive
- An actual bug in libc++
$ clang++-10 -fsanitize=thread -lpthread -std=c++17 -stdlib=libc++ -O0 -g
testrace.cpp -o testrace
$ ./testrace
==================
WARNING: ThreadSanitizer: data race (pid=4806)
Write of size 8 at 0x7b2000000018 by thread T14:
#0 operator delete(void*) <null> (testrace+0x4b541e)
#1 std::__1::__shared_count::__release_shared() <null>
(libc++.so.1+0x844ac)
#2 std::__1::__tuple_leaf<1ul, main::$_0, false>::~__tuple_leaf()
/usr/lib/llvm-10/bin/../include/c++/v1/tuple:181:7 (testrace+0x4b8228)
#3 std::__1::__tuple_impl<std::__1::__tuple_indices<0ul, 1ul>,
std::__1::unique_ptr<std::__1::__thread_struct,
std::__1::default_delete<std::__1::__thread_struct> >,
main::$_0>::~__tuple_impl() /usr/lib/llvm-10/bin/../include/c++/v1/tuple:372:37
(testrace+0x4b81d9)
#4 std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct,
std::__1::default_delete<std::__1::__thread_struct> >, main::$_0>::~tuple()
/usr/lib/llvm-10/bin/../include/c++/v1/tuple:477:28 (testrace+0x4b8188)
#5
std::__1::default_delete<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct,
std::__1::default_delete<std::__1::__thread_struct> >, main::$_0>
<span class="quote">>::operator()(std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct,</span >
std::__1::default_delete<std::__1::__thread_struct> >, main::$_0>*) const
/usr/lib/llvm-10/bin/../include/c++/v1/memory:2378:5 (testrace+0x4b8106)
#6
std::__1::unique_ptr<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct,
std::__1::default_delete<std::__1::__thread_struct> >, main::$_0>,
std::__1::default_delete<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct,
std::__1::default_delete<std::__1::__thread_struct> >, main::$_0> >
<span class="quote">>::reset(std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct,</span >
std::__1::default_delete<std::__1::__thread_struct> >, main::$_0>*)
/usr/lib/llvm-10/bin/../include/c++/v1/memory:2633:7 (testrace+0x4b8070)
#7
std::__1::unique_ptr<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct,
std::__1::default_delete<std::__1::__thread_struct> >, main::$_0>,
std::__1::default_delete<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct,
std::__1::default_delete<std::__1::__thread_struct> >, main::$_0> >
<span class="quote">>::~unique_ptr() /usr/lib/llvm-10/bin/../include/c++/v1/memory:2587:19</span >
(testrace+0x4b79dc)
#8 void*
std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct,
std::__1::default_delete<std::__1::__thread_struct> >, main::$_0> >(void*)
/usr/lib/llvm-10/bin/../include/c++/v1/thread:285:1 (testrace+0x4b7887)
Previous atomic read of size 1 at 0x7b2000000018 by main thread:
#0 pthread_cond_wait <null> (testrace+0x426748)
#1
std::__1::condition_variable::wait(std::__1::unique_lock<std::__1::mutex>&)
<null> (libc++.so.1+0x422de)
#2 __libc_start_main <null> (libc.so.6+0x271e2)
Thread T14 (tid=13457, running) created by main thread at:
#0 pthread_create <null> (testrace+0x425adb)
#1 std::__1::__libcpp_thread_create(unsigned long*, void* (*)(void*),
void*) /usr/lib/llvm-10/bin/../include/c++/v1/__threading_support:336:10
(testrace+0x4b9a7c)
#2 std::__1::thread::thread<main::$_0, void>(main::$_0&&)
/usr/lib/llvm-10/bin/../include/c++/v1/thread:299:16 (testrace+0x4b7504)
#3 main /testrace/testrace.cpp:11:25 (testrace+0x4b72d4)
SUMMARY: ThreadSanitizer: data race (/testrace/testrace+0x4b541e) in operator
delete(void*)
==================</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>