A couple of possible data-race bugs

[Robert W O'callahan <ro...@us.ibm.com>]

I'm working on a tool for finding datarace bugs in Java programs. Roughly,
we find places where data shared between threads is being accessed without
locking or other synchronization. I found a couple of things in Tomcat
(4.0.4 final, still present in CVS) that look like lurking problems:

The first one is minor: in
org.apache.catalina.connector.http.HttpConnector.start(), curProcessors is
checked without holding the processors lock. So, between start() checking
curProcessors < maxProcessors and creating a new processor, the
HttpConnector thread might get a bunch of connections and create its own
processors up to maxProcessors, and so start() will create processor number
"maxProcessors+1".

In org.apache.catalina.core.StandardWrapper, the countAllocated field is
updated without any locking. If increments or decrements to countAllocated
occur simultaneously in different threads, updates can be lost, leading to
countAllocated having an incorrect value. It seems that an incorrect value
could cause problems in unload(), where the loop that waits for
countAllocated to go <= 0 might either terminate early or never terminate
at all.

I'd appreciate any feedback on whether my understanding of the code is
correct and whether these are real problems.

Thanks,
Robert O'Callahan         IBM TJ Watson Research Staff Member
Office: Hawthorne 1N-J20            Phone: (914) 784-7911
"The first to present his case seems right, till another comes forward
and questions him." -- Proverbs 18:17



--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>