tsan: fix deadlock during race reporting

[dvyukov]

Summary

SlotPairLocker calls SlotLock under ctx->multi_slot_mtx.
SlotLock can invoke global reset DoReset if we are out of slots/epochs.
But DoReset locks ctx->multi_slot_mtx as well, which leads to deadlock.

Resolve the deadlock by removing SlotPairLocker/multi_slot_mtx
and only lock one slot for which we will do RestoreStack.
We need to lock that slot because RestoreStack accesses the slot journal.
But it's unclear why we need to lock the current slot.
Initially I did it just to be on the safer side (but at that time
we dit not lock the second slot, so it was easy just to lock the current slot).

[vitalybuka]

https://lab.llvm.org/buildbot/#/builders/70/builds/15581 hangs after this patch

[dvyukov]

In D116040#3203782, @vitalybuka wrote:

https://lab.llvm.org/buildbot/#/builders/70/builds/15581 hangs after this patch

Mailed fix: https://reviews.llvm.org/D116091

[yln]

This commit causes compiler-rt/test/tsan/libdispatch/dispatch_once_deadlock.c to hang for a debug (but not release) build of the TSan runtime (COMPILER_RT_DEBUG=ON). Not resolved by D116091.
@vitalybuka @dvyukov

* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP
  * #0: 0x00007ff810f48ab2 libsystem_kernel.dylib
    #1: 0x00007ff810f82b81 libsystem_pthread.dylib`sched_yield + 11 at .../libpthread/libpthread-486.100.10/src/pthread.c:2254
    #2: 0x0000000100639729 libclang_rt.tsan_osx_dynamic.dylib`__sanitizer::FutexWait(p=<unavailable>, cmp=<unavailable>) + 9 at .../llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_mac.cpp:516
    #3: 0x000000010063bb9a libclang_rt.tsan_osx_dynamic.dylib`__sanitizer::Semaphore::Wait(this=0x0000000101aa6e08) + 58 at .../llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_mutex.cpp:35
    #4: 0x00000001006389d7 libclang_rt.tsan_osx_dynamic.dylib`__sanitizer::Mutex::Lock(this=0x0000000101aa6e00) + 183 at .../llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_mutex.h:194
    #5: 0x000000010064120d libclang_rt.tsan_osx_dynamic.dylib`__sanitizer::ThreadRegistry::Lock(this=<unavailable>) + 13 at .../llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_thread_registry.h:98
    #6: 0x00000001006411ef libclang_rt.tsan_osx_dynamic.dylib`__sanitizer::GenericScopedLock<__sanitizer::ThreadRegistry>::GenericScopedLock(this=<unavailable>, mu=<unavailable>) + 15 at .../llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_mutex.h:367
    #7: 0x000000010063feb9 libclang_rt.tsan_osx_dynamic.dylib`__sanitizer::GenericScopedLock<__sanitizer::ThreadRegistry>::GenericScopedLock(this=<unavailable>, mu=<unavailable>) + 9 at .../llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_mutex.h:366
    #8: 0x000000010067f586 libclang_rt.tsan_osx_dynamic.dylib`__tsan::SlotLock(thr=0x0000000103abd100) + 54 at .../llvm-project/compiler-rt/lib/tsan/rtl/tsan_rtl.cpp:343
    #9: 0x00000001006967e9 libclang_rt.tsan_osx_dynamic.dylib`__tsan::Acquire(__tsan::ThreadState*, unsigned long, unsigned long) [inlined] __tsan::SlotLocker::SlotLocker(thr=0x0000000103abd100, recursive=false) + 57 at .../llvm-project/compiler-rt/lib/tsan/rtl/tsan_rtl.h:616
    #10: 0x00000001006967e1 libclang_rt.tsan_osx_dynamic.dylib`__tsan::Acquire(__tsan::ThreadState*, unsigned long, unsigned long) [inlined] __tsan::SlotLocker::SlotLocker(thr=0x0000000103abd100, recursive=false) at .../llvm-project/compiler-rt/lib/tsan/rtl/tsan_rtl.h:614
    #11: 0x00000001006967e1 libclang_rt.tsan_osx_dynamic.dylib`__tsan::Acquire(thr=0x0000000103abd100, pc=<unavailable>, addr=<unavailable>) + 49 at .../llvm-project/compiler-rt/lib/tsan/rtl/tsan_rtl_mutex.cpp:447
    #12: 0x00000001006a25a8 libclang_rt.tsan_osx_dynamic.dylib`::wrap_dispatch_once(predicate=0x00000001000040c8, block=0x0000000100003ce0) + 216 at .../llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_libdispatch.cpp:306
    #13: 0x0000000100003c9f dispatch_once_deadlock.c.tmp`f [inlined] _dispatch_once + 40 at /Applications/XcodeSunriverE.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.Internal.sdk/usr/include/dispatch/once.h:84
    #14: 0x0000000100003c77 dispatch_once_deadlock.c.tmp`f + 39 at .../llvm-project/compiler-rt/test/tsan/libdispatch/dispatch_once_deadlock.c:15
    #15: 0x0000000100003d76 dispatch_once_deadlock.c.tmp`__tsan_on_report + 54 at .../llvm-project/compiler-rt/test/tsan/libdispatch/dispatch_once_deadlock.c:23
    #16: 0x0000000100698286 libclang_rt.tsan_osx_dynamic.dylib`__tsan::OutputReport(thr=0x0000000103abd100, srep=<unavailable>) + 390 at .../llvm-project/compiler-rt/lib/tsan/rtl/tsan_rtl_report.cpp:692
    #17: 0x0000000100695bd7 libclang_rt.tsan_osx_dynamic.dylib`__tsan::ReportMutexMisuse(thr=0x0000000103abd100, pc=<unavailable>, typ=ReportTypeMutexBadUnlock, addr=140702053824072, creation_stack_id=<unavailable>) + 183 at .../llvm-project/compiler-rt/lib/tsan/rtl/tsan_rtl_mutex.cpp:65
    #18: 0x0000000100695dd4 libclang_rt.tsan_osx_dynamic.dylib`__tsan::MutexUnlock(thr=0x0000000103abd100, pc=<unavailable>, addr=<unavailable>, flagz=<unavailable>) + 468 at .../llvm-project/compiler-rt/lib/tsan/rtl/tsan_rtl_mutex.cpp:256
    #19: 0x00000001006658fa libclang_rt.tsan_osx_dynamic.dylib`::wrap_pthread_mutex_unlock(m=0x00007ff7bfeff648) + 90 at .../llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc:4339
    #20: 0x0000000100003de9 dispatch_once_deadlock.c.tmp`main + 105 at .../llvm-project/compiler-rt/test/tsan/libdispatch/dispatch_once_deadlock.c:32
    #21: 0x000000010001150e dyld`start(kernArgs=<unavailable>) + 462 at .../dyld/dyld-951/dyld/dyldMain.cpp:879

[dvyukov]

#15: 0x0000000100003d76 dispatch_once_deadlock.c.tmp`__tsan_on_report + 54 at .../llvm-project/compiler-rt/test/tsan/libdispatch/dispatch_once_deadlock.c:23

void __tsan_on_report() {

fprintf(stderr, "Report.\n");
f();

}

Calling instrumented code from runtime callbacks is not supported.

The test just says:
// Check that calling dispatch_once from a report callback works.
but it does not explain why this is needed.

[yln]

In D116040#3205289, @dvyukov wrote:

Calling instrumented code from runtime callbacks is not supported.

Acknowledged. I update the test: https://reviews.llvm.org/rG63ddf0baf37edbfdf482853870238f9f88bfeb0b

The test just says:
// Check that calling dispatch_once from a report callback works.
but it does not explain why this is needed.

For example, if we want to write to a file or os_log() from __tsan_on_report() and we get unlucky and encounter an uninitialized dispatch_once() in a system library.

When I comment out this line at compiler-rt/lib/tsan/rtl/tsan_rtl.cpp:343 we don't deadlock:

void SlotLock(ThreadState* thr) NO_THREAD_SAFETY_ANALYSIS {
  DCHECK(!thr->slot_locked);
#if SANITIZER_DEBUG
  // Check these mutexes are not locked.
  // We can call DoReset from SlotAttachAndLock, which will lock
  // these mutexes, but it happens only every once in a while.
  { ThreadRegistryLock lock(&ctx->thread_registry); }  <<<<< line 343
  { Lock lock(&ctx->slot_mtx); }
#endif

Does that help? Any ideas?

[dvyukov]

For example, if we want to write to a file or os_log() from __tsan_on_report() and we get unlucky and encounter an uninitialized dispatch_once() in a system library.

System calls will work in this context, or calling sanitizer routines (e.g. Printf). Anything that sanitizers don't intercept.

Allowing arbitrary code in the callbacks would require moving them out of the scope of all runtime mutexes. But it's non-trivial to do.

Adding ignoring of interceptors/synchronization/memory accesses may hide a particular problem, but it may re-appear later as we need to handle some interceptors even when interceptors are ignored.

When I comment out this line at compiler-rt/lib/tsan/rtl/tsan_rtl.cpp:343 we don't deadlock:

void SlotLock(ThreadState* thr) NO_THREAD_SAFETY_ANALYSIS {
  DCHECK(!thr->slot_locked);
#if SANITIZER_DEBUG
  // Check these mutexes are not locked.
  // We can call DoReset from SlotAttachAndLock, which will lock
  // these mutexes, but it happens only every once in a while.
  { ThreadRegistryLock lock(&ctx->thread_registry); }  <<<<< line 343
  { Lock lock(&ctx->slot_mtx); }
#endif

Does that help? Any ideas?

The comment there explains what happens. If we remove this, it may make the toy test work, but the code that does this in real life will still deadlock from time to time.

[yln]

In D116040#3206016, @dvyukov wrote:

System calls will work in this context, or calling sanitizer routines (e.g. Printf). Anything that sanitizers don't intercept.

Thank you for your explanation, Dmitry! I appreciate it.

I updated my mental model to: TSan runtime callbacks should not execute any code that might call back into the runtime; TSan runtime does not support reentrancy from callbacks.

I will look into changing this test.

compiler-rt/lib/tsan/rtl/tsan_defs.h

enum {
   MutexTypeAtExit,
   MutexTypeFired,
   MutexTypeRacy,
   MutexTypeGlobalProc,
   MutexTypeInternalAlloc,
   MutexTypeTrace,
   MutexTypeSlot,
   MutexTypeSlots,
-  MutexTypeMultiSlot,
 };
 
 }  // namespace __tsan
 
 #endif  // TSAN_DEFS_H

compiler-rt/lib/tsan/rtl/tsan_rtl.h

#endif
   Flags flags;
   fd_t memprof_fd;
 
   // The last slot index (kFreeSid) is used to denote freed memory.
   TidSlot slots[kThreadSlotCount - 1];
 
   // Protects global_epoch, slot_queue, trace_part_recycle.
   Mutex slot_mtx;
-  // Prevents lock order inversions when we lock more than 1 slot.
-  Mutex multi_slot_mtx;
   uptr global_epoch;  // guarded by slot_mtx and by all slot mutexes
   bool resetting;     // global reset is in progress
   IList<TidSlot, &TidSlot::node> slot_queue GUARDED_BY(slot_mtx);
   IList<TraceHeader, &TraceHeader::global, TracePart> trace_part_recycle
       GUARDED_BY(slot_mtx);
   uptr trace_part_total_allocated GUARDED_BY(slot_mtx);
   uptr trace_part_recycle_finished GUARDED_BY(slot_mtx);
   uptr trace_part_finished_excess GUARDED_BY(slot_mtx);

 void FiberSwitch(ThreadState *thr, uptr pc, ThreadState *fiber, unsigned flags);
 
 // These need to match __tsan_switch_to_fiber_* flags defined in
 // tsan_interface.h. See documentation there as well.
 enum FiberSwitchFlags {
   FiberSwitchFlagNoSync = 1 << 0, // __tsan_switch_to_fiber_no_sync
 };
 
-class SlotPairLocker {
- public:
-  SlotPairLocker(ThreadState *thr, Sid sid);
-  ~SlotPairLocker();
-
- private:
-  ThreadState *thr_;
-  TidSlot *slot_;
-};
-
 class SlotLocker {
  public:
   ALWAYS_INLINE
   SlotLocker(ThreadState *thr, bool recursive = false)
       : thr_(thr), locked_(recursive ? thr->slot_locked : false) {
     if (!locked_)
       SlotLock(thr_);
   }

compiler-rt/lib/tsan/rtl/tsan_rtl.cpp

static void DoResetImpl(uptr epoch) {
   ctx->metamap.ResetClocks();
   ctx->resetting = false;
 }
 
 // Clang does not understand locking all slots in the loop:
 // error: expecting mutex 'slot.mtx' to be held at start of each loop
 void DoReset(ThreadState* thr, uptr epoch) NO_THREAD_SAFETY_ANALYSIS {
   {
-    Lock l(&ctx->multi_slot_mtx);
     for (auto& slot : ctx->slots) {
       slot.mtx.Lock();
       if (UNLIKELY(epoch == 0))
         epoch = ctx->global_epoch;
       if (UNLIKELY(epoch != ctx->global_epoch)) {
         // Epoch can't change once we've locked the first slot.
         CHECK_EQ(slot.sid, 0);
         slot.mtx.Unlock();

 
 void SlotDetach(ThreadState* thr) {
   Lock lock(&thr->slot->mtx);
   SlotDetachImpl(thr, true);
 }
 
 void SlotLock(ThreadState* thr) NO_THREAD_SAFETY_ANALYSIS {
   DCHECK(!thr->slot_locked);
+#if SANITIZER_DEBUG
+  // Check these mutexes are not locked.
+  // We can call DoReset from SlotAttachAndLock, which will lock
+  // these mutexes, but it happens only every once in a while.
+  { ThreadRegistryLock lock(&ctx->thread_registry); }
+  { Lock lock(&ctx->slot_mtx); }
+#endif
   TidSlot* slot = thr->slot;
   slot->mtx.Lock();
   thr->slot_locked = true;
   if (LIKELY(thr == slot->thr && thr->fast_state.epoch() != kEpochLast))
     return;
   SlotDetachImpl(thr, false);
   thr->slot_locked = false;
   slot->mtx.Unlock();
: initialized(),
         return new (Alloc(sizeof(ThreadContext))) ThreadContext(tid);
       }),
       racy_mtx(MutexTypeRacy),
       racy_stacks(),
       racy_addresses(),
       fired_suppressions_mtx(MutexTypeFired),
       clock_alloc(LINKER_INITIALIZED, "clock allocator"),
       slot_mtx(MutexTypeSlots),
-      multi_slot_mtx(MutexTypeMultiSlot),
       resetting() {
   fired_suppressions.reserve(8);
   for (uptr i = 0; i < ARRAY_SIZE(slots); i++) {
     TidSlot* slot = &slots[i];
     slot->sid = static_cast<Sid>(i);
     slot_queue.PushBack(slot);
   }
   global_epoch = 1;

 }
 
 #if !SANITIZER_GO
 void ForkBefore(ThreadState *thr, uptr pc) NO_THREAD_SAFETY_ANALYSIS {
   GlobalProcessorLock();
   // Detaching from the slot makes OnUserFree skip writing to the shadow.
   // The slot will be locked so any attempts to use it will deadlock anyway.
   SlotDetach(thr);
-  ctx->multi_slot_mtx.Lock();
   for (auto& slot : ctx->slots) slot.mtx.Lock();
   ctx->thread_registry.Lock();
   ctx->slot_mtx.Lock();
   ScopedErrorReportLock::Lock();
   AllocatorLock();
   // Suppress all reports in the pthread_atfork callbacks.
   // Reports will deadlock on the report_mtx.
   // We could ignore sync operations as well,
static void ForkAfter(ThreadState* thr) NO_THREAD_SAFETY_ANALYSIS {
   thr->suppress_reports--;  // Enabled in ForkBefore.
   thr->ignore_interceptors--;
   thr->ignore_reads_and_writes--;
   AllocatorUnlock();
   ScopedErrorReportLock::Unlock();
   ctx->slot_mtx.Unlock();
   ctx->thread_registry.Unlock();
   for (auto& slot : ctx->slots) slot.mtx.Unlock();
-  ctx->multi_slot_mtx.Unlock();
   SlotAttachAndLock(thr);
   SlotUnlock(thr);
   GlobalProcessorUnlock();
 }
 
 void ForkParentAfter(ThreadState* thr, uptr pc) { ForkAfter(thr); }
 
 void ForkChildAfter(ThreadState* thr, uptr pc, bool start_thread) {
MutexMeta mutex_meta[] = {
      "ThreadRegistry",
      {MutexTypeSlots, MutexTypeTrace, MutexTypeReport}},
     {MutexTypeReport, "Report", {MutexTypeTrace}},
     {MutexTypeSyncVar, "SyncVar", {MutexTypeReport, MutexTypeTrace}},
     {MutexTypeAnnotations, "Annotations", {}},
     {MutexTypeAtExit, "AtExit", {}},
     {MutexTypeFired, "Fired", {MutexLeaf}},
     {MutexTypeRacy, "Racy", {MutexLeaf}},
-    {MutexTypeGlobalProc,
-     "GlobalProc",
-     {MutexTypeSlot, MutexTypeSlots, MutexTypeMultiSlot}},
+    {MutexTypeGlobalProc, "GlobalProc", {MutexTypeSlot, MutexTypeSlots}},
     {MutexTypeInternalAlloc, "InternalAlloc", {MutexLeaf}},
     {MutexTypeTrace, "Trace", {}},
     {MutexTypeSlot,
      "Slot",
      {MutexMulti, MutexTypeTrace, MutexTypeSyncVar, MutexThreadRegistry,
       MutexTypeSlots}},
     {MutexTypeSlots, "Slots", {MutexTypeTrace, MutexTypeReport}},
-    {MutexTypeMultiSlot, "MultiSlot", {MutexTypeSlot, MutexTypeSlots}},
     {},
 };
 
 void PrintMutexPC(uptr pc) { StackTrace(&pc, 1).Print(); }
 
 }  // namespace __sanitizer
 #endif

compiler-rt/lib/tsan/rtl/tsan_rtl_mutex.cpp

for (int j = 0; j < (flags()->second_deadlock_stack ? 2 : 1); j++) {
       }
     }
   }
   OutputReport(thr, rep);
 }
 
 void ReportDestroyLocked(ThreadState *thr, uptr pc, uptr addr,
                          FastState last_lock, StackID creation_stack_id) {
-  SlotPairLocker locker(thr, last_lock.sid());
+  // We need to lock the slot during RestoreStack because it protects
+  // the slot journal.
+  Lock slot_lock(&ctx->slots[static_cast<uptr>(last_lock.sid())].mtx);
   ThreadRegistryLock l0(&ctx->thread_registry);
   Lock slots_lock(&ctx->slot_mtx);
   ScopedReport rep(ReportTypeMutexDestroyLocked);
   rep.AddMutex(addr, creation_stack_id);
   VarSizeStackTrace trace;
   ObtainCurrentStack(thr, pc, &trace);
   rep.AddStack(trace, true);
 

compiler-rt/lib/tsan/rtl/tsan_rtl_report.cpp

if (addr == s->pc_or_addr) {
       if (s->supp)
         atomic_fetch_add(&s->supp->hit_count, 1, memory_order_relaxed);
       return true;
     }
   }
   return false;
 }
 
-// We need to lock the target slot during RestoreStack because it protects
-// the slot journal. However, the target slot can be the slot of the current
-// thread or a different slot.
-SlotPairLocker::SlotPairLocker(ThreadState *thr,
-                               Sid sid) NO_THREAD_SAFETY_ANALYSIS : thr_(thr),
-                                                                    slot_() {
-  CHECK_NE(sid, kFreeSid);
-  Lock l(&ctx->multi_slot_mtx);
-  SlotLock(thr);
-  if (sid == thr->slot->sid)
-    return;
-  slot_ = &ctx->slots[static_cast<uptr>(sid)];
-  slot_->mtx.Lock();
-}
-
-SlotPairLocker::~SlotPairLocker() NO_THREAD_SAFETY_ANALYSIS {
-  SlotUnlock(thr_);
-  if (slot_)
-    slot_->mtx.Unlock();
-}
-
 void ReportRace(ThreadState *thr, RawShadow *shadow_mem, Shadow cur, Shadow old,
                 AccessType typ0) {
   CheckedMutex::CheckNoLocks();
 
   // Symbolizer makes lots of intercepted calls. If we try to process them,
   // at best it will cause deadlocks on internal mutexes.
   ScopedIgnoreInterceptors ignore;
 
void ReportRace(ThreadState *thr, RawShadow *shadow_mem, Shadow cur, Shadow old,
 
   ObtainCurrentStack(thr, thr->trace_prev_pc, &traces[0], &tags[0]);
   if (IsFiredSuppression(ctx, rep_typ, traces[0]))
     return;
 
   DynamicMutexSet mset1;
   MutexSet *mset[kMop] = {&thr->mset, mset1};
 
-  SlotPairLocker locker(thr, s[1].sid());
+  // We need to lock the slot during RestoreStack because it protects
+  // the slot journal.
+  Lock slot_lock(&ctx->slots[static_cast<uptr>(s[1].sid())].mtx);
   ThreadRegistryLock l0(&ctx->thread_registry);
   Lock slots_lock(&ctx->slot_mtx);
   if (!RestoreStack(EventType::kAccessExt, s[1].sid(), s[1].epoch(), addr1,
                     size1, typ1, &tids[1], &traces[1], mset[1], &tags[1]))
     return;
 
   if (IsFiredSuppression(ctx, rep_typ, traces[1]))
     return;

compiler-rt/lib/tsan/tests/unit/tsan_trace_test.cpp

TRACE_TEST(Trace, RestoreAccess) {
   CHECK(TryTraceMemoryAccess(thr, 0x2001, 0x3001, 8, kAccessRead));
   TraceMutexLock(thr, EventType::kRLock, 0x4002, 0x5002, 0x6002);
   TraceFunc(thr, 0x1002);
   CHECK(TryTraceMemoryAccess(thr, 0x2000, 0x3000, 8, kAccessRead));
   // This is the access we want to find.
   // The previous one is equivalent, but RestoreStack must prefer
   // the last of the matchig accesses.
   CHECK(TryTraceMemoryAccess(thr, 0x2002, 0x3000, 8, kAccessRead));
-  SlotPairLocker locker(thr, thr->fast_state.sid());
+  Lock slot_lock(&ctx->slots[static_cast<uptr>(thr->fast_state.sid())].mtx);
   ThreadRegistryLock lock1(&ctx->thread_registry);
   Lock lock2(&ctx->slot_mtx);
   Tid tid = kInvalidTid;
   VarSizeStackTrace stk;
   MutexSet mset;
   uptr tag = kExternalTagNone;
   bool res = RestoreStack(EventType::kAccessExt, thr->fast_state.sid(),
                           thr->fast_state.epoch(), 0x3000, 8, kAccessRead, &tid,
for (int type = 0; type < 3; type++) {
           CHECK(TryTraceMemoryAccess(thr, 0x2000000, 0x3000, params.access_size,
                                      kAccessRead));
           break;
         case 2:
           TraceMemoryAccessRange(thr, 0x2000000, 0x3000, params.access_size,
                                  kAccessRead);
           break;
       }
-      SlotPairLocker locker(thr, thr->fast_state.sid());
+      Lock slot_lock(&ctx->slots[static_cast<uptr>(thr->fast_state.sid())].mtx);
       ThreadRegistryLock lock1(&ctx->thread_registry);
       Lock lock2(&ctx->slot_mtx);
       Tid tid = kInvalidTid;
       VarSizeStackTrace stk;
       MutexSet mset;
       uptr tag = kExternalTagNone;
       bool res =
           RestoreStack(EventType::kAccessExt, thr->fast_state.sid(),

 
 TRACE_TEST(Trace, RestoreMutexLock) {
   // Check of restoration of a mutex lock event.
   ThreadArray<1> thr;
   TraceFunc(thr, 0x1000);
   TraceMutexLock(thr, EventType::kLock, 0x4000, 0x5000, 0x6000);
   TraceMutexLock(thr, EventType::kRLock, 0x4001, 0x5001, 0x6001);
   TraceMutexLock(thr, EventType::kRLock, 0x4002, 0x5001, 0x6002);
-  SlotPairLocker locker(thr, thr->fast_state.sid());
+  Lock slot_lock(&ctx->slots[static_cast<uptr>(thr->fast_state.sid())].mtx);
   ThreadRegistryLock lock1(&ctx->thread_registry);
   Lock lock2(&ctx->slot_mtx);
   Tid tid = kInvalidTid;
   VarSizeStackTrace stk;
   MutexSet mset;
   uptr tag = kExternalTagNone;
   bool res = RestoreStack(EventType::kLock, thr->fast_state.sid(),
                           thr->fast_state.epoch(), 0x5001, 0, 0, &tid, &stk,
for (uptr i = 0; i < kEvents; i++) {
     MutexPreLock(thr, 0x4002, 0x5002, 0);
     MutexPostLock(thr, 0x4002, 0x5002, 0);
     MutexUnlock(thr, 0x4003, 0x5002, 0);
     FuncExit(thr);
   }
   FuncEntry(thr, 0x4000);
   TraceMutexLock(thr, EventType::kRLock, 0x4001, 0x5001, 0x6001);
   CHECK(TryTraceMemoryAccess(thr, 0x2002, 0x3000, 8, kAccessRead));
-  SlotPairLocker locker(thr, thr->fast_state.sid());
+  Lock slot_lock(&ctx->slots[static_cast<uptr>(thr->fast_state.sid())].mtx);
   ThreadRegistryLock lock1(&ctx->thread_registry);
   Lock lock2(&ctx->slot_mtx);
   Tid tid = kInvalidTid;
   VarSizeStackTrace stk;
   MutexSet mset;
   uptr tag = kExternalTagNone;
   bool res = RestoreStack(EventType::kAccessExt, thr->fast_state.sid(),
                           thr->fast_state.epoch(), 0x3000, 8, kAccessRead, &tid,

compiler-rt/test/tsan/stress.cpp

-// RUN: %clangxx_tsan -O1 %s -o %t && %env_tsan_opts=flush_memory_ms=1:flush_symbolizer_ms=1:memory_limit_mb=1 %run %t 2>&1 | FileCheck %s
+// This run stresses global reset happenning concurrently with everything else.
+// RUN: %clangxx_tsan -O1 %s -o %t && %env_tsan_opts=flush_memory_ms=1:flush_symbolizer_ms=1:memory_limit_mb=1 %run %t 2>&1 | FileCheck %s --check-prefix=CHECK-NORACE
+// This run stresses race reporting happenning concurrently with everything else.
+// RUN: %clangxx_tsan -O1 %s -DRACE=1 -o %t && %env_tsan_opts=suppress_equal_stacks=0:suppress_equal_addresses=0 %deflake %run %t | FileCheck %s --check-prefix=CHECK-RACE
 #include "test.h"
 #include <fcntl.h>
 #include <string.h>
 
 volatile long stop;
-long atomic, read_only;
+long atomic, read_only, racy;
 int fds[2];
 
 __attribute__((noinline)) void *SecondaryThread(void *x) {
   __atomic_fetch_add(&atomic, 1, __ATOMIC_ACQ_REL);
   return NULL;
 }
 
 void *Thread(void *x) {
   const int me = (long)x;
   volatile long sink = 0;
   while (!stop) {
     // If me == 0, we do all of the following,
     // otherwise only 1 type of action.
     if (me == 0 || me == 1) {
       // just read the stop variable
     }
     if (me == 0 || me == 2) {
-      __atomic_store_n(&atomic, 1, __ATOMIC_RELEASE);
+      __atomic_store_n(&atomic, sink, __ATOMIC_RELEASE);
     }
     if (me == 0 || me == 3) {
       sink += __atomic_fetch_add(&atomic, 1, __ATOMIC_ACQ_REL);
     }
     if (me == 0 || me == 4) {
       SecondaryThread(NULL);
     }
     if (me == 0 || me == 5) {
       write(fds[1], fds, 1);
     }
     if (me == 0 || me == 6) {
       char buf[2];
       read(fds[0], &buf, sizeof(buf));
     }
     if (me == 0 || me == 7) {
       pthread_t th;
       pthread_create(&th, NULL, SecondaryThread, NULL);
       pthread_join(th, NULL);
     }
     if (me == 0 || me == 8) {
       long buf;
       memcpy(&buf, &read_only, sizeof(buf));
       sink += buf;
     }
+    if (me == 0 || me == 9) {
+#if RACE
+      sink += racy++;
+#else
+      sink += racy;
+#endif
+    }
     // If you add more actions, update kActions in main.
   }
   return NULL;
 }
 
 int main() {
   ANNOTATE_BENIGN_RACE(stop);
   if (pipe(fds))
     exit((perror("pipe"), 1));
   if (fcntl(fds[0], F_SETFL, O_NONBLOCK))
     exit((perror("fcntl"), 1));
   if (fcntl(fds[1], F_SETFL, O_NONBLOCK))
     exit((perror("fcntl"), 1));
-  const int kActions = 9;
+  const int kActions = 10;
+#if RACE
+  const int kMultiplier = 1;
+#else
   const int kMultiplier = 4;
+#endif
   pthread_t t[kActions * kMultiplier];
   for (int i = 0; i < kActions * kMultiplier; i++)
     pthread_create(&t[i], NULL, Thread, (void *)(long)(i % kActions));
   sleep(5);
   stop = 1;
   for (int i = 0; i < kActions * kMultiplier; i++)
     pthread_join(t[i], NULL);
   fprintf(stderr, "DONE\n");
   return 0;
 }
 
-// CHECK-NOT: ThreadSanitizer:
-// CHECK: DONE
-// CHECK-NOT: ThreadSanitizer:
+// CHECK-NORACE-NOT: ThreadSanitizer:
+// CHECK-NORACE: DONE
+// CHECK-NORACE-NOT: ThreadSanitizer:
+// CHECK-RACE: ThreadSanitizer: data race
+// CHECK-RACE: DONE