[tsan] dispatch_once interceptor will cause a deadlock when the original dispatch_once is used

[kubamracek]

Summary

Because we use SCOPED_TSAN_INTERCEPTOR in the dispatch_once interceptor, the original dispatch_once can also be sometimes called (when ignores are enabled or when thr->is_inited is false). However the original dispatch_once function doesn’t expect to find “2” in the storage and it will spin forever (but we use “2” to indicate that the initialization is already done, so no waiting is necessary). We should never call the original dispatch_once.

[kubamracek]

Adding a testcase. Without the patch, the test doesn’t deadlock but only crashes, so I didn’t add a timeout.

lib/tsan/rtl/tsan_libdispatch_mac.cc

 // and acquire semantics. Since TSan does not see its own atomic stores, the
 // race on predicate won't be reported - the only accesses to it that TSan sees
 // are the loads on the fast path. Loads don't race. Secondly, dispatch_once is
 // both a macro and a real function, we want to intercept the function, so we
 // need to undefine the macro.
 #undef dispatch_once
 TSAN_INTERCEPTOR(void, dispatch_once, dispatch_once_t *predicate,
                  dispatch_block_t block) {
-  SCOPED_TSAN_INTERCEPTOR(dispatch_once, predicate, block);
+  SCOPED_INTERCEPTOR_RAW(dispatch_once, predicate, block);
   atomic_uint32_t *a = reinterpret_cast<atomic_uint32_t *>(predicate);
   u32 v = atomic_load(a, memory_order_acquire);
   if (v == 0 &&
       atomic_compare_exchange_strong(a, &v, 1, memory_order_relaxed)) {
     SCOPED_TSAN_INTERCEPTOR_USER_CALLBACK_START();
     block();
     SCOPED_TSAN_INTERCEPTOR_USER_CALLBACK_END();
     Release(thr, pc, (uptr)a);
     atomic_store(a, 2, memory_order_release);
   } else {
     while (v != 2) {
       internal_sched_yield();
       v = atomic_load(a, memory_order_acquire);
     }
     Acquire(thr, pc, (uptr)a);
   }
 }
 
 #undef dispatch_once_f
 TSAN_INTERCEPTOR(void, dispatch_once_f, dispatch_once_t *predicate,
                  void *context, dispatch_function_t function) {
-  SCOPED_TSAN_INTERCEPTOR(dispatch_once_f, predicate, context, function);
+  SCOPED_INTERCEPTOR_RAW(dispatch_once_f, predicate, context, function);
   SCOPED_TSAN_INTERCEPTOR_USER_CALLBACK_START();
   WRAP(dispatch_once)(predicate, ^(void) {
     function(context);
   });
   SCOPED_TSAN_INTERCEPTOR_USER_CALLBACK_END();
 }
 
 TSAN_INTERCEPTOR(long_t, dispatch_semaphore_signal,

test/tsan/Darwin/dispatch_once_deadlock.mm

+// Check that calling dispatch_once from a report callback works.
+
+// RUN: %clang_tsan %s -o %t -framework Foundation
+// RUN: %env_tsan_opts=ignore_interceptors_accesses=1 not %run %t 2>&1 | FileCheck %s
+
+#import <Foundation/Foundation.h>
+#import <pthread.h>
+
+long g = 0;
+long h = 0;
+void f() {
+  static dispatch_once_t onceToken;
+  dispatch_once(&onceToken, ^{
+    g++;
+  });
+  h++;
+}
+
+extern "C" void __tsan_on_report() {
+  fprintf(stderr, "Report.\n");
+  f();
+}
+
+int main() {
+  fprintf(stderr, "Hello world.\n");
+
+  f();
+
+  pthread_mutex_t mutex = {0};
+  pthread_mutex_lock(&mutex);
+
+  fprintf(stderr, "g = %ld.\n", g);
+  fprintf(stderr, "h = %ld.\n", h);
+  fprintf(stderr, "Done.\n");
+}
+
+// CHECK: Hello world.
+// CHECK: Report.
+// CHECK: g = 1
+// CHECK: h = 2
+// CHECK: Done.