[tsan] Fix false positives with GCD dispatch_source_*

[kubamracek]

Summary

We already have interceptors for dispatch_source API (e.g. dispatch_source_set_event_handler), but they currently only handle submission synchronization. We also need to synchronize based on the target queue (serial, concurrent), in other words, we need to use dispatch_callback_wrap. This patch implements that.

However, some more magic is needed for this to work, because the callback set in dispatch_source_set_event_handler is called multiple times (to the contrary of most other GCD APIs), so we cannot free() the context in the callback. The lifetime of the context and the wrapper block needs to be inherited from the outer block (the one actually submitted to REAL(dispatch_source_set_event_handler)), so we need to *capture* the original handler *and* the context. The Block_copy is needed to make sure the __block tsan_block_context_t new_context is converted to a heap-allocated object.

lib/tsan/rtl/tsan_libdispatch_mac.cc

 
 static bool IsQueueSerial(dispatch_queue_t q) {
   CHECK_EQ(dispatch_queue_offsets.dqo_width_size, 2);
   uptr width = *(uint16_t *)(((uptr)q) + dispatch_queue_offsets.dqo_width);
   CHECK_NE(width, 0);
   return width == 1;
 }
 
+static dispatch_queue_t GetTargetQueueFromSource(dispatch_source_t source) {
+  CHECK_EQ(dispatch_queue_offsets.dqo_target_queue_size, 8);
+  dispatch_queue_t target_queue =
+      *(dispatch_queue_t *)(((uptr)source) + dispatch_queue_offsets.dqo_target_queue);
+  CHECK_NE(target_queue, 0);
+  return target_queue;
+}
+
 static tsan_block_context_t *AllocContext(ThreadState *thr, uptr pc,
                                           dispatch_queue_t queue,
                                           void *orig_context,
                                           dispatch_function_t orig_work) {
   tsan_block_context_t *new_context =
       (tsan_block_context_t *)user_alloc(thr, pc, sizeof(tsan_block_context_t));
   new_context->queue = queue;
   new_context->orig_context = orig_context;
static void dispatch_callback_wrap(void *param) {
   SCOPED_TSAN_INTERCEPTOR_USER_CALLBACK_END();
 
   Release(thr, pc, serial_task ? serial_sync : concurrent_sync);
   if (context->submitted_synchronously) Release(thr, pc, submit_sync);
 
   if (context->free_context_in_callback) user_free(thr, pc, context);
 }
 
+static void invoke_block(void *param) {
+  dispatch_block_t block = (dispatch_block_t)param;
+  block();
+}
+
 static void invoke_and_release_block(void *param) {
   dispatch_block_t block = (dispatch_block_t)param;
   block();
   Block_release(block);
 }
 
 #define DISPATCH_INTERCEPT_B(name, barrier)                                  \
   TSAN_INTERCEPTOR(void, name, dispatch_queue_t q, dispatch_block_t block) { \
TSAN_INTERCEPTOR(void, dispatch_group_notify_f, dispatch_group_t group,
   WRAP(dispatch_group_notify)(group, q, ^(void) { work(context); });
 }
 
 TSAN_INTERCEPTOR(void, dispatch_source_set_event_handler,
                  dispatch_source_t source, dispatch_block_t handler) {
   SCOPED_TSAN_INTERCEPTOR(dispatch_source_set_event_handler, source, handler);
   if (handler == nullptr)
     return REAL(dispatch_source_set_event_handler)(source, nullptr);
-  dispatch_block_t new_handler = ^(void) {
-    {
-      SCOPED_INTERCEPTOR_RAW(dispatch_source_set_event_handler_callback);
-      Acquire(thr, pc, (uptr)source);
-    }
-    handler();
-  };
-  Release(thr, pc, (uptr)source);
+  dispatch_queue_t q = GetTargetQueueFromSource(source);
+  __block tsan_block_context_t new_context = {
+      q, handler, &invoke_block, false, false, false };
+  dispatch_block_t new_handler = Block_copy(^(void) {
+    new_context.orig_context = handler;  // To explicitly capture "handler".
+    dispatch_callback_wrap(&new_context);
+  });
+  uptr submit_sync = (uptr)&new_context;
+  Release(thr, pc, submit_sync);
   REAL(dispatch_source_set_event_handler)(source, new_handler);
+  Block_release(new_handler);
 }
 
 TSAN_INTERCEPTOR(void, dispatch_source_set_event_handler_f,
                  dispatch_source_t source, dispatch_function_t handler) {
   SCOPED_TSAN_INTERCEPTOR(dispatch_source_set_event_handler_f, source, handler);
   if (handler == nullptr)
     return REAL(dispatch_source_set_event_handler)(source, nullptr);
   dispatch_block_t block = ^(void) {
     handler(dispatch_get_context(source));
   };
   WRAP(dispatch_source_set_event_handler)(source, block);
 }
 
 TSAN_INTERCEPTOR(void, dispatch_source_set_cancel_handler,
                  dispatch_source_t source, dispatch_block_t handler) {
   SCOPED_TSAN_INTERCEPTOR(dispatch_source_set_cancel_handler, source, handler);
   if (handler == nullptr)
     return REAL(dispatch_source_set_cancel_handler)(source, nullptr);
-  dispatch_block_t new_handler = ^(void) {
-    {
-      SCOPED_INTERCEPTOR_RAW(dispatch_source_set_cancel_handler_callback);
-      Acquire(thr, pc, (uptr)source);
-    }
-    handler();
-  };
-  Release(thr, pc, (uptr)source);
+  dispatch_queue_t q = GetTargetQueueFromSource(source);
+  __block tsan_block_context_t new_context = {
+      q, handler, &invoke_block, false, false, false };
+  dispatch_block_t new_handler = Block_copy(^(void) {
+    new_context.orig_context = handler;  // To explicitly capture "handler".
+    dispatch_callback_wrap(&new_context);
+  });
+  uptr submit_sync = (uptr)&new_context;
+  Release(thr, pc, submit_sync);
   REAL(dispatch_source_set_cancel_handler)(source, new_handler);
+  Block_release(new_handler);
 }
 
 TSAN_INTERCEPTOR(void, dispatch_source_set_cancel_handler_f,
                  dispatch_source_t source, dispatch_function_t handler) {
   SCOPED_TSAN_INTERCEPTOR(dispatch_source_set_cancel_handler_f, source,
                           handler);
   if (handler == nullptr)
     return REAL(dispatch_source_set_cancel_handler)(source, nullptr);
   dispatch_block_t block = ^(void) {
     handler(dispatch_get_context(source));
   };
   WRAP(dispatch_source_set_cancel_handler)(source, block);
 }
 
 TSAN_INTERCEPTOR(void, dispatch_source_set_registration_handler,
                  dispatch_source_t source, dispatch_block_t handler) {
   SCOPED_TSAN_INTERCEPTOR(dispatch_source_set_registration_handler, source,
                           handler);
   if (handler == nullptr)
     return REAL(dispatch_source_set_registration_handler)(source, nullptr);
-  dispatch_block_t new_handler = ^(void) {
-    {
-      SCOPED_INTERCEPTOR_RAW(dispatch_source_set_registration_handler_callback);
-      Acquire(thr, pc, (uptr)source);
-    }
-    handler();
-  };
-  Release(thr, pc, (uptr)source);
+  dispatch_queue_t q = GetTargetQueueFromSource(source);
+  __block tsan_block_context_t new_context = {
+      q, handler, &invoke_block, false, false, false };
+  dispatch_block_t new_handler = Block_copy(^(void) {
+    new_context.orig_context = handler;  // To explicitly capture "handler".
+    dispatch_callback_wrap(&new_context);
+  });
+  uptr submit_sync = (uptr)&new_context;
+  Release(thr, pc, submit_sync);
   REAL(dispatch_source_set_registration_handler)(source, new_handler);
+  Block_release(new_handler);
 }
 
 TSAN_INTERCEPTOR(void, dispatch_source_set_registration_handler_f,
                  dispatch_source_t source, dispatch_function_t handler) {
   SCOPED_TSAN_INTERCEPTOR(dispatch_source_set_registration_handler_f, source,
                           handler);
   if (handler == nullptr)
     return REAL(dispatch_source_set_registration_handler)(source, nullptr);

test/tsan/Darwin/gcd-source-serial.mm

+// RUN: %clang_tsan %s -o %t -framework Foundation
+// RUN: %env_tsan_opts=ignore_interceptors_accesses=1 %run %t 2>&1 | FileCheck %s
+
+#import <Foundation/Foundation.h>
+
+long global;
+
+int main(int argc, const char *argv[]) {
+  fprintf(stderr, "Hello world.\n");
+
+  dispatch_queue_t q = dispatch_queue_create("my.queue", DISPATCH_QUEUE_SERIAL);
+  dispatch_semaphore_t sem = dispatch_semaphore_create(0);
+  dispatch_source_t timer = dispatch_source_create(DISPATCH_SOURCE_TYPE_TIMER, 0, 0, q);
+  long long interval_ms = 10;
+  dispatch_source_set_timer(timer, dispatch_time(DISPATCH_TIME_NOW, 0), interval_ms * NSEC_PER_MSEC, 0);
+  dispatch_source_set_event_handler(timer, ^{
+    fprintf(stderr, "timer\n");
+    global++;
+
+    if (global > 50) {
+      dispatch_semaphore_signal(sem);
+    }
+  });
+  dispatch_resume(timer);
+
+  dispatch_semaphore_wait(sem, DISPATCH_TIME_FOREVER);
+
+  fprintf(stderr, "Done.\n");
+}
+
+// CHECK: Hello world.
+// CHECK-NOT: WARNING: ThreadSanitizer
+// CHECK: Done.