Eliminate cyclic locks in runtime

This change introduces a new deadlock detector for Cosmo's POSIX threads
implementation. Error check mutexes will now track a DAG of nested locks
and report EDEADLK when a deadlock is theoretically possible. These will
occur rarely, but it's important for production hardening your code. You
don't even need to change your mutexes to use the POSIX error check mode
because `cosmocc -mdbg` will enable error checking on mutexes by default
globally. When cycles are found, an error message showing your demangled
symbols describing the strongly connected component are printed and then
the SIGTRAP is raised, which means you'll also get a backtrace if you're
using ShowCrashReports() too. This new error checker is so low-level and
so pure that it's able to verify the relationships of every libc runtime
lock, including those locks upon which the mutex implementation depends.
This commit is contained in:
Justine Tunney 2024-12-16 20:51:27 -08:00
parent 26c051c297
commit af7bd80430
No known key found for this signature in database
GPG key ID: BE714B4575D6E328
141 changed files with 2094 additions and 1601 deletions

View file

@ -191,15 +191,22 @@ The following supplemental flags are defined by cosmocc:
- `-mdbg` may be passed when linking programs. It has the same effect as
`export MODE=dbg` in that it will cause an alternative build of the
Cosmopolitan Libc runtime to be linked that was built with `-O0 -g`.
Under the normal build mode, `--ftrace` output is oftentimes missing
important pieces of the puzzle due to inlining. This mode makes it
more comprehensible. It's also the only way to make using GDB to
troubleshoot issues inside Cosmo Libc work reliably. Please be warned
that this flag may enable some heavyweight runtime checks. For
example, mmap() will become O(n) rather than O(logn) in an effort to
spot data structure corruption. Lastly, the linked Cosmo runtime was
compiled with `-fsanitize=undefined` (UBSAN) although you still need
to pass that flag too if you want it for your own code.
Under the normal build mode, `--ftrace` output generated by your libc
is oftentimes missing important details due to inlining. If your build
your code with `cosmocc -O0 -mdbg` then `--ftrace` will make much more
sense. It's also the only way to make using GDB to troubleshoot issues
inside Cosmo Libc work reliably. Please be warned, this flag enables
some heavy-hitting runtime checks, such such lock graph validation.
The debug Cosmopolitan runtime is able to detect lock cycles globally
automatically via your normal usage of `pthread_mutex_t` and then
report strongly connected components with C++ symbol demangling. This
runtime will absolutely crash your entire process, if it helps you
spot a bug. For example, debug cosmo is build with UBSAN so even an
undiscovered yet innocent bit shift of a negative number could take
you down. So you wouldn't want to use this in prod very often. Please
note that passing `-mdbg` doesn't imply `-g -O0 -fsanitize=undefined`
which must be passed separately if you want your code to be compiled
with the same stuff as libc.
- `-mtiny` may be passed when linking programs. It has the same effect
as `export MODE=tiny` in that it will cause an alternative build of

View file

@ -6799,6 +6799,8 @@ static int HandleConnection(size_t i) {
} else {
switch ((pid = fork())) {
case 0:
lua_repl_wock();
lua_repl_lock();
meltdown = false;
__isworker = true;
connectionclose = false;