這段代碼中的競態條件是什麼？

Question

以下是我執行的SleepConditionVariableCS，WakeAllConditionVariable和線程創建函數。問題是，有時當我嘗試創建線程時，創建線程卡在WaitForSingleObject(cv->mut, INFINITE);的SleepConditionVariableCS中。我無法弄清楚這裏的競賽狀況。

typedef struct 
{ 
    int waiters_count; 
    HANDLE sema_; 
    HANDLE mut; 
} CONDITION_VARIABLE; 

void SleepConditionVariableCS(CONDITION_VARIABLE *cv, CRITICAL_SECTION *cs, int32_t dwMilliseconds){ 
    WaitForSingleObject(cv->mut, INFINITE); //Acuire object lock 

    cv->waiters_count++; 
    LeaveCriticalSection (cs); 
    if (SignalObjectAndWait(cv->mut, cv->sema_, dwMilliseconds, FALSE) == WAIT_TIMEOUT){ //SignalObjectAndWait releases the lock 
     cv->waiters_count--; 
    } 
    EnterCriticalSection(cs); 
} 

void WakeAllConditionVariable(CONDITION_VARIABLE *cv){ 
    WaitForSingleObject(cv->mut, INFINITE); 

    while (cv->waiters_count > 0){ 
     cv->waiters_count = cv->waiters_count - 1; 
     ReleaseSemaphore (cv->sema_, 1, 0); 
    } 
    ReleaseMutex(cv->mut); 
} 

void KernelThread_CreationWait(void *kthread){ 
    KernelThread *thread = (KernelThread *) kthread; 

    EnterCriticalSection(thread->lock); 
    thread->state = Thread_CREATED; 

    WakeAllConditionVariable(thread->condition_variable); 

    LeaveCriticalSection(thread->lock); 
    KernelThread_main(kthread); 
} 

KernelThread* createKernelThread(){ 
    EventHandler_getHandler(); 

    unsigned long threadid; 
    int t; 
    void *hand; 

    KernelThread *thread = KernelThread_malloc(); 
    EnterCriticalSection(thread->lock); 
    thread->state = Thread_WAITINGFORCREATION; 
    hand = CreateThread(NULL, 
      0, // security, stack size 
      (LPTHREAD_START_ROUTINE)&KernelThread_CreationWait, // start 
      (void *)thread, 
      0, 
      &threadid); // param, creation flags, id 
    if (hand == NULL){ 
     printf("ERROR: return handle from CreateThread() is NULL\n"); 
     exit(-1); 
    } 
    thread->thread = hand; 
    thread->thread_id = threadid; 

    SleepConditionVariableCS(thread->condition_variable,thread->lock,INFINITE); 
    LeaveCriticalSection(thread->lock); 

    return thread; 
} 

void InitializeConditionVariable (CONDITION_VARIABLE *cv){ 
    cv->waiters_count = 0; 
    cv->sema_ = CreateSemaphore (NULL,  // no security 
           0,   // initially 0 
           0x7fffffff, // max count 
           NULL);  // unnamed 
    cv->mut = CreateMutex(
      NULL,    // default security attributes 
      FALSE,    // initially not owned 
      NULL);    // unnamed mutex 
} 

Answer 1

在嘗試使用win32 apis實現pthread樣式條件變量時，請查看以下詳細分析。 http://www.cs.wustl.edu/~schmidt/win32-cv-1.html。 （尤其是第3.4節）。

在你的代碼中，我目前只看到一個問題。在SleepConditionVariableCS()：

LeaveCriticalSection (cs); 
    if (SignalObjectAndWait(cv->mut, cv->sema_, dwMilliseconds, FALSE) == WAIT_TIMEOUT){ //SignalObjectAndWait releases the lock 
     // RIGHT HERE YOU HAVE NOT ACQUIRED cv->mut 
     cv->waiters_count--; // SO THIS IS A DATA RACE (with the cv->waiters_count uses in WakeAllConditionVariable() 
    } 

在

Answer 2

我沒有看到真正突出的邏輯缺陷。

但是......

你初始化CONDITION_VARIABLE到已知狀態使用它之前？

你不檢查幾個系統調用的返回值，這可能會返回一個你永遠不會看到的錯誤。 WaitForSingleObject和EnterCriticalSection可以失敗或被給予錯誤的句柄。

你是否總是鎖定thread->lock並在處理條件變量時保持鎖定狀態？我看到2個不同的代碼片段，並參考了thread->lock。

您是否每次都以相同的順序鎖定/解鎖臨界區域和區域？