thread_annotations.h 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264
  1. // Copyright (c) 2018 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. // This header file contains macro definitions for thread safety annotations
  5. // that allow developers to document the locking policies of multi-threaded
  6. // code. The annotations can also help program analysis tools to identify
  7. // potential thread safety issues.
  8. //
  9. // Note that the annotations we use are described as deprecated in the Clang
  10. // documentation, linked below. E.g. we use EXCLUSIVE_LOCKS_REQUIRED where the
  11. // Clang docs use REQUIRES.
  12. //
  13. // http://clang.llvm.org/docs/ThreadSafetyAnalysis.html
  14. //
  15. // We use the deprecated Clang annotations to match Abseil (relevant header
  16. // linked below) and its ecosystem of libraries. We will follow Abseil with
  17. // respect to upgrading to more modern annotations.
  18. //
  19. // https://github.com/abseil/abseil-cpp/blob/master/absl/base/thread_annotations.h
  20. //
  21. // These annotations are implemented using compiler attributes. Using the macros
  22. // defined here instead of raw attributes allow for portability and future
  23. // compatibility.
  24. //
  25. // When referring to mutexes in the arguments of the attributes, you should
  26. // use variable names or more complex expressions (e.g. my_object->mutex_)
  27. // that evaluate to a concrete mutex object whenever possible. If the mutex
  28. // you want to refer to is not in scope, you may use a member pointer
  29. // (e.g. &MyClass::mutex_) to refer to a mutex in some (unknown) object.
  30. #ifndef BASE_THREAD_ANNOTATIONS_H_
  31. #define BASE_THREAD_ANNOTATIONS_H_
  32. #include "base/check_op.h"
  33. #include "build/build_config.h"
  34. #if defined(__clang__)
  35. #define THREAD_ANNOTATION_ATTRIBUTE__(x) __attribute__((x))
  36. #else
  37. #define THREAD_ANNOTATION_ATTRIBUTE__(x) // no-op
  38. #endif
  39. // GUARDED_BY()
  40. //
  41. // Documents if a shared field or global variable needs to be protected by a
  42. // mutex. GUARDED_BY() allows the user to specify a particular mutex that
  43. // should be held when accessing the annotated variable.
  44. //
  45. // Example:
  46. //
  47. // Mutex mu;
  48. // int p1 GUARDED_BY(mu);
  49. #define GUARDED_BY(x) THREAD_ANNOTATION_ATTRIBUTE__(guarded_by(x))
  50. // PT_GUARDED_BY()
  51. //
  52. // Documents if the memory location pointed to by a pointer should be guarded
  53. // by a mutex when dereferencing the pointer.
  54. //
  55. // Example:
  56. // Mutex mu;
  57. // int *p1 PT_GUARDED_BY(mu);
  58. //
  59. // Note that a pointer variable to a shared memory location could itself be a
  60. // shared variable.
  61. //
  62. // Example:
  63. //
  64. // // `q`, guarded by `mu1`, points to a shared memory location that is
  65. // // guarded by `mu2`:
  66. // int *q GUARDED_BY(mu1) PT_GUARDED_BY(mu2);
  67. #define PT_GUARDED_BY(x) THREAD_ANNOTATION_ATTRIBUTE__(pt_guarded_by(x))
  68. // ACQUIRED_AFTER() / ACQUIRED_BEFORE()
  69. //
  70. // Documents the acquisition order between locks that can be held
  71. // simultaneously by a thread. For any two locks that need to be annotated
  72. // to establish an acquisition order, only one of them needs the annotation.
  73. // (i.e. You don't have to annotate both locks with both ACQUIRED_AFTER
  74. // and ACQUIRED_BEFORE.)
  75. //
  76. // Example:
  77. //
  78. // Mutex m1;
  79. // Mutex m2 ACQUIRED_AFTER(m1);
  80. #define ACQUIRED_AFTER(...) \
  81. THREAD_ANNOTATION_ATTRIBUTE__(acquired_after(__VA_ARGS__))
  82. #define ACQUIRED_BEFORE(...) \
  83. THREAD_ANNOTATION_ATTRIBUTE__(acquired_before(__VA_ARGS__))
  84. // EXCLUSIVE_LOCKS_REQUIRED() / SHARED_LOCKS_REQUIRED()
  85. //
  86. // Documents a function that expects a mutex to be held prior to entry.
  87. // The mutex is expected to be held both on entry to, and exit from, the
  88. // function.
  89. //
  90. // Example:
  91. //
  92. // Mutex mu1, mu2;
  93. // int a GUARDED_BY(mu1);
  94. // int b GUARDED_BY(mu2);
  95. //
  96. // void foo() EXCLUSIVE_LOCKS_REQUIRED(mu1, mu2) { ... };
  97. #define EXCLUSIVE_LOCKS_REQUIRED(...) \
  98. THREAD_ANNOTATION_ATTRIBUTE__(exclusive_locks_required(__VA_ARGS__))
  99. #define SHARED_LOCKS_REQUIRED(...) \
  100. THREAD_ANNOTATION_ATTRIBUTE__(shared_locks_required(__VA_ARGS__))
  101. // LOCKS_EXCLUDED()
  102. //
  103. // Documents the locks acquired in the body of the function. These locks
  104. // cannot be held when calling this function (as Abseil's `Mutex` locks are
  105. // non-reentrant).
  106. #define LOCKS_EXCLUDED(...) \
  107. THREAD_ANNOTATION_ATTRIBUTE__(locks_excluded(__VA_ARGS__))
  108. // LOCK_RETURNED()
  109. //
  110. // Documents a function that returns a mutex without acquiring it. For example,
  111. // a public getter method that returns a pointer to a private mutex should
  112. // be annotated with LOCK_RETURNED.
  113. #define LOCK_RETURNED(x) THREAD_ANNOTATION_ATTRIBUTE__(lock_returned(x))
  114. // LOCKABLE
  115. //
  116. // Documents if a class/type is a lockable type (such as the `Mutex` class).
  117. #define LOCKABLE THREAD_ANNOTATION_ATTRIBUTE__(lockable)
  118. // SCOPED_LOCKABLE
  119. //
  120. // Documents if a class does RAII locking (such as the `MutexLock` class).
  121. // The constructor should use `LOCK_FUNCTION()` to specify the mutex that is
  122. // acquired, and the destructor should use `UNLOCK_FUNCTION()` with no
  123. // arguments; the analysis will assume that the destructor unlocks whatever the
  124. // constructor locked.
  125. #define SCOPED_LOCKABLE THREAD_ANNOTATION_ATTRIBUTE__(scoped_lockable)
  126. // EXCLUSIVE_LOCK_FUNCTION()
  127. //
  128. // Documents functions that acquire a lock in the body of a function, and do
  129. // not release it.
  130. #define EXCLUSIVE_LOCK_FUNCTION(...) \
  131. THREAD_ANNOTATION_ATTRIBUTE__(exclusive_lock_function(__VA_ARGS__))
  132. // SHARED_LOCK_FUNCTION()
  133. //
  134. // Documents functions that acquire a shared (reader) lock in the body of a
  135. // function, and do not release it.
  136. #define SHARED_LOCK_FUNCTION(...) \
  137. THREAD_ANNOTATION_ATTRIBUTE__(shared_lock_function(__VA_ARGS__))
  138. // UNLOCK_FUNCTION()
  139. //
  140. // Documents functions that expect a lock to be held on entry to the function,
  141. // and release it in the body of the function.
  142. #define UNLOCK_FUNCTION(...) \
  143. THREAD_ANNOTATION_ATTRIBUTE__(unlock_function(__VA_ARGS__))
  144. // EXCLUSIVE_TRYLOCK_FUNCTION() / SHARED_TRYLOCK_FUNCTION()
  145. //
  146. // Documents functions that try to acquire a lock, and return success or failure
  147. // (or a non-boolean value that can be interpreted as a boolean).
  148. // The first argument should be `true` for functions that return `true` on
  149. // success, or `false` for functions that return `false` on success. The second
  150. // argument specifies the mutex that is locked on success. If unspecified, this
  151. // mutex is assumed to be `this`.
  152. #define EXCLUSIVE_TRYLOCK_FUNCTION(...) \
  153. THREAD_ANNOTATION_ATTRIBUTE__(exclusive_trylock_function(__VA_ARGS__))
  154. #define SHARED_TRYLOCK_FUNCTION(...) \
  155. THREAD_ANNOTATION_ATTRIBUTE__(shared_trylock_function(__VA_ARGS__))
  156. // ASSERT_EXCLUSIVE_LOCK() / ASSERT_SHARED_LOCK()
  157. //
  158. // Documents functions that dynamically check to see if a lock is held, and fail
  159. // if it is not held.
  160. #define ASSERT_EXCLUSIVE_LOCK(...) \
  161. THREAD_ANNOTATION_ATTRIBUTE__(assert_exclusive_lock(__VA_ARGS__))
  162. #define ASSERT_SHARED_LOCK(...) \
  163. THREAD_ANNOTATION_ATTRIBUTE__(assert_shared_lock(__VA_ARGS__))
  164. // NO_THREAD_SAFETY_ANALYSIS
  165. //
  166. // Turns off thread safety checking within the body of a particular function.
  167. // This annotation is used to mark functions that are known to be correct, but
  168. // the locking behavior is more complicated than the analyzer can handle.
  169. #define NO_THREAD_SAFETY_ANALYSIS \
  170. THREAD_ANNOTATION_ATTRIBUTE__(no_thread_safety_analysis)
  171. //------------------------------------------------------------------------------
  172. // Tool-Supplied Annotations
  173. //------------------------------------------------------------------------------
  174. // TS_UNCHECKED should be placed around lock expressions that are not valid
  175. // C++ syntax, but which are present for documentation purposes. These
  176. // annotations will be ignored by the analysis.
  177. #define TS_UNCHECKED(x) ""
  178. // TS_FIXME is used to mark lock expressions that are not valid C++ syntax.
  179. // It is used by automated tools to mark and disable invalid expressions.
  180. // The annotation should either be fixed, or changed to TS_UNCHECKED.
  181. #define TS_FIXME(x) ""
  182. // Like NO_THREAD_SAFETY_ANALYSIS, this turns off checking within the body of
  183. // a particular function. However, this attribute is used to mark functions
  184. // that are incorrect and need to be fixed. It is used by automated tools to
  185. // avoid breaking the build when the analysis is updated.
  186. // Code owners are expected to eventually fix the routine.
  187. #define NO_THREAD_SAFETY_ANALYSIS_FIXME NO_THREAD_SAFETY_ANALYSIS
  188. // Similar to NO_THREAD_SAFETY_ANALYSIS_FIXME, this macro marks a GUARDED_BY
  189. // annotation that needs to be fixed, because it is producing thread safety
  190. // warning. It disables the GUARDED_BY.
  191. #define GUARDED_BY_FIXME(x)
  192. // Disables warnings for a single read operation. This can be used to avoid
  193. // warnings when it is known that the read is not actually involved in a race,
  194. // but the compiler cannot confirm that.
  195. #define TS_UNCHECKED_READ(x) thread_safety_analysis::ts_unchecked_read(x)
  196. namespace thread_safety_analysis {
  197. // Takes a reference to a guarded data member, and returns an unguarded
  198. // reference.
  199. template <typename T>
  200. inline const T& ts_unchecked_read(const T& v) NO_THREAD_SAFETY_ANALYSIS {
  201. return v;
  202. }
  203. template <typename T>
  204. inline T& ts_unchecked_read(T& v) NO_THREAD_SAFETY_ANALYSIS {
  205. return v;
  206. }
  207. } // namespace thread_safety_analysis
  208. // The above is imported as-is from abseil-cpp. The following Chromium-specific
  209. // synonyms are added for Chromium concepts (SequenceChecker/ThreadChecker).
  210. #if DCHECK_IS_ON()
  211. // Equivalent to GUARDED_BY for SequenceChecker/ThreadChecker. Currently,
  212. // clang's error message "requires holding mutex" is misleading. Usage of this
  213. // macro is discouraged until the message is updated.
  214. // TODO(etiennep): Update comment above once clang's error message is updated.
  215. #define GUARDED_BY_CONTEXT(name) GUARDED_BY(name)
  216. // Equivalent to EXCLUSIVE_LOCKS_REQUIRED for SequenceChecker/ThreadChecker.
  217. // Currently, clang's error message "requires holding mutex" is misleading.
  218. // Usage of this macro is discouraged until the message is updated.
  219. // TODO(etiennep): Update comment above once clang's error message is updated.
  220. #define VALID_CONTEXT_REQUIRED(name) EXCLUSIVE_LOCKS_REQUIRED(name)
  221. #else // DCHECK_IS_ON()
  222. #define GUARDED_BY_CONTEXT(name)
  223. #define VALID_CONTEXT_REQUIRED(name)
  224. #endif // DCHECK_IS_ON()
  225. #endif // BASE_THREAD_ANNOTATIONS_H_