Understanding Swift’s value type thread safety - 代码分析（二）

示范代码

`

func testScenarioA2() throws {
    var store: Int = 100
    DispatchQueue.concurrentPerform(iterations: 1_000_000) { _ in
        store.negate()
        _ = store
    }
}

`

开启线程race诊断后，出现以下错误

Swift access race in closure #1 (Swift.Int) -> () in UnderstandStruct.testScenarioA2() throws -> ()

查看汇编

`

0x100002a30 <+0>: pushq %rbp

0x100002a31 <+1>: movq %rsp, %rbp

0x100002a34 <+4>: subq $0x20, %rsp

0x100002a38 <+8>: movq 0x8(%rbp), %rdi

0x100002a3c <+12>: movq %rsi, -0x10(%rbp)

0x100002a40 <+16>: callq 0x100003bac ; symbol stub for: __tsan_func_entry

0x100002a45 <+21>: xorl %esi, %esi

0x100002a47 <+23>: leaq -0x8(%rbp), %rax

0x100002a4b <+27>: movq %rax, %rdi

0x100002a4e <+30>: movl $0x8, %edx

0x100002a53 <+35>: callq 0x100003c06 ; symbol stub for: memset

0x100002a58 <+40>: xorl %ecx, %ecx

0x100002a5a <+42>: movl %ecx, %esi

0x100002a5c <+44>: movq -0x10(%rbp), %rdx

0x100002a60 <+48>: movq %rdx, -0x8(%rbp)

-> 0x100002a64 <+52>: movq %rdx, %rdi

0x100002a67 <+55>: movl $0x1, %edx

0x100002a6c <+60>: movq %rax, -0x18(%rbp)

0x100002a70 <+64>: callq 0x100003ba6 ; symbol stub for: __tsan_external_write

0x100002a75 <+69>: movq -0x10(%rbp), %rax

0x100002a79 <+73>: movq %rax, %rdi

0x100002a7c <+76>: callq 0x100003bbe ; symbol stub for: __tsan_read8

0x100002a81 <+81>: xorl %ecx, %ecx

0x100002a83 <+83>: movl %ecx, %eax

0x100002a85 <+85>: movq -0x10(%rbp), %rdx

0x100002a89 <+89>: subq (%rdx), %rax

0x100002a8c <+92>: seto %r8b

0x100002a90 <+96>: testb $0x1, %r8b

0x100002a94 <+100>: movq %rax, -0x20(%rbp)

0x100002a98 <+104>: jne 0x100002ac1 ; <+145> [inlined] Swift runtime failure: arithmetic overflow at main.swift:13

0x100002a9a <+106>: movq -0x10(%rbp), %rdi

0x100002a9e <+110>: callq 0x100003bc4 ; symbol stub for: __tsan_write8

0x100002aa3 <+115>: movq -0x10(%rbp), %rax

0x100002aa7 <+119>: movq -0x20(%rbp), %rcx

0x100002aab <+123>: movq %rcx, (%rax)

0x100002aae <+126>: movq %rax, %rdi

0x100002ab1 <+129>: callq 0x100003bbe ; symbol stub for: __tsan_read8

0x100002ab6 <+134>: callq 0x100003bb2 ; symbol stub for: __tsan_func_exit

0x100002abb <+139>: addq $0x20, %rsp

0x100002abf <+143>: popq %rbp

0x100002ac0 <+144>: retq

0x100002ac1 <+145>: ud2

0x100002ac3 <+147>: nopw %cs:(%rax,%rax)

0x100002acd <+157>: nopl (%rax)

`

0x100002aab <+123>: movq %rcx, (%rax)

rax是store的地址，直接将计算结果赋给指向的地址。

结论

• 对于堆中的变量 store，系统会自动生成 begin_access 和 end_access插桩的检测竞争代码，该代码不影响实际逻辑的执行
• 对于store的值的改变，不同线程中都是一条mov指令，所以这里存在的线程竞争不会导致crash

参考

`

bb0(%0 : $Int, %1 : $Int):

debug_value %0 : $Int // id: %2

debug_value_addr %1 : $Int, var, name "store", argno 2 // id: %3

%4 = begin_access [modify] [unknown] %1 : $Int // users: %7, %6

// function_ref SignedNumeric.negate()

%5 = function_ref @$ss13SignedNumericPsE6negateyyF : $@convention(method) <τ_0_0 where τ_0_0 : SignedNumeric> (@inout τ_0_0) -> () // user: %6

%6 = apply %5(%4) : $@convention(method) <τ_0_0 where τ_0_0 : SignedNumeric> (@inout τ_0_0) -> ()

end_access %4 : $Int // id: %7

%8 = begin_access [read] [unknown] %1 : $Int // users: %10, %9

%9 = load [trivial] %8 : $Int

end_access %8 : $*Int // id: %10

%11 = tuple () // user: %12

return %11 : $() // id: %12

}

`