这段代码中的竞态条件是什么？

Question

以下是我执行的SleepConditionVariableCS，WakeAllConditionVariable和线程创建函数。问题是，有时当我尝试创建线程时，创建线程卡在WaitForSingleObject(cv->mut, INFINITE);的SleepConditionVariableCS中。我无法弄清楚这里的竞赛状况。

typedef struct 
{ 
    int waiters_count; 
    HANDLE sema_; 
    HANDLE mut; 
} CONDITION_VARIABLE; 

void SleepConditionVariableCS(CONDITION_VARIABLE *cv, CRITICAL_SECTION *cs, int32_t dwMilliseconds){ 
    WaitForSingleObject(cv->mut, INFINITE); //Acuire object lock 

    cv->waiters_count++; 
    LeaveCriticalSection (cs); 
    if (SignalObjectAndWait(cv->mut, cv->sema_, dwMilliseconds, FALSE) == WAIT_TIMEOUT){ //SignalObjectAndWait releases the lock 
     cv->waiters_count--; 
    } 
    EnterCriticalSection(cs); 
} 

void WakeAllConditionVariable(CONDITION_VARIABLE *cv){ 
    WaitForSingleObject(cv->mut, INFINITE); 

    while (cv->waiters_count > 0){ 
     cv->waiters_count = cv->waiters_count - 1; 
     ReleaseSemaphore (cv->sema_, 1, 0); 
    } 
    ReleaseMutex(cv->mut); 
} 

void KernelThread_CreationWait(void *kthread){ 
    KernelThread *thread = (KernelThread *) kthread; 

    EnterCriticalSection(thread->lock); 
    thread->state = Thread_CREATED; 

    WakeAllConditionVariable(thread->condition_variable); 

    LeaveCriticalSection(thread->lock); 
    KernelThread_main(kthread); 
} 

KernelThread* createKernelThread(){ 
    EventHandler_getHandler(); 

    unsigned long threadid; 
    int t; 
    void *hand; 

    KernelThread *thread = KernelThread_malloc(); 
    EnterCriticalSection(thread->lock); 
    thread->state = Thread_WAITINGFORCREATION; 
    hand = CreateThread(NULL, 
      0, // security, stack size 
      (LPTHREAD_START_ROUTINE)&KernelThread_CreationWait, // start 
      (void *)thread, 
      0, 
      &threadid); // param, creation flags, id 
    if (hand == NULL){ 
     printf("ERROR: return handle from CreateThread() is NULL\n"); 
     exit(-1); 
    } 
    thread->thread = hand; 
    thread->thread_id = threadid; 

    SleepConditionVariableCS(thread->condition_variable,thread->lock,INFINITE); 
    LeaveCriticalSection(thread->lock); 

    return thread; 
} 

void InitializeConditionVariable (CONDITION_VARIABLE *cv){ 
    cv->waiters_count = 0; 
    cv->sema_ = CreateSemaphore (NULL,  // no security 
           0,   // initially 0 
           0x7fffffff, // max count 
           NULL);  // unnamed 
    cv->mut = CreateMutex(
      NULL,    // default security attributes 
      FALSE,    // initially not owned 
      NULL);    // unnamed mutex 
} 

Answer 1

在尝试使用win32 apis实现pthread样式条件变量时，请查看以下详细分析。 http://www.cs.wustl.edu/~schmidt/win32-cv-1.html。 （尤其是第3.4节）。

在你的代码中，我目前只看到一个问题。在SleepConditionVariableCS()：

LeaveCriticalSection (cs); 
    if (SignalObjectAndWait(cv->mut, cv->sema_, dwMilliseconds, FALSE) == WAIT_TIMEOUT){ //SignalObjectAndWait releases the lock 
     // RIGHT HERE YOU HAVE NOT ACQUIRED cv->mut 
     cv->waiters_count--; // SO THIS IS A DATA RACE (with the cv->waiters_count uses in WakeAllConditionVariable() 
    } 

在

Answer 2

我没有看到真正突出的逻辑缺陷。

但是......

你初始化CONDITION_VARIABLE到已知状态使用它之前？

你不检查几个系统调用的返回值，这可能会返回一个你永远不会看到的错误。 WaitForSingleObject和EnterCriticalSection可以失败或被给予错误的句柄。

你是否总是锁定thread->lock并在处理条件变量时保持锁定状态？我看到2个不同的代码片段，并参考了thread->lock。

您是否每次都以相同的顺序锁定/解锁临界区域和区域？