Detecting And Replaying Data Races In Android Applications

With the development of broadband wireless access and mobile terminal technique,smart phones with Android,IoS or WindowPhone system grow rapidly.Among these mobile systems,Android system holds a dominant role in the world market due to its open source.In addition,Android system offers timely response to user interactions and well-accepted performance due to its event-driven model and multi-thread model.However,most events occur unpredictably,which may lead to concurrency bugs(data races,deadlocks and atomic violations)and may cause system crash or serious damages.It is hard to detect and identify concurrency bugs due to the non-determinism of the schedules of the concurrency programs.In this paper,we focus on data races.A data race occurs when two statements access one shared variable(at least one operation is WRITE)in different threads and there is no extra synchronization.Existing techniques,such as CAFA,DroidRacer and EVENTRACER,detect data races with two steps.Firstly,they obtain executing trace by instrumenting and dynamically executing apps with Android Monkey tool.Secondly,they construct Happens-Before(HB)graphs based on the HB rules of Android system and check if two statements accessing the same thread shared variable has HB relations in HB graphs.These tools identity the semantic and HB rules for Android system.However,there are still more problems needing to further explore.Firstly,existing techniques identify data races based on dynamic analysis approach,executing trace obtained by several dynamic executing can only cover a small part of the whole codes,so they suffer from low coverage.Secondly,existing techniques cannot automaticly distinguish whether a data race in Android apps is benign or harmful.Thirdly,existing techniques cannot replay data races in Android apps.Therefore,we combine static analysis and dynamic analysis,implement DRHDR(Detecting and Replaying Harmful Data Races in Android Application),a tool not only detects data race,but also replays data race to present harmful behaviors.The outline of this paper is listed as follows.(1)Data race detecting.Data race detecting has two steps:static analysis and constraint solver.In first step,we parse APK(Android Package)with SOOT to extract relevant threads and thread sharing variables information.Then we do Android Thread Sharing Analysis(ATSA)to generate minimal realistic threading sharing variables set.Furthermore,based on threading sharing variables and its'read and write context,we generate doubtful data race set according to the first condition of data race definition.In second step,we encode statements based on HB rules of Android system.We can generate constraint files for each doubtful data race and then put these constraint files into Z3 solver to check if there is a feasible solution.Therefore,static analysis approach improves coverage by parsing all source code for Android application and constraint solver covers all threads and event schedules.(2)Data race replaying.Data race replaying include LCCG(Listener Callback Control-Flow Graph)constructor,testing script generator,recording and replaying data races.LCCG extends the tradition control-flow graph and presents the relationships of events and callback methods.For each doubtful data race,we can find a path in LCCG and then generate testing script based on relevant context.Finally,we record and replay harmful data races with the help of tool Reran.We tested DRHDR on 15 popular Android apps.In data race detecting,DRHDR reports 340 data races on average,including 4%harmful data races(15/340)and the False Positive is 13%.In data race replaying phase,DRHDR replays 5 data races on average(33%= 5/15).For existing techniques,such as EVENTRACER,it covers thread schedules with single dynamic executing trace and covers event schedules with 300 random input events generating by AndroidMonkey.In coverage,DRHDR parses the whole app and covers the whole thread schedules and event schedules with constraint solver.In conparison,DRHDR detects 15 harmful data races and replays 5 data races on average,while EVENTRACER only detects 2 harmful data races on average and has no replay function.