LOCKSMITH: Practical Static Race Detection for C

LOCKSMITH is a static analysis tool for automatically detecting data races in C programs. In this article, we describe each of LOCKSMITH's component analyses precisely, and present systematic measurements that isolate interesting trade-offs between precision and efficiency in each analysis. Using a benchmark suite comprising stand-alone applications and Linux device drivers totaling more than 200,000 lines of code, we found that a simple no-worklist strategy yielded the most efficient interprocedural dataflow analysis; that our sharing analysis was able to determine that most locations are thread-local, and therefore need not be protected by locks; that modeling C structs and void pointers precisely is key to both precision and efficiency; and that context sensitivity yields a much more precise analysis, though with decreased scalability. Put together, our results illuminate some of the key engineering challenges in building LOCKSMITH and data race detection analyses in particular, and constraint-based program analyses in general.