[Bug]: Data-race due to ME violation between ConcurrentQueue::PushAndCalConcurrency & ConcurrentQueue::GetHeadTask

### 发生了什么问题？

`PushAndCalConcurrency` is supposed to be called inside the CS of `mutex_`.

`ConcurrentQueue::WaitAll()` calls `PushAndCalConcurrency` in a loop.  `PushAndCalConcurrency` in some path unlocks and the PushAndCalConcurrency that is called in the next iteration is called without lock protection.

### 期望行为是什么？

Ensure `PushAndCalConcurrency` is always called in the CS.

### 如何复现该缺陷

```
cmake -S. -Bbuild -DFFRT_TEST_ENABLE=ON -DFFRT_SANITIZE=thread
cmake --build build -j 
test  --test-dir build/test -R QueueTest.submit_task_while_concurrency_queue_waiting_all_test
```

### 其他补充信息

```
[ RUN      ] QueueTest.submit_task_while_concurrency_queue_waiting_all_test
==================
WARNING: ThreadSanitizer: data race (pid=199666)
  Write of size 8 at 0x7b54000006c8 by thread T7 (mutexes: write M0):
    #0 std::_Rb_tree_iterator<std::pair<unsigned long const, ffrt::QueueTask*> > std::_Rb_tree<unsigned long, std::pair<unsigned long const, ffrt::QueueTask*>, std::_Select1st<std::pair<unsigned long const, ffrt::QueueTask*> >, std::less<unsigned long>, std::allocator<std::pair<unsigned long const, ffrt::QueueTask*> > >::_M_insert_<std::pair<unsigned long const, ffrt::QueueTask*>, std::_Rb_tree<unsigned long, std::pair<unsigned long const, ffrt::QueueTask*>, std::_Select1st<std::pair<unsigned long const, ffrt::QueueTask*> >, std::less<unsigned long>, std::allocator<std::pair<unsigned long const, ffrt::QueueTask*> > >::_Alloc_node>(std::_Rb_tree_node_base*, std::_Rb_tree_node_base*, std::pair<unsigned long const, ffrt::QueueTask*>&&, std::_Rb_tree<unsigned long, std::pair<unsigned long const, ffrt::QueueTask*>, std::_Select1st<std::pair<unsigned long const, ffrt::QueueTask*> >, std::less<unsigned long>, std::allocator<std::pair<unsigned long const, ffrt::QueueTask*> > >::_Alloc_node&) /usr/include/c++/13/bits/stl_tree.h:1835 (libffrt.so+0x344f52) (BuildId: 68555905fd2b3a74a5f801605d442b01af840435)
    #1 std::_Rb_tree_iterator<std::pair<unsigned long const, ffrt::QueueTask*> > std::_Rb_tree<unsigned long, std::pair<unsigned long const, ffrt::QueueTask*>, std::_Select1st<std::pair<unsigned long const, ffrt::QueueTask*> >, std::less<unsigned long>, std::allocator<std::pair<unsigned long const, ffrt::QueueTask*> > >::_M_insert_equal<std::pair<unsigned long const, ffrt::QueueTask*> >(std::pair<unsigned long const, ffrt::QueueTask*>&&) /usr/include/c++/13/bits/stl_tree.h:2200 (libffrt.so+0x344155) (BuildId: 68555905fd2b3a74a5f801605d442b01af840435)
    #2 std::multimap<unsigned long, ffrt::QueueTask*, std::less<unsigned long>, std::allocator<std::pair<unsigned long const, ffrt::QueueTask*> > >::insert(std::pair<unsigned long const, ffrt::QueueTask*>&&) /usr/include/c++/13/bits/stl_multimap.h:553 (libffrt.so+0x34370b) (BuildId: 68555905fd2b3a74a5f801605d442b01af840435)
    #3 ffrt::ConcurrentQueue::PushAndCalConcurrency(ffrt::QueueTask*, ffrt_queue_priority_t, std::unique_lock<ffrt::mutex>&) /home/lilith/workspace/FFRT/resourceschedule_ffrt/src/queue/concurrent_queue.cpp:251 (libffrt.so+0x340a02) (BuildId: 68555905fd2b3a74a5f801605d442b01af840435)
    #4 ffrt::ConcurrentQueue::WaitAll() /home/lilith/workspace/FFRT/resourceschedule_ffrt/src/queue/concurrent_queue.cpp:200 (libffrt.so+0x34043f) (BuildId: 68555905fd2b3a74a5f801605d442b01af840435)
    #5 ffrt::QueueHandler::WaitAll() <null> (libffrt.so+0x35472f) (BuildId: 68555905fd2b3a74a5f801605d442b01af840435)
    #6 ffrt_concurrent_queue_wait_all /home/lilith/workspace/FFRT/resourceschedule_ffrt/src/queue/queue_api.cpp:344 (libffrt.so+0x353ac3) (BuildId: 68555905fd2b3a74a5f801605d442b01af840435)
    #7 operator() /home/lilith/workspace/FFRT/resourceschedule_ffrt/test/ut/testcase/ut_queue.cpp:1505 (ffrt_ut+0x21891e) (BuildId: ae174d78de96fa8b594dae0bf6af020f7cbe3b8f)
    #8 __invoke_impl<void, QueueTest_submit_task_while_concurrency_queue_waiting_all_test_Test::TestBody()::<lambda()> > /usr/include/c++/13/bits/invoke.h:61 (ffrt_ut+0x23823e) (BuildId: ae174d78de96fa8b594dae0bf6af020f7cbe3b8f)
    #9 __invoke<QueueTest_submit_task_while_concurrency_queue_waiting_all_test_Test::TestBody()::<lambda()> > /usr/include/c++/13/bits/invoke.h:96 (ffrt_ut+0x2380a3) (BuildId: ae174d78de96fa8b594dae0bf6af020f7cbe3b8f)
    #10 _M_invoke<0> /usr/include/c++/13/bits/std_thread.h:292 (ffrt_ut+0x237ec6) (BuildId: ae174d78de96fa8b594dae0bf6af020f7cbe3b8f)
    #11 operator() /usr/include/c++/13/bits/std_thread.h:299 (ffrt_ut+0x237db8) (BuildId: ae174d78de96fa8b594dae0bf6af020f7cbe3b8f)
    #12 _M_run /usr/include/c++/13/bits/std_thread.h:244 (ffrt_ut+0x237cda) (BuildId: ae174d78de96fa8b594dae0bf6af020f7cbe3b8f)
    #13 <null> <null> (libstdc++.so.6+0xe62b2) (BuildId: 2db998bd67acbfb235c464c0275d4070061695fb)

Previous read of size 8 at 0x7b54000006c8 by thread T6:
    #0 std::_Rb_tree<unsigned long, std::pair<unsigned long const, ffrt::QueueTask*>, std::_Select1st<std::pair<unsigned long const, ffrt::QueueTask*> >, std::less<unsigned long>, std::allocator<std::pair<unsigned long const, ffrt::QueueTask*> > >::empty() const /usr/include/c++/13/bits/stl_tree.h:1030 (libffrt.so+0x2fbfec) (BuildId: 68555905fd2b3a74a5f801605d442b01af840435)
    #1 std::multimap<unsigned long, ffrt::QueueTask*, std::less<unsigned long>, std::allocator<std::pair<unsigned long const, ffrt::QueueTask*> > >::empty() const /usr/include/c++/13/bits/stl_multimap.h:465 (libffrt.so+0x2fa716) (BuildId: 68555905fd2b3a74a5f801605d442b01af840435)
    #2 WhenMapVecEmpty /home/lilith/workspace/FFRT/resourceschedule_ffrt/src/queue/concurrent_queue.cpp:41 (libffrt.so+0x33f08e) (BuildId: 68555905fd2b3a74a5f801605d442b01af840435)
    #3 ffrt::ConcurrentQueue::GetHeadTask() /home/lilith/workspace/FFRT/resourceschedule_ffrt/src/queue/concurrent_queue.cpp:292 (libffrt.so+0x340ed6) (BuildId: 68555905fd2b3a74a5f801605d442b01af840435)
    #4 ffrt::QueueHandler::Deliver() /home/lilith/workspace/FFRT/resourceschedule_ffrt/src/queue/queue_handler.cpp:361 (libffrt.so+0x357612) (BuildId: 68555905fd2b3a74a5f801605d442b01af840435)
    #5 ffrt::QueueHandler::Dispatch(ffrt::QueueTask*) /home/lilith/workspace/FFRT/resourceschedule_ffrt/src/queue/queue_handler.cpp:348 (libffrt.so+0x3574bf) (BuildId: 68555905fd2b3a74a5f801605d442b01af840435)
    #6 ffrt::QueueTask::Execute() /home/lilith/workspace/FFRT/resourceschedule_ffrt/src/tm/queue_task.cpp:135 (libffrt.so+0x3c5800) (BuildId: 68555905fd2b3a74a5f801605d442b01af840435)
    #7 ffrt::ExecuteTask(ffrt::TaskBase*) /home/lilith/workspace/FFRT/resourceschedule_ffrt/src/tm/task_base.cpp:56 (libffrt.so+0x3c73ff) (BuildId: 68555905fd2b3a74a5f801605d442b01af840435)
    #8 ffrt::CPUWorker::RunTask(ffrt::TaskBase*, ffrt::CPUWorker*) /home/lilith/workspace/FFRT/resourceschedule_ffrt/src/eu/cpu_worker.cpp:123 (libffrt.so+0x2a9493) (BuildId: 68555905fd2b3a74a5f801605d442b01af840435)
    #9 ffrt::CPUWorker::WorkerLooper(ffrt::CPUWorker*) /home/lilith/workspace/FFRT/resourceschedule_ffrt/src/eu/cpu_worker.cpp:189 (libffrt.so+0x2a992e) (BuildId: 68555905fd2b3a74a5f801605d442b01af840435)
    #10 ffrt::CPUWorker::Dispatch(ffrt::CPUWorker*) /home/lilith/workspace/FFRT/resourceschedule_ffrt/src/eu/cpu_worker.cpp:158 (libffrt.so+0x2a96bf) (BuildId: 68555905fd2b3a74a5f801605d442b01af840435)
    #11 ffrt::CPUWorker::WrapDispatch(void*) /home/lilith/workspace/FFRT/resourceschedule_ffrt/src/eu/cpu_worker.cpp:97 (libffrt.so+0x2a932c) (BuildId: 68555905fd2b3a74a5f801605d442b01af840435)
```

### 版本或分支信息

- [x] master
- [ ] 5.1-Release
- [ ] 5.0-Release
- [ ] 5.0-Beta1
- [ ] Release 4.1
- [ ] Release 4.0
- [ ] Release 3.2

OpenHarmony / resourceschedule_ffrt
关闭

内容风险标识

评论 (1)

OpenHarmony / resourceschedule_ffrt关闭 .gitee-modal { width: 500px !important; }

内容风险标识