C ++：信号/插槽库中的线程安全

Question

I'm implementing a Signal/Slot framework, and got to the point that I want it to be thread-safe. I already had a lot of support from the Boost mailing-list, but since this is not really boost-related, I'll ask my pending question here.

When is a signal/slot implementation (or any framework that calls functions outside itself, specified in some way by the user) considered thread-safe? Should it be safe wrt its own data, ie the data associated to its implementation details? Or should it also take into account the user's data, which might or might not be modified whatever functions are passed to the framework?

This is an example given on the mailing-list ( Edit: this is an example use-case --ie user code--. My code is behind the calls to the Emitter object ):

int * somePtr = nullptr;
Emitter<Event> em; // just an object that can emit the 'Event' signal    

void mainThread()
{
    em.connect<Event>(someFunction);

    // now, somehow, 2 threads are created which, at some point
    // execute the thread1() and thread2() functions below
}

void someFunction()
{
    // can somePtr change after the check but before the set?
    if (somePtr)
        *somePtr = 17;
}

void cleanupPtr()
{
    // this looks safe, but compilers and CPUs can reorder this code:
    int *tmp = somePtr;
    somePtr = null;
    delete tmp;
}

void thread1()
{
    em.emit<Event>();
}

void thread2()
{
    em.disconnect<Event>(someFunction);
    // now safe to cleanup (?)
    cleanupPtr();
}

In the above code, it might happen that Event is emitted, causing someFunction to be executed. If somePtr is non- null , but becomes null just after the if , but before the assignment, we're in trouble. From the point of view of thread2 , this is not obvious because it is disconnecting someFunction before calling cleanupPtr .

I can see why this could potentially lead to trouble, but who's responsibility is this? Should my library protect the user from using it in every irresponsible but imaginable way?

Answer 1

The last question is easy. If you say your library is threadsafe, it should threadsafe. It makes no sense to say it is partly threadsafe or, it is only threadsafe if you do not abuse it. In that case you have to explain what exactly is not threadsafe.

Now to your first question regarded someFunction : The operation is non atomic. Which means the CPU can interrupt between the if and the assigment . And that will happen, I know that :-) The other thread can erase the pointer anytime. Even between two short and fast looking statements.

Now to cleanupPtr : I am not a compiler expert, but if you want to be shure that your assigment take place in the same moment you wrote it in code you should write the keyword volatile in front of the declaration of somePtr . The compiler will now know that you use that attribute in a multithreaded situation and will not buffer the value in a register of the CPU.

If you have a thread situation with a reader thread and a writer thread, the keyword volatile can (IMHO) be enough to sync them. As long as the attributes you use to exchange information between threads are generic. For other situations you can use mutex or atomics. I will give you an example for mutex. I use C++11 for that, but it works similar with previous versions of C++ using boost.

Using mutex:

int * somePtr = nullptr;
Emitter<Event> em; // just an object that can emit the 'Event' signal    
std::recursive_mutex g_mutex;

void mainThread()
{
    em.connect<Event>(someFunction);

    // now, somehow, 2 threads are created which, at some point
    // execute the thread1() and thread2() functions below
}

void someFunction()
{
    std::lock_guard<std::recursive_mutex> lock(g_mutex);
    // can somePtr change after the check but before the set?
    if (somePtr)
        *somePtr = 17;
}

void cleanupPtr()
{
    std::lock_guard<std::recursive_mutex> lock(g_mutex);
    // this looks safe, but compilers and CPUs can reorder this code:
    int *tmp = somePtr;
    somePtr = null;
    delete tmp;
}

void thread1()
{
    em.emit<Event>();
}

void thread2()
{
    em.disconnect<Event>(someFunction);
    // now safe to cleanup (?)
    cleanupPtr();
}

I only added a recursive mutex here without changing any other code of the sample, even if it's now cargo code. There are two kinds of mutex in the std. A utterly useless std::mutex and the std::recursive_mutex which work like you expect a mutex should work. The std::mutex exclude the access of any further call even from the same thread. Which can happen if a method which needs mutex protection calls a public method which use the same mutex. std::recursive_mutex is reentrant for the same thread. Atomics (or interlocks in win32) are another way, but only to exchange values between threads or access them concurrently. Your example is missing such values, but in your case, I would look a little deeper in them (std::atomic).

UPDATE

If your are the user of a library which is not explicit declared as threadsafe by the developer, take it as non threadsafe and shield every call to it with a mutex lock. To stick with the example. If you cannot change someFunction the you have to wrap the function like:

void threadsafeSomeFunction()
{
  std::lock_guard<std::recursive_mutex> lock(g_mutex);
  someFunction();
}

Answer 2

I suspect there is no clearly good answer, but clarity will come from documenting the guarantees you wish to make about concurrent access to an Emitter object.

One level of guarantee, which to me is what is implied by a promise of thread safety, is that:

• Concurrent operations on the object are guaranteed to leave the object in a consistent state (at least, from the point of view of the accessing threads.)
• Non-commutative operations will be performed as if they were scheduled serially in some (unknown) order.

Then the question is, what does the emit method promise semantically: passing control to the connected routine, or evaluation of the function? If the former, then your work sounds like it is already done; if the latter, then the 'as-if ordered' requirement would mean that you need to enforce some level of synchronisation.

Users of the library can work with either, provided it is clear what is being promised.

Answer 3

Firstly the simplest possibility: If you don't claim your library to be thread-safe, you don't have to bother about this.

(But even) if you do: In your example the user would have to take care about thread-safety, since both functions could be dangerous, even without using your event-system (IMHO, this is a pretty good way to determine who should take care about those kind of problems). A possible way for him to do this in C++11 could be:

#include <mutex>

// A mutex is used to control thread-acess to a shared resource
std::mutex _somePtr_mutex;

int* somePtr = nullptr;

void someFunction()
{
    /*
        Create a 'lock_guard' to manage your mutex.

        Is the mutex '_somePtr_mutex' already locked?
            Yes: Wait until it's unlocked.
            No: Lock it and continue execution.
    */
    std::lock_guard<std::mutex> lock(_somePtr_mutex);

    if(somePtr)
        *somePtr = 17;

    // End of scope: 'lock' gets destroyed and hence unlocks '_somePtr_mutex'
}

void cleanupPtr()
{
    /*
        Create a 'lock_guard' to manage your mutex.

        Is the mutex '_somePtr_mutex' already locked?
            Yes: Wait until it's unlocked.
            No: Lock it and continue execution.
    */
    std::lock_guard<std::mutex> lock(_somePtr_mutex);

    int *tmp = somePtr;
    somePtr = null;
    delete tmp;

    // End of scope: 'lock' gets destroyed and hence unlocks '_somePtr_mutex'
}