Functions that can fail spuriously should be wrapped in a loop. The
atomic_compare_exchange_weak_explicit() functions both attempt to set an atomic variable to a new value but only if it currently possesses a known old value. Unlike the related functions
atomic_compare_exchange_strong_explicit(), these functions are permitted to fail spuriously. This makes these functions faster on some platforms—for example, on architectures that implement compare-and-exchange using load-linked/store-conditional instructions, such as Alpha, ARM, MIPS, and PowerPC. The C Standard, 188.8.131.52, paragraph 4 [ISO/IEC 9899:2011], describes this behavior:
A weak compare-and-exchange operation may fail spuriously. That is, even when the contents of memory referred to by
objectare equal, it may return zero and store back to
expectedthe same memory contents that were originally there.
Noncompliant Code Example
In this noncompliant code example,
reorganize_data_structure() is to be used as an argument to
thrd_create(). After reorganizing, the function attempts to replace the head pointer so that it points to the new version. If no other thread has changed the head pointer since it was originally loaded,
reorganize_data_structure() is intended to exit the thread with a result of
true, indicating success. Otherwise, the new reorganization attempt is discarded and the thread is exited with a result of
atomic_compare_exchange_weak() may fail even when the head pointer has not changed. Therefore,
reorganize_data_structure() may perform the work and then discard it unnecessarily.
Compliant Solution (
To recover from spurious failures, a loop must be used. However,
atomic_compare_exchange_weak() might fail because the head pointer changed, or the failure may be spurious. In either case, the thread must perform the work repeatedly until the compare-and-exchange succeeds, as shown in this compliant solution:
This loop could also be part of a larger control flow; for example, the thread from the noncompliant code example could be retried if it returns
Compliant Solution (
When a weak compare-and-exchange would require a loop and a strong one would not, the strong one is preferable, as in this compliant solution:
Failing to wrap the
atomic_compare_exchange_weak_explicit() functions in a loop can result in incorrect values and control flow.
Inappropriate Call Outside Loop
Wrap functions that can fail spuriously in a loop
|Polyspace Bug Finder
|CERT C: Rule CON41-C
|Checks for situations where functions that can spuriously fail are not wrapped in loop (rule fully covered)
Key here (explains table format and definitions)
|CERT Oracle Secure Coding Standard for Java
|THI03-J. Always invoke wait() and await() methods inside a loop
|Prior to 2018-01-12: CERT: Unspecified Relationship
atomic_compare_exchange Generic Functions"