Race Condition Audit

Systematic process for finding concurrency bugs that cause data corruption, deadlocks, or non-deterministic behavior.

Process

Step 1: Map Concurrency Entry Points

Find where concurrent execution begins:

# TypeScript/JavaScript
grep -rn "async \|Promise\|Worker\|fork" --include="*.ts" --include="*.js"

# Python
grep -rn "threading\|asyncio\|async def" --include="*.py"

# Go
grep -rn "go func\|go \w\+(" --include="*.go"

# Rust
grep -rn "thread::spawn\|tokio::spawn\|async fn" --include="*.rs"

# C++
grep -rn "std::thread\|std::async\|pthread" --include="*.cpp" --include="*.hpp"

Step 2: Identify Shared Mutable State

For each entry point, trace:

1. What variables/state are accessed?
2. Are any accessed from multiple concurrent contexts?
3. Is the state mutable?

Step 3: Verify Synchronization

For each shared mutable state:

1. Is there a lock/mutex/atomic protecting it?
2. Is protection held for the entire critical section?
3. Are ALL access paths protected, including error paths?

Step 4: Check for Anti-Patterns

Scan for these categories (see language references for specific patterns):

Step 5: Report Findings

Use this format:

## [RC-001] Brief Title
**File:** `path/to/file.ext:line`
**Category:** Check-Then-Act
**Severity:** Critical | High | Medium | Low

**Code:**
[snippet]

**Bug:** [one sentence explanation]

**Scenario:** [how this manifests]

**Fix:**
[corrected code]

Severity Criteria

• Critical: Security bypass, data corruption with financial/legal impact, crashes
• High: Data corruption, deadlocks, payment/transaction races
• Medium: Non-deterministic tests, resource leaks under contention
• Low: Theoretical races, deprecated code, performance issues

Language References

Load the appropriate reference based on codebase languages:

• TypeScript/JavaScript: See references/typescript-javascript.md
• Python: See references/python.md
• Go: See references/go.md
• Rust: See references/rust.md
• C++: See references/cpp.md

Each reference contains language-specific anti-patterns with buggy/fixed code examples.

Quick Detection Commands

# Go: Run race detector
go test -race ./...

# C++: Compile with ThreadSanitizer
clang++ -fsanitize=thread -g source.cpp

# Find non-atomic increments (JS/TS)
grep -rn "++" --include="*.ts" | grep -v "for\|while\|i++"

# Find Python threading without locks
grep -rn "threading.Thread" --include="*.py" -A5 | grep -v Lock