A Race Detector for Web Sites

What is this tool? Read our tutorial on how to find web races with EventRacer!
Failed to load! (Tool may be busy or offline)

Note: If you want to perform a more thorough analysis of your website than this online demo, please download the tool.

Do you have an Android application? Try out the EventRacer for Android.


EventRacer consists of two parts - an instrumented WebKit browser, which dumps a logfile and a race analyzer which analyses the output.

As compiled binary

For anyone interested in running EventRacer without making changes to the source, we recommend this option:

64-bit binary for Ubuntu 12.04 - Download eventracer.tar.gz [24MB]

As source

All the sources are available on GitHub. We provide the EventRacer analyzer together with two instrumented browsers you can choose from - Chromium and WebKit. To build them, follow the instructions in the README included in each project.

Instrumented Chromium


Instrumented WebKit


Race Analyzer


Additional Libraries

All of the above require additional libraries, get them with: sudo apt-get install libjpeg62 libssl0.9.8 graphviz


What is EventRacer ?

EventRacer is a tool which attempts to discover harmful races (concurrency bugs) in web pages. EventRacer classifies the discovered races and shows the ones it thinks are potentially harmful first (in red). If you would like to know how to use EventRacer and what are web races, go to our tutorial.

EventRacer consists of two parts -- an instrumented browser and a race analyzer. The analysis behind EventRacer is based on techniques developed in the programming languages community. More information about the analysis algorithms can be found in the following two papers:

Below, we provide instructions for running and using the tool. Here, we assume that the tool has already been downloaded and built.

Running the instrumented browser

Once the instrumented browser has been obtained (either downloaded as binary or built from source, one can either load a website as usual or run the browser in a mode that will automatically explore the website (links will be clicked automatically, etc.).

Open a terminal, go to the directory where the browser is found and type one of the following two commands:

In both cases, a file named ER_actionlog will be produced as output. This file will be then analyzed by the race analyzer (see below how to run the race analyzer on this log).


Some HTML features are not supported by the EventRacer browser (even if they are supported by WebKit). If such an issue is encountered, the browser will terminate and print a stack trace. We will be glad to add this feature to the instrumentation of the browser if you contact us with the reported stack trace.

Running the race analyzer

Open a terminal and go the directory where Event Racer is found (either where it was extracted from eventracer.tar.gz or where it is built from source), and type:

./raceanalyzer ER_actionlog (if you are using the binary directly)


 bin/eventracer/webapp/raceanalyzer ER_actionlog (if you built Event Racer from source) 

This starts a web server on port 8000 (can be changed with a -port flag). Then use a browser of your choice (e.g. Chrome, Firefox) and go to http://localhost:8000/ to see the races which are found in the explored page.

Using the race analyzer: inspecting races

Open the list of memory locations with races at http://localhost:8000/varlist and a list of all JavaScript variables and DOM objects that have races are shown. The memory locations with races that the tool believes are the most likely to be buggy are shown on top and are in red. The memory locations with races that we have filtered out as unlikely to be harmful are at bottom and are in green.

For every memory location, we show the following information:

Clicking on a the variable opens more information about it. This information may be helpful for debugging the cause of the race.

All races have indices and can be inspected by clicking on the link of a race. Clicking on a race shows the two operations which caused the race along with the call traces of these two operations (useful for debugging). If the race happens in JavaScript code, we may be able to understand the names of the JavaScript functions called and link you to the code that executes.

Note: the tool works best if you open non-obfuscated sites. This way, we can precisely point you to the actual line of code in the JavaScript and the names of the variables participating in races will be user readable.

Advanced usage

EventRacer can also be used as a debugging tool. Because a ER_actionlog stores one read and one write of all the JavaScript variables, along with JavaScript code and the values stored in the variables, the tool can be used to show more information than just the races.

When opening the list of variables http://localhost:8000/varlist, one can also see memory locations that do no participate in races. This is done with the links at the top:

[all] [only with races] [only with uncovered races] [only with uncovered unfiltered races] [only with high risk races]

To reduce the number of results, one can search the memory location by name from the search box. Then click on the memory location from the table and open "List all event actions with reads and writes of variable". Then all values that a variable takes can be explored.

Another possibility is to explore the list of everything that happens in an event action (an event action is typically one event handler or atomic action - e.g. parsing of on HTML tag). This is done by clicking on an event action number (all event actions have sequential numbers associated with them). Then a page with everything that happens in the event action opens.

Extending EventRacer

This is a section for anyone who is interested in extending the tool, for instance by adding their own analysis.

Analyzing multiple traces in bulk

We distribute a tool named racestats that takes a directory with actionlog files and analyzes them in bulk. Then it prints statistics about number of memory locations with races in all the logs in the directory. Also, it prints a list of high risk races. This tool may be useful to find races in a large number of websites.

Extending EventRacer

If you consider adding new analysis to EventRacer, it is unlikely that a change in the WebKit browser will be needed. The ER_actionlog already includes the happens-before, all the event actions and for every memory location -- the first read, the first write in an event action, and the value read or written. To build a new analysis, instead we recommend that you get familiar with the ActionLog.h / .cpp files in the EventRacer github repository.


Veselin Raychev

Veselin Raychev

PhD Student
Software Reliability Lab, ETH Zurich

Martin Vechev

Prof. Martin Vechev

Assistant Professor
Software Reliability Lab, ETH Zurich

Manu Sridharan

Dr. Manu Sridharan

Samsung Research