Translator. Tool architecture, detail. Annotated Jav

1
Technologies for finding errorsin
object-oriented software

• K. Rustan M. LeinoMicrosoft Research, Redmond, WA

Lecture 0Summer school on Formal Models of
Software1 Sep 2003, Tunis, Tunisia
2
Motivation
3
Software development problem

• Software construction and maintenance are
  expensive
• Reliability is costly and difficult to achieve

4
Vision

• Increased programmer productivity and program
  reliability through increased rigor

Record design decisions Utilize automatic
checking Detect errors and improve
maintainability
5
User's view
Error messages
Program with specifications
Program checker
public class Bag private /_at_non_null/ int
a private int n //_at_ invariant 0 lt n n lt
a.length public Bag(/_at_non_null/ int
initialElements) n initialElements.length
a new intn System.arraycopy(initialElement
s, 0, a, 0, n) public void add(int x)
if (n a.length) int b new
int2(a.length1) System.arraycopy(a, 0, b,
0, n) a b an x n public
int extractMin() int m Integer.MAX_VALUE
int mindex 0 for (int i 0 i lt n i)
if (ai lt m) mindex i m
ai if (0 lt n) n-- amindex
an return m // The program text
continues down here, but if youre // reading
this, you probably arent paying attention to //
the talk.
Bag.java18 Array index possibly too large
6
Extended Static Checker for Java (ESC/Java)

• Built at Compaq SRC
• Input Java user-supplied annotations
• Annotation language captures programmer design
  decisions
• Powered by program semantics and automatic
  theorem proving
• Performs modular checking

7
ESC/Java demo
8
Program checker design tradeoffs

• Missed errors
• Spurious warnings
• Annotation overhead
• Performance

9
Tool architecture
Annotated Java program
Translator
Verification condition
Valid
Automatic theorem prover
Resource exhausted
Counterexample context
Post processor
Warning messages
10
Tool architecture, detail
Annotated Java program
Sugared command
Translator
Primitive command
Passive command
Verification condition
Automatic theorem prover
Counterexample context
Post processor
Warning messages
11
Tool architecture, detail
12
Annotation language
Annotated Java program

• Simple
• non_null
• Method annotations
• requires E
• modifies w
• ensures E
• exsures (T x) E
• Object invariants
• invariant E

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
13
Annotation language
Annotated Java program

• Simple
• non_null
• Method annotations
• requires E
• modifies w
• ensures E
• exsures (T x) E
• Object invariants
• invariant E

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
14
Annotation language
Annotated Java program

• Specification expressions
• side-effect free Java expressions
• no , no method calls
• result, old(E)
• ensures result old(x)
• gt
• (forall T x E), (exists T x E)
• (forall int j 0 lt j j lt n gt aj gt 0)
• typeof(E), type(T), lt
• requires typeof(x) typeof(this)

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
15
Annotation language
Annotated Java program

• Specification expressions
• side-effect free Java expressions
• no , no method calls
• result, old(E)
• ensures result old(x)
• gt
• (forall T x E), (exists T x E)
• (forall int j 0 lt j j lt n gt aj gt 0)
• typeof(E), type(T), lt
• requires typeof(x) typeof(this)

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
16
Annotation language
Annotated Java program

• Concurrency
• monitored_by lock
• /_at_ monitored_by this / long x
• locksetlock
• requires locksetthis
• lock0 lt lock1
• max(lockset)
• requires max(lockset) lt this

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
17
Annotation language
Annotated Java program

• Concurrency
• monitored_by lock
• /_at_ monitored_by this / long x
• locksetlock
• requires locksetthis
• lock0 lt lock1
• max(lockset)
• requires max(lockset) lt this

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
18
Annotation language
Annotated Java program

• Ghost variables
• ghost public T x
• ghost public int objectState
• ghost public TYPE elementType
• set x E
• set objectState Open
• set elementType type(T)

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
19
Annotation language
Annotated Java program

• Ghost variables
• ghost public T x
• ghost public int objectState
• ghost public TYPE elementType
• set x E
• set objectState Open
• set elementType type(T)

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
20
Annotation language
Annotated Java program

• Miscellaneous
• assert E
• assume E
• assume x gt 0 // because x yy
• nowarn
• x aj //_at_ nowarn
• axiom E
• axiom (forall int x x 2 gt 0)

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
21
Sugared commands
Annotated Java program

• S,T assert E
• assume E
• x E
• raise
• S T
• S ! T
• S T
• loop inv E S ? T end
• call x t.m(E)

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
22
Sugared commands
Annotated Java program

• x t.f.g
• assert t ? null
• tmp select(f, t)
• assert tmp ? null
• x select(g, tmp)
• if (x lt 0) x -x /_at_ assert x gt 0 /
• ( assume x lt 0 x -x
• assume ?(x lt 0)
• )
• assert x gt 0

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
23
Sugared commands
Annotated Java program

• x t.f.g
• assert lblneg(Null_at_58.9, t ? null)
• tmp select(f, t)
• assert lblneg(Null_at_58.11, tmp ? null)
• x select(g, tmp)
• if (x lt 0) x -x /_at_ assert x gt 0 /
• ( assume x lt 0 assume lblpos(Then2807,
  true) x -x
• assume ? (x lt 0) assume lblpos(Else2807,
  true)
• )
• assert x gt 0

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
24
Primitive commands
Annotated Java program

• S,T assert E
• assume E
• x E
• raise
• S T
• S ! T
• S T
• loop inv E S ? T end
• call x t.m(E)

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
25
Primitive commands
Annotated Java program

• //_at_ requires Pre modifies w ensures PostX
  m(U u)
• call x t.m(E)
• var u in
• u E
• assert Pre
• var w0 in
• w0 w
• havoc w
• assume Post
• x result
• end
• end

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
26
Passive commands
Annotated Java program

• S,T assert E
• assume E
• x E

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
27
Passive commands
Annotated Java program

• if (x lt 0) x -x /_at_ assert x gt 0 /
• ( assume x0 lt 0 x1 -x0 x2 x1
• assume ?(x0 lt 0) x2 x0
• )
• assert x2 gt 0

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
28
Passive commands
Annotated Java program

• if (x lt 0) x -x /_at_ assert x gt 0 /
• ( assume x0 lt 0 assume x1 -x0 assume x2
  x1
• assume ?(x0 lt 0) assume x2 x0
• )
• assert x2 gt 0

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
29
Weakest preconditions
Annotated Java program

• A Hoare triple P S Qsays that if command S
  is started in a state satisfying P, then S
  terminates without error in a state satisfying Q
• The weakest precondition of a command S with
  respect to a postcondition Q, written wp(S, Q),
  is the weakest P such that P S Q

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
30
Weakest preconditions
Annotated Java program

• wp(assert E, Q) E Q
• wp(assume E, Q) E gt Q
• wp(ST, Q) wp(S, wp(T,Q))
• wp(S T, Q) wp(S, Q) wp(T, Q)
• wp(S, Q) wp(S, true) wlp(S, Q)
• wlp(S, Q) wlp(S, false) Q

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
31
Verification condition
Annotated Java program

• Universal background predicate
• (?t ? t lt t)
• Type-specific background predicate
• Bag lt java.lang.Object
• Verification condition BPUniv BPT gt
  VCmethod

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
32
Verification condition
(BG_PUSH (AND (lt T_T T_java.lang.Object)
(EQ T_T (asChild T_T T_java.lang.Object))
(DISTINCT arrayType T_boolean T_char T_byte
T_short T_int T_long
T_float T_double T_.TYPE
T_T T_java.lang.Object))) (EXPLIES (LBLNEG
vc.T.abs.2.2 (IMPLIES (AND (EQ
elems_at_pre elems) (EQ elems (asElems
elems)) (lt (eClosedTime elems) alloc) (EQ
LS (asLockSet LS)) (EQ alloc_at_pre alloc))
(NOT (AND (EQ _at_true (is x2.21
T_int)) (OR (AND (OR
(AND (lt x2.21 0) (LBLPOS
trace.Then0,3.15 (EQ _at_true _at_true))
(EQ x3.17 (- 0 x2.21)) (EQ
x2.21lt1gt x3.17)) (AND (NOT
(lt x2.21 0)) (LBLPOS
trace.Else1,3.4 (EQ _at_true _at_true))
(EQ x2.21lt1gt x2.21))) (NOT (LBLNEG
Assert_at_4.8 (gt x2.21lt1gt 0)))) (AND
(OR (AND (lt x2.21 0)
(LBLPOS trace.Then0,3.15 (EQ _at_true
_at_true)) (EQ x3.17 (- 0 x2.21))
(EQ x2.21lt1gt x3.17)) (AND
(NOT (lt x2.21 0)) (LBLPOS
trace.Else1,3.4 (EQ _at_true _at_true))
(EQ x2.21lt1gt x2.21))) (LBLNEG
Assert_at_4.8 (gt x2.21lt1gt 0)) (NOT
(LBLNEG Exception_at_5.2 (EQ ecReturn
ecReturn))))))))) (AND (DISTINCT
ecReturn)))
Annotated Java program

• class T
• static int abs(int x)
• if (x lt 0) x -x
• //_at_ assert x gt 0

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
33
Theorem prover Simplify
Annotated Java program

• Nelson-Oppen cooperating decision procedures
• conguence closure
• linear arithmetic
• partial orders
• quantifiers
• Key features
• automatic no user interaction
• refutation based searches for counterexamples
• heuristics tuned for program checking
• labels
• time limit

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
34
Counterexamples and warnings
Annotated Java program

• Counterexample labels (IndexTooBig_at_26.5
  vc.Bag.add.20.2 trace.Then0,21.23)
  context (AND (NEQ tmp1!a23.23
  null) (NEQ this null) (EQ alloc_at_pre
  alloc) (EQ tmp4!n26.6 0)
  (lt alloc (vAllocTime tmp3!a26.4)) )
• Bag add(int) ...--------------------------------
  ---------------------------Bag.java26 Warning
  Array index possibly too large (IndexTooBig)
  an x Execution trace information
  Executed then branch in "Bag.java", line 21, col
  23.----------------------------------------------
  -------------

Sugared command
Primitive command
Translator
Passive command
Verification condition
Automatictheorem prover
Counterexample context
Post processor
Warning messages
35
Experience annotations

• Capture common design decisions
• Suggested immediately by warnings
• Overhead 4-10 of source code
• 1 annotation per field or parameter
• Most common annotations
• non_null
• container element types

36
Experience performance

• 50 of all methods lt 0.5 s
• 80 of all methods lt 1 s
• time limit 300 s
• total time for Javafe (40kloc) 65 min.

37
Related work

• ESC/Modula-3
• Full functional specification and verification
• JML, LOOP, B, Penelope, ...
• Languages and language features
• Euclid, Eiffel, Escher, Guava, Vault, Cqual, ...
• LCLint, refinement types, Types against races,
  ...
• Other checking techniques
• Abstract interpretation, PREfix, SLAM,
  Bandera,Java PathFinder 2, Canvas, ESP, AST
  Toolkit, Metal,

38
Conclusions

• Using program semantics and automatic decision
  procedures for program analysis works!
• Cost effective?

39
What's needed?

• Semantics of programming language
• Specification language
• Programming methodology and disciplines
• Decision procedures
• Property inference

Download ESC/Java (tool, documentation,
sources) http//research.compaq.com/SRC/esc
http//research.compaq.com