1 / 37

Comprehensive Overview of Extended Static Checking for Java Syntax

Explore the concept of static checking in Java through annotated source code, error detection, verification conditions, and more for robust programming practices.

jeneva
Télécharger la présentation

Comprehensive Overview of Extended Static Checking for Java Syntax

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Extended Static Checkingfor Java Cormac Flanagan Joint work with: Rustan Leino, Mark Lillibridge, Greg Nelson, Jim Saxe, and Raymie Stata Compaq Systems Research Center

  2. What is “Static Checking”? Annotated Source Code Static Checker Error: ... • type systems Error: wrong number of arguments in method call • lint Error: unreachable code • full program verification Error: qsort does not yield a sorted array

  3. Why not just use testing? • Testing essential but • Expensive • Finds errors late • Misses errors • Static checking and testing complementary

  4. Comparison of Static Checkers Quality full verification 100% Extended Static Checking ESC Modula-3 ESC Java type systems lint Effort Note: Graph is not to scale

  5. Goals of ESC/Java • Practical static checking • Detect common run-time errors • null dereferences • array bounds • type casts • race conditions • deadlocks • ... • Modular checking

  6. Non-goals of ESC/Java • Complete functional verification • Completeness • May not pass all programs • Soundness • May fail to detect errors • Error-resistant, not error-proof

  7. Architecture of ESC/Java Method + annotations Verification condition generator Background axioms Verification condition x.y.(x > y ==> … ) Automatic theorem prover Error: index out of bounds on line 218 Counterexample

  8. Input to ESC/Java Method + annotations Verification condition generator Background axioms Verification condition Automatic theorem prover Counterexample

  9. Modular checking Interface Client check Method body check Client check

  10. Describing interfaces public class Vector { Object[] a; int size; public Object elementAt(int i) { ... } public Object[] copyToArray() { ... } } //@ invariant a != null //@ invariant size <= a.length //@ requires 0 <= i && i < size //@ ensures RES != null && RES.length == size //@ modifies size, a[0], a[*]

  11. Input to ESC/Java’s “checking engine” • Method implementation • Interface annotations • requires • ensures • modifies • invariants

  12. Verification condition generation Method + annotations Verification condition generator Background axioms Verification condition Automatic theorem prover Counterexample

  13. Verification condition generation • Easy for small languages [Dijkstra] • Much harder for real languages • Object-oriented • Typed • Dynamic allocation • Exceptions • Aliasing • Threads

  14. Verification conditions for real programs Java x = a[ i++ ]; assume preconditions assume invariants ... ... assert postconditions assert invariants i0 = i;i = i + 1;assert (LABEL Null@218: a != null);assert (LABEL IndexNeg@218: 0 <= i0);assert (LABEL IndexTooBig@218: i0 < a.length);x = elems[a][i0]; Guarded command wlp Verification condition i0.(i0 == i ==> … )

  15. Exceptions • Java has exceptions • Add exceptions (raise and catch) to guarded command language • Calculate wlp of GC statement with respect to normal and exceptional postconditions

  16. Method overriding • Method in subclass can override method in superclass • Must respect interface of overridden method • Weaker requires clause • Stronger ensures clause

  17. Verification condition Method + annotations Verification condition generator Background axioms Verification condition Automatic theorem prover Counterexample

  18. Verification condition • Formula in untyped, first-order predicate calculus • equality and function symbols • quantifiers • arithmetic operations • select and store operations • Eg. x.y.(x > y ==> … )

  19. Example verification condition • Verification condition large but “dumb” (IMPLIES (DISTINCT |ecReturn| |L_14.4|) (IMPLIES (AND (EQ |a@pre:2.8| |a:2.8|) (EQ |a:2.8| (asField |a:2.8| (array |T_int|))) (< (fClosedTime |a:2.8|) alloc) (EQ |n@pre:3.6| |n:3.6|) (EQ |n:3.6| (asField |n:3.6| |T_int|)) (EQ |MAX_VALUE@pre:3.4.26| |MAX_VALUE:3.4.26|) (EQ |@true| (is |MAX_VALUE:3.4.26| |T_int|)) (EQ |elems@pre| elems) (EQ elems (asElems elems)) (< (eClosedTime elems) alloc) (EQ LS (asLockSet LS)) (EQ |alloc@pre| alloc) (EQ |@true| (is |this<1>| |T_Bag|)) (EQ |@true| (isAllocated |this<1>| alloc)) (NEQ |this<1>| null)) (FORALL (tmp1 |tmp2:21.4| |tmp3:21.6| |m:12.8| |mindex:13.8| |i:14.13| |tmp0:14.28|) (AND (IMPLIES (<= 1 (select |n:3.6| |this<1>|)) (AND (LBLNEG |Null@15.10~15.10| (NEQ (select |a:2.8| |this<1>|) null)) (LBLNEG |IndexNegative@15.10~15.11| (<= 0 1)) (LBLNEG |IndexTooBig@15.10~15.11| (< 1 (arrayLength (select |a:2.8| |this<1>|)))) (IMPLIES (< (select (select elems (select |a:2.8| |this<1>|)) 1) |MAX_VALUE:3.4.26|) (AND (LBLNEG |Null@17.12~17.12| (NEQ (select |a:2.8| |this<1>|) null)) (LBLNEG |IndexNegative@17.12~17.13| (<= 0 1)) (LBLNEG |IndexTooBig@17.12~17.13| (< 1 (arrayLength (select |a:2.8| |this<1>|)))) (FORALL (|m:17.8|) (IMPLIES (EQ |m:17.8| (select (select elems (select |a:2.8| |this<1>|)) 1)) (FORALL (|i:14.28|) (IMPLIES (AND (EQ |i:14.28| (+ 1 1)) (EQ |@true| |bool$false|)) (FORALL (|tmp2:21.4<1>|) (IMPLIES (EQ |tmp2:21.4<1>| (select |a:2.8| |this<1>|)) (AND (LBLNEG |Null@21.16~21.16| (NEQ (select |a:2.8| |this<1>|) null)) (LBLNEG |IndexNegative@21.16~21.17| (<= 0 (select (store |n:3.6| |this<1>| (- (select |n:3.6| |this<1>|) 1)) |this<1>|))) (LBLNEG |IndexTooBig@21.16~21.17| (< (select (store |n:3.6| |this<1>| (- (select |n:3.6| |this<1>|) 1)) |this<1>|) (arrayLength (select |a:2.8| |this<1>|)))) (LBLNEG |Null@21.4~21.4| (NEQ |tmp2:21.4<1>| null)) (LBLNEG |IndexNegative@21.4~21.5| (<= 0 1)) (LBLNEG |IndexTooBig@21.4~21.5| (< 1 (arrayLength |tmp2:21.4<1>|))) (LBLNEG |Exception:11.6~11.6@11.2~11.2| (EQ |ecReturn| |ecReturn|))))))))))) (IMPLIES (NOT (< (select (select elems (select |a:2.8| |this<1>|)) 1) |MAX_VALUE:3.4.26|)) (FORALL (|i:14.28|) (IMPLIES (AND (EQ |i:14.28| (+ 1 1)) (EQ |@true| |bool$false|)) (FORALL (|tmp2:21.4<1>|) (IMPLIES (EQ |tmp2:21.4<1>| (select |a:2.8| |this<1>|)) (AND (LBLNEG |Null@21.16~21.16| (NEQ (select |a:2.8| |this<1>|) null)) (LBLNEG |IndexNegative@21.16~21.17| (<= 0 (select (store |n:3.6| |this<1>| (- (select |n:3.6| |this<1>|) 1)) |this<1>|))) (LBLNEG |IndexTooBig@21.16~21.17| (< (select (store |n:3.6| |this<1>| (- (select |n:3.6| |this<1>|) 1)) |this<1>|) (arrayLength (select |a:2.8| |this<1>|)))) (LBLNEG |Null@21.4~21.4| (NEQ |tmp2:21.4<1>| null)) (LBLNEG |IndexNegative@21.4~21.5| (<= 0 0)) (LBLNEG |IndexTooBig@21.4~21.5| (< 0 (arrayLength |tmp2:21.4<1>|))) (LBLNEG |Exception:11.6~11.6@11.2~11.2| (EQ |ecReturn| |ecReturn|)))))))))) (IMPLIES (NOT (<= 1 (select |n:3.6| |this<1>|))) (AND (IMPLIES (EQ |L_14.4| |L_14.4|) (FORALL (|tmp2:21.4<1>|) (IMPLIES (EQ |tmp2:21.4<1>| (select |a:2.8| |this<1>|)) (AND (LBLNEG |Null@21.16~21.16| (NEQ (select |a:2.8| |this<1>|) null)) (LBLNEG |IndexNegative@21.16~21.17| (<= 0 (select (store |n:3.6| |this<1>| (- (select |n:3.6| |this<1>|) 1)) |this<1>|))) (LBLNEG |IndexTooBig@21.16~21.17| (< (select (store |n:3.6| |this<1>| (- (select |n:3.6| |this<1>|) 1)) |this<1>|) (arrayLength (select |a:2.8| |this<1>|)))) (LBLNEG |Null@21.4~21.4| (NEQ |tmp2:21.4<1>| null)) (LBLNEG |IndexNegative@21.4~21.5| (<= 0 0)) (LBLNEG |IndexTooBig@21.4~21.5| (< 0 (arrayLength |tmp2:21.4<1>|))) (LBLNEG |Exception:11.6~11.6@11.2~11.2| (EQ |ecReturn| |ecReturn|)))))) (IMPLIES (NOT (EQ |L_14.4| |L_14.4|)) (AND (LBLNEG |Exception:11.6~11.6@11.2~11.2| (EQ |L_14.4| |ecReturn|))))))))))

  20. Background axioms Method + annotations Verification condition generator Background axioms Verification condition Automatic theorem prover Counterexample

  21. Background axioms • Additional properties of Java that the theorem prover needs to know • A variable of type T always holds a value whose type is a subtype of T • The subtyping relation is reflexive, anti-symmetric, and transitive • new returns an object that is distinct from all existing objects • ... lots more ... • java.lang.Object has no supertype

  22. Automatic theorem proving Method + annotations Verification condition generator Background axioms Verification condition Automatic theorem prover Counterexample

  23. Automatic theorem proving • Use Simplify • Theorem prover from ESC/Modula-3 • Accepts formulae in untyped, first-order predicate calculus • Attempts to prove or refute

  24. Automatic theorem proving Verification condition x.y.(x > y ==> … ) Automatic theorem prover(Simplify) Valid Counterexample Diverges

  25. Handling counterexamples Method + annotations Verification condition generator Background axioms Verification condition Automatic theorem prover Counterexample

  26. Error message from counterexample Verification condition x.y. ( … (LABEL IndexTooBig@218 …) …) Automatic theorem prover(Simplify) Counterexample: x417 > 7 …Label: IndexTooBig@218 … Error: index out of bounds on line 218

  27. Initial experience • First implementation is done • Run on 30,000+ lines of code (mostly itself) • Caught several errors • null dereference, array bounds • Programmer can annotate and check about 300 lines per hour • Looks promising ...

  28. Demonstration

  29. ESC/Java Summary • Finds more errors than type checking • Costs less than full verification • Currently working; is being evaluated • Potential as “software reliability metric” • Practical checking based on automatic theorem proving may be possible www.research.digital.com/SRC/esc/Esc.html

  30. Comparison of Static Checkers Quality full verification 100% Extended Static Checking decidability limit type systems lint Effort Note: Graph is not to scale

  31. Metrics for Static Checkers • Cost of using the tool • Quality Does it miss errors? Does it give spurious warnings?

  32. Challenges • Automatic theorem proving • Error messages from counterexample • Verification conditions for real programs • Object-oriented • Typed • Dynamic allocation • Exceptions

  33. ESC/Java vs. Testing • Testing essential but • Expensive • Finds errors late • Misses errors • ESC/Java ... ?

  34. Background axioms Java Background axioms Guarded command wlp Verification condition

  35. Additional annotations //@ assert <exp> //@ assume <exp> //@ nowarn <error code> //@ axiom <exp>

  36. Describing interfaces public Integer[] sum(Integer[] a, Integer[] b); //@ requires a != null && b != null; //@ requires a.length == b.length; //@ ensures RES != null && RES.length == a.length; //@ modifies a[0], b[*];

More Related