Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC...
-
Upload
donald-hicks -
Category
Documents
-
view
216 -
download
0
Transcript of Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC...
![Page 1: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/1.jpg)
Applications of extended static Applications of extended static checkingcheckingApplications of extended static Applications of extended static checkingchecking
K. Rustan M. Leino
Compaq SRC
K. Rustan M. Leino
Compaq SRC
Systems Research CenterSystems Research Center
Invited talk, SAS’01, Paris, France, 17 July 2001Invited talk, SAS’01, Paris, France, 17 July 2001
![Page 2: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/2.jpg)
Talk outlineTalk outlineTalk outlineTalk outline
The extended static checking (ESC) technique ESC/Java Other possible applications of the ESC technique
![Page 3: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/3.jpg)
GoalGoalGoalGoal
Increase productivity in software development
![Page 4: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/4.jpg)
Static program checkingStatic program checkingStatic program checkingStatic program checking
![Page 5: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/5.jpg)
Static program checkersStatic program checkersStatic program checkersStatic program checkers
![Page 6: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/6.jpg)
ESC architectureESC architectureESC architectureESC architecture
![Page 7: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/7.jpg)
ESC/JavaESC/JavaESC/JavaESC/Java
Checked run-time errors– Null dereferences– Array index bounds errors– Type cast errors– …
Synchronization errors– Race conditions– Deadlocks
Consistency with annotations– Preconditions– Object invariants– …
Joint work withCormac Flanagan,Mark Lillibridge,Todd Millstein,Greg Nelson, Jim Saxe,Raymie Stata
![Page 8: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/8.jpg)
Modular checkingModular checkingModular checkingModular checking
![Page 9: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/9.jpg)
ESC/Java demo: Bag.javaESC/Java demo: Bag.javaESC/Java demo: Bag.javaESC/Java demo: Bag.java
![Page 10: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/10.jpg)
Checker design tradeoffsChecker design tradeoffsChecker design tradeoffsChecker design tradeoffs
Soundness Spurious warnings Annotation burden Performance
![Page 11: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/11.jpg)
Evaluation of the ESC techniqueEvaluation of the ESC techniqueEvaluation of the ESC techniqueEvaluation of the ESC technique
Strengths:– Local analysis offers precision
– Modular checking performs well and scales Weaknesses:
– Modularity requires annotations
![Page 12: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/12.jpg)
Change modularity boundariesChange modularity boundariesChange modularity boundariesChange modularity boundaries
Reduce annotation burden by changing grain of modularity?
![Page 13: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/13.jpg)
Use ESC as a subroutineUse ESC as a subroutineUse ESC as a subroutineUse ESC as a subroutine
Houdini: joint work with Cormac Flanagan and Michael LevinDaikon: Michael Ernst, et al.
generate candidate set of annotations ;repeat
invoke ESC to refute annotations ;remove refuted annotations
until quiescence ;
invoke ESC to identify possible defects
![Page 14: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/14.jpg)
Check only the annotationsCheck only the annotationsCheck only the annotationsCheck only the annotations
/*@ modifies isOpen; ensures isOpen; */void open(String filename);
/*@ requires isOpen; */int getChar();
/*@ requires isOpen; modifies isOpen; */void close();
Other protocol checking: Tom Ball & Sriram Rajamani; andRob DeLine & Manuel Fähndrich
![Page 15: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/15.jpg)
Principle of programming language designPrinciple of programming language designPrinciple of programming language designPrinciple of programming language design
syntactic restrictions
+ static checks
+ dynamic checks
= guaranteed program invariants
![Page 16: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/16.jpg)
Example program invariants enforced by Example program invariants enforced by popular programming languagespopular programming languagesExample program invariants enforced by Example program invariants enforced by popular programming languagespopular programming languages
each program variable holds a value of its type program counter is a valid program location each live local variable has a value …
![Page 17: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/17.jpg)
Null or not?Null or not?Null or not?Null or not?
T+ a possibly-null T object T- a non-null T object
t.f defined only if t is of type T- can cast from T+ to T- at the cost of a dynamic
check
CLU [Liskov & Guttag 1986]
![Page 18: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/18.jpg)
VerbosityVerbosityVerbosityVerbosity
if (t instanceof T-) {T- tm = (T-)t;… tm.f …
}
if (t instanceof T- &&((T-)t).f instanceof T-)
{… ((T-)((T-)t).f)).g …
}
![Page 19: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/19.jpg)
ESC technique to the rescueESC technique to the rescueESC technique to the rescueESC technique to the rescue
Use T+ and T- types Define dereference only for static type T- Require explicit cast from T+ to T- only if ESC
technique is unable to prove value to be non-null
![Page 20: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/20.jpg)
Examples revisitedExamples revisitedExamples revisitedExamples revisited
if (t != null) {… t.f …
}
if (t != null && t.f != null) {… t.f.g …
}
![Page 21: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/21.jpg)
Obstacles to applying ESC techniqueObstacles to applying ESC techniqueObstacles to applying ESC techniqueObstacles to applying ESC technique
Soundness What can be modified? How does a programming language prescribe
ESC checks?
![Page 22: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/22.jpg)
ConclusionsConclusionsConclusionsConclusions
ESC is a powerful program analysis technique Used in ESC/Modula-3, ESC/Java, Houdini Future applications include programming
language design ESC/Java in teaching
http://research.compaq.com/SRC/esc/
![Page 23: Applications of extended static checking K. Rustan M. Leino Compaq SRC K. Rustan M. Leino Compaq SRC Systems Research Center Invited talk, SAS’01, Paris,](https://reader036.fdocuments.in/reader036/viewer/2022081516/56649f065503460f94c1b25c/html5/thumbnails/23.jpg)