1. Dept. of Computer Science A Runtime Assertion Checker for the Java Modeling Language (JML) Yoonsik Cheon and Gary T. Leavens SERP 2002, June 24-27, 2002 www.jmlspecs.org

2. Dept. of Computer ScienceIowa State University 2 Motivation Goal –To improve quality of software by using formal interface specifications Reality –Formal specifications seldom used in practice, due to Lack of immediate, tangible payoff to programmers … Contribution: runtime assertion checking –Practical debugging (and testing) tool –Brings benefits of writing formal specifications to programmers

3. Dept. of Computer ScienceIowa State University 3 Related Work Eiffel –Integrates executable specs into programming language, often called Design by Contract (DBC) –But, hard to write complete, abstract specifications No purity checking No quantified expressions No specification-only fields, methods, and types No immutable version of collection types DBC Tools for Java –Jass, iContract, Handshake, jContractor, Contact Java, etc. –Same problem as Eiffel

4. Dept. of Computer ScienceIowa State University 4 Outline Java Modeling Language (JML) General approach Translating JML specifications –JML expressions –Method specifications –Inheritance of specifications –Interface specifications –Model specifications Conclusion

5. Dept. of Computer ScienceIowa State University 5 An Overview of JML Java Modeling Language (JML) –Formal behavioral interface specification language for Java –Hoare-style pre- and postconditions –Influenced by Eiffel and model-oriented specification languages such as VDM and Larch –Can write complete interface specifications

6. Dept. of Computer ScienceIowa State University 6 An Overview of JML (Cont.) public interface Stack { //@ model Object[] elems; /*@ old int len = elems.length; @ requires e != null; @ modifies elems; @ ensures elems.length == len + 1 && @ elems[0] == e && @ (\forall int i; 0 <= i && i < len; @ elems[i+1] == \old(elems[i])); @*/ void push(Object e); } Example in JML

7. Dept. of Computer ScienceIowa State University 7 General Approach Runtime assertion checking –JML assertions into runtime check code –Transparent (except for performance) unless assertions are violated jmlc Stack.javaStack.class jml-runtime.jar JVM

8. Dept. of Computer ScienceIowa State University 8 Translating JML Expressions JML Expressions –Side-effect free subset of Java expressions Challenges –Undefinedness (due to runtime errors, exceptions, non-executable clauses, etc.) –Quantified expressions (\forall, \exists, \sum, etc.)

9. Dept. of Computer ScienceIowa State University 9 Undefinedness of Expressions JML semantics –Arbitrary expressible value (of correct type) –E.g., a[i] != null Goals –To catch as many errors as possible –To be faithful to the JML semantics

10. Dept. of Computer ScienceIowa State University 10 Undefinedness (Cont.) Approach: Local, contextual interpretation –Interpreted locally by the smallest, enclosing boolean expression –Boolean value determined contextually –E.g., true for “a[i] != null” //@ requires !(a[i] != null); void foo(int i) { /* … */ }

11. Dept. of Computer ScienceIowa State University 11 Quantified Expressions Quantifiers in JML –Universal and existential (\forall and \exists) –Generalized (\sum, \product, \min, and \max) –Numerical (\num_of) Extensible framework –Type extent-based approach –Static analysis approach

12. Dept. of Computer ScienceIowa State University 12 Static Analysis Approach Collections for reference types (\forall Student p; ta.contains(p) || ra.contains(p); p.credits() <= 12) Intervals for numeric types (\sum int x; x > 1 && x < 5; x) Enumeration for boolean type

13. Dept. of Computer ScienceIowa State University 13 Translating Method Specifications Method specifications in JML –Rich set of syntactic sugars Multiple clauses Nested specifications Case analysis, etc. Approach –Desugaring specifications –Assertion check methods Precondition check methods Postcondition check methods (normal and exceptional) Invariant check methods, etc. –Wrapper methods

14. Dept. of Computer ScienceIowa State University 14 Wrapper Methods } checkInv$m(); // I checkPre$m(…); // P T m(…) { //@ requires P; //@ ensures Q; //@ signals S; //@ invariant I; T m(…) { body; try try { } original$m(…); checkPost$m(…); // Q } if (…) { check$Inv(); } // I } catch (Throwable e) { } finally { checkXPost$m(…); // S catch (JMLAssertionException e) { … }

15. Dept. of Computer ScienceIowa State University 15 Inheritance of Specifications Specification inheritance –Through subclassing, interfaces, and refinement Challenge –Existence of supertype’s assertion check methods is not known at compile time (e.g., due to separate compilation)

16. Dept. of Computer ScienceIowa State University 16 Inheritance of Specifications (cont.) Approach –Dynamic delegation using Java’s reflection facility 1.Check local assertions 2.Check inherited assertions, i.e., for each supertype, 2.1 Look up corresponding assertion check method 2.2 Invoke the target method 2.3 Combine the result appropriately 3.Report an assertion violation based on the combined result

17. Dept. of Computer ScienceIowa State University 17 Interface Specifications Problem –Can’t add assertion check methods to interfaces Surrogate classes –Static inner classes of interfaces –Responsible for checking assertions in interfaces > Checker interface I C static delegation dynamic delegation

18. Dept. of Computer ScienceIowa State University 18 Model Specifications for ADTs JML model fields, methods, and types –Specification-purpose fields, methods, and types Model fields –Can be accompanied with abstraction functions public class StackImpl implements Stack { private java.util.List contents; /*@ public depends elems <- contents; @ private represents elems <- contents.toArray(); @*/ /* … */ }

19. Dept. of Computer ScienceIowa State University 19 Model Specifications (Cont.) Model field access methods –Generated from specific form of “represents” clauses –Calculate abstract (specification) values from concrete (program) values –Replaces model fields appearing in assertions // generated from “represents elems <- contents.toArray();” public Object[] model$elems() { return contents.toArray(); }

20. Dept. of Computer ScienceIowa State University 20 Conclusion JML runtime assertion checker –Executes many quantified expressions –Supports specification inheritance –Works with abstract specifications –Thus, provides a practical, formal specification-based debugging (and testing) tool to Java programmers JML distribution available from www.jmlspecs.org