1. Extended Static Checking for Java Cormac Flanagan Joint work with: Rustan Leino, Mark Lillibridge, Greg Nelson, Jim Saxe, and Raymie Stata

2. What is “Static Checking”? Annotated Source Code StaticChecker Error:... type systems type systems Error: wrong number of arguments in method call lint lint Error: unreachable code full program verification full program verification Error: qsort does not yield a sorted array

3. Comparison of Static Checkers Quality 100% Effort fullverification lint typesystems ExtendedStaticChecking Note: Graph is not to scale ESCModula-3 ESCJava

4. ESC/Java  Detect common run-time errors null dereferences null dereferences array bounds array bounds type casts type casts race conditions race conditions deadlocks deadlocks......  Check other properties object invariants object invariants method specifications method specifications......

5. Architecture of ESC/Java Annotated program Verification condition generator Automatic theorem prover Counter-example  x.  y. (x > y =>...) Error: index out of bounds on line 218 when x = 4 and y = 3

6. Not Full Verification  Prove absence of run-time errors, not full functional correctness Simpler method specifications Simpler method specifications Verification conditions easier to prove Verification conditions easier to prove

7. Example void sort2(int[] a) void sort2(int[] a) { if( a[0] < a[1] ) if( a[0] < a[1] ) { int t = a[0]; int t = a[0]; a[0] = a[ ]; a[0] = a[ ]; a[1] = t; a[1] = t; } } Error: possible null dereference at line 5 Error: possible index out of bounds at line 5 //@ ensures a[0] <= a[1] //@ requires a != null && a.length == 2 Error: possible index out of bounds at line 8 21 Error: postcondition not achieved No more errors detected :-( >

8. Under the Hood  Verification condition large but “dumb”  Proved in < 1 second (FORALL (t1) (FORALL (t2) (IMPLIES (AND (NEQ a null) (EQ (arrayLength a) 2)) (AND (NEQ a null) (AND (AND ( (select (select elem a) 0) (select (select elem a) 1)) (FORALL (t3) (AND (NEQ a null) (AND (AND ( (select (select elem a) 0) (select (select elem a) 1))) (AND (<= (select (select elem a) 0) (select (select elem a) 1)) (EQ true true)))))))))))

9. ESC/Java vs. Testing  Testing essential but Expensive Expensive Finds errors late Finds errors late Misses errors Misses errors  ESC/Java... ?

10. ESC/Java Summary  Finds more errors than type checking  Costs less than full verification  Currently working on small test programs www.research.digital.com/SRC/esc/Esc.html

11. Comparison of Static Checkers Quality 100% Effort fullverification lint typesystems decidabilitylimit ExtendedStaticChecking Note: Graph is not to scale

12. Metrics for Static Checkers  Cost of using the tool  Quality Does it miss errors? Does it give spurious warnings?