Javarifier: inference of reference immutability Jaime Quinonez - PowerPoint PPT Presentation

print(Object x) { print( @Readonly Object x) { … … } } Javarifier: inference of reference immutability Jaime Quinonez Matthew S. Tschantz Michael D. Ernst MIT

Security code in JDK 1.1 class Class { private Object[] signers; Object[] getSigners() { return signers; } }

Security code in JDK 1.1 class Class { private Object[] signers; Object[] getSigners() { return signers; } } myClass.getSigners()[0] = “Sun”;

Immutability annotations prevent mutation errors class Class { private Object[] signers; // Prohibits client from mutating @Readonly Object[] getSigners() { return signers; } } myClass.getSigners()[0] = “Sun”; // Error

Immutability annotations prevent mutation errors class Class { // Forces getSigners to return a copy private @Readonly Object[] signers; Object[] getSigners() { return signers; // Error } } myClass.getSigners()[0] = “Sun”;

Reasoning about side effects • Machine-checked formal documentation • Error detection • Verification • Enables analyses • Enables transformations and optimizations • Case studies: expressive, natural, useful – 300 KLOC of programmer-written code

Type-checking requires annotations • Easy for new programs • Tedious for legacy programs • Worst for libraries: large, hard to understand • Library annotations cannot be omitted // Assume user program is fully annotated @Readonly MyClass x = …; x.toString(); // OK x.mutate(); // Error System.out.println(x); // False error! • Library declares println as: void println (Object) { … } • But it should be: void println(@Readonly Object) { … }

Immutability inference algorithm • Sound • Precise (complete) • Linear time • Rich, practical type system: Javari [Tschantz 2005] • Context-sensitive – Type polymorphism (Java generics and wildcards) – Mutability polymorphism (type qualifier polymorphism) – Containing-object context (deep immutability) • Infers abstract state • Handles partially-annotated code, unanalyzable code

Immutability inference implementation • Implements the full algorithm • Handles all of Java • Works on bytecodes • Inserts results in source or .class file • Scales to >100 KLOC • Verified by independent typechecker • Verified by comparison to other tools • Publicly available: – http://pag.csail.mit.edu/javari/javarifier/

Javari type system • A given reference cannot be used to modify its referent – Other references to the object may modify it • Deep: the transitively reachable state (the abstract state) is protected • Generics: List<@Readonly Date> • Mutability polymorphism: @Polyread Object id(@Polyread arg) { return arg; }

Algorithm: propagate mutability • Syntax-directed constraint generation • Unconditional constraint: x – x is mutable – Example code: x.field = 22; • Conditional constraint: y  z – if y is mutable, then z is mutable – Example code: y = z; • Constraint solving: graph reachability – Unmarked references remain readonly

Appointment class class Appt { Receivers are written explicitly private Date d; void setDate(Appt this, Date newDate) { this.d = newDate; } Date getDate(Appt this) { class Date { Date result = this.d; private long time; return result; } … void reset(Appt this) { void setTime(Date this, long newTime) { Date thisDate = this.d; this.time = newTime; setTime(thisDate, 0); } } } }

Assignment class Appt { Sample code: x.f = y; private Date d; Constraints: { x, void setDate(Appt this, f  y } Date newDate) { this.d = newDate; } Date getDate(Appt this) { class Date { Date result = this.d; private long time; return result; } … void reset(Appt this) { void setTime(Date this, long newTime) { Date thisDate = this.d; this.time = newTime; setTime(thisDate, 0); } } } }

Assignment class Appt { Sample code: x.f = y; private Date d; Constraints: { x, void setDate(Appt this , f  y } Date newDate) { this.d = newDate; } Date getDate(Appt this) { class Date { Date result = this.d; private long time; return result; } … void reset(Appt this) { void setTime(Date this, long newTime) { Date thisDate = this.d; this.time = newTime; setTime(thisDate, 0); } } } }

Dereference class Appt { Sample code: x = y.f; private Date d; { x  f, Constraints: void setDate(Appt this, x  y } Date newDate) { this.d = newDate; } Date getDate(Appt this) { class Date { Date result = this.d; private long time; return result; } … void reset(Appt this) { void setTime(Date this, long newTime) { Date thisDate = this.d; this.time = newTime; setTime(thisDate, 0); } } } }

Method invocation class Appt { Sample code: x = m(y1); private Date d; { param1  y1, Constraints: void setDate(Appt this, x  ret } Date newDate) { this.d = newDate; } Date getDate(Appt this) { class Date { Date result = this.d; private long time; return result; } … void reset(Appt this) { void setTime(Date this, long newTime) { Date thisDate = this.d; this.time = newTime; setTime(thisDate, 0); } } } }

All constraints class Appt { private Date d; void setDate(Appt this , Date newDate) { this.d = newDate; } Date getDate(Appt this) { class Date { Date result = this.d; private long time; return result; } … void reset(Appt this) { void setTime(Date this , long newTime) { Date thisDate = this.d; this.time = newTime; setTime(thisDate, 0); } } } }

Propagate mutability via graph reachability class Appt { private Date d; void setDate(Appt this , Date newDate) { this.d = newDate; } Date getDate(Appt this) { class Date { Date result = this.d; private long time; return result; } … void reset(Appt this) { void setTime(Date this , long newTime) { Date thisDate = this.d; this.time = newTime; setTime(thisDate, 0); } } } }

Javarifier: inference of reference immutability Jaime Quinonez - PowerPoint PPT Presentation

print(Object x) { print( @Readonly Object x) { } } Javarifier: inference of reference immutability Jaime Quinonez Matthew S. Tschantz Michael D. Ernst MIT Security code in JDK 1.1 class Class { private Object[] signers;

Object and Reference Immutability using Java Generics Yoav Zibin, Alex Potanin(*), Mahmood Ali,

Type-based Object Immutability with Flexible Initialization Christian Haack 1 , 2 and Erik

Ownership and Immutability in Generic Java (OIGJ) Yoav Zibin + , Alex Potanin * Paley Li * ,

In a world where bindings and values Immutability: obstacle or tool? are

Principles of Software Construction: Class invariants, immutability, and testing Josh Bloch

Reference Card Jean-Raymond Abrial and Thai Son Hoang April 2008 Contents 1 - Logic Rules of

Type-based Object Immutability with Flexible Initialization Christian Haack 1 , 2 Erik Poll 1 1

Glacier: Usable Enforcement of Transitive Immutability Michael Coblenz, Whitney Nelson, Jonathan

Buy a Feature Adventure in Immutability and Actors David Pollak CUFP September 26 th , 2008

Exact Inference Inference Basic task for inference: Compute

CSE 331 Mutation and immutability slides created by Marty Stepp based on materials by M. Ernst,

Immutability, or Putting the Dream Machine to Work The trie memory scheme is ine ffi cient for

Immutability, or Putting the Dream Machine to Work The trie memory scheme is ine ffi cient for

A typed calculus for unique access and immutability Paola Giannini (1) , Marco Servetto (2) ,

Inference in Bayesian networks Chapter 14.45 Chapter 14.45 1 Outline Exact inference

Inference in First-Order Logic C H A P T E R 9 H A S S A N K H O S R A V I S P R I N G 2 0 1 1

Bayesian Optimization for Likelihood-Free Inference Michael Gutmann

Inference in Bayesian networks Chapter 14.45 Chapter 14.45 1 Outline Exact inference

Type Inference 75 Definition Type Inference Type inference = Java compiler's ability

Causal Inference and Response Surface Modeling Inference and

Soft Inference and Posterior Marginals September 19, 2013 Soft vs. Hard Inference Hard

Greed is Good if Randomized: New Inference for Dependency

Variational Inference for GPs: Presenters Group1: Stochastic variational inference. Slides 2 - 28

Inference in first-order logic Chapter 9 1 Outline Reducing first-order inference to