Type Safe Nondeterminism A Formal Semantics of Java Threads Andreas - PowerPoint PPT Presentation

Type Safe Nondeterminism A Formal Semantics of Java Threads Andreas Lochbihler University of Passau Germany 01/13/2008 Funded by DFG grant Sn11/10-1 Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 1 / 17

Overview Motivation 1 Java threads 2 Formalisation 3 The Jinja and framework semantics Deadlock vs. progress Type safety for Jinja Summary 4 Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 2 / 17

Motivation The goal Our goal: Formalise Java thread semantics Show type safety In a theorem prover Benefits: Solid basis for formal verification problems Language based security (LBS) Proof carrying code (PCC) Starting point: Jinja semantics (Nipkow, Klein, TOPLAS’06) Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 3 / 17

Motivation Type safety Type safety Well-typed programs evaluate fully and No untrapped errors can occur Proof technique (Wright, Felleisen ’94): Progress Semantics cannot get stuck (as long as some threads are not deadlocked yet) Preservation Evaluating a well-typed statement results in another well-typed statement with equal or smaller type Challenge: Deadlock can break progress property Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 4 / 17

Java threads Java thread features Dual nature of threads: Objects of class Thread Execution contexts spawned by start() Communication via shared memory Synchronization via locking Deadlocks to break progress Synthesized methods in Object : wait() notify() notifyAll() Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 5 / 17

Java threads Java deadlock example Thread (I) Thread (II) Thread (III) synchronized (f) { synchronized (g) { synchronized (e) { synchronized (g) { synchronized (e) { synchronized (f) { ··· ··· ··· ··· g.wait(); g.notify(); ··· ··· ··· } } } } } } I II Objects e f g Wait set: {} {} {} III Locked by: Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 6 / 17

Java threads Java deadlock example Thread (I) Thread (II) Thread (III) synchronized (f) { synchronized (g) { synchronized (e) { synchronized (g) { synchronized (e) { synchronized (f) { ··· ··· ··· ··· g.wait(); g.notify(); ··· ··· ··· } } } } } } Request lock on f I II Objects e f g Wait set: {} {} {} III Locked by: Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 6 / 17

Java threads Java deadlock example Thread (I) Thread (II) Thread (III) synchronized (f) { synchronized (g) { synchronized (e) { synchronized (g) { synchronized (e) { synchronized (f) { ··· ··· ··· ··· g.wait(); g.notify(); ··· ··· ··· } } } } } } I II Objects e f g Wait set: {} {} {} III Locked by: I Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 6 / 17

Java threads Java deadlock example Thread (I) Thread (II) Thread (III) synchronized (f) { synchronized (g) { synchronized (e) { synchronized (g) { synchronized (e) { synchronized (f) { ··· ··· ··· ··· g.wait(); g.notify(); ··· ··· ··· } } } } } } Request lock on g I II Objects e f g Wait set: {} {} {} III Locked by: I Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 6 / 17

Java threads Java deadlock example Thread (I) Thread (II) Thread (III) synchronized (f) { synchronized (g) { synchronized (e) { synchronized (g) { synchronized (e) { synchronized (f) { ··· ··· ··· ··· g.wait(); g.notify(); ··· ··· ··· } } } } } } I II Objects e f g Wait set: {} {} {} III Locked by: I II Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 6 / 17

Java threads Java deadlock example Thread (I) Thread (II) Thread (III) synchronized (f) { synchronized (g) { synchronized (e) { synchronized (g) { synchronized (e) { synchronized (f) { ··· ··· ··· ··· g.wait(); g.notify(); ··· ··· ··· } } } } } } Request lock on e I II Objects e f g Wait set: {} {} {} III Locked by: I II Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 6 / 17

Java threads Java deadlock example Thread (I) Thread (II) Thread (III) synchronized (f) { synchronized (g) { synchronized (e) { synchronized (g) { synchronized (e) { synchronized (f) { ··· ··· ··· ··· g.wait(); g.notify(); ··· ··· ··· } } } } } } I II Objects e f g Wait set: {} {} {} III Locked by: III I II Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 6 / 17

Java threads Java deadlock example Thread (I) Thread (II) Thread (III) synchronized (f) { synchronized (g) { synchronized (e) { synchronized (g) { synchronized (e) { synchronized (f) { ··· ··· ··· ··· g.wait(); g.notify(); ··· ··· ··· } } } } } } Request lock on g I II Objects e f g Wait set: {} {} {} III Locked by: III I II Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 6 / 17

Java threads Java deadlock example Thread (I) Thread (II) Thread (III) synchronized (f) { synchronized (g) { synchronized (e) { synchronized (g) { synchronized (e) { synchronized (f) { ··· ··· ··· ··· g.wait(); g.notify(); ··· ··· ··· } } } } } } Request lock on g Request lock on e I II Objects e f g Wait set: {} {} {} III Locked by: III I II Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 6 / 17

Java threads Java deadlock example Thread (I) Thread (II) Thread (III) synchronized (f) { synchronized (g) { synchronized (e) { synchronized (g) { synchronized (e) { synchronized (f) { ··· ··· ··· ··· g.wait(); g.notify(); ··· ··· ··· } } } } } } Request lock on g Request lock on e Request lock on f I II Objects Deadlock e f g Wait set: {} {} {} III Locked by: III I II Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 6 / 17

Java threads Java deadlock example with wait sets Thread (I) Thread (II) Thread (III) synchronized (f) { synchronized (g) { synchronized (e) { synchronized (g) { synchronized (e) { synchronized (f) { ··· ··· ··· ··· g.wait(); g.notify(); ··· ··· ··· } } } } } } Z Z Z I II Objects e f g Wait set: {} {} {} III Locked by: Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 7 / 17

Java threads Java deadlock example with wait sets Thread (I) Thread (II) Thread (III) synchronized (f) { synchronized (g) { synchronized (e) { synchronized (g) { synchronized (e) { synchronized (f) { ··· ··· ··· ··· g.wait(); g.notify(); ··· ··· ··· } } } } } } Request lock on f Z Z Z I II Objects e f g Wait set: {} {} {} III Locked by: Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 7 / 17

Java threads Java deadlock example with wait sets Thread (I) Thread (II) Thread (III) synchronized (f) { synchronized (g) { synchronized (e) { synchronized (g) { synchronized (e) { synchronized (f) { ··· ··· ··· ··· g.wait(); g.notify(); ··· ··· ··· } } } } } } Z Z Z I II Objects e f g Wait set: {} {} {} III Locked by: I Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 7 / 17

Java threads Java deadlock example with wait sets Thread (I) Thread (II) Thread (III) synchronized (f) { synchronized (g) { synchronized (e) { synchronized (g) { synchronized (e) { synchronized (f) { ··· ··· ··· ··· g.wait(); g.notify(); ··· ··· ··· } } } } } } Request lock on g Z Z Z I II Objects e f g Wait set: {} {} {} III Locked by: I Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 7 / 17

Java threads Java deadlock example with wait sets Thread (I) Thread (II) Thread (III) synchronized (f) { synchronized (g) { synchronized (e) { synchronized (g) { synchronized (e) { synchronized (f) { ··· ··· ··· ··· g.wait(); g.notify(); ··· ··· ··· } } } } } } Z Z Z I II Objects e f g Wait set: {} {} {} III Locked by: I I Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 7 / 17

Java threads Java deadlock example with wait sets Thread (I) Thread (II) Thread (III) synchronized (f) { synchronized (g) { synchronized (e) { synchronized (g) { synchronized (e) { synchronized (f) { ••• ··· ··· ··· g.wait(); g.notify(); ··· ··· ··· } } } } } } Z Z Z I II Objects e f g Wait set: {} {} {} III Locked by: I I Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 7 / 17

Java threads Java deadlock example with wait sets Thread (I) Thread (II) Thread (III) synchronized (f) { synchronized (g) { synchronized (e) { synchronized (g) { synchronized (e) { synchronized (f) { ··· ··· ··· ··· g.wait(); g.notify(); ··· ··· ··· } } } } } } Wait on notify Z Z Z I II Objects e f g Wait set: {} {} { I } III Locked by: I Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 7 / 17

Java threads Java deadlock example with wait sets Thread (I) Thread (II) Thread (III) synchronized (f) { synchronized (g) { synchronized (e) { synchronized (g) { synchronized (e) { synchronized (f) { ··· ··· ··· ··· g.wait(); g.notify(); ··· ··· ··· } } } } } } Wait on notify Request lock on e Z Z Z I II Objects e f g Wait set: {} {} { I } III Locked by: I Andreas Lochbihler Type Safe Nondeterminism FOOL ’08 7 / 17