Probabilistic, modular and scalable inference of typestate specifications

ABSTRACT

Static analysis tools aim to find bugs in software that correspond to violations of specifications. Unfortunately, for large and complex software, these specifications are usually either unavailable or sophisticated, and hard to write.

This paper presents ANEK, a tool and accompanying methodology for inferring specifications useful for modular typestate checking of programs. In particular, these specifications consist of pre and postconditions along with aliasing annotations known as access permissions. A novel feature of ANEK is that it can generate program specifications even when the code under analysis gives rise to conflicting constraints, a situation that typically occurs when there are bugs. The design of ANEK also makes it easy to add heuristic constraints that encode intuitions gleaned from several years of experience writing such specifications, and this allows it to infer specifications that are better in a subjective sense. The ANEK algorithm is based on a modular analysis that makes it fast and scalable, while producing reliable specifications. All of these features are enabled by its underlying probabilistic analysis that produces specifications that are very likely.

Our implementation of ANEK infers access permissions specifications used by the PLURAL [5] modular typestate checker for Java programs. We have run ANEK on a number of Java benchmark programs, including one large open-source program(approximately 38K lines of code), to infer specifications that were then checked using PLURAL. The results for the large benchmark show that ANEK can quickly infer specifications that are both accurate and qualitatively similar to those written by hand, and at 5% of the time taken to manually discover and hand-code the specifications.

References

1. R. Alur, P. Černý, P. Madhusudan, and W. Nam. Synthesis of interface specifications for java classes. In POPL '05: Principles of Programming Languages, pages 98--109, 2005.
2. M. Barnett and K. R. M. Leino. Weakest-precondition of unstructured programs. In PASTE '05: Program Analysis For Software Tools and Engineering, pages 82--87, 2005.
3. N. E. Beckman, K. Bierhoff, and J. Aldrich. Verifying correct usage of atomic blocks and typestate. In OOPSLA '08: Object Oriented Programming Systems, Languages, and Applications, pages 227--244, 2007.
4. K. Bierhoff. API Protocol Compliance in Object-Oriented Software. PhD thesis, Carnegie Mellon University, April 2009.
5. K. Bierhoff and J. Aldrich. Modular typestate checking of aliased objects. In OOPSLA '07: Object Oriented Programming Systems, Languages and Applications, pages 301--320, 2007.
6. K. Bierhoff, N. E. Beckman, and J. Aldrich. Practical API protocol checking with access permissions. In ECOOP '09: European Conference on Object-Oriented Programming, pages 195--219, July 2009.
7. J. Boyland. Checking interference with fractional permissions. In SAS '03: Static Analysis Symposium, pages 55--72. Springer, 2003.
8. J. Condit, B. Hackett, S. K. Lahiri, and S. Qadeer. Unifying type checking and property checking for low-level code. In POPL '09: Principles of Programming Languages, pages 302--314, 2009.
9. W. Dietl. Universe Types: Topology, Encapsulation, Genericity, and Tools. PhD thesis, ETH Zurich, December 2009.
10. C. Flanagan and K. R. M. Leino. Houdini, an annotation assistant for ESC/Java. In FME '01: International Symposium of Formal Methods Europe, pages 500--517, 2001.
11. C. Flanagan, K. R. M. Leino, M. Lillibridge, G. Nelson, J. B. Saxe, and R. Stata. Extended static checking for java. In PLDI '02: Programming Language Design and mplementation, pages 234--245, 2002.
12. C. Flanagan, K. R. M. Leino, M. Lillibridge, G. Nelson, J. B. Saxe, and R. Stata. Extended static checking for Java. In PLDI '02: Programming Language Design and Implementation, pages 234--245, 2002.
13. T. Kremenek, P. Twohey, G. Back, A. Ng, and D. Engler. From uncertainty to belief: Inferring the specification within. In OSDI '06: Operating Systems Design and Implementation, pages 161--176, 2006.
14. F. R. Kschischang, B. J. Frey, and H. A. Loeliger. Factor graphs and the sum-product algorithm. IEEE Transactions on Information Theory, 2 (47): 498--519, 2001.
15. B. Livshits, A. V. Nori, S. K. Rajamani, and A. Banerjee. Merlin: specification inference for explicit information flow problems. In PLDI '09: Programming Language Design and Implementation, pages 75--86, 2009.
16. T. Minka, J. Winn, J. Guiver, and D. Knowles. Infer.NET 2.4, 2010. Microsoft Research Cambridge. http://research.microsoft.com/infernet.
17. M. K. Ramanathan, A. Grama, and S. Jagannathan. Static specification inference using predicate mining. In PLDI '07: Programming Language Design and Implementation, pages 123--134, 2007.
18. R. E. Strom and S. Yemini. Typestate: A programming language concept for enhancing software reliability. IEEE Trans. Softw. Eng., 12 (1): 157--171, 1986.
19. T. Terauchi. Checking race freedom via linear programming. In PLDI '08: Programming Language Design and Implementation, pages 1--10, 2008.
20. J. Whaley,, M. C. Martin,, and M. S. Lam. Automatic extraction of object-oriented component interfaces. In ISSTA '02: International Symposium on Software Testing and Analysis, pages 218--228, 2002.
21. J. Yang, D. Evans, D. Bhardwaj, T. Bhat, and M. Das. Perracotta: Mining temporal API rules from imperfect traces. In ICSE '06: International Conference on Software engineering, pages 282--291, 2006.
22. H. Zhong, T. Xie, L. Zhang, J. Pei, and H. Mei. MAPO: Mining and recommending api usage patterns. In ECOOP '09: European Conference on Object-Oriented Programming, pages 318--343, 2009.

Index Terms

• General and reference

  • Cross-computing tools and techniques

    • Verification

• Software and its engineering

  • Software creation and management

    • Software development process management

    • Software verification and validation

      • Formal software verification

  • Software organization and properties

    • Software functional properties

      • Formal methods

        • Software verification

• Theory of computation

  • Semantics and reasoning

    • Program reasoning

      • Program verification