Alias Annotations for Program Understanding Jonathan Aldrich Valentin Kostadinov Craig Chambers University of Washington

November 8, 2002AliasJava - OOPSLA '022 Building Big Systems is Hard The ArchJava Project –Software architecture for managing complexity –Previous work: control flow ICSE ’02, ECOOP ’02 –This paper: data sharing component Acomponent Bcomponent C calls shared data

November 8, 2002AliasJava - OOPSLA '023 Why Specify Data Sharing? Evolve programs –Modify component A to update data lazily Improves efficiency –Must update component C as well! Might not be obvious without sharing specification component Acomponent Bcomponent C calls shared data

November 8, 2002AliasJava - OOPSLA '024 Maintain Invariants _ class SynchronizedSet { Set backingSet; synchronized boolean add(Object o) { return backing.add(o); Synchronization wrappers –Wrap a collections methods –Synchronize before invoking method Wrapper invariant –Must access backing set only through wrapper set wrapper client X

November 8, 2002AliasJava - OOPSLA '025 Avoid Security Holes (JDK 1.1.1) public class Class { public Object[] getSigners() { return signers; } Returns an internal array, rather than a copy Allows untrusted clients access –Can change the list of signatures for a class signers Class client X

November 8, 2002AliasJava - OOPSLA '026 Type-based Approaches Many previous systems –Uniqueness [Minsky, Boyland…] –Ownership types [Clarke et al, Boyapati et al...] Advantages –Modular, efficient checking –Documents aliasing in the code Challenges –Express common idioms –Support for Java constructs –Usability in practice

November 8, 2002AliasJava - OOPSLA '027 Outline AliasJava: alias annotations for Java –Combines uniqueness and ownership Supports full language –Arrays, casts, iterators, inner classes, subtyping Algorithm infers annotations Guarantee of properties Evaluated on library, application code

November 8, 2002AliasJava - OOPSLA '028 Annotations: Unique static unique Set… synchronizedSet…(unique Set… s) { return new SynchronizedSet…(s); } // s is dead after use in constructor // o goes out of scope here unique objects have no persistent aliases –Newly allocated objects Can only use once –Variable must be dead after use set Unique reference

November 8, 2002AliasJava - OOPSLA '029 Annotations: Unique static unique Set… synchronizedSet…(unique Set… s) { return new SynchronizedSet…(s); } // s is dead after use in constructor // o goes out of scope here unique objects have no persistent aliases –Newly allocated objects Can only use once –Variable must be dead after use setUnique reference X

November 8, 2002AliasJava - OOPSLA '0210 Annotations: Owned private owned Object[…] signers; public Object[…] getSigners() { return signers; } owned objects confined within their owner –Aliasing allowed within owner Cannot return owned state to clients Making a copy fixes the security hole Compile-time error Class signers client X

November 8, 2002AliasJava - OOPSLA '0211 Annotations: Owned private owned Object[…] signers; public unique Object[…] getSigners() { return arraycopy(signers); } owned objects confined within their owner –Aliasing allowed within owner Cannot return owned state to clients Making a copy fixes the security hole Class signers client copy

November 8, 2002AliasJava - OOPSLA '0212 Annotations: Parameters class ArrayList { private owned Object[elem_owner] elems; void add(int i, elem_owner Object o) { elems[i] = o; } Parameterized by element owner Method parameterization also supported owner element List array

November 8, 2002AliasJava - OOPSLA '0213 Annotations: Shared static shared Object singleton; unique Object[shared] getSigners() { return arraycopy(signers); } shared objects may be globally aliased –Singletons –Static fields –Global data Conceptually “owned by the system” shared

November 8, 2002AliasJava - OOPSLA '0214 Annotations: Lent int find(lent Object o) { for (int i = 0;...) { if elems[i] == o return i; Temporary alias of unique/owned object –Used for duration of method –Cannot store in fields Syntactically default

November 8, 2002AliasJava - OOPSLA '0215 Annotation Flow unique Object uniq = new Object(); owned Object own = uniq; lent Object l = own; shared Object sh = own; // error unique owned lent sharedparam1 param2...

November 8, 2002AliasJava - OOPSLA '0216 Implementation AliasJava supports all features of Java –Subtyping –Inner classes –Casts Interoperates with existing code –Just annotate the interface of legacy libraries Checking is dynamic only where Java’s is –run-time type information for alias parameters –checks at casts and array writes

November 8, 2002AliasJava - OOPSLA '0217 Annotation Inference class ArrayList { private owned Object elems[A]; void put(int i, A Object o) { elems[i] = o; } Saves tedious annotation work Infers general annotations –Edit annotations to improve understandability –Future work: annotation assistant

November 8, 2002AliasJava - OOPSLA '0218 Properties: Ownership Common property: owners-as-dominators All paths to owned objects go through owner Prevents clients from accessing owned state –Clarke et al.: allow owned objects on stack Patterns like Observer are prohibited –Boyapati et al.: inner classes may access owned state Can’t implement Iterators/Observers with ordinary classes owned array ClientArrayList X

November 8, 2002AliasJava - OOPSLA '0219 Properties: Ownership Common property: owners-as-dominators All paths to owned objects go through owner Problem: Iterators violate owners-as-dominators –Clarke et al.: allow Iterators on stack Patterns like Observer prohibited –Boyapati et al.: inner classes access owned state Can’t implement with ordinary classes owned array ClientArrayList Iterator X

November 8, 2002AliasJava - OOPSLA '0220 Properties: Ownership Common property: owners-as-dominators All paths to owned objects go through owner Problem: Iterators violate owners-as-dominators –Clarke et al.: allow Iterators on stack Patterns like Command prohibited –Boyapati et al., Clarke: inner classes access owned state Can’t implement with ordinary classes state ClientDocument Command X

November 8, 2002AliasJava - OOPSLA '0221 Ownership Capability Model Owned objects are only accessible by their owner and the objects to which it grants a capability General model –Owner grants a capability to trusted objects

November 8, 2002AliasJava - OOPSLA '0222 Ownership Capability Model Owned objects are only accessible by their owner and the objects to which it grants a capability class ArrayList { private owned Object elems[elem_owner]; unique Iterator iterator() { return new ArrayItr (elems); owned capability –Access to ArrayList’s owned state –Passed via static parameterization –ArrayList controls who accesses state

November 8, 2002AliasJava - OOPSLA '0223 Ownership Capability Model Owned objects are only accessible by their owner and the objects to which it grants a capability class ArrayList { private owned Object elems[elem_owner]; unique Iterator iterator() { return new ArrayItr (elems); Compare annotations –owned parameter lost by subsumption –Clients cannot access owned state

November 8, 2002AliasJava - OOPSLA '0224 Ownership Capability Model Owned objects are only accessible by their owner and the objects to which it grants a capability int find(lent Object o) lent capability –Temporary permission to access owned state –find can access o for duration of call

November 8, 2002AliasJava - OOPSLA '0225 Properties: Uniqueness If a variable is unique, it has no aliases other than lent variables on the stack Reasoning –No aliases in heap data structures –Still must track lent aliases on the stack Extension: Alias Burying [Boyland] –When a unique var is read, all aliases are dead –Requires read/write effect specifications

November 8, 2002AliasJava - OOPSLA '0226 AliasFJ : A Formal Framework Based on Featherweight Java [OOPSLA 99] –Includes unique, owned, parameters, and lent Benefits –Precise semantics –Shows how properties are enforced Theorems –Type safety –Ownership property –Uniqueness property

November 8, 2002AliasJava - OOPSLA '0227 Evaluation: java.util.Hashtable public class Hashtable extends Dictionary { value_owner Object get(key_owner Object k) {... Annotated and checked Hashtable –1000 lines of code, 2.5 hours –Annotated some library functions Experience –Annotations were natural, easy to add –Changed code in only one place

November 8, 2002AliasJava - OOPSLA '0228 Enforcing Library Invariants static unique Set synchronizedSet (unique Set s) { return new SynchronizedSet (s); } Javadoc comment: In order to guarantee serial access, it is critical that all access to the backing set is accomplished through the returned set. AliasJava: argument is unique –Therefore, there are no aliases to the backing set

November 8, 2002AliasJava - OOPSLA '0229 Evaluation: Aphyds Pedegogical circuit layout application –Blackboard Architecture Annotated functional core of system –7 classes, 3500 lines of code Showed sharing of circuit elements Circuit DBPartition Place Route Floorplan ChannelRoute

November 8, 2002AliasJava - OOPSLA '0230 Evaluation: Aphyds Pedegogical circuit layout application –Blackboard Architecture Annotated functional core of system –7 classes, 3500 lines of code Showed sharing of circuit elements Circuit DBPartition Place Route Floorplan ChannelRoute circuit objects

November 8, 2002AliasJava - OOPSLA '0231 More in the Paper Application to software architecture Detailed semantics Implementation technique Inference algorithm Case study on 3000 lines of application code

November 8, 2002AliasJava - OOPSLA '0232 AliasJava Combines object ownership and uniqueness Aids reasoning in large systems Expressive enough to use in existing code Try out AliasJava!