Making Void Safety Practical

Transcription

1 Making Void Safety Practical Alexander Kogtenkov

2 Problem Overview of Void safety components Object initialization issue Examples Solutions Results 2

3 Problem expr.method (args); 3

4 Problem expr.method (args); tmp = expr; if (tmp == null) throw new NullPointerException (); else tmp.method (args); 3

5 NullPointerException in Java applets on new MacOS

6 NullPointerException in Java applets on new MacOS Problem: NullPointerException in Java applets on new MacOS Source: Java TM SE Development Kit 8, 8u111 Update Release Notes Bug number: JDK Description: A user presses modifier keys (such as Command, Shift, or Alt) while an applet is running in a browser What to do? Dismiss the applet Rerun [it] while not pressing a modifier key Install JRE 8u112 Created: Closed:

7 Statistics Number of null-pointer issues Year average Null pointer issues (such as null pointer dereferencing) in Common Vulnerabilities and Exposures database (funded by CERT) 5

8 Approaches Review source sound Language manual unsound binary Testing automated Binary analysis 6

9 Approaches Review source sound Language manual unsound binary Testing automated Binary analysis 6

10 Void safety Run-time 7

11 Void safety Compile-time = Run-time 7

12 Components of void safety Type system Object initialization Certified attachment patterns (CAP) 8

13 Components of void safety Type system target target := source detachable source attached detachable attached 8

14 Components of void safety Type system Attached Type system Conformance: Detachable 8

15 Components of void safety Type system Object initialization Attached a Type system Detachable 8

16 Components of void safety Type system Object initialization Attached a Initialization Type system a x Detachable 8

17 Components of void safety Type system Object initialization Certified attachment patterns (CAP) a := x Initialization Attached Type system Detachable 8

18 CAP Components of void safety Type system Object initialization Certified attachment patterns (CAP) if x /= Void then a := x Initialization Attached Type system Detachable 8

19 CAP Components of void safety Type system Object initialization Certified attachment patterns (CAP) Initialization Attached Type system Detachable 8

20 Example 1: polymorphic call class A create make feature make do x :=... f x: X init do... f do... A x 9

21 Example 1: polymorphic call class A create make feature make do x :=... f x: X init do... f do... class D inherit A redefine init, f create make feature y: Y init do y :=... f do y.something D x y 9

22 Example 1: polymorphic call class A create make feature make do x :=... init; f x: X init do... f do... class D inherit A redefine init, f create make feature y: Y init do y :=... f do y.something D x y 9

23 Example 2: callback class A create make feature make a local b: B do create b.make b (Current) x :=... x: X f do x.something A 1 make b 2 f B class B create make b feature make b (a: A) do... a.f... 10

24 Example 2: callback class A create make feature make a local b: B do x :=... create b.make b (Current) x: X f do x.something A 1 make b 2 f B class B create make b feature make b (a: A) do... a.f... 10

25 Example 3: mediator class A create make feature make (m: M) do m.register (Current) x :=... x: X notify do x.something A 1 register 3 notify M class M... feature register (a: A) do list.ext (a) notify do across list as c do c.item.notify 2 notify 11

26 Example 3: mediator class A create make feature make (m: M) do x :=... m.register (Current) x: X notify do x.something A 1 register 3 notify M class M... feature register (a: A) do list.ext (a) notify do across list as c do c.item.notify 2 notify 11

27 How can it be done? Time Alexander J. Summers and Peter Müller Freedom Before Commitment Initialized Current All attributes are set Creation procedure Regular execution 12

28 How can it be done? Time Alexander J. Summers and Peter Müller Freedom Before Commitment Initialized Current All attributes are set Creation procedure Regular execution Polymorphic call Callback? Mediator 12

29 How can it be done? Time Alexander J. Summers and Peter Müller Freedom Before Commitment Initialized Current All attributes are set Creation procedure Regular execution Additional annotations Cannot register new objects in existing structures 12

30 Static analysis: simple rule Time Initialized Current All attributes are set Creation procedure Regular execution V = V Current c Current 13

31 Static analysis: simple rule Time Initialized Current All attributes are set Creation procedure Regular execution Polymorphic call Callback Mediator 13

32 Static analysis: simple rule Time Initialized Current All attributes are set Creation procedure Regular execution No annotations All scenarios 13

33 Static analysis: simple rule Time Initialized Current All attributes are set Creation procedure Regular execution No annotations All scenarios so far 13

34 Simple rule: practice 2%? 98% 14

35 Simple rule: practice 98% 2% circular references 14

36 Circular references class DOCUMENT feature root: ELEMENT... class ELEMENT feature parent: DOCUMENT Document root. parent. Element 2. Document root. parent. Element 3. Document root. parent. Element 15

37 Q: What could go wrong? Document root. parent. Element class DOCUMENT create make feature root: ELEMENT make do create root.make (Current) class ELEMENT create make feature parent: DOCUMENT make (p: DOCUMENT) do parent := p 16

38 Q: What could go wrong? Document root. parent. Element class DOCUMENT create make feature root: ELEMENT make do create root.make (Current) class ELEMENT create make feature parent: DOCUMENT make (p: DOCUMENT) do parent := p parent.root.something 16

39 Q: What could go wrong? Document root. parent. Element class DOCUMENT create make feature root: ELEMENT make do create root.make (Current) class ELEMENT create make feature parent: DOCUMENT make (p: DOCUMENT) do parent := p parent.root.something A: Qualified call 16

40 Solution Time Unused Current No qualified calls Initialized Current All attributes are set Creation procedure Regular execution S, V Current c Current 17

41 Solution Time Unused Current No qualified calls Initialized Current All attributes are set Creation procedure Regular execution S, V Current c Current S, V e c S, V > e es [ c] S, V e n (es) safe (e es) V c Call 17

42 Solution Time Unused Current No qualified calls Initialized Current All attributes are set Creation procedure Regular execution Polymorphic call Callback Mediator Circular references 17

43 Solution Time Unused Current No qualified calls Initialized Current All attributes are set Creation procedure Regular execution No additional annotations All existing code 1% compilation time increase 17

44 Comparison with existing approaches Approach polymorphic call Examples callback mediator circular references Annotations Raw types 2+ Masked types many Free/committed types? 1+ Targeted expressions 0 Abstract interpretation 0 Practical void safety 0 18

45 Comparison with existing approaches Approach polymorphic call Examples callback mediator circular references Annotations Modularity Raw types 2+ class Masked types many? Free/committed types? 1+ class Targeted expressions 0 system Abstract interpretation 0 system Practical void safety 0 library 18

46 Key features Annotationfree Expressive Modular Fast 19

47 expr.method (args); tmp = expr; if (tmp == null) throw new NullPointerException (); else tmp.method (args); 20