context free grammars

Transcription

1 context free grammars in JavaMOP CS 119 a property can be seen as a language defined by a grammar

2 2

3

4 Instances of MOP MOP JavaMOP BusMOP HardwareMOP languages MOP JavaMOP BusMOP logic plugins ERE CFG LTL ptltl ptcaret today

5 the 4 elements context free languages pushdown Automata (theoretical concept) context free grammars parsers

6 Chomsky s language hierarchy

7 example context free languages and pushdown automata l n r n S! ² lsr input: llll rrrr ² q 1 l l l l $ q 4 ² top()=$! pop() q 3 ²! push($) q 2 l! push(l) r top()=l! pop() r top()=l! pop()

8 CFL parsers Consider the term: ax top-down parser expands non-terminals into RH-sides example grammar: S! Ax A! a A! b S! Ax! ax bottom-up parser reduces RH-sides to non-terminals LALR(1) ½ LR(1) ½ DCFL ½ CFL JavaMOP ax! Ax! S

9 structure of a table-driven bottom-up parser an input buffer a stack of states visited an action-table giving a grammar rule to apply given the current state and current terminal in input buffer a goto-table describing which new state it should go to

10 actions Shift - push token onto stack Reduce - remove handle from stack and push on corresponding nonterminal Accept - recognize sentence when stack contains only the distinguished symbol and input is empty Error - happens when none of the above is possible; means original input was not a sentence!

11 abstract algorithm start with an empty stack a "shift" action corresponds to pushing the current input symbol onto the stack a "reduce" action occurs when we have a handle on top of the stack. To perform the reduction, we pop the handle off the stack and replace it with the terminal on the LHS of the corresponding rule.

12 specification S! S S! epsilon the / example () () ( ) ( ) ( ) ( S) ( S ) ( S) ( S ) (S) SHIFT SHIFT SHIFT SHIFT RED(S) SHIFT RED(S) SHIFT RED(S) ACC

13 expressions example

14 recall structure of a table-driven bottom-up parser

15 JavaMOP specification event event productions : S -> S epsilon input $ 0

16 JavaMOP specification event event productions : S -> S epsilon input $ 1 0

17 JavaMOP specification event event productions : S -> S epsilon input $ 2 1 0

18 JavaMOP specification event event productions : S -> S epsilon input $

19 JavaMOP specification event event productions : S -> S epsilon input $

20 JavaMOP specification event event productions : S -> S epsilon input $

21 JavaMOP specification event event productions : S -> S epsilon input $

22 JavaMOP specification event event productions : S -> S epsilon input $

23 JavaMOP specification event event productions : S -> S epsilon input $

24 JavaMOP specification event event productions : S -> S epsilon input $

25 JavaMOP specification event event productions : S -> S epsilon input $

26 JavaMOP algorithm

27 properties of Java library APIs R 1 : There should be no two calls to next() without a call to hasnext() in between, on the same iterator.

28 an example class Test { public static void main(string[] args) { Vector<Integer> v1 = new Vector(); Vector<Integer> v2 = new Vector(); v1.add(1); v1.add(3); v2.add(5); v2.add(7); Iterator it1 = v1.iterator(); Iterator it2 = v2.iterator(); int sum = 0; if(it2.hasnext()) sum += (Integer)it2.next(); if(it1.hasnext()) sum += (Integer)it2.next(); System.out.println( sum(v2) = " + sum); should have been: if(it2.hasnext()) ) unguarded call: it2.next()

29 recall the regular expression specification partial centralized scope = global logic = ERE partial, matching against suffix trace HasNext(Iterator i) { event hasnext<i> : end(call(* i.hasnext())); event next<i> : begin(call(* i.next())); formula : next next validation handler{ System.err.println("*** call hasnext() before validation (not violation)

30 CFG Property in JavaMOP (trying to replicate the RE solution) partial centralized scope = global logic = CFG HasNext(Iterator i) { event hasnext<i> : end(call(* i.hasnext())); event next<i> : begin(call(* i.next())); productions : Pattern -> next next validation handler{ System.err.println("*** call hasnext() before in this case we can write the same spec more or less

31 recall this other regular expression (hasnext hasnext* next)* which was slightly too strong, but let s try to emulate it i) total trace semantics ii)looking for violation

32 CFG Property in JavaMOP centralized scope = global logic = CFG HasNext(Iterator i){ event hasnext<i> : end(call(* i.hasnext())); event next<i> : begin(call(* i.next())); productions : Iterate -> hasnext HasnextStar next Iterate epsilon, HasnextStar -> hasnext HasnextStar epsilon violation handler{ System.err.println("*** call hasnext() before no longer partial

33 DEMO ON SLIDES

34

35

36

37

38

39

40

41

42

43 END OF DEMO ON SLIDES

44 CFG Property in JavaMOP as a state machine /*@ centralized scope = global logic = CFG HasNext(Iterator i) { event hasnext<i> : end(call(* i.hasnext())); event next<i> : begin(call(* i.next())); productions : Iterate -> hasnext HasnextStar next Iterate epsilon, HasnextStar -> hasnext HasnextStar epsilon State0 -> hasnext State1 epsilon, State1 -> hasnext State1 next State0 violation handler{ System.err.println("*** call hasnext() before epsilon needed state machine like notation

45 suppose we changed the example class Test { public static void main(string[] args) { Vector<Integer> v1 = new Vector(); Vector<Integer> v2 = new Vector(); v1.add(1); v1.add(3); v2.add(5); v2.add(7); Iterator it1 = v1.iterator(); Iterator it2 = v2.iterator(); int sum = 0; if(it1.hasnext()) sum += (Integer)it2.next(); if(it1.hasnext()) sum += (Integer)it2.next(); System.out.println( sum(v2) = " + sum); change from: if(it2.hasnext()) to: if(it1.hasnext()) program still has the same error! does our latest spec still catch the error?

46 no: CFG property will not catch error centralized scope = global logic = CFG HasNext(Iterator i) { event hasnext<i> : end(call(* i.hasnext())); event next<i> : begin(call(* i.next())); productions : Iterate -> hasnext HasnextStar next Iterate epsilon, HasnextStar -> hasnext HasnextStar epsilon violation handler{ System.err.println("*** call hasnext() before the monitor generating event is hasnext since it occurs first (and not next!!) Since only operation on it2 is next, a monitor is not created.

47 CFG validation & violation CFG: makes most sense together with validation because the monitor generating events in a CFG are the first ones appearing (in JavaMOP). does not work well when searching for violation since one here potentially looks for event sequences that do not follow the grammar. ERE: makes sense with violation as well as validation because all events (with maximum number of parameters) are monitor generating.

48 properties of Java library APIs R 2 : An enumeration should not be propagated after the underlying vector has been changed.

49 CFG specification partial centralized scope = global logic = CFG SafeEnum (Vector v, Enumeration+ e) { works the same with or without the partial keyword. event create<e, v> : end(call(enumeration v.elements())) with (e); event updatesource<v> : end(call(* v.add*(..))) \/ \/ end(call(* v.set*(..))); event next<e> : begin(call(object e.nextelement())); productions : S -> create NextStar updatesource UpdateStar next, NextStar -> next NextStar epsilon, UpdateStar -> updatesource UpdateStar epsilon validation handler { System.out.println("the collection is changed during

50 indexing works as for regular expressions events: create<v,e> update<v> next<e> monitor creation event create <v,e> v 1 v 2 One index per parameter set. Weak references. e 1 e 2 e 3 v 1 v 2 e 1 e 2 e 3 update <v> next <e>

51 our non-regular property R 4 : s can be taken in a nested manner, but should be d in reverse order. n un n un un un

52 stack of histories Data = Level! LockHist Data = LockHist-stack LockHist = Set Bag Stack L 1 L 2 L 6 L 7 L 5 L 3 public interface LockHist { public void (Lock l); public boolean un(lock l); public boolean isempty(); public void clear();

53 an example void start() { a(); void a() { l1.(); l2.(); l1.un(); l2.un(); l3.(); NO! /*@ centralized scope = global logic = CFG SafeLock(Lock l) { event <l> : begin(call(* l.())); event un<l> : begin(call(* l.un())); productions: S -> S un S epsilon violation handler{ System.out.println("*** Unsafe does this spec catch any errors?

54 another example void start() { a(); void a() { l1.(); l2.(); l1.un(); l2.un(); l2.un(); YES! l2 uned twice /*@ centralized scope = global logic = CFG SafeLock(Lock l) { event <l> : begin(call(* l.())); event un<l> : begin(call(* l.un())); productions: S -> S un S epsilon violation handler{ System.out.println("*** Unsafe does this one?

55 Within one method invocation, s should be acquired and d correctly (all taken s should be d as many times as taken) void start() { a(); void a() { l1.(); l1.(); l1.un(); l1.un(); l1.(); b(); error void b() { l1.un(); /*@ scope = global logic = CFG SafeLock(Lock l) { event <l> : begin(call(* l.())); event un<l> : begin(call(* l.un())); event begin : begin(call(* Test*.*(..))); event end : end(call(* Test*.*(..))); productions: S -> begin S end S S un S epsilon Error #0: javamop.mopexception: monitor should start with events that have all the parameters! violation handler{ System.out.println("Unsafe operation

56 Within one method invocation, s should be acquired and d correctly (all taken s should be d as many times as taken) void start() { a(); void a() { l1.(); l1.(); l1.un(); l1.un(); l1.(); b(); error void b() { l1.un(); /*@ centralized scope = global logic = CFG SafeLock(Lock l) { event <l> : begin(call(* l.())); event un<l> : begin(call(* l.un())); event begin : begin(call(* Test*.*(..))); event end : end(call(* Test*.*(..))); productions: S -> epsilon S M un A, M -> epsilon M begin M end M M un, A -> epsilon A begin A end violation handler{ System.out.println("Unsafe operation

57 end