Detecting non-local violations of API contracts in large software systems

1. Eric Bodden McGill University Detecting non-localviolations of API contracts inlarge software systems

3. public class Logging { private static Writer w; public staticvoid init(OutputStreamos) { w = new PrintWriter(os); } public static void log(String s) { w.write(s); } public static voidlogAll(Reader r) { StreamUtil.copyAll(r,w); } }

4. One month later…

5. public class Logging { private static Writer w; public staticvoid init(OutputStreamos) { w = new PrintWriter(os); } public static void log(String s) { w.write(s); } public static voidlogAll(Reader r) { StreamUtil.copyAll(r,w); } }

6. static voidcopyAll(Reader r, Writer w) { intbuffer = 0; try { do { buffer = r.read(); w.write(buffer); } while(buffer!=-1); } finally { r.close(); w.close(); } }

7. One hour later…

8. public class Logging { private static Writer w; public staticvoid init(OutputStreamos) { w = new PrintWriter(os); } public static void log(String s) { w.write(s); } public static voidlogAll(Reader r) { StreamUtil.copyAll(r,w); } }

12. public class Logging { private static Writer w; public staticvoid init(OutputStreamos) { w = new PrintWriter(os); } public static void log(String s) { w.write(s); } public static voidlogAll(Reader r) { StreamUtil.copyAll(r,w); } } Possible API violation on Writer w I’m feeling lucky Show API contract Ignore

14. API violation on Writer w public class Logging { private static Writer w; public staticvoid init(OutputStreamos) { w = new PrintWriter(os); } public static void log(String s) { w.write(s); } public static voidlogAll(Reader r) { StreamUtil.copyAll(r,w); } } • StreamUtil.copyAll(..) Show API contract Ignore

15. Detectingnon-local violationsof API contracts inlarge software systems

16. Pure runtime monitoring • Current approach…

17. “no writeafter close” abc compiler

18. Current approach: Tracematches tracematch(Writer w) { sym close after returning: call(* Writer.close()) && target(w);sym write before: call(* Writer.write(..)) && target(w); close write { System.out.println( “Writer ”+w+“ was closed!”); } }

19. close write true w = o(w1) false false w = o(w1) w1.close(); w1.write(“foo”); w1.write(“foo”); • { • System.out.println( “Writer ”+w+“ was closed!”); • }

21. Problem 1: • How to capture an API contract precisely and concisely?

22. Problem 2: • Potentially largeruntime overhead

23. Problem 3: • No static guarantees

24. novel static API specification language(s) “no writeafter close” 4 novel staticprogram analyses

26. Current approach: Tracematches tracematch(Writer w) { sym close after returning: call(* Writer.close()) && target(w);sym write before: call(* Writer.write(..)) && target(w); close write { System.out.println( “Writer ”+w+“ was closed!”); } }

27. Good: • Can reason aboutsingle objects.

28. Even better: • Can reason about combinationsof objects.

29. Good: • Semantics of regular expression matching well understood.

30. Bad: • Regular expressions bad at stating required events. • “always close after open” • “open ¬close” • ?

31. Bad: • Little reuse. • “no write after close” • and • “always close after open” • requires two tracematches!

32. Goal: Make API specificationsprecise and concise

33. Plan • Investigate a number ofactual programs

34. Plan • Investigate a number ofactual programs • What APIs do programs use?

35. Plan • Investigate a number ofactual programs • What mistakes do people make?

36. Plan • Investigate a number ofactual programs • What specifications would have avoided those mistakes?

37. Goal • findreoccurring • patterns

38. fall-back • solution • concise • specifications • 90 / 10

40. 4 novel static program analyses

41. First static analysis: • “Quick • Check”

42. close write count( ) = 0 count( ) = 2

43. Second static analysis: “Consistent-shadows analysis”

44. close write [close,write]

45. [close,write] w1 w2 c1 {c1} {w1,w2} x new PrintWriter(); {c1, w1} o2 o1 • {c1, w2}

46. Third static analysis: “Flow-sensitive unnecessary shadows analysis”

47. close write w = i(w1)-s1 true false false w = i(w1)-s1,s2 true true w = i(w1)-s1,s2 w ≠ i(w1)-s2 false V w =i(w1)-s1 w1.close(); w1.write(“foo”); w1.write(“foo”); //s1 //s2 //s3

48. 4th static analysis: “run-once loop optimization”

49. 1

50. Results • |.........|.........|.........|.........|.........|.........|.........|.........|.........|.........|. • |.........|.........|.........|.........|.........|.........|.........|.........|.........|.........|. • |.........|.........|.........|.........|.........|.........|.........|.........|.........|.........|. • |.........|.........|.........|.........|.........|.........|.........|.........|.........|.........|. • 102 program/tracematch combinations • static guarantees in 77 cases • Found 5 programs with bugs or questionable code. • less than 10 shadows in 12 cases • less than 10% overhead in 9 cases