Alias Annotations for Program Understanding

1. Alias Annotationsfor Program Understanding Jonathan Aldrich Valentin Kostadinov Craig Chambers University of Washington

2. Building Big Systems is Hard calls component A component B calls component C • The ArchJava Project • Software architecture for managing complexity • Previous work: control flow • ICSE ’02, ECOOP ’02 • This paper: data sharing shared data AliasJava - OOPSLA '02

3. Why Specify Data Sharing? calls component A component B calls component C • Evolve programs • Modify component A to update data lazily • Improves efficiency • Must update component C as well! • Might not be obvious without sharing specification shared data AliasJava - OOPSLA '02

4. wrapper Maintain Invariants _ X client set class SynchronizedSet { Set backingSet; synchronized boolean add(Object o) { return backing.add(o); • Synchronization wrappers • Wrap a collections methods • Synchronize before invoking method • Wrapper invariant • Must access backing set only through wrapper AliasJava - OOPSLA '02

5. Avoid Security Holes (JDK 1.1.1) public class Class { public Object[] getSigners() { return signers; } • Returns an internal array, rather than a copy • Allows untrusted clients access • Can change the list of signatures for a class Class X client signers AliasJava - OOPSLA '02

6. Type-based Approaches • Many previous systems • Uniqueness [Minsky, Boyland…] • Ownership types [Clarke et al, Boyapati et al...] • Advantages • Modular, efficient checking • Documents aliasing in the code • Challenges • Express common idioms • Support for Java constructs • Usability in practice AliasJava - OOPSLA '02

7. Outline • AliasJava: alias annotations for Java • Combines uniqueness and ownership • Supports full language • Arrays, casts, iterators, inner classes, subtyping • Algorithm infers annotations • Guarantee of properties • Evaluated on library, application code AliasJava - OOPSLA '02

8. Unique reference Annotations: Unique set static unique Set… synchronizedSet…(unique Set… s) { return new SynchronizedSet…(s); }// s is dead after use in constructor // o goes out of scope here • unique objects have no persistent aliases • Newly allocated objects • Can only use once • Variable must be dead after use AliasJava - OOPSLA '02

9. Annotations: Unique X Unique reference set static unique Set… synchronizedSet…(unique Set… s) { return new SynchronizedSet…(s); }// s is dead after use in constructor // o goes out of scope here • unique objects have no persistent aliases • Newly allocated objects • Can only use once • Variable must be dead after use AliasJava - OOPSLA '02

10. Class Annotations: Owned signers private owned Object[…] signers; public Object[…] getSigners() { return signers; } • owned objects confined within their owner • Aliasing allowed within owner • Cannot return owned state to clients • Making a copy fixes the security hole X client Compile-time error AliasJava - OOPSLA '02

11. Class Annotations: Owned signers private owned Object[…] signers; public unique Object[…] getSigners() { return arraycopy(signers); } • owned objects confined within their owner • Aliasing allowed within owner • Cannot return owned state to clients • Making a copy fixes the security hole client copy AliasJava - OOPSLA '02

12. owner Annotations: Parameters List array element class ArrayList<elem_owner> { private owned Object[elem_owner] elems; void add(int i, elem_owner Object o) { elems[i] = o; } } • Parameterized by element owner • Method parameterization also supported AliasJava - OOPSLA '02

13. Annotations: Shared shared static shared Object singleton; unique Object[shared] getSigners() { return arraycopy(signers); } • shared objects may be globally aliased • Singletons • Static fields • Global data • Conceptually “owned by the system” AliasJava - OOPSLA '02

14. Annotations: Lent int find(lent Object o) { for (int i = 0; ...) { if elems[i] == o return i; • Temporary alias of unique/owned object • Used for duration of method • Cannot store in fields • Syntactically default AliasJava - OOPSLA '02

15. Annotation Flow unique unique Object uniq = new Object(); owned Object own = uniq; lent Object l = own; shared Object sh = own;// error owned param1 param2 ... shared lent AliasJava - OOPSLA '02

16. Implementation • AliasJava supports all features of Java • Subtyping • Inner classes • Casts • Interoperates with existing code • Just annotate the interface of legacy libraries • Checking is dynamic only where Java’s is • run-time type information for alias parameters • checks at casts and array writes AliasJava - OOPSLA '02

17. Annotation Inference class ArrayList<A> { private owned Object elems[A]; void put(int i, A Object o) { elems[i] = o; } } • Saves tedious annotation work • Infers general annotations • Edit annotations to improve understandability • Future work: annotation assistant AliasJava - OOPSLA '02

18. Properties: Ownership • Common property: owners-as-dominators All paths to owned objects go through owner • Prevents clients from accessing owned state • Clarke et al.: allow owned objects on stack • Patterns like Observer are prohibited • Boyapati et al.: inner classes may access owned state • Can’t implement Iterators/Observers with ordinary classes ArrayList Client X owned array AliasJava - OOPSLA '02

19. Client Properties: Ownership • Common property: owners-as-dominators All paths to owned objects go through owner • Problem: Iterators violate owners-as-dominators • Clarke et al.: allow Iterators on stack • Patterns like Observer prohibited • Boyapati et al.: inner classes access owned state • Can’t implement with ordinary classes ArrayList X owned array Iterator AliasJava - OOPSLA '02

20. Client Properties: Ownership • Common property: owners-as-dominators All paths to owned objects go through owner • Problem: Iterators violate owners-as-dominators • Clarke et al.: allow Iterators on stack • Patterns like Command prohibited • Boyapati et al., Clarke: inner classes access owned state • Can’t implement with ordinary classes Document X state Command AliasJava - OOPSLA '02

21. Ownership Capability Model Owned objects are only accessible by their owner and the objects to which it grants a capability • General model • Owner grants a capability to trusted objects AliasJava - OOPSLA '02

22. Ownership Capability Model Owned objects are only accessible by their owner and the objects to which it grants a capability class ArrayList<elem_owner> { private owned Object elems[elem_owner]; unique Iterator<elem_owner> iterator() { return new ArrayItr<elem_owner,owned>(elems); • owned capability • Access to ArrayList’s owned state • Passed via static parameterization • ArrayList controls who accesses state AliasJava - OOPSLA '02

23. Ownership Capability Model Owned objects are only accessible by their owner and the objects to which it grants a capability class ArrayList<elem_owner> { private owned Object elems[elem_owner]; unique Iterator<elem_owner> iterator() { return new ArrayItr<elem_owner,owned>(elems); • Compare annotations • ownedparameter lost by subsumption • Clients cannot access owned state AliasJava - OOPSLA '02

24. Ownership Capability Model Owned objects are only accessible by their owner and the objects to which it grants a capability int find(lent Object o) • lent capability • Temporary permission to access owned state • find can access o for duration of call AliasJava - OOPSLA '02

25. Properties: Uniqueness If a variable is unique, it has no aliases other than lent variables on the stack • Reasoning • No aliases in heap data structures • Still must track lent aliases on the stack • Extension: Alias Burying [Boyland] • When a unique var is read, all aliases are dead • Requires read/write effect specifications AliasJava - OOPSLA '02

26. AliasFJ : A Formal Framework • Based on Featherweight Java [OOPSLA 99] • Includes unique, owned, parameters, and lent • Benefits • Precise semantics • Shows how properties are enforced • Theorems • Type safety • Ownership property • Uniqueness property AliasJava - OOPSLA '02

27. Evaluation: java.util.Hashtable public class Hashtable<key_owner, value_owner...> extends Dictionary<key_owner, value_owner> { value_owner Object get(key_owner Object k) {... • Annotated and checked Hashtable • 1000 lines of code, 2.5 hours • Annotated some library functions • Experience • Annotations were natural, easy to add • Changed code in only one place AliasJava - OOPSLA '02

28. Enforcing Library Invariants static unique Set<elements> synchronizedSet<elements>(unique Set<elements> s) { return new SynchronizedSet<…>(s); } • Javadoc comment: In order to guarantee serial access, it is critical that all access to the backing set is accomplished through the returned set. • AliasJava: argument is unique • Therefore, there are no aliases to the backing set AliasJava - OOPSLA '02

29. Evaluation: Aphyds Partition Circuit DB ChannelRoute • Pedegogical circuit layout application • Blackboard Architecture • Annotated functional core of system • 7 classes, 3500 lines of code • Showed sharing of circuit elements Route Floorplan Place AliasJava - OOPSLA '02

30. Evaluation: Aphyds Partition Circuit DB ChannelRoute • Pedegogical circuit layout application • Blackboard Architecture • Annotated functional core of system • 7 classes, 3500 lines of code • Showed sharing of circuit elements Route circuit objects Floorplan Place AliasJava - OOPSLA '02

31. More in the Paper • Application to software architecture • Detailed semantics • Implementation technique • Inference algorithm • Case study on 3000 lines of application code AliasJava - OOPSLA '02

32. AliasJava • Combines object ownership and uniqueness • Aids reasoning in large systems • Expressive enough to use in existing code • Try out AliasJava! http://www.archjava.org/ AliasJava - OOPSLA '02