Selective Ownership: Combining Object and Type Hierarchies for - - PowerPoint PPT Presentation
Selective Ownership: Combining Object and Type Hierarchies for Flexible Sharing Stephanie Balzer, Thomas R. Gross, and Peter Mller School of Computer Science, Carnegie Mellon University Department of Computer Science, ETH Zurich FOOL 2012
Stephanie Balzer, Thomas R. Gross, and Peter Müller School of Computer Science, Carnegie Mellon University Department of Computer Science, ETH Zurich FOOL 2012
2
Structure program heap
2
Structure program heap
Application domains
2
Structure program heap
Application domains
Proof obligations to verify, at compile-time, that invariants hold
2
3
n1 n2 n4 n5 n3 n6 n7
3
n1 n2 n4 n5 n3 n6 n7 invariant on tree nodes
3
n1 n2 n4 n5 n3 n6 n7 Owner of children nodes invariant on tree nodes
3
n1 n2 n4 n5 n3 n6 n7 Owner of children nodes invariant on tree nodes
3
n1 n2 n4 n5 n3 n6 n7 Owner of children nodes Owner of children nodes invariant on tree nodes
3
n1 n2 n4 n5 n3 n6 n7 Owner of children nodes Owner of children nodes invariant on tree nodes
3
n1 n2 n4 n5 n3 n6 n7
Impose a tree topology on program heap
invariant on tree nodes
3
n1 n2 n4 n5 n3 n6 n7
3
n1 n2 n4 n5 n3 n6 n7
Modifications of objects are initiated by their owners
3
n1 n2 n4 n5 n3 n6 n7 modification
Modifications of objects are initiated by their owners
n2
3
n1 n2 n4 n5 n3 n6 n7 modification
Modifications of objects are initiated by their owners
n2
3
n1 n2 n4 n5 n3 n6 n7 modification
Modifications of objects are initiated by their owners
n2
discipline
3
n1 n2 n4 n5 n3 n6 n7
3
n1 n2 n4 n5 n3 n6 n7
No modifying call-backs into owners from owned objects
3
n1 n2 n4 n5 n3 n6 n7
No modifying call-backs into owners from owned objects
3
Guarantees by ownership
4
Guarantees by ownership
Sound, modular verification of invariants on owned objects
4
Guarantees by ownership
Sound, modular verification of invariants on owned objects
However ...
4
Restrict sharing: modifying access only by owner and peers
4
n1 n2 n4 n5 n3 n6 n7
Restrict sharing: modifying access only by owner and peers
4
n1 n2 n4 n5 n3 n6 n7
Restrict sharing: modifying access only by owner and peers
modifying access
4
5
Selective ownership
heap topology
5
Selective ownership
heap topology
n1 n2 n4 n5 n3 n6 n7
5
Selective ownership
heap topology
n1 n2 n4 n5 n3 n6 n7 modifying access
5
Selective ownership
heap topology
5
Selective ownership
heap topology
Selective ownership-based verification
modifiable sub-structures
First-class relationships
5
6
Gives structure to program heap
6
Gives structure to program heap
6
Gives structure to program heap
E.g., subtyping, package structure
6
Gives structure to program heap
6
6
Selective ownership := type order [+ object ownership]
7
A B C D E
7
A B C D E Legend: type
7
A B C D E Legend: type type order
7
A B C D E Legend: type type order
7
A B C D E Legend: type type order
7
A B C D E Legend: type type order
7
A B C D E Legend: type type order
7
A B C D E Legend: type type order
7
A B C D E Legend: type type order
7
{A ↦ D, B ↦ C, B ↦ E, C ↦ D, C ↦ E}
A B C D E Legend: type type order
7
A B C D E Legend: type type order
Type order forms a strict partial order
7
A B C D E
Legend: type type order
7
A B C D E
Legend: type type order instance
7
A B C D E
a1 a2 c1 c2 e1 e2 e3 b1 b2 b3 d1 Legend: type type order instance
7
A B C D E
a1 a2 c1 c2 e1 e2 e3 b1 b2 b3 d1 Legend: type type order instance
7
Modifying references comply with type order
A B C D E
a1 a2 c1 c2 e1 e2 e3 b1 b2 b3 d1 Legend: type type order instance modifying reference
7
Modifying references comply with type order
A B C D E
a1 a2 c1 c2 e1 e2 e3 b1 b2 b3 d1 Legend: type type order instance modifying reference
7
Modifying references comply with type order
A B C D E
a1 a2 c1 c2 e1 e2 e3 b1 b2 b3 d1 Legend: type type order instance modifying reference
7
Modifying references comply with type order
A B C D E
a1 a2 c1 c2 e1 e2 e3 b1 b2 b3 d1 Legend: type type order instance modifying reference
7
Modifying references comply with type order
A B C D E
a1 a2 c1 c2 e1 e2 e3 b1 b2 b3 d1 Legend: type type order instance modifying reference
7
A B C D E
a1 a2 c1 c2 e1 e2 e3 b1 b2 b3 d1 Legend: type type order instance modifying reference
7
Read-only references are unrestricted
A B C D E
a1 a2 c1 c2 e1 e2 e3 b1 b2 b3 d1 Legend: type type order instance modifying reference
7
Read-only references are unrestricted
read-only reference
A B C D E
a1 a2 c1 c2 e1 e2 e3 b1 b2 b3 d1 Legend: type type order instance modifying reference
7
Read-only references are unrestricted
read-only reference
A B C D E
a1 a2 c1 c2 e1 e2 e3 b1 b2 b3 d1 Legend: type type order instance modifying reference
7
A B C D E
a1 a2 c1 c2 e1 e2 e3 b1 b2 b3 d1 Legend: type type order instance modifying reference
Heap forms DAG (w.r.t. modifying access)
7
Legend: type type order instance modifying reference A B C D E a1 a2 c1 c2 e1 e2 e3 b1 b2 b3 d1
7
Legend: type type order instance modifying reference A B C D E a1 a2 c1 c2 e1 e2 e3 b1 b2 b3 d1
8
Legend: type type order instance modifying reference A B C D E a1 a2 c1 c2 e1 e2 e3 b1 b2 b3 d1
8
Legend: type type order instance modifying reference A B C D E a1 a2 c1 c2 e1 e2 e3 b1 b2 b3 d1
8
a1 a2 c1 c2 e1 e2 e3 b1 b2 b3 d1 A B C F D E G Legend: type type order instance modifying reference
8
a1 a2 c1 c2 e1 e2 e3 b1 b2 b3 d1 A B C F D E G Legend: type type order instance modifying reference
8
a1 a2 c1 c2 e1 e2 e3 b1 b2 b3 d1 A B C F D E G Legend: type type order instance modifying reference f1 f2 g1
8
a1 a2 c1 c2 e1 e2 e3 b1 b2 b3 d1 A B C F D E G Legend: type type order instance modifying reference f1 f2 g1
8
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 b2 b3 g1 d1 A B C F D E G Legend: type type order instance modifying reference
8
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 b2 b3 g1 d1 A B C F D E G Legend: type type order instance modifying reference
8
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 b2 b3 g1 d1 A B C F D E G c1 Legend: type type order instance modifying reference
8
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 b2 b3 g1 d1 A B C F D E G c1
Legend: type type order instance modifying reference
8
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 b2 b3 g1 d1 A B C F D E G c1 Legend: type type order instance modifying reference
8
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 b2 b3 g1 d1 A B C F D E G Legend: type type order instance modifying reference
8
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 b2 b3 g1 d1 A B C F D E G b2 Legend: type type order instance modifying reference
8
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 b2 b3 g1 d1 A B C F D E G b2
Legend: type type order instance modifying reference
8
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 b2 b3 g1 d1 A B C F D E G b2 Legend: type type order instance modifying reference
8
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 b3 g1 d1 A B C F D E G b2 Legend: type type order instance modifying reference
8
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 b3 g1 d1 A B C F D E G b2 b3 Legend: type type order instance modifying reference
8
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 g1 d1 A B C F D E G b2 b3 Legend: type type order instance modifying reference
8
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 g1 d1 A B C F D E G b2 b3
Heap forms DAG with “sub-trees” (w.r.t. modifying access)
Legend: type type order instance modifying reference
8
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 g1 d1 A B C F D E G b2 b3
Heap forms DAG with “sub-trees” (w.r.t. modifying access) restricted, modifying access
Legend: type type order instance modifying reference
8
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 g1 d1 A B C F D E G b2 b3
shared, modifying access Heap forms DAG with “sub-trees” (w.r.t. modifying access) restricted, modifying access
Legend: type type order instance modifying reference
8
9
OO verification challenges
Ownership-based verification
9
OO verification challenges
Ownership-based verification
Selective ownership
9
F
10
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 b2 b3 g1 d1 A B C F D E G
10
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 b2 b3 g1 d1 A B C F D E G
No transitive call-backs
10
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 b2 b3 g1 d1 A B C F D E G
No transitive call-backs
e3
10
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 b2 b3 g1 d1 A B C F D E G
10
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 b2 b3 g1 d1 A B C F D E G
invariant (b2)
b2
10
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 b2 b3 g1 d1 A B C F D E G
Visible-state semantics for single-object invariants is sound invariant (b2)
b2
10
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 b2 b3 g1 d1 A B C F D E G
11
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 b2 b3 g1 d1 A B C F D E G
11
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 b2 b3 g1 d1 A B C F D E G
11
B
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 g1 d1 A C F D E G b2 b3
11
B
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 g1 d1 A C F D E G b2 b3
invariant (b2)
b2
11
B
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 g1 d1 A C F D E G b2 b3
invariant (b2)
b2 f1
invariant (b2,d1)
11
B
a1 a2 c1 c2 f1 f2 e1 e2 e3 b1 g1 d1 A C F D E G b2 b3
Modular verification of multi-object invariants invariant (b2)
b2 f1
invariant (b2,d1)
11
12
Relationship-based programming languages
First-class relationships
12
Relationship-based programming languages
First-class relationships
Naturally support selective ownership
12
Rumer
Running example: tree
13
14
class Node {...} relationship Parent participants (Node child, Node parent) { void link(Node c, Node p) {...} } relationship Tree participants (Node root, Set<Parent> tree) { void appendTree(Tree t, Node p) {...} }
14
class Node {...} relationship Parent participants (Node child, Node parent) { void link(Node c, Node p) {...} } relationship Tree participants (Node root, Set<Parent> tree) { void appendTree(Tree t, Node p) {...} }
14
class Node {...} relationship Parent participants (Node child, Node parent) { void link(Node c, Node p) {...} } relationship Tree participants (Node root, Set<Parent> tree) { void appendTree(Tree t, Node p) {...} }
14
relationships instances
class Node {...} relationship Parent participants (Node child, Node parent) { void link(Node c, Node p) {...} } relationship Tree participants (Node root, Set<Parent> tree) { void appendTree(Tree t, Node p) {...} }
14
Type order defined by relationship declarations
class Node {...} relationship Parent participants (Node child, Node parent) { void link(Node c, Node p) {...} } relationship Tree participants (Node root, Set<Parent> tree) { void appendTree(Tree t, Node p) {...} }
14
Type order defined by relationship declarations
class Node {...} relationship Parent participants (Node child, Node parent) { void link(Node c, Node p) {...} } relationship Tree participants (Node root, Set<Parent> tree) { void appendTree(Tree t, Node p) {...} }
14
Type order defined by relationship declarations {Tree ↦ Parent
class Node {...} relationship Parent participants (Node child, Node parent) { void link(Node c, Node p) {...} } relationship Tree participants (Node root, Set<Parent> tree) { void appendTree(Tree t, Node p) {...} }
14
Type order defined by relationship declarations {Tree ↦ Parent {Tree ↦ Parent, Tree ↦ Node
class Node {...} relationship Parent participants (Node child, Node parent) { void link(Node c, Node p) {...} } relationship Tree participants (Node root, Set<Parent> tree) { void appendTree(Tree t, Node p) {...} }
14
Type order defined by relationship declarations {Tree ↦ Parent {Tree ↦ Parent, Tree ↦ Node
class Node {...} relationship Parent participants (Node child, Node parent) { void link(Node c, Node p) {...} } relationship Tree participants (Node root, Set<Parent> tree) { void appendTree(Tree t, Node p) {...} }
14
Type order defined by relationship declarations {Tree ↦ Parent {Tree ↦ Parent, Tree ↦ Node {Tree ↦ Parent, Tree ↦ Node, Parent ↦ Node}
class Node {...} relationship Parent participants (Node child, Node parent) { void link(Node c, Node p) {...} } relationship Tree participants (Node root, Set<Parent> tree) { void appendTree(Tree t, Node p) {...} }
14
15
class Node {...} relationship Parent participants (Node child, Node parent) { void link(Node c, Node p) {...} } relationship Tree participants (Node r, owned Set<Parent> t) { void appendTree(Tree t, Node p) {...} }
15
Ownership relation must be subset of type order
class Node {...} relationship Parent participants (Node child, Node parent) { void link(Node c, Node p) {...} } relationship Tree participants (Node r, owned Set<Parent> t) { void appendTree(Tree t, Node p) {...} }
15
Ownership relation must be subset of type order
class Node {...} relationship Parent participants (Node child, Node parent) { void link(Node c, Node p) {...} } relationship Tree participants (Node r, owned Set<Parent> t) { void appendTree(Tree t, Node p) {...} }
15
16
Selective ownership = type [+ object ownership]
16
Selective ownership = type [+ object ownership]
Sound modular verification of multi-object invariants
16
Selective ownership = type [+ object ownership]
Sound modular verification of multi-object invariants Permits shared, modifying access to objects further down
16
Selective ownership = type [+ object ownership]
Sound modular verification of multi-object invariants Permits shared, modifying access to objects further down Type order naturally arises from first-class relationships
16