houdini an annotation assistant for escjava.pptVIP

Houdini:An Annotation Assistant for ESC/Java Cormac Flanagan and K. Rustan M. Leino Compaq Systems Research Center Software QA via Testing Useful (the dominant methodology), but .. Costly half of development cost is testing finds errors late in development cycle Incomplete often fails to ensure needed reliability hard to test all configurations Software QA via Static Checking Statically verify many correctness properties Type systems catch many errors e.g. “Cannot multiply a number and a string” Would like to catch additional errors e.g. “Array index out of bounds at line 10” And verify other correctness properties assertions object invariants lightweight method specifications Extended Static Checker Architecture ESC/Java Example ESC/Java Experience Tested on 40 KLOC, caught a variety of defects Ready for educational/research use? Yes! /SRC/esc/ Ready for software engineering use? Not really. annotation overhead significant annotations increase program size by 10% requires 1 programmer-hour to annotate 300 lines of code Need annotation inference for ESC/Java! Houdini Architecture Generating Candidate Annotations Invariants generated heuristically from program text For fields int i,j guess //@ invariant i cmp j; //@ invariant i cmp 0; where cmp ? { , =, =, !=, , = } For field Object[] a guess //@ invariant a != null; //@ invariant a.length cmp i; //@ invariant (forall int k; 0 = k k a.length == a[k] != null); Similar heuristics for preconditions and postconditions Removing Invalid Annotations Houdini Architecture Houdini Example Houdini Architecture Finding the cause of a warning Houdini Example (corrected) Houdini Architecture Houdini is a Two-Level Analysis Interprocedural analysis Uses ESC/Java (weakest preconditions, theorem proving) Precise, not scalable Intraprocedural analysis Abstract interpretation based on powerset lattice Less precise, but more scalable Evaluation Houdini for Other Modular Checkers Houdini originally desi