JayHorn: A Framework for Verifying Java programs

Abstract

Abstract. Building a competitive program verifiers is becoming cheaper. On the front-end side, openly available compiler infrastructure and optimization frameworks take care of hairy problems such as alias analysis, and break down the subtleties of modern languages into a handful of simple instructions that need to be handled. On the back-end side, theorem provers start providing full-fledged model checking algorithms, such as PDR, that take care looping control-flow. In this spirit, we developed JayHorn, a verification framework for Java with the goal of having as few moving parts as possible. Most steps of the translation from Java into logic are implemented as bytecode transformations, with the implication that their soundness can be tested easily. From the transformed bytecode, we generate a set of constrained Horn clauses that are verified using state-of-the-art Horn solvers. We report on our implementation experience and evaluate JayHorn on benchmarks.

Quantified Heap Invariants for Object-Oriented Programs

“…challenging for automated tools, since it requires combined reasoning about the shape of heapallocated linked data-structures, and about arithmetic properties of the stored data. Indeed, to the best of our knowledge no fully-automatic tool is able to verify the program in Figure 1, with the exception of our own JayHorn verifier [15].…”

“…We show how we can infer such space invariants automatically with our JayHorn tool [15]. The tool and all examples from this paper are available online.…”

“…It serves as the platform for simple static analysis, as well as to encode the results of that analysis to later be leveraged by the solver. We do not go into details of the translation of Java to this language, but instead refer the interested reader to [15], a tool paper about JayHorn.…”

“…This includes user-defined exceptions, Java assertions (which are represented as exceptions in bytecode) and implicit exceptions that are thrown by null-pointer dereferences, array bounds violations, and illegal casts. More details on the implementation are given in [15].…”

“…The presented technique is part of a verification algorithm for single-threaded Java programs and is implemented in the JayHorn verification tool [15].…”