Lightweight object specification with typestates

Abstract

Previous work has proven typestates to be useful for modeling protocols in object-oriented languages. We build on this work by addressing substitutability of subtypes as well as improving precision and conciseness of specifications. We propose a specification technique for objects based on abstract states that incorporates state refinement, method refinement, and orthogonal state dimensions. Union and intersection types form the underlying semantics of method specifications. The approach guarantees substitutability and behavioral subtyping. We designed a dynamic analysis to check existing object-oriented software for protocol conformance and validated our approach by specifying two standard Java libraries. We provide preliminary evidence for the usefulness of our approach.

Practical API Protocol Checking with Access Permissions

“…Method cases amount to specifying the same method with multiple pre-/post-condition pairs, allowing methods to behave di erently in di erent situations. We early on recognized their relevance for specifying API protocols [6,4] In order to take such tests into account, Plural performs a branch-sensitive ow analysis: if the code tests the state of an object, for instance with an if statement, then the analysis updates the state of the object being tested according to the test's result. For example, Plural updates the result set's state to unread at the beginning of the outer if branch in gure 3.…”

“…It took one of the authors 75 minutes to examine and specify PMD, a speci cation that ultimately consisted of just 15 annotations. 6 http://dacapobench.org/ This then enabled Plural to check that this protocol is followed all across PMD, which includes 170 distinct calls to the next method de ned in the Iterator interface. Most iterator usages could be veri ed by Plural without any additional annotations because they are entirely local to a method.…”

“…Once usage protocols are codi ed, violations can be detected statically (like in our and most of the above approaches) or dynamically (while the program is executing, e.g. [6,18]). …”

Checking Concurrent Typestate with Access Permissions in Plural: A Retrospective

“…For example, OPEN and CLOSING (no more items can be enqueued) can be summarized into STILLOPEN, which is the state needed for consumer threads to dequeue an item (figure 1). Hierarchy serves to naturally encode design intent regarding the structure of the state space; we have found it to be essential for expressing complex protocols compactly [5].…”

JPure: A Modular Purity System for Java

“…Knowing which methods are pure in a program has a variety of applications, such as: specification languages [19,1,3,10], model checking [31], compiler optimisations [9,18,36], atomicity [13], query systems [21,34] and memoisation of function calls [15].…”