Verifying the reflective visitor pattern

Abstract

Computational reflection allows a program to inspect and manipulate the structure or behaviour of itself at runtime. Often this means that it is possible to create more generic or adaptable programs in an elegant way. However, there is little support for specification and automatic verification of reflective programs. We address this problem by implementing, specifying, and verifying a reflective library using a Hoare-logic for a simple language with stored procedures. The latter is important since reflective metadata is modelled on the heap, thus method objects will be realised as stored procedures. We verify memory safety as well as functional correctness of an instance of the reflective visitor pattern, including the reflective library. The entire verification is carried out in our (semi-)automatic verification tool Crowfoot.

Symbolic Execution Proofs for Higher Order Store Programs

“…The two extra pre and post annotations to the store-code statement hint serve this purpose and can give the necessary fold instruction. A demonstration of the use of such hints in a more realistic setting can be seen in the verification of the reflective visitor pattern [28].…”

“…The assertion language uses nested triples to specify stored procedures and recursively defined assertions to deal with recursion through the store. An SMT solver is invoked to deal with pure assertions and therefore Crowfoot can be used to prove more than just memory safety (see [13,28], and the example in this paper where fib is proved to compute Fibonacci numbers).…”

“…verification of runtime code updates [13] 2. verification of a program that evaluates expressions in a binary tree [16] 3. verification of an instance of the reflective visitor pattern [28] 4. verification of a higher-order list search algorithm (online example) 5. verification of an updatable login server (online example) 6. inspired by media players, verification of a program that allows user triggered loading/unloading of plugins (online example)…”

“…The model is also different from the one sketched in [14] allowing one to model some features not originally discussed. -a number of additional proof hint mechanisms that were needed for verification of a reflective visitor implementation [28].…”