Modular verification of higher-order methods with mandatory calls specified by model programs

Steve M. Shaner, Gary T. Leavens, David A. Naumann
2007 Proceedings of the 22nd annual ACM SIGPLAN conference on Object oriented programming systems and applications - OOPSLA '07  
What we call a "higher-order method" (HOM) is a method that makes mandatory calls to other dynamically-dispatched methods. Examples include template methods as in the Template method design pattern and notify methods in the Observer pattern. HOMs are particularly difficult to reason about, because standard pre-and postcondition specifications cannot describe the mandatory calls. For reasoning about such methods, existing approaches use either higherorder logic or traces, but both are complex
more » ... verbose. We describe a simple, concise, and modular approach to specifying HOMs We show how to verify calls to HOMs and their code using first-order verification conditions, in a sound and modular way. Verification of client code that calls HOMs can take advantage of the client's knowledge about the mandatory calls to make strong conclusions. Our verification technique validates and explains traditional documentation practice for HOMs, which typically shows their code. However, specifications do not have to expose all of the code to clients, but only enough to determine how the HOM makes its mandatory calls. LastVal lv = new LastVal(); //@ assert lv != null && lv.val == 0; Counter c = new Counter(); c.register(lv); //@ assert c.lstnr == lv && lv != null; //@ assert c.count == 0; c.bump(); //@ assert lv.val == 1;
doi:10.1145/1297027.1297053 dblp:conf/oopsla/ShanerLN07 fatcat:x3xwaijsvnc3fdvlqcyikgz7pq