Java and the Java Virtual Machine

Transcription

1 Java and the Java Virtual Machine

2 Springer Berlin Heidelberg New York Barcelona Hong Kong London Milan Paris Singapore Tokyo

3 Robert F. SHirk Joachim Schmid Egon Borger Java and the Java Virtual Machine Definition, Verification, Validation With 84 Figures, 18 Tables, and CD-ROM, Springer

4 Prof. Dr. Robert F. Stiirk ETH Zentrum, Theoretische Informatik 8092 Zurich, Switzerland Dipl.-Inf. Joachim Schmid Siemens AG, CT SE 4, Otto-Hahn-Ring Munchen, Germany Prof. Dr. Egon Borger Universita di Pis a, Dipartimento di Informatica Corso Italia 40,56125 Pis a, Italy Library of Congress Cataloging-in-Publication Data applied for Die Deutsche Bibliothek-CIP-Einheitsaufnahme Java and the Java virtual machine: definition, verification, validation: with 18 tables and CD-ROMI Robert F. Stark; Joachim Schmid; Egon Borger. - Berlin; Heidelberg; New York; Barcelona; Hong Kong; London; Milan; Paris; Singapore; Tokyo: Springer, 2001 ISBN-13: e- ISBN-13: DOl: 10.lO ACM Computing Classification (1998): D.3.1, D.3.4, F Additional material to this book can be downloaded from ISBN-13: Springer-Verlag Berlin Heidelberg New York This work consists of a printed book and a CD-ROM packaged with the book, and is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilm or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer-Verlag. Violations are liable for prosecution under the German Copyright Law. Springer-Verlag or the authors make no warranty for representation, either expressed or implied with respect to this CD-ROM or book, including their quality, merchantibility, or fitness for a particular purpose. In no event will springer or the authors be liable for direct, indirect, special, incidental, or consequential damages arising out of the use or inability to use the CD-ROM or book, even if Springer Verlag or the authors have been advised of the possibility of such damages. Springer-Verlag Berlin Heidelberg New York, a member of Springer Science+Business Media Springer-Verlag Berlin Heidelberg 2001 Softcover reprint of the hardcover 1st edition 2001 The use of designations, trademarks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use. Java and all Java-based marks are trademarks or registered trademarks of Sun Microsystems, Inc. in the United States and other countries. Springer-Verlag is independent of Sun Microsystems, Inc. Cover Design: KiinkelLopka, Heidelberg Typesetting: Computer to film by authors' data Printed on acid-free paper SPIN /3111PS

5 Preface The origin of this book goes back to the Dagstuhl seminar on Logic for System Engineering, organized during the first week of March 1997 by S. Jiihnichen, J. Loeckx, and M. Wirsing. During that seminar, after Egon Borger's talk on How to Use Abstract State Machines in Software Engineering, Wolfram Schulte, at the time a research assistant at the University of Ulm, Germany, questioned whether ASMs provide anything special as a scientifically wellfounded and rigorous yet simple and industrially viable framework for highlevel design and analysis of complex systems, and for natural refinements of models to executable code. Wolfram Schulte argued, referring to his work with K. Achatz on A Formal Object-Oriented Method Inspired by Fusion and Object-Z [1], that with current techniques of functional programming and of axiomatic specification, one can achieve the same result. An intensive and long debate arose from this discussion. At the end of the week, it led Egon Borger to propose a collaboration on a real-life specification project of Wolfram Schulte's choice, as a comparative field test of purely functionaldeclarative methods and of their enhancement within an integrated abstract state-based operational (ASM) approach. After some hesitation, in May 1997 Wolfram Schulte accepted the offer and chose as the theme a high-level specification of Java and of the Java Virtual Machine. What followed were two years of hard but enjoyable joint work, resulting in a series of ASM models of the Java language, of the JVM, and of a provably correct compilation scheme for compiling Java programs to JVM code, which were published in [9, 8, 10, 11, 12]. When in the spring of 1999, Wolfram Schulte put this work together for his Habilitationsschrift at the University of Ulm, Egon Borger suggested completing and extending it to a-badly needed- full-blown ASM case study book. The book should show the ASM method at work, convincingly, for the practical design of a complex real-life system, and for its rigorous mathematical and extensive experimental analysis. Robert Stark and Joachim Schmid accepted to join this book project. At that time, in his Fribourg lectures [33], Robert Stark had already elaborated part of the Java-to-JVM compilation correctness claim, namely, that the execution, on the ASM for the JVM, of every correctly compiled legal Java program is equivalent to the execution of the original Java program

6 VI Preface on the ASM for Java. In the spring of 1998, Egon Borger had proposed to Joachim Schmid a PhD thesis, hosted by Siemens Corporate Technology in Munich, on defining and implementing practically useful structuring and decomposition principles for large ASMs. It could be expected that for this work Wolfram Schulte's suggestion to make our abstract Java/ JVM models executable would provide a rich test bed for validating the submachine concepts we were looking for (see [7]). The realization of these ideas led to a complete revision (completion, correction, and restructuring) of all the Java/ JVM models and to their refinement by AsmGofer executable versions. The revision was triggered, not surprisingly, by three sources, namely: - The needs of the proofs, in particular for the correctness and completeness of the verification of the bytecode resulting from the compilation, proofs which have been worked out for this book by Robert Stark - The needs of naturally detailing the abstractions to make them executable in AsmGofer, developed by Joachim Schmid building upon an extension of the functional programming environment Gofer by graphical user interfaces [36] - An enhancement of the stepwise refined definition of the Java/ JVM models, driven by the goal to create a compositional structure of submachines which supports incremental modularized proofs and component-wise validation (model-based testing) All this took much more time and energy, and made us aware of more problems with bytecode verification than we had expected in the spring of 1999, and in retrospect we see that it was at the very beginning of this long journey when we lost Wolfram Schulte as the fourth author. We regret this, it was painful for the four of us to eventually recognize and accept it. We had to understand that since the moment when, just after having submitted his Habilitationsschrift to the University of VIm, Wolfram joined the Foundations of Software Engineering group at Microsoft Research in Redmond, all his energy has been absorbed by Yuri Gurevich's challenging project to make ASMs relevant for software development at Microsoft. Egon Borger, Joachim Schmid, Robert Stark Pisa, Munchen, Zurich, March 2001

7 Contents 1. Introduction The goals of the book The contents of the book Decomposing Java and the JVM Sources and literature Abstract State Machines ASMs in a nutshell Mathematical definition of ASMs Notational conventions Part I. Java 3. The imperative core Javax of Java Static semantics of Javar Transition rules for Javar The procedural extension Javac of Javax Static semantics of Javac Transition rules for Javac The object-oriented extension Javao of Javac Static semantics of Javao Transition rules for Javao The exception-handling extension Javae of Javao Static semantics of Java Transition rules for Java The concurrent extension JavaT of Javae Static semantics of JavaT , Transition rules for JavaT Thread invariants

8 VIII Contents 8. Java is type safe Structural properties of Java runs Unreachable statements Rules of definite assignment Java is type safe Part II. Compilation of Java: The Trustful JVM 9. The JVMz submachine Dynamic semantics of the JVMI Compilation of JavaI The procedural extension JVMc of JVMz Dynamic semantics of the JVMc Compilation of Javac The object-oriented extension JVMo of JVMc Dynamic semantics of the JVMo Compilation of Javao The exception-handling extension JVMe of JVMo Dynamic semantics of the JVMe Compilation of Javae Executing the JVM..v Correctness of the compiler The correctness statement The correctness proof Part III. Bytecode Verification: The Secure JVM 15. The defensive virtual machine Construction of the defensive JVM Checking JVMI Checking JVMc Checking JVMo Checking JVMe Checking JVMN Checks are monotonic

9 Contents IX 16. Bytecode type assignments Problems of bytecode verification Successors of bytecode instructions Type assignments without subroutine call stacks Soundness of bytecode type assignments Certifying compilation The diligent virtual machine Principal bytecode type assignments Verifying JVMy Verifying JVMc Verifying JVMo Verifying JVM Verifying JVMN The dynamic virtual machine , Initiating and defining loaders Loading classes Dynamic semantics of the JVMv Appendix A. Executable Models A.1 Overview A.2 Java A.3 Compiler A.4 Java Virtual Machine B. Java B.1 Rules B.2 Arrays c. JVM C.1 Trustful execution C.2 Defensive execution C.3 Diligent execution C.4 Check functions C.5 Successor functions C.6 Constraints C.7 Arrays C.8 Abstract versus real instructions

10 X Contents D. Compiler Dol Compilation Do2 maxopd Do3 Arrays 361 functions References 0 List of Figures List of Tables Index