This paper describes Lua, a language for extending applications. Lua combines procedural features with powerful data description facilities, by using a simple, yet powerful, mechanism of tables. This mechanism implements the concepts of records, arrays, and recursive data types (pointers), and adds some object-oriented facilities, such as methods with dynamic dispatching. Lua presents a mechanism of fallbacks that allows programmers to extend the semantics of the language in some unconventional ways. As a noteworthy example, fallbacks allow the user to add different kinds of inheritance to the language. Currently, Lua is being extensively used in production for several tasks, including user configuration, general-purpose data-entry, description of user interfaces, storage of structured graphical metafiles, and generic attribute configuration for finite element meshes.

It is di#cult to write programs that behave correctly in the presence of run-time errors. Existing programming language features often provide poor support for executing clean-up code and for restoring invariants in such exceptional situations. We present a dataflow analysis for finding a certain class of error-handling mistakes: those that arise from a failure to release resources or to clean up properly along all paths. Many real-world programs violate such resource safety policies because of incorrect error handling. Our flow-sensitive analysis keeps track of outstanding obligations along program paths and does a precise modeling of control flow in the presence of exceptions. Using it, we have found over 800 error handling mistakes almost 4 million lines of Java code. The analysis is unsound and produces false positives, but a few simple filtering rules su#ce to remove them in practice. The remaining mistakes were manually verified. These mistakes cause sockets, files and database handles to be leaked along some paths. We present a characterization of the most common causes of those errors and discuss the limitations of exception handling, finalizers and destructors in addressing them. Based on those errors, we propose a programming language feature that keeps track of obligations at run time and ensures that they are discharged. Finally, we present case studies to demonstrate that this feature is natural, e#cient, and can improve reliability; for example, retrofitting a 34kLOC program with it resulted in a 0.5% code size decrease, a surprising 17% speed increase (from correctly deallocating resources in the presence of exceptions) , and more consistent behavior.

Ever since their invention 30 years ago, checked exceptions have been a point of much discussion. On the one hand, they increase the robustness of soft ware by preventing the manifestation of unanticipated checked exceptions at run-time. On the other hand, they decrease the adaptability of software bec ause they must be propagated explicitly, and must often be handled even if they cannot be signalled. We show that these problems are caused by a conflict between the exceptional interface of a method and the principle of abstraction. We then solve this conflict by introducing anchored exception declarations, which allow the exceptional behaviour of a method to be declared relative to that of others. We present their formal semantics, along with the necessary rules for ensuring compile-time safety, and give a proof of correctness. We show that ancho red exception declarations do not violate the principle of information hiding when used properly, and provide a guideline for when to use them. We have implemented anchored exception declarations as an extension to the ClassicJava programming language, called Cappuccino.

In the context of object-oriented programming languages we propose an extension of the Smalltalk environment which provides for the possibility of constructing software by applying the Design by Contract methodology, introduced by Meyer as a way of developing reliable software. In this sense, both correctness and robustness are increased by using the mechanisms incorporated to Smalltalk as a consequence of the proposed extension. Thus, assertions are used to guarantee the preconditions and postconditions of methods and the stability of the state of the objects, while a mechanism is provided in order to handle the exceptional situations.

Exception handling is a powerful and widely-used programming language abstraction for constructing robust software systems. Unfortunately, it introduces an inter-procedural flow of control that can be difficult to reason about. Failure to do so correctly can lead to security vulnerabilities, breaches of API encapsulation, and any number of safety policy violations. We present a fully automated tool that statically infers and characterizes exception-causing conditions in Java programs. Our tool is based on an inter-procedural, contextsensitive analysis. The output of this tool is well-suited for use as human-readable documentation of exceptional conditions. We evaluate the output of our tool by comparing it to over 900 instances of existing exception documentation in almost two million lines of code. We find that the output of our tool is at least as good as existing documentation 85% of the time and is better 25 % of the time.

i Integrating Concurrency Constructs with Object-Oriented Programming

Concurrent programming using threads is considered a hard and error-prone task. Coroutines are conceptually simpler, they are easier to program with due to their sequential nature. Flexible coroutines as presented by Belsnes and Østvold liberate classical coroutines from their quasi-parallel world and combine them with threads. This allows the programmer to factor programs into sequential and parallel tasks, leading to simpler programs. This thesis presents an extension to the formal semantics for flexible coroutines. A detailed breakdown of the scheduling strategies and parameter passing is presented in the same formal framework. Some words are given on patterns that emerge when programming with flexible coroutines and these patterns are defined in the formal framework. We present a clean implementation of flexible coroutines in Java, based on standard threads and semaphores. Challenges encountered, such as representing coroutines in Java and invoking methods across threads are

This paper describes LuaOrb, a binding between the extension language Lua and CORBA. Like other CORBA bindings, this binding allows a program to manipulate CORBA objects in the same way it manipulates local objects. Unlike conventional bindings, however, LuaOrb is based on the CORBA Dynamic Invocation Interface, mapping its dynamic character to the dynamic type system of Lua. This binding brings together CORBA reuse facilities with the flexibility provided by an interpreted language, fulfilling the "command center" concept proposed by Siegel.

In hard real-time applications, programs must not only be functionally correct but must also meet timing constraints. Unfortunately, little work has been done to allow a high-level incorporation of timing constraints into distributed real-time programs. Instead the programmer is required to ensure system timing through a complicated synchronization process or through low-level programming, making it difficult to create and modify programs. In this report, we describe six features that must be integrated into a high level language and underlying support system in order to promote time to a first class position in distributed real-time programming systems: expressibility of time, real-time communication, enforcement of timing constraints, fault tolerance to violations of constraints, ensuring distributed system state consistency in the time domain, and static timing verification. For each feature we describe what is required, what related work has been performed, and why this work does not adequately provide sufficient capabilities for distributed real-time programming. We then briefly outline an integrated approach to provide these six features using a high-level distributed programming language and system