Citation Context

...ltaneously. This is why we say the object invariant holds in steady states, which essentially means that the object is not currently being operated on. Following our methodology for object invariants =-=[3, 45, 6]-=-, Spec# makes explicit when an object is in its steady state versus when it is exposed, which means the object is vulnerable to modifications. Spec# introduces a block statement expose that explicitly...

Citation Context

...ecifications statically using an automatic theorem prover (akin the tools described in Section 5). One difference between Spec# and JML is that Spec# builds in a new methodology for object invariants =-=[5,63,7]-=-, trading restrictions on the kinds of programs that can be written for a sound modular reasoning technique. 9.3 OCL: UML’s constraint language Despite the similarity in the acronyms, JML is very diff...

Citation Context

...]. The current presentation using rep was chosen for simplicity. Leino and Müller have extended our methodology to allow invariants for more kinds of data structures, including cyclic data structures =-=[12]-=-. 8 CONCLUSIONS Re-entrancy in object-oriented programming makes it untenable to treat object invariants as implicit pre- and postconditions and completely hide the preconditions from callers. In orde...

Citation Context

...an restrictions (such as unique-pointer restrictions). A recent emphasis has been on using ownership assertions that refer to auxiliary fields that may be altered, and this leads to added flexibility =-=[2, 24]-=-, including transfer. New schemes are being invented to extend the basic idea, such as a “friends” concept that lets invariants reach across hierarchical ownership domain [30]. We refer to David Nauma...

Citation Context

...om modifying the iterator. Generalizing object creation to arbitrary owners is straightforward, but requires that the owner of the new object is passed as additional (ghost) parameter to constructors =-=[LM04]-=-. By using a ghost field to encode ownership, ownership transfer can easily be expressed by setting the owner field to a new value [LM04]. In this paper, we do not consider ownership transfer because ...

Citation Context

... understood. We deliberately ignore more powerful escape analyses [6,7,8,22] which are sensitive to small code changes and may be difficult to interpret, as well as more powerful notions of ownership =-=[1,4,5,11,12,13,16,17,21,32,35]-=-.Of course, the tradeoff is that we will sometime deem an object as ‘escaping’ when a more precise analysis would discover that this is not the case. In particular, we have chosen to investigate confi...

Citation Context

...ns are. We believe our system imposes a minimal set of constraints on the participating parties. Our method builds on ownership-based invariants [BDF + 03a], formalized using an auxiliary field owner =-=[LM03]-=-. We refer to the combination of [BDF + 03a] and [LM03] as the Boogie methodology. An on-going project at Microsoft Research named “Boogie” is building a tool based on that methodology. In Section 1, ...

Citation Context

...ant does not hold. Of course, the invariant is reestablished before the method terminates. A direct approach to solving this temporary violation problem of invariants is given by the Boogie technique =-=[12,13]-=-. The essence of this technique is an explicit treatment of when invariants must hold in specifications. In the Boogie technique, an object is either in a valid or a mutable state. Only when in a vali...

Citation Context

...ver, the early work does not admit more refined notions of shape, as it does not address the use of quantifiers. Our work uses methods most similar to the Extended Static Checker [3] and Boogie/Spec# =-=[11]-=-. However, while we suspect that specifications similar to elements described here have been written before while verifying programs, we are unaware of any attempts to explore their expressiveness or ...

Citation Context

...plementation of insert will change the value of y, unless the parameter x is equal to the initial value of y. This situation is called abstract aliasing [18]. To avoid the problem, existing solutions =-=[18, 20, 16]-=- impose a series of programming restrictions, which guarantee absence of abstract aliasing: if two variables are not known to be dependent then they can be assumed independent. Unfortunately, these so...