Java Bytecode Verification for NonNull Types

1
Java Bytecode Verification for _at_NonNull Types

• Chris Male, David J. Pearce,
• Alex Potanin and Constantine Dymnikov
• Victoria University of Wellington,
• New Zealand

2
Introduction

• Suppose
• Bytecode verifier to enforce _at_NonNull
• NullPointerExceptions eliminated for good!
• Useful for optimising away null-checks

3
Bytecode Verification

• Standard Bytecode Verifier
• Abstract Store Location ? Type

Local Variable Array
Stack
4
Bytecode Verification

• Standard Bytecode Verifier
• Abstract Store Location ? Type
• Can we extend to _at_NonNull types ?
• Abstract Store Location ? _at_NonNull Type

Local Variable Array
Stack
5
_at_NonNull Verification Problem
static int f(Integer,String) 0 aload_0
1 ifnull 8 4 aload_0 5 invokevirtual
8 return
1
0
6
_at_NonNull Verification Problem
static int f(Integer,String) 0 aload_0
1 ifnull 8 4 aload_0 5 invokevirtual
8 return
1
0
7
_at_NonNull Verification Problem
static int f(Integer,String) 0 aload_0
1 ifnull 8 4 aload_0 5 invokevirtual
8 return
1
0
Integer
8
_at_NonNull Verification Problem
static int f(Integer,String) 0 aload_0
1 ifnull 8 4 aload_0 5 invokevirtual
8 return
1
0
Integer
9
_at_NonNull Verification Problem
static int f(Integer,String) 0 aload_0
1 ifnull 8 4 aload_0 5 invokevirtual
8 return
1
0
Integer
Integer
10
_at_NonNull Verification Problem
static int f(Integer,String) 0 aload_0
1 ifnull 8 4 aload_0 5 invokevirtual
8 return
1
0
Integer
Integer
11
_at_NonNull Verification Problem
static int f(Integer,String) 0 aload_0
1 ifnull 8 4 aload_0 5 invokevirtual
8 return
1
0
Integer
Integer
12
_at_NonNull Verification Problem
static int f(Integer,String) 0 aload_0
1 ifnull 8 4 aload_0 5 invokevirtual
8 return
1
0
Integer
Integer
13
Type Aliasing

• IDEA add another level of indirection!
• Abstract store Location ? TypeObject ? Type

Local Var Array
Stack
2
0
1
0
String
1
_at_NN String
Integer
2
Abstract Meta Heap
14
static int f(Integer,String) 0 aload_0 1
ifnull 8 4 aload_0 5 invokevirtual 8
return
15
static int f(Integer,String) 0 aload_0 1
ifnull 8 4 aload_0 5 invokevirtual 8
return
16
static int f(Integer,String) 0 aload_0 1
ifnull 8 4 aload_0 5 invokevirtual 8
return
17
static int f(Integer,String) 0 aload_0 1
ifnull 8 4 aload_0 5 invokevirtual 8
return
18
static int f(Integer,String) 0 aload_0 1
ifnull 8 4 aload_0 5 invokevirtual 8
return
19
static int f(Integer,String) 0 aload_0 1
ifnull 8 4 aload_0 5 invokevirtual 8
return
20

• Abstract Semantics expressed as transition
  system

21
Abstract Store Subtyping

• Store subtyping needed for termination
• For when stores are joined

astore 1
astore 2
aload 1
22

• To show termination requires
• The Transfer Function to be Monotonic
• That the Abstract Stores form a Lattice

?
?
23
Equivalence of Stores

• Type Objects have identity (like Java Objects)
• i.e. type objects with the same type can be
  distinct
• Thus, different abstract stores can be equivalent

24
Equivalence of Stores

• Type Objects have identity (like Java Objects)
• i.e. type objects with the same type can be
  distinct
• Thus, different abstract stores can be equivalent

25
(No Transcript)
26
Field-Load Fix

• Consider the following Java code
• Can conclude no NullPointerException ?

27
Field-Load Fix

• Consider the following Java code
• Now its OK!

28
Context Fix

• When programmer knows reference cant be null,
  but verifier doesnt!
• To deal with these, we must add spurious null
  check

29
Experimental Results

• Annotated some benchmarks by hand

30
(No Transcript)
31
Experiences

• This is good JavaDoc!!

32
Experiences (contd)
33
Experiences (contd)
Overall, found 83/1101 methods were misdocumented!
34
Generics

• We allow _at_NonNull types in generics
• Some classes cause a problem

35
Conclusion

• Bytecode Verification of _at_NonNull Types
• Must deal with aliasing between stack and locals
• Subtyping of Abstract Stores non-trivial
• Situations where programmer knows better
• Problem with generic collections like HashMap
• Contact david.pearce_at_mcs.vuw.ac.nz

36
Equivalence of Stores

• Type Objects have identity (like Java Objects)
• i.e. type objects with the same type can be
  distinct
• Thus, different abstract stores can be equivalent

2
0
1
String
0
Integer
1
37
Implementation Considerations

• Constructors
• Generics hash map problems
• Field Retyping
• Casting/Arrays
• New Operator
• Instance Of
• Static blocks
• Effect of interface limitation

38
Graph Isomorphism