Java and the Java Virtual Machine

(1)

(2)

Springer

Berlin Heidelberg New York Barcelona Hong Kong London Milan Paris Singapore Tokyo

(3)

Robert

F. SHirk

Joachim Schmid

Egon Borger

Java and the

Java Virtual Machine

Definition, Verification, Validation

With 84 Figures, 18 Tables, and CD-ROM

(4)

Additional material to this book can be downloaded from http://extras.springer.com

Prof. Dr. Robert

F.

Stiirk

ETH Zentrum, Theoretische Informatik 8092 Zurich, Switzerland

Dipl.-Inf. Joachim Schmid

Siemens AG, CT SE 4, Otto-Hahn-Ring 6 81730 Munchen, Germany

Prof. Dr. Egon Borger

Universita di Pis a, Dipartimento di Informatica Corso Italia 40,56125 Pis a, Italy

Library of Congress Cataloging-in-Publication Data applied for Die Deutsche Bibliothek-CIP-Einheitsaufnahme

Java and the Java virtual machine: definition, verification, validation: with 18 tables and CD-ROMI

Robert F. Stark; Joachim Schmid; Egon Borger. - Berlin; Heidelberg; New York; Barcelona; Hong Kong; London; Milan; Paris; Singapore; Tokyo: Springer, 2001

ISBN-13: 978-3-642-63997 -5 e- ISBN-13:978-3-642-59495-3 DOl: 10.lO071978-3-642-59495-3

ACM Computing Classification (1998): D.3.1, D.3.4, F.3.2-3

ISBN-13:978-3-642-63997-5 Springer-Verlag Berlin Heidelberg New York

This work consists of a printed book and a CD-ROM packaged with the book, and is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfIlm or in any other way, and storage in data banks. Duplication of this publication or parts thereof is per-mitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer-Verlag. Violations are liable for prosecution under the German Copyright Law.

Springer-Verlag or the authors make no warranty for representation, either expressed or implied with respect to this CD-ROM or book, including their quality, merchantibility, or fitness for a particular purpose. In no event will springer or the authors be liable for direct, indirect, special, incidental, or consequential damages arising out of the use or inability to use the CD-ROM or book, even if Springer-Verlag or the authors have been advised of the possibility of such damages.

Springer-Verlag Berlin Heidelberg New York, a member of Springer Science+Business Media http://www.springer.de

The use of designations, trademarks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use. Java and all Java-based marks are trademarks or registered trademarks of Sun Microsystems, Inc. in the United States and other countries. Springer-Verlag is independent of Sun Microsystems, Inc.

Cover Design: KiinkelLopka, Heidelberg

Typesetting: Computer to film by authors' data

(5)

Preface

The origin of this book goes back to the Dagstuhl seminar on Logic for System Engineering, organized during the first week of March 1997 by S. Jiihnichen, J. Loeckx, and M. Wirsing. During that seminar, after Egon Borger's talk on How to Use Abstract State Machines in Software Engineering, Wolfram Schulte, at the time a research assistant at the University of Ulm, Germany, questioned whether ASMs provide anything special as a scientifically well-founded and rigorous yet simple and industrially viable framework for high-level design and analysis of complex systems, and for natural refinements of models to executable code. Wolfram Schulte argued, referring to his work with K. Achatz on A Formal Object-Oriented Method Inspired by Fusion and Object-Z [1], that with current techniques of functional programming and of axiomatic specification, one can achieve the same result. An intensive and long debate arose from this discussion. At the end of the week, it led Egon Borger to propose a collaboration on a real-life specification project of Wolfram Schulte's choice, as a comparative field test of purely functional-declarative methods and of their enhancement within an integrated abstract state-based operational (ASM) approach.

After some hesitation, in May 1997 Wolfram Schulte accepted the offer and chose as the theme a high-level specification of Java and of the Java Virtual Machine. What followed were two years of hard but enjoyable joint work, resulting in a series of ASM models of the Java language, of the JVM, and of a provably correct compilation scheme for compiling Java programs to JVM code, which were published in [9, 8, 10, 11, 12]. When in the spring of 1999, Wolfram Schulte put this work together for his Habilitationsschrift at the University of Ulm, Egon Borger suggested completing and extending it to a-badly needed- full-blown ASM case study book. The book should show the ASM method at work, convincingly, for the practical design of a complex real-life system, and for its rigorous mathematical and extensive experimental analysis.

Robert Stark and Joachim Schmid accepted to join this book project. At that time, in his Fribourg lectures [33], Robert Stark had already elabo-rated part of the Java-to-JVM compilation correctness claim, namely, that the execution, on the ASM for the JVM, of every correctly compiled legal Java program is equivalent to the execution of the original Java program

(6)

VI Preface

on the ASM for Java. In the spring of 1998, Egon Borger had proposed to Joachim Schmid a PhD thesis, hosted by Siemens Corporate Technology in Munich, on defining and implementing practically useful structuring and de-composition principles for large ASMs. It could be expected that for this work Wolfram Schulte's suggestion to make our abstract Java/ JVM mod-els executable would provide a rich test bed for validating the submachine concepts we were looking for (see [7]). The realization of these ideas led to a complete revision (completion, correction, and restructuring) of all the Java/ JVM models and to their refinement by AsmGofer executable versions. The revision was triggered, not surprisingly, by three sources, namely: - The needs of the proofs, in particular for the correctness and completeness

of the verification of the bytecode resulting from the compilation, proofs which have been worked out for this book by Robert Stark

- The needs of naturally detailing the abstractions to make them executable in AsmGofer, developed by Joachim Schmid building upon an extension of the functional programming environment Gofer by graphical user inter-faces [36]

- An enhancement of the stepwise refined definition of the Java/ JVM models, driven by the goal to create a compositional structure of submachines which supports incremental modularized proofs and component-wise validation (model-based testing)

All this took much more time and energy, and made us aware of more problems with bytecode verification than we had expected in the spring of 1999, and in retrospect we see that it was at the very beginning of this long journey when we lost Wolfram Schulte as the fourth author. We regret this, it was painful for the four of us to eventually recognize and accept it. We had to understand that since the moment when, just after having submitted his

Habilitationsschrift to the University of VIm, Wolfram joined the Foundations of Software Engineering group at Microsoft Research in Redmond, all his energy has been absorbed by Yuri Gurevich's challenging project to make ASMs relevant for software development at Microsoft.

Egon Borger, Joachim Schmid, Robert Stark

(7)

c.

JVM .... . .. ... .. . ... . ... .. .... . ... . ... ... ... . .. 335 C.1 Trustful execution ... 335 C.2 Defensive execution ... . ... . .. .. ... .. ... .. ... 343 C.3 Diligent execution ... . ... .. ... 344 C.4 Check functions .. ... . . .. .. .. ... . ... . ... .. ... .. 347 C.5 Successor functions ... 348 C.6 Constraints .... ... ... . ... 349 C.7 Arrays ... .. .... . ... .. ... .. ... ... ... . . 351

(10)

X Contents D. Compiler 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3 6 1 D o l Compilation functions 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3 6 1 D o 2 maxOpd 0 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 3 6 3 D o 3 Arrays 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3 6 4 References 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3 6 5 List of Figures 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3 6 7 List of Tables 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3 7 1 Index 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3 7 3