Correct blame for contracts

Abstract

Behavioral software contracts supplement interface information with logical assertions. A rigorous enforcement of contracts provides useful feedback to developers if it signals contract violations as soon as they occur and if it assigns blame to violators with preciseexplanations. Correct blame assignment gets programmers started with the debugging process and can significantly decrease the time needed to discover and fix bugs. Sadly the literature on contracts lacks a framework for making statements about the correctness of blame assignment and for validating such statements. This paper fills the gap and uses the framework to demonstrate how one of the proposed semantics for higher-order contracts satisfies this criteria and another semantics occasionally assigns blame to the wrong module. Concretely, the paper applies the framework to the lax enforcement of dependent higher-order contracts and the picky one. A higher-order dependent contract specifies constraints for the domain and range of higher-order functions and also relates arguments and results in auxiliary assertions. The picky semantics ensures that the use of arguments in the auxiliary assertion satisfies the domain contracts and the lax one does not. While the picky semantics discovers more contract violations than the lax one, it occasionally blames the wrong module. Hence the paper also introduces a third semantics, dubbed indy , which fixes the problems of the picky semantics without giving up its advantages.

Complete Monitors for Behavioral Contracts

“…3. In prior work [3], we show, however, that picky may blame the wrong party for a contract violations and may thus point programmers in the wrong direction in their search for bugs. A variant of picky, dubbed indy, is shown to be blame correct.…”

“…According to their proposal, the contracts for f and fp prohibits their application to complex numbers, and their reuse catches contract-internal problems [6]. 3. In prior work [3], we show, however, that picky may blame the wrong party for a contract violations and may thus point programmers in the wrong direction in their search for bugs.…”

“…CPCF [2,3] extends a conventional, typed and higher-order functional language, with contracts for base values and first-class functions:…”

Computational contracts

“…that the blame is assigned to the call made from the prompt 4 . It is important to note that blame is assigned when the argument function is applied in the body of the map-pos.…”

“…While picky contracts capture more violations they do not assign blame to the contract. Recently Dimoulas et al [4] have further extended the picky blame assignment. This system dubbed indy, treats the contract as an independent party and in case that the postcondition violates the domain contract, blame is assigned to the contract.…”