Fissile type analysis

Abstract

We present a generic analysis approach to the imperative relationship update problem, in which destructive updates temporarily violate a global invariant of interest. Such invariants can be conveniently and concisely specified with dependent refinement types, which are efficient to check flow-insensitively. Unfortunately, while traditional flow-insensitive type checking is fast, it is inapplicable when the desired invariants can be temporarily broken. To overcome this limitation, past works have directly ratcheted up the complexity of the type analysis and associated type invariants, leading to inefficient analysis and verbose specifications. In contrast, we propose a generic lifting of modular refinement type analyses with a symbolic analysis to efficiently and effectively check concise invariants that hold almost everywhere. The result is an efficient, highly modular flow-insensitive type analysis to optimistically check the preservation of global relationship invariants that can fall back to a precise, disjunctive symbolic analysis when the optimistic assumption is violated. This technique permits programmers to temporarily break and then re-establish relationship invariants-a flexibility that is crucial for checking relationships in real-world, imperative languages. A significant challenge is selectively violating the global type consistency invariant over heap locations, which we achieve via almost type-consistent heaps. To evaluate our approach, we have encoded the problem of verifying the safety of reflective method calls in dynamic languages as a refinement type checking problem. Our analysis is capable of validating reflective call safety at interactive speeds on commonly-used Objective-C libraries and applications.

Robust Safety for Move

“…Note that this procedure temporarily violates the conservation property! The invariant is not required to hold at every program point (which would be overly strict [13]); only at the beginning (precondition) and at the end (postcondition) of every public procedure of the module. And indeed the final line of the procedure restores the invariant by creating and returning a Coin with the corresponding value.…”

Selectively-Amortized Resource Bounding

“…The subsequent work by Rondon et al [41] propose a flow-sensitive refinement type system to reason about programs with mutation. Similarly, Coughlin et al's work [17] handles mutation via a flow-sensitive approach, allowing type refinements to temporarily break and then get re-established later at some other control locations. It adopts flow-sensitive analysis between control locations who break and reestablish the invariant, respectively.…”

Polymorphic symmetric multiple dispatch with variance

“…Following, for example, Vytiniotis et al [2013] and Coughlin and Chang [2014], we use an overline above mathematical material to indicate an appropriately punctuated sequence of zero or more repetitions of the material, with a subscript added to each metavariable in the material. Thus {α } is equal to {α 1 , α 2 , .…”