On contract satisfaction in a higher-order world

Dimoulas, Christos; Felleisen, Matthias

doi:10.1145/2039346.2039348

Cited by 43 publications

(32 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Plain CPCF is an extension of Plotkin's 1977 PCF [18], developed first by Dimoulas and Felleisen [3,4] (our syntax is in Fig. 2).…”

Section: Contract Pcf (Cpcf)mentioning

confidence: 99%

Space-Efficient Latent Contracts

Greenberg

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Standard higher-order contract monitoring breaks tail recursion and leads to space leaks that can change a program's asymptotic complexity; space-efficiency restores tail recursion and bounds the amount of space used by contracts. Space-efficient contract monitoring for contracts enforcing simple type disciplines (a/k/a gradual typing) is well studied. Prior work establishes a space-efficient semantics for manifest contracts without dependency [11]; we adapt that work to a latent calculus with dependency. We guarantee space efficiency when no dependency is used; we cannot generally guarantee space efficiency when dependency is used, but instead offer a framework for making such programs space efficient on a case-by-case basis.

show abstract

“…Plain CPCF is an extension of Plotkin's 1977 PCF [18], developed first by Dimoulas and Felleisen [3,4] (our syntax is in Fig. 2).…”

Section: Contract Pcf (Cpcf)mentioning

confidence: 99%

Space-Efficient Latent Contracts

Greenberg

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Higher-order contracts were introduced by Findler and Felleisen [30], and play a significant role in the Racket ecosystem [29,26,79,88]. Higher-order contract systems have also been proposed for other languages, e.g.…”

Section: Related Workmentioning

confidence: 99%

LMS-Verify: abstraction without regret for verified systems programming

Amin

Rompf

2017

Proceedings of the 44th ACM SIGPLAN Symposium on Principles of Programming Languages

View full text Add to dashboard Cite

Performance critical software is almost always developed in C, as programmers do not trust high-level languages to deliver the same reliable performance. This is bad because low-level code in unsafe languages attracts security vulnerabilities and because development is far less productive, with PL advances mostly lost on programmers operating under tight performance constraints. Highlevel languages provide memory safety out of the box, but they are deemed too slow and unpredictable for serious system software.Recent years have seen a surge in staging and generative programming: the key idea is to use high-level languages and their abstraction power as glorified macro systems to compose code fragments in first-order, potentially domain-specific, intermediate languages, from which fast C can be emitted. But what about security? Since the end result is still C code, the safety guarantees of the high-level host language are lost.In this paper, we extend this generative approach to emit ACSL specifications along with C code. We demonstrate that staging achieves "abstraction without regret" for verification: we show how high-level programming models, in particular higher-order composable contracts from dynamic languages, can be used at generation time to compose and generate first-order specifications that can be statically checked by existing tools. We also show how type classes can automatically attach invariants to data types, reducing the need for repetitive manual annotations.We evaluate our system on several case studies that varyingly exercise verification of memory safety, overflow safety, and functional correctness. We feature an HTTP parser that is (1) fast (2) high-level: implemented using staged parser combinators (3) secure: with verified memory safety. This result is significant, as input parsing is a key attack vector, and vulnerabilities related to HTTP parsing have been documented in all widely-used web servers.

show abstract

“…CPCF [2,3] extends a conventional, typed and higher-order functional language, with contracts for base values and first-class functions:…”

Section: Beyond Blame Correctnessmentioning

confidence: 99%

Complete Monitors for Behavioral Contracts

Dimoulas

Tobin-Hochstadt

Felleisen

2012

Programming Languages and Systems

Self Cite

View full text Add to dashboard Cite

Abstract.A behavioral contract in a higher-order language may invoke methods of unknown objects. Although this expressive power allows programmers to formulate sophisticated contracts, it also poses a problem for language designers. Indeed, two distinct semantics have emerged for such method calls, dubbed lax and picky. While lax fails to protect components in certain scenarios, picky may blame an uninvolved party for a contract violation.In this paper, we present complete monitoring as the fundamental correctness criterion for contract systems. It demands correct blame assignment as well as complete monitoring of all channels of communication between components. According to this criterion, lax and picky are indeed incorrect ways to monitor contracts. A third semantics, dubbed indy, emerges as the only correct variant.

show abstract

On contract satisfaction in a higher-order world

Cited by 43 publications

References 32 publications

Space-Efficient Latent Contracts

Space-Efficient Latent Contracts

LMS-Verify: abstraction without regret for verified systems programming

Complete Monitors for Behavioral Contracts

Contact Info

Product

Resources

About