Permission-Based Separation Logic for Multithreaded Java Programs

Abstract

Abstract. This paper presents a program logic for reasoning about multithreaded Javalike programs with dynamic thread creation, thread joining and reentrant object monitors. The logic is based on concurrent separation logic. It is the first detailed adaptation of concurrent separation logic to a multithreaded Java-like language.The program logic associates a unique static access permission with each heap location, ensuring exclusive write accesses and ruling out data races. Concurrent reads are supported through fractional permissions. Permissions can be transferred between threads upon thread starting, thread joining, initial monitor entrancies and final monitor exits. In order to distinguish between initial monitor entrancies and monitor reentrancies, auxiliary variables keep track of multisets of currently held monitors. Data abstraction and behavioral subtyping are facilitated through abstract predicates, which are also used to represent monitor invariants, preconditions for thread starting and postconditions for thread joining. Value-parametrized types allow to conveniently capture common strong global invariants, like static object ownership relations.The program logic is presented for a model language with Java-like classes and interfaces, the soundness of the program logic is proven, and a number of illustrative examples are presented. ACM CCS: [Theory of computation]:Semantics and reasoning-Program reasoning-Program verification.

Dynamic Frames Based Verification Method for Concurrent Java Programs

“…To the best of our knowledge, our method so far is the only one that uses Dynamic Frames in the explicit form with permissions [1] and in this paper we have shown the necessary extensions and modifications to the Java Dynamic Logic (JDL) used in the KeY verifier to build a fully functional verification system for this combination. The existing approaches to (fractional) permissionbased reasoning with functional tools are based on Separation Logic (SL) [2] or Implicit Dynamic Frames (IDF) [4], e.g., our own VerCors toolset [5,18], VeriFast [25], Silicon [26], or Chalice [3].…”

“…A specified read permission implies that the corresponding location is in the accessible clause, and a specified write location puts the location in the assignable clause. The resulting reasoning system has the look-and-feel of permission-based Separation Logic [17,18]. It is also possible to achieve full IDFstyle framing in our framework, however, we have chosen not to do so (yet) for two reasons.…”

Specification and verification of synchronisation classes in Java : a practical approach

“…This logic later has been extended by Haack and Hurlin for multi-threaded Java programs with the support of: 1. thread creation and joining, and 2. reentrant locks [46,10].…”

“…In his PhD thesis, Hurlin [46] proposed contracts for the class Thread to handle this. The contracts are specified based on permission-based separation logic developed for multithreaded Java programs [10].…”

“…In this chapter, we first summarize the technique presented in [10] for reasoning about thread's start and join in Java and then illustrate it on a larger case study. First, in Section 3.1 we shortly explain how thread's start and join work in Java.…”