Soft contract verification for higher-order stateful programs

Abstract

Software contracts allow programmers to state rich program properties using the full expressive power of an object language. However, since they are enforced at runtime, monitoring contracts imposes significant overhead and delays error discovery. Soft contract verification aims to guarantee all or most of these properties ahead of time, enabling valuable optimizations and yielding a more general assurance of correctness. Existing methods for static contract verification satisfy the needs of more restricted target languages, but fail to address the challenges unique to those conjoining untyped, dynamic programming, higher-order functions, modularity, and statefulness. Our approach tackles all these features at once, in the context of the full Racket system-a mature environment for stateful, higher-order, multi-paradigm programming with or without types. Evaluating our method using a set of both pure and stateful benchmarks, we are able to verify 99.94% of checks statically (all but 28 of 49, 861).Stateful, higher-order functions pose significant challenges for static contract verification in particular. In the presence of these features, a modular analysis must permit code from the current module to escape permanently to an opaque context (unspecified code from outside the current module) that may be stateful and therefore store a reference to the escaped closure. Also, contracts themselves, being predicates written in unrestricted Racket, may exhibit stateful behavior; a sound approach must be robust to contracts which are arbitrarily expressive and interwoven with the code they monitor. In this paper, we present and evaluate our solution based on higher-order symbolic execution, explain the techniques we used to address such thorny issues, formalize a notion of behavioral approximation, and use it to provide a mechanized proof of soundness.

Corpse reviver: sound and efficient gradual typing via contract verification

“…We then show an optimizer which soundly removes contracts based on the results of SCV, whose soundness follows directly from the theorems of [Nguyễn et al 2018]. While this model is simple, it demonstrates the essential ideas behind our approach, and shows how the correctness of our optimizer can be derived directly from the soundness of the underlying tools.…”

“…Building on a sound and precise higher-order symbolic execution system for a large subset of Racket [Nguyễn et al 2018], SCV-CR eliminates almost all of the contracts generated by Typed Racket across a dozen preexisting benchmarks [Greenman et al 2019]. As shown in Figure 1, after our optimizations, almost no performance overhead remains, despite the presence of catastrophic overhead even in some simple benchmarks we study.…”

“…We begin with an example-driven overview of how contract verification can eliminate gradual typing dynamic checks ( §2). Next, we formalize our ideas ( §3) in a simple gradually typed language of modules and functions, which compiles to the language of contracts considered by Nguyễn et al [2018], and show how the soundness of our optimizer is a corrollary of the soundness result for their symbolic executor. Then, we describe the implementation ( §4), including integration with Typed Racket, use of an existing symbolic execution engine, and subsequent optimization.…”

“…Verification of main involves approximating arbitrary interactions with it through symbolic execution. If main is blame-free during symbolic execution, it must also be blame-free in any concrete execution, by the soundness of higher-order symbolic execution [Nguyễn et al 2018].…”

“…We assume the operational semantics of Con programs as given by [Nguyễn et al 2018]. Informally, the example program computes as follows, resulting in the blaming of u2 for violating the type of t1:…”