Verifying OpenJDK’s Sort Method for Generic Collections

TimSort is the main sorting algorithm provided by the Java standard library and many other programming frameworks. Our original goal was functional verification of TimSort with mechanical proofs. However, during our verification attempt we discovered a bug which causes the implementation to crash by an uncaught exception. In this paper, we identify conditions under which the bug occurs, and from this we derive a bug-free version that does not compromise performance. We formally specify the new version and verify termination and the absence of exceptions including the bug. This verification is carried out mechanically with KeY, a state-of-the-art interactive verification tool for Java. We provide a detailed description and analysis of the proofs. The complexity of the proofs required extensions and new capabilities in KeY, including symbolic state merging.

[1]  Wojciech Mostowski,et al.  Fully Verified Java Card API Reference Implementation , 2007, VERIFY.

[2]  Frank S. de Boer,et al.  OpenJDK's Java.utils.Collection.sort() Is Broken: The Good, the Bad and the Worst Case , 2015, CAV.

[3]  Christian Sternagel.  Proof Pearl—A Mechanized Proof of GHC’s Mergesort , 2012, Journal of Automated Reasoning.

[4]  Bernhard Beckert,et al.  Proof reuse for deductive program verification , 2004, Proceedings of the Second International Conference on Software Engineering and Formal Methods, 2004. SEFM 2004..

[5]  C. A. R. Hoare,et al.  Proof of a Recursive Program: Quicksort , 1971, Comput. J..

[6]  F. Sforza,et al.  A "design for verification" methodology , 2001, Proceedings of the IEEE 2001. 2nd International Symposium on Quality Electronic Design.

[7]  Reiner Hähnle,et al.  A General Lattice Model for Merging Symbolic Execution Branches , 2016, ICFEM.

[8]  Lawrence Charles Paulson,et al.  Isabelle: A Generic Theorem Prover , 1994 .

[9]  Frank S. de Boer,et al.  Proof Pearl: The KeY to Correct and Stable Sorting , 2013, Journal of Automated Reasoning.

[10]  Sofiène Tahar,et al.  Verifying a Synthesized Implementation of IEEE-754 Floating-Point Exponential Function using HOL , 2010, Comput. J..

[11]  Dirk Beyer.  Software Verification and Verifiable Witnesses - (Report on SV-COMP 2015) , 2015, TACAS.

[12]  Gabriele Paganelli,et al.  Real-time Java API specifications for high coverage test generation , 2012, JTRES '12.

[13]  Nadia Polikarpova,et al.  AutoProof: auto-active functional verification of object-oriented programs , 2015, International Journal on Software Tools for Technology Transfer.

[14]  Bernhard Beckert,et al.  Reasoning and Verification: State of the Art and Current Trends , 2014, IEEE Intelligent Systems.

[15]  Nadia Polikarpova,et al.  Formal Aspects of Computing Formal Aspects of Computing A fully verified container library , 2017 .

[16]  Kurt Stenzel,et al.  Reuse of Proofs in Software Verification , 1993, FSTTCS.

[17]  Peter M. McIlroy.  Optimistic sorting and information theoretic complexity , 1993, SODA '93.

[18]  Wojciech Mostowski,et al.  Formalisation and Verification of Java Card Security Properties in Dynamic Logic , 2005, FASE.

[19]  Cezary Kaliszyk,et al.  Hammering towards QED , 2016, J. Formaliz. Reason..

[20]  Bernhard Beckert,et al.  Deductive Software Verification – The KeY Book , 2016, Lecture Notes in Computer Science.

[21]  Koushik Sen,et al.  Symbolic execution for software testing: three decades later , 2013, CACM.

[22]  C.-B. Breunesse.  On JML: topics in tool-assisted verification of Java programs , 2006 .