We define the noninterference relation for static effects (Γ ⊢ E # E′
) as follows. The noninterference relation is symmetric:
NI-SYMMETRIC Γ ⊢ E # E′
Γ ⊢ E′# E
Pairs of reads always commute:
NI-READ
Γ ⊢readsR #readsR′ Read-write and write-write pairs commute only if the locations are disjoint:
NI-READ-WRITE Γ ⊢ R # R′
Γ ⊢readsR #writesR′
NI-WRITE Γ ⊢ R # R′
Γ ⊢writesR #writesR′
An invocation effect commutes with another effect if the underlying effect of the invocation commutes with that effect:
NI-INVOKES-1 Γ ⊢ E # E′
Γ ⊢invokesC.mwithE # E′
Two invocation effects commute if they are declared to commute, regardless of their underlying effects:
NI-INVOKES-2 mcommuteswithm′∈
def(C) Γ ⊢invokesC.mwithE #invokesC.m′
withE′
Finally, we have the obvious rules for empty sets and set unions:
NI-EMPTY
Γ ⊢ ∅ # E
NI-UNION Γ ⊢ E # E′′ Γ ⊢ E′# E′′
Γ ⊢ E ∪ E′# E′′
We extend the relation to dynamic effects as described in Section 4.2.3.
Now we can prove that expressions with noninterfering effects commute. First we define basic effects, which are the actual effects produced by program execution:
Definition 4.3.7. A basic effect is one of the following:readsRf,writesRf, orinvokesC.mwith
dE′′
, wheredE′′
is a possibly empty union of basic effects.
Lemma 4.3.8. If(e, Σ, H) → (o, H′
, dE), then dE is a possibly empty union of basic effects.
Proof. Obvious from the rules given in Section 4.2.2.
Next we formally define what it means for a commutativity annotation mcommuteswithm′
to be correct:
Definition 4.3.9. For a program P, an annotation mcommuteswithm′
appearing in class C of P is correct if for every pair of heapsH and H′
and objects o and o′
inH such that executing o.m and then o′
.m′
with initial heapH produces heap H′
, executing the methods in reverse order (i.e.,o′
.m′
theno.m) in initial heapH also produces heap H′
.
Informally,m and m′
commute if the order in which they appear in the program execution is irrelevant. Note that we define commutativity in terms of physical heap state, which is somewhat stronger than we might want in a real application: for example, we might want to treat two methods as commutative if either order of execution produces the same abstract data structure, with possibly different internal representations. The formalism given here could easily be extended to represent higher-level notions of equivalent heap state, such as equivalent data structures with different internal representations.
Now we can state a proposition about the dynamic effects produced by program execution: if we evaluate e then e′
with the same dynamic environmentΣ, and if the dynamic effects produced by the two evaluations are noninterfering, thene and e′are commutative, i.e., we get the same result as if we evaluatee′ thene: Proposition 4.3.10. If all annotationsmcommuteswithm′
appearing inP are correct and (e, Σ, H) → (o, H′ , dE) and (e′ , Σ, H′ ) → (o′ , H′′ , dE′ ) and H′′⊢ dE # dE′
, then there existsH′′′
such that(e′ , Σ, H) → (o′ , H′′′ , dE′ ) and (e, Σ, H′′′ ) → (o, H′′ , dE).
Proof. First, note that the rules in Section 4.2.2 faithfully record the heap effects of expression evaluation: whenever we read a region, we record a read effect to that region (DYN-FIELD-ACCESS); whenever we write
a region, we record a write effect to that region (DYN-FIELD-ASSIGN); and whenever we invoke a method,
we record an invocation with all the effects that occurred during the evaluation of the method body (DYN- INVOKE). Further, by rules NI-EMPTYand NI-UNION, it is clear that two effects are noninterfering if and
only if their component basic effects are pairwise noninterfering. Thus it suffices to prove the proposition in the case where each ofdE and dE′
is a basic effect.
Note that the invocation effect is recursive (invocation effects can appear in the effectdE′′
ininvokes C.mwithdE′′
). So use induction on the total number of times thatinvokesappears indE and dE′
. In the base case of zero times, the result is obvious from the noninterference rules, Proposition 4.3.6, and the semantics of read and write. In the inductive case, eitherdE or dE′
(or both) is an invocation effect, and we must have used either DYN-NI-INVOKES-1 or DYN-NI-INVOKES-2 to proveH ⊢ dE # dE′. Assume
without loss of generality thatdE = invokesC.mwithdE′′
. If we used DYN-NI-INVOKES-1, then
we haveH ⊢ dE′′
# dE′
, and by the IH all the operations that createddE′′
can be interchanged with the operation that createddE′
. Therefore the method invocation that produceddE can be interchanged with the operation that produceddE′
. If we used DYN-NI-INVOKES-2, then by Definition 4.3.9, the operations can be interchanged without changing the resulting heap state.
By extending this result to static effects, we obtain the main soundness property of Core DPJ:
Theorem 4.3.11. IfΓ ⊢ e : T, E and Γ ⊢ e′
: T′
, E′
and Γ ⊢ E # E′
andH ⊢ Σ Γ and (e, Σ, H) → (o, H′, dE) and (e′, Σ, H′) → (o′, H′′, dE′), then there exists H′′′ such that(e′, Σ, H) → (o′, H′′′, dE′)
and(e, Σ, H′′′
) → (o, H′′
, dE).
Proof. By Proposition 4.3.10, it suffices to prove thatH′′ ⊢ dE # dE′
, and again we can assume thatdE and dE′
are basic. By Theorem 4.2.7, we have (a)H′′ ⊢ dE ⊆ Σ(E) and H′′ ⊢ dE′ ⊆ Σ(E′
), and by Lemma 4.2.6, we have (b)H′′⊢ Σ(E) # Σ(E′). Now consider the possibilities for dE and dE′
. Again we use induction on the total number of times thatinvokesappears indE and dE′. In the base case of zero
times, there are three possibilities, up to reordering:
1. dE =readsdRf,dE′ =readsdR′f: Obvious because pairs of reads always commute.
2. dE = readsdRf,dE′ = writesdRf′: By (a) together with rules DYN-SE-READS, DYN-SE-
READS-WRITES, and DYN-SE-WRITES, there exists an effectreadsdR orwritesdR in Σ(E)
such thatH ⊢ dRf ⊆ dR, and there exists an effectwritesdR′ inΣ(E′) such that H ⊢ dR′f ⊆
dR′
. By (b) and the rules for noninterference of effect, we haveH′′ ⊢ dR # dR′
. Lemma 4.3.3 and Proposition 4.3.4 then establish thatdRf anddRf′ are distinct regions.
3. dE = writesdRf,dE′ = writesdR′f: Nearly identical to case 2, except that only DYN-SE-
WRITES is used, and both effects are covered by a write.
In the inductive case, there are a further three possibilities, again up to reordering:
4. dE =readsRf,dE′ =invokesC.mwithdE′′: By the rules for subeffects, together with (a),
dE is covered by eitherreadsdR orwritesdR in Σ(E); and eitherinvokesC.mwithdE′′′
appears inΣ(E′ ) with H′′ ⊢ dE′ ⊆ dE′′′ (rule Dyn-SE-Invokes-1), orH′′ ⊢ dE′′ ⊆ Σ(E′ ) (rule Dyn-SE-Invokes-2). In the first case, by rule DYN-NI-INVOKES-1, we have that the covering read or write effect is disjoint from dE′′′
, and by the IH we have that readsRf is disjoint from dE′′,
which gives the result, again by rule DYN-NI-INVOKES-1. In the second case, the IH gives the result directly.
5. dE =writesRf,dE′ =invokesC.mwithdE′′: Same as case 4, except thatdE is covered
only by a write effect.
6. dE = invokesC.mwithdE′′
, dE′
= invokesC′ .m′
withdE′′′
: If we used rule NI- Invokes-1 to prove that the two covering effects are noninterfering, then this case reduces to the IH. Otherwise, each ofdE and dE′
is covered by an invocation effect, and the two effects are non- interfering by rule NI-Invokes-2. In this case, we haveC = C′
,mcommuteswithm′ ∈def
(C), andH′′⊢ E′′
# E′′′
. ThereforeH′′⊢ dE # dE′
, again by rule NI-Invokes-2.
Theorem 4.3.11 says that if two expressions have noninterfering static effects, then their actual runtime effects are noninterfering as well. Therefore, we can use the static effect information to reason soundly about noninterference at runtime.