Abstract. Methods that query the state of a data structure often return identical or equivalent values as long as the data structure does not change. Program verification depends on this fact, but it has been difficult to specify and verify such equivalent-results methods and their callers. This paper presents an encoding from which one can determine equivalent-results methods to be deterministic modulo a user-defined equivalence relation. It also presents a technique for checking that a query method returns equivalent results and enforcing that the result depends only on a user-defined influence set. The technique is general, for example it supports user-defined equivalence relations based on Equals methods and it supports query methods that return newly allocated objects. The paper also discusses the implementation of the technique in the context of the Spec# static program verifier. Computer programs contain many methods that query the state of a data structure and return a value based on that state. As long as the data structure remains unchanged, one expects different invocations of the query method to produce equivalent return values. For methods returning scalar values, the return values are expected to be the same. For methods returning object references, the most interesting equivalences are reference equality and equivalence based on the Equals method. A simple and common example of a query method is the Count method of a collection class, like List in Fig. 0 , where for a given collection the method returns the number of elements stored in the collection. Obviously, one expects Count to return identical values when called twice on the same collection. Another example is shown in the Calendar class in Fig. 2 , where invocations of the GetEarliestAppointment will yield equivalent results as long as the state of the calendar does not change. However, since GetEarliestAppointment returns a newly allocated object, the results will not be identical. Due to object-allocation, query methods cannot be expected to be deterministic. Nevertheless, their results are expected to be equivalent. Therefore, we shall refer to such query methods as equivalent-results methods. Query methods (also called pure methods) are particularly important in assertion languages such as JML [15] or Spec# [1] because they allow assertions to be expressed in an abstract, implementation-independent way. For instance, Count is used in the precondition of GetItem (Fig. 0) to refer to the number of elements in the list without revealing any implementation details. However, reasoning about assertions that contain query methods is difficult. The client program in Fig. 1 illustrates the problem. It uses a
Luckily, this case has occurred only for property getters whose body returns a newly allocated object (see REF for a technique that allows such methods to be considered observationally pure).
Verification of Equivalent-Results Methods
ESOP
Computer Science