Heaps and Hops

This dissertation is about the specification and verification of copyless message-passing programs, a particular kind of concurrent programs that communicate by message passing. Instead of copying messages over channels, processes exchange pointers into a shared memory where the actual contents of messages are stored. Channels are themselves objects in the heap that can be communicated, thus achieving full mobility. This flexible and efficient programming paradigm must be used carefully: every pointer that is communicated becomes shared between its sender and its recipient, which may introduce races. To err on the side of caution, the sender process should not attempt to access the area of storage circumscribed by a message once it has been sent. Indeed, this right is now reserved to the recipient, who may already have modified it or even disposed of it. In other words, the ownership of pieces of heap hops from process to process following the flow of messages. Copyless message passing combines two features of programs that make formal verification challenging: explicit memory management and concurrency. To tackle these difficulties, we base our approach on two recent developments. On the one hand, concurrent separation logic produces concise proofs of pointer-manipulating programs by keeping track only of those portions of storage owned by the program. We use such local reasoning techniques to analyse the fluxes of ownership in programs, and ensure in particular that no dangling pointer will be dereferenced or freed at runtime. On the other hand, channel contracts, a form of session types introduced by the S♯ programming language, provide an abstraction of the exchanges of messages that can be used to statically verify that programs never face unexpected message receptions and that all messages are delivered before a channel is closed. The contributions contained in this dissertation fall into three categories. First, we give a semantics to copyless message-passing programs, the ownership transfers they induce and contracts, and link the three together. In doing so, we provide the first formal model of a theoretically significant subset of the S♯ programming language. In particular, we show that some properties of their contracts rub off on programs, which justifies their use as protocol specifications. Second, we introduce the first proof system for copyless message passing, based on separation logic and contracts. The proof system discharges parts of the verification of programs on the verification of their contracts. The marriage of these two techniques allows one to prove that programs are free from memory faults, race conditions and message-passing errors such as unspecified receptions and undelivered messages. Moreover, we show how the logic and contracts cooperate to prove the absence of memory leaks. Third, we give an implementation of our analysis, Heap-Hop, that takes annotated