Finding errors from reverse-engineered equality models using a constraint solver

Java objects are required to honor an equality contract in order to participate in standard collection data structures such as List, Set, and Map. In practice, the implementation of equality can be error prone, resulting in subtle bugs. We present a checker called EQ that is designed to automatically detect such equality implementation bugs. The key to EQ is the automated extraction of a logical model of equality from Java code, which is then checked, using Alloy Analyzer, for contract conformance. We have evaluated EQ on four open-source, production code bases in terms of both scalability and usefulness. We discuss in detail the detected problems, their root causes, and the reasons for false alarms.

I. Introduction

Software systems rely on various rules to govern the interactions among their components. Such rules are often specified by the API developers and obeyed by the application developers. One important case in Object-Oriented languages such as Java¹

http://tinyurl.com/java-equals. All URLs verified on July 11, 2012

and C#²

http://tinyurl.com/csharp-equals

is the contract for the Object.equals () method, which requires that all objects satisfy the three properties of the equivalence relation (reflexivity, symmetry, and transitivity) in order to participate in collections such as List and Set. Breaking this contract often leads to unforeseen bugs that are hard to diagnose even for an experienced developer [4][21][23][26][10]. Indeed, the correct implementation of equality is probably a concern for all programmers. For example, 622 classes in JDK 1.5 override Object.equals (), covering such diverse areas as networking, security, CORBA, RMI, and utilities.