Static Analysis of JWIG Programs

The unique design of JWIG allows some specialized program analyses to be performed, such that the programmer can check at compile time that certain kinds of errors related to the dynamic document construction cannot occur at runtime. The JWIG analyzer considers the following properties for a given program:

plug consistency:

that gaps are always present when subjected to the plug operation and XML templates are never plugged into attribute gaps

receive consistency:

that input fields occur the right number of times in the shown documents so receive and receive[] operations always succeed

show validity:

that all documents being shown are valid XHTML 1.0

If any of these correctness properties is not satisfied at runtime, an exception will be thrown, as described earlier. The analyses try to verify at compile time that these exceptions cannot occur, and if then can occur, an explanatory warning message is automatically produced.

To analyze a JWIG program, run

    jwig analyze files

where files is a collection of class files from the compiled program. This collection is called the application classes. For efficiency reasons, the application classes can be just the few classes that actually constitute the JWIG service, not including all the standard Java classes that the program uses. Exactly one of the application classes must be a subclass of Service.

As an example, if we try analyzing a buggy version of the guessing game example from the JWIG distribution, the following errors are reported (abbreviated with "..."):

Gap `holder' does not exist on line 67
Field `name' is not always available exactly once on line 70
*** Invalid XHTML at line 69
--- element 'html' in XML template at line 10: illegal content:
<sequence>
 <element xmlns:h="http://www.w3.org/1999/xhtml" name="h:head" />
 <element xmlns:h="http://www.w3.org/1999/xhtml" name="h:body" />
</sequence>
'body' <- XML template at line 14 in class BuggyGuess in template plug
          into `body' at line 49 in class BuggyGuess$Play
...

The first line explains that a plug operation on line 67 in the source program may fail because the specified gap does not exist. Similarly, the next line means that a receive operation may fail. The remaining lines mean that the show operation on line 69 may send invalid XHTML to the client. The XML fragment in the error message is the part of the DSD2 schema constraint that is violated. In this example, the validity requirement that html elements always must contain a head element followed by a body element is not satisfied. The last line shows the relevant plug operations.

The soundness of the analyses is based on a set of well-formedness assumptions:

• all invocation sites in the application classes must either always invoke methods in the application classes or always invoke methods in the non-application classes
• no fields or methods of application classes are accessed by a non-application class
• no XML operations are performed in non-application classes
• XML casts are always valid, according to the definition in the previous section

These assumptions usually do not limit expressibility in practice. In some cases, the second assumption can be relaxed slightly, for instance if some method called from a non-application class does not modify any String or XML value that will ever reach other application class methods. This makes it possible to safely use callback mechanisms such as the Comparator interface.

The current prototype implementation may require large amounts of memory when analyzing complex JWIG programs. The running times for the analysis typically range from a few seconds to a number of minutes, depending on the program size and complexity. Analyzing a JWIG program is recommended, not after every single compilation, but periodically as a supplement to extensive testing before the deployment.

The technical details of the JWIG program analyses are explained in the research paper Extending Java for High-Level Web Service Development. The JWIG development team is working on improving the analysis implementation to produce more precise error messages and decrease the time and space requirements.

News in JWIG 1.1: The program analysis now uses the Java String Analyzer, which is described in the paper Precise Analysis of String Expressions. This analyzer is able to track the values of string expressions more precisely than previously possible.