A Closer Look at Aspect Interference and Cooperation Cynthia Disenfeld Shmuel Katz Department of Computer Science Technion - Israel Institute of Technology {cdisenfe,katz}@cs.technion.ac.il Abstract In this work we consider specification and compositional verification for interference detection when several aspects are woven together under joint-weaving semantics without recursion. In this semantics, whenever a joinpoint of an as- pect is reached, the corresponding advice is begun even if the joinpoint is inside the advice of other aspects. This captures most of the possible aspect interference cases in AspectJ. Moreover, the given technique is used to capture cooperation among aspects, which enhances modularity. The extended specification and proof obligations should provide insight to the possible interactions among aspects in a reusable library. Categories and Subject Descriptors D.2.1 [Software En- gineering]: Requirements/Specifications; D.2.4 [Software Engineering]: Software/Program Verification—Correctness proofs, Model checking General Terms Languages, Verification Keywords Aspects, Joint-Weaving, Verification, Composi- tion, Cooperation, Interference 1. Introduction Aspects capture problems that may crosscut the application, such as logging, persistence, exception management, and others. Weaving several aspects within an application may lead to interference: given a set of aspects, each aspect on its own behaves as expected but when considering all aspects woven together the expected behavior is no longer achieved. In this work, we extend existing results on interference detection, to treat the basic joint-weaving semantics seen in AspectJ. In joint-weaving semantics, whenever a joinpoint of an aspect is reached, the corresponding advice is begun even if the joinpoint is inside the advice of other aspects. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. AOSD’12 March 25–30, 2012, Potsdam, Germany. Copyright c  2012 ACM 978-1-4503-1092-5/12/03. . . $10.00 aspect Auth before () : doTrans() Usr u= requestUsr () Pwd p= requestPwd () authenticated = usrPwdExist(u,p) aspect SaveCookie after (Usr u, Pwd p) returning ( boolean success): call ( ∗ usrPwdExist (..) ) && args (u,p) if (success) saveCookie(u,p) aspect EncryptPwd Pwd around (): call (requestPwd()) Pwd p= proceed () return encrypt(p) Figure 1. Aspects Auth, SaveCookie and EncryptPwd The program listing in Figure 1 shows AspectJ-style as- pects to authenticate transactions on a website (Auth), to save a cookie on authentication success (SaveCookie), and to encrypt passwords (EncryptPwd), where the latter two are activated within the advice code of the first. Note that SaveCookie does not affect the behavior of Auth. However EncryptPwd may cause an existing user and password not to be found anymore by Auth (because the password is now encrypted by the time the check is done). This interference is caused from the execution of EncryptPwd within Auth. In this paper, we will consider a precise representation of aspect specifications which allow using formal verification techniques to detect such interfer- ence. If EncryptPwd assumes that every password satisfies some necessary constraints (such as a minimum number of characters, combination of letters, numbers and symbols), then another aspect may collaborate in order to guarantee that the assumptions of EncryptPwd hold. Such aspect col- laboration will also be considered. A restricted procedure for detecting interference among aspects using model checking is presented in MAVEN [8]. This method assumes that there are no joinpoints inside ad- vice and is valid for sequential weaving, where the advice of an aspect is woven into the system at the joinpoints available so far, and then another aspect can be woven. (In addition, [8] considers simple cases in which joint weaving is equiva- lent to sequential weaving.)