The design and verification of Java's memory model

After many years of waiting, real support for multi-threading has been integrated into mainstream programming languages. Inclusion of this long-awaited feature brings with it a need for a clear and direct explanation of how threads interact through memory. Java's threading specification, its memory model, is fundamentally flawed [1, §17]. Some language features, like volatile fields, are under-specified: their treatment is so weak as to be useless. Other features, including fields without access modifiers, are over-specified: the memory model prevents almost all optimizations of code containing these "normal" fields. Finally, some features, like final fields, have no specification at all.This work has attempted to remedy these limitations; we provide a clear and concise definition of thread interaction. It is sufficiently simple for programmers to work with, and flexible enough to take advantage of compiler and processor-level optimizations. We provide techniques for verifying that the model does what we expect it to do, and apply them. These techniques take the form of both rigorous proof and automated simulation. This work is critical for portable, safe, secure and efficient support of multi-threading.