Verifying OpenJDK's Sort Method for Generic Collections

Stijn de Gouw*, Frank S. de Boer, Richard Bubel, Reiner Hähnle, Jurriaan Rot, Dominic Steinhöfel

*Corresponding author for this work

Research output: Contribution to journalArticleAcademicpeer-review

3 Citations (Web of Science)


TimSort is the main sorting algorithm provided by the Java standard library and many other programming frameworks. Our original goal was functional verification of TimSort with mechanical proofs. However, during our verification attempt we discovered a bug which causes the implementation to crash by an uncaught exception. In this paper, we identify conditions under which the bug occurs, and from this we derive a bug-free version that does not compromise performance. We formally specify the new version and verify termination and the absence of exceptions including the bug. This verification is carried out mechanically with KeY, a state-of-the-art interactive verification tool for Java. We provide a detailed description and analysis of the proofs. The complexity of the proofs required extensions and new capabilities in KeY, including symbolic state merging.
Original languageEnglish
Pages (from-to)93-126
Number of pages34
JournalJournal of Automated Reasoning
Issue number1
Publication statusPublished - 31 Jan 2019


  • Case study
  • Program verification
  • Specification
  • Theorem proving


Dive into the research topics of 'Verifying OpenJDK's Sort Method for Generic Collections'. Together they form a unique fingerprint.

Cite this