Specifying multithreaded Java semantics for program verification