Upload
russell-white
View
39
Download
0
Tags:
Embed Size (px)
DESCRIPTION
Javari: Adding Reference Immutability to Java. Matthew Tschantz & Michael Ernst (MIT) OOPSLA’05 Presented by Tali Shragai. Extension to Javari2004 [Birka]. Javari: Java + (C++ const) + more… Two new keywords: readonly , mutable OOPSLA’04: Initial Javari implementation - PowerPoint PPT Presentation
Citation preview
1
Javari: Adding Reference Immutability to Java
Matthew Tschantz & Michael Ernst (MIT)
OOPSLA’05
Presented by Tali Shragai
2
Extension to Javari2004 [Birka]
Javari: Java + (C++ const) + more… Two new keywords: readonly, mutable
OOPSLA’04: Initial Javari implementation Experience: 160,000 code lines
Better documentation Error detection and prevention Compatible with Java & existing JVMs
But: No Generics, serialization, reflection Confuses mutability & assignability
Javari 05: More keywords: assignable, romaybe Genericity, reflection, serialization Most important (?): mutability vs. assignability
3
Protecting method arguments A library routine does not modify its arguments:
static void print(readonly Date d) { ... // Cannot modify d }
String toString() readonly { ... // Cannot modify the receiver}
4
Protecting abstract state: observer methods
class Class {
private Object[] signers;
Object[] getSigners() { return signers; // JDK 1.1 security hole
}
}
myClass.getSigners()[0] = “Sun”;
5
Protecting abstract state: observer methods (revised)
class Class {
private Object[] signers;
readonly Object[] getSigners() {
return signers; // Fixes JDK 1.1 bug
}
}
myClass.getSigners()[0] = “Sun”; // Error
6
Reference vs. Object immutability Reference immutability
Object modification: Readonly reference: no! Other reference: yes.
Deep: cannot modify transitively reachable state Static type checking!
Dynamic checking for mutability downcasts Object immutability:
write protect from any reference
Graph temp = new Graph();// construct the graphreadonly Graph g = temp;temp = null;// further usage through read only reference…
Javari: object immutability emulated by reference immutability
7
Related work Old trick: pass/return by value
pain for large objects C++: const, const_cast
Unsound (unchecked casts) Non-transitive! No immutability-based parameterization Leads to code duplication (const methods) No support for multidimensional arrays?
JAC [Kniesel 2001]: Implementation requires rewriting the code Unsound (subtyping, arrays) Return type mutability equals receiver's
8
Protection methods
Level Java C++ JavariLevel 1
assignmentfinal Foo a const Foo *a final Foo a
Level 2 mutability
Foo const *a readonly Foo a
Level 3 const Foo const *a final readonly Foo a
… Level ∞ Transitive protection!
9
Yield protection
Level Java C++ JavariLevel 1 mutable Foo *a assignable Foo a
Level 2 mutable Foo a
10
Readonly
readonly Date rd = new Date();
rd.year = 2005; // Compile-time error
rd.incrementDay(); // Compile-time error
rd = new Foo(); // OK
11
Mutability vs. Assignability
final Date fd = null;readonly Date rd = null; fd = new Date(); // Error: finalrd = null; // OKDate d1 = fd; // OKDate d2 = rd; // Error: wrong type
Mutability Assignabilitypart of the type not part of the type
may abstract state mutate?
can be lvalue in assignment?
readonly final
12
Type system
Every type (mutable) T has readonly T as a supertype
readonly Object
readonly Date
/*mutable*/ Object
/*mutable*/ Date
13
Immutable classes
A class/interface can be declared immutable using readonly in its class declaration. Non-static fields & methods readonly (default) Reference to its objects implicitly read-only Subclasses must be immutable too! readonly class String{…}/*readonly*/ String s1 = new String();readonly String s2 = new String();
S1 = s2; // OKS2 = s1; // OK
14
Assignability May a reference be assigned to?
class Appointment {final Date time; // Same as in Javaassignable int room;
}
Appointment appoint;
appoint.time = new Date(); // Errorappoint.room = 250; // OK
15
Assignability modifiers
final: May never be assigned
assignable: May always be assigned (default for locals)
this-assignable: May be assigned through a mutable reference May not be assigned through a readonly reference Only applicable to fields (the default) The assignability depends on the mutability of the
enclosing object: “this”
16
Assignability example
class Bicycle {
final int id; // Never changes
assignable int hashCode; // A cache
/*this-assign*/ int gear; // Abstract state
}
/*mutable*/ Bicycle b;
readonly Bicycle rb;
17
final
class Bicycle { final int id; // Never changes assignable int hashCode; // A cache /*this-assign*/ int gear; // Abstract
state}/*mutable*/ Bicycle b;readonly Bicycle rb;b.id = 5; // Errorrb.id = 5;// Error Resolved assignability of ref.f
Declared assignability of f
Resolved mutability of ref
mutable readonly
final unassignable unassignable
18
assignable
class Bicycle { final int id; // Never changes assignable int hashCode; // A cache /*this-assign*/ int gear; // Abstract state}/*mutable*/ Bicycle b;readonly Bicycle rb;b.hashCode = 5; // OKrb.hashCode = 5; // OK
Resolved assignability of ref.f
Declared assignability of f
Resolved mutability of ref
mutable readonly
final unassignable unassignable
assignable assignable assignable
19
this-assignable
class Bicycle { final int id; // Never changes assignable int hashCode; // A cache /*this-assign*/ int gear; // Abstract state}/*mutable*/ Bicycle b;readonly Bicycle rb; b.gear = 5; // OK rb.gear = 5; // Error
Resolved assignability of ref.f
Declared assignability of f
Resolved mutability of ref
mutable readonly
final unassignable unassignable
assignable assignable assignable
this-assignable assignable unassignable
20
Mutability
May the object’s transitive abstract state be modified?
class Date {
/*this-assignable*/ int year;
}
/*mutable*/ Date d;
readonly Date rd;
d.year = 2005; // OK
rd.year = 2005; // Error
21
Mutability modifiers
readonly: May never be mutated
mutable: May always be mutated, the default for locals
this-mutable: May be mutated through mutable reference May not be mutated through readonly references Only applicable to fields (the default) The mutability depends on the mutability of the
enclosing class: “this”
22
Mutability example
class Account { readonly Customer owner; mutable RequestLog requests; /*this-mut*/ Balance bal;}/*mutable*/ Account a;readonly Account ra;
23
readonly
class Account { readonly Customer owner; mutable RequestLog requests; /*this-mut*/ Balance bal;}/*mutable*/ Account a;readonly Account ra;a.owner.setName(“Bob”); // Errorra.owner.setName(“Bob”); // Error
Mutability of ref.f
Declared mutability of f
Resolved mutability of ref
mutable readonly
readonly readonly readonly
24
mutable
class Account { readonly Customer owner; mutable RequestLog requests; /*this-mut*/ Balance bal;}/*mutable*/ Account a;readonly Account ra;a.requests.add(“checkBalance”); // OKra.requests.add(“checkBalance”); // OK
Mutability of ref.f
Declared mutability of f
Resolved mutability of ref
mutable readonly
readonly readonly readonly
mutable mutable mutable
mutable excludes requests from the
abstract state of the object
25
this-mutable
class Account { readonly Customer owner; mutable RequestLog requests; /*this-mut*/ Balance bal;}/*mutable*/ Account a;readonly Account ra;a.balance.withdraw(1000); // OK
Declared mutability of f
Resolved mutability of ref
mutable readonly
readonly readonly readonly
mutable mutable mutable
this-mutable mutable ?
26
this-mutable
class Account { readonly Customer owner; mutable RequestLog requests; /*this-mut*/ Balance bal;}/*mutable*/ Account a;readonly Account ra;a.balance.withdraw(1000); // OKra.balance.withdraw(1000); // Error
Mutability of ref.f
Declared mutability of f
Resolved mutability of ref
mutable readonly
readonly readonly readonly
mutable mutable mutable
this-mutable mutable readonly?
27
this-mutable fields reached through a readonly reference
readonly, right?
28
this-mutable fields reached through a readonly reference
readonly, right? NO, would result in type loophole allowing one to
convert a readonly reference to a mutable reference:
29
this-mutable fields reached through a readonly reference
class Student { assignable /*this-mut*/ GradeReport grades;}/*mutable*/ Student s = new Student();readonly Student rs = s;readonly GradeReport rg;/*mutable*/ GradeReport g;
rs.grades = rg; //readonly assigned to this-mutableg = s.grades; //this-mutable assigned to mutable
Downcast
rs
s
grades
Non-readonly
Readonly
Readonly??assignable
30
this-mutable fields reached through a readonly reference
Solution: Disallow readonly references to be assigned to a this-mutable field
this-mutable fields through readonly reference are: readonly as rvalue (may only be assigned to a
readonly reference) mutable as lvalue (may only be assigned with
mutable reference)
Notation: <? readonly GradeReport>
31
Uses of parametric classes
Local variable declarations:
/*mut*/ List</*mut*/ Date> a; // add, mutate
/*mut*/ List<readonly Date> b; // add
readonly List</*mut*/ Date> c; // mutate
readonly List<readonly Date> d; // neither
32
Inside parametric classes
Type arguments include mutability
Library cannot write:
class C<T> { mutable T x; }
C<readonly Date> y; // Conflicting types
Library can force a mutable type using a bound:
;
class C<T extends mutable Object> { T x; }
33
this-mutable type argumentsclass Device { /*this-mut*/ List</*this-mut*/ Driver> drivers;}
/*mutable*/ Device d;readonly Device rd;
d.drivers has type /*mut*/ List</*mut*/ Driver>
/*mut*/ List</*mut*/Driver> dl = d.drivers; // OK
34
this-mutable type arguments
class Device { /*this-mut*/ List</*this-mut*/ Driver> drivers;}
/*mutable*/ Device d;readonly Device rd;
rd.drivers has type ? readonly List<? readonly Driver>
readonly List<? readonly Driver> x = rd. drivers; //OKreadonly List<readonly Driver> y = rd. drivers; //Errorreadonly List</*mutable*/Driver> z = rd. drivers; //Error
35
Serialization
Add a readonly-ness bit to the serialized form.
De-serialization done using 2 versions of ObjectInputStream.readObject: readObjectReadonly – returns a read-only
object, without checking. readObject – returns a mutable objects, but
throws an exception if the readonly-ness bit is set.
36
Reducing code duplication
In Java, each class definition defines exactly one type. In Javari, by contrast, a class C actually denotes 2 type: C and readonly C.
romaybe keyword templates over methods
class Conference { /*this-mutable*/ Date d;
We wish to write two (overloaded) methods:
readonly Date getDate() readonly { return d;} /*mutable*/ Date getDate() /*mutable*/{ return d;}
Syntactic sugar:
romaybe Date getDate() romaybe { return d;}}
37
Downcasts
Javari guarantees that a readonly reference cannot be used, directly or indirectly, to modify its referent.
Down-casting a reference from readonly to mutable triggers run-time checks, which disallow any modifications done through the casted reference.
38
Downcast example
class Foo{Date d;void setD() /*mutable*/{
d = new Date();}
}Foo f1 = new Foo();
readonly Foo rf = f1;Foo f2 = (mutable)rf;
f1.d = new Date(); // OKf2.d = new Date(); // run-time errorf1.setD(); // OKF2.setD(); // run-time error
39
Contributions
Transitive reference immutability Distinguishes assignability and mutability Formal model (not shown here) Type system for full Java 5.0 including
parametric polymorphism, reflection, and serialization
Templates to reduce code duplication Interoperable with Java Still to come: type inference…
40
The End!
Thank you for listening…