Contents. Softwaretechnik. Type Safety of Java. Featherweight Java. Lecture 21: Featherweight Java

Transcription

1 Contents Softwaretechnik Lecture 21: Peter Thiemann Universität Freiburg, Germany Operational Semantics SS 2011 Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 1 / 40 Type Safety of Java Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 2 / public presentation of Java obtain importance very fast Questions type safety? What does Java mean? 1997/98 resolved Drossopoulou/Eisenbach Flatt/Krishnamurthi/Felleisen Igarashi/Pierce/Wadler (, FJ) Construction of a formal model: consideration of completeness and compactness FJ: minimal model (compactness) complete definition: one page ambition: the most important language features short proof of type soundness FJ Java Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 3 / 40 Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 4 / 40

2 The Language FJ Omitted class definition object creation new method call (dynamic dispatch), recursion with this field access type cast override of methods subtypes assignments interfaces overload super-calls null-references primitive types abstract methods inner classes shadowing of fields of super classes access control (private, public, protected) exceptions concurrency reflections Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 5 / 40 Example Programs Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 6 / 40 Explanation class A extends Object { A() { super (); class B extends Object { B() { super (); class Pair extends Object { Object fst; Object snd; // Constructor Pair (Object fst, Object snd) { super(); this.fst = fst; this.snd = snd; // Method definition Pair setfst (Object newfst) { return new Pair (newfst, this.snd); class definition: always define super class constructors: one per class, always defined arguments correspond to fields always the same form: super-call, then copy the arguments into the fields field accesses and method calls always with recipient object method body: always in the form return... Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 7 / 40 Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 8 / 40

3 Examples for Evaluation Examples for Evaluation method call method call new Pair (new A(), new B()).setfst (new B()) // will be evaluated to new Pair (new B(), new B()) new Pair (new A(), new B()).setfst (new B()) // will be evaluated to new Pair (new B(), new B()) type cast ((Pair) new Pair (new Pair (new A(), new B ()), new A()).fst).snd includes type cast (Pair) It s needed, because new Pair (...).fst has the type Object. Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 9 / 40 Examples for Evaluation field access new Pair (new A (), new B ()).snd // will be evaluated to new B() Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 9 / 40 Examples for Evaluation field access new Pair (new A (), new B ()).snd // will be evaluated to new B() method call new Pair (new A(), new B()).setfst (new B()) yields a substitution [new B()/newfst, new Pair (new A(), new B())/this] We have to evaluate the method body new Pair (newfst, this.snd) under this this substitution. The substitution yields new Pair (new B(), new Pair (new A(), new B()).snd) Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 10 / 40 Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 10 / 40

4 Examples of Evaluation type cast (Pair)new Pair (new A (), new B ()) // evaluates to new Pair (new A (), new B ()) Examples of Evaluation type cast (Pair)new Pair (new A (), new B ()) // evaluates to new Pair (new A (), new B ()) runtime check if Pair is a subtype of Pair. runtime check if Pair is a subtype of Pair. call-by-value evaluation ((Pair) new Pair (new Pair (new A(), new B ()), new A()).fst).snd // ((Pair) new Pair (new A(), new B ())).snd // new Pair (new A(), new B ()).snd // new B() Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 11 / 40 Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 11 / 40 Runtime Error Runtime Error access to non existing field new A().fst no value, no evaluation rule matches access to non existing field new A().fst no value, no evaluation rule matches call of non existing method new A().setfst (new B()) no value, no evaluation rule matches Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 12 / 40 Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 12 / 40

5 Runtime Error access to non existing field Guarantees of Java s Type System new A().fst no value, no evaluation rule matches call of non existing method new A().setfst (new B()) no value, no evaluation rule matches If a Java program is type correct, then all field accesses refer to existing fields all method calls refer to existing methods, but failing type casts are possible. failing type cast (B)new A () A is not subtype of B no value, no evaluation rule matches Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 12 / 40 Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 13 / 40 Syntax CL ::= class definition class C extends D {C 1 f 1 ;... K M 1... K ::= constructor definition C(C 1 f 1,... ) {super(g 1,... ); this.f 1 = f 1 ;... M ::= method definition C m(c 1 x 1,... ) {return t; t ::= expressions x variable t.f field access t.m(t 1,... ) method call new C(t 1,... ) object creation (C) t type cast v ::= values new C(v 1,... ) object creation Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 14 / 40 Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 15 / 40

6 Syntax Conventions Syntax Conventions this special variable, do not use it as field name or parameter implicit bound in each method body sequences of field names, parameter names and method names include no repetition class C extends D {C 1 f 1 ;... K M 1... defines class C as subclass of D fields f 1... with types C 1... constructor K methods M 1... fields from D will be added to C, shadowing is not supported C(D 1 g 1,..., C 1 f 1,... ) {super(g 1,... ); this.f 1 = f 1 ;... define the constructor of class C fully specified by the fields of C and the fields of the super classes. number of parameters is equal to number of fields in C and all its super classes. body start with super(g 1,... ), where g 1,... corresponds to the fields of the super classes D m(c 1 x 1,... ) {return t; defines method m result type D parameter x 1... with types C 1... body is a return statement Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 16 / 40 Class Table Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 17 / 40 Subtype Relation The class table CT is a map from class names to class definitions each class has exactly one definition the CT is global, it corresponds to the program arbitrary but fixed Each class except Object has a superclass Object is not part of CT Object has no fields Object has no methods ( Java) The class table defines a subtype relation C <: D over class names the reflexive and transitive closure of subclass definitions. EXT TRANS REFL C <: C C <: D D <: E C <: E CT(C) = class C extends D... C <: D Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 18 / 40 Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 19 / 40

7 Consistency of CT Example: Classes Do Refer to Each Other 1. CT(C) = class C... for all C dom(ct) 2. Object / dom(ct) 3. For each class name C mentioned in CT : C dom(ct) {Object 4. The relation <: is antisymmetric (no cycles) class Author extends Object { String name; Book bk; Author (String name, Book bk) { super(); this.name = name; this.bk = bk; class Book extends Object { String title; Author ath; Book (String title, Author ath) { super(); this.title = title; this.ath = ath; Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 20 / 40 Auxiliary Definitions collect Fields of classes Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 21 / 40 Auxiliary Definitions detect type of methods empty list fields(object) = CT(C) = class C extends D {C 1 f 1 ;... K M 1... fields(d) = D 1 g 1,... fields(c) = D 1 g 1,..., C 1 f 1,... fields(author) = String name; Book bk; Usage: evaluation steps, typing rules CT(C) = class C extends D {C 1 f 1 ;... K M 1... M j = E m(e 1 x 1,... ) {return t; mtype(m, C) = (E 1,... ) E CT(C) = class C extends D {C 1 f 1 ;... K M 1... ( j) M j F m(f 1 x 1,... ) {return t; mtype(m, D) = (E 1,... ) E mtype(m, C) = (E 1,... ) E Usage: typing rules Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 22 / 40 Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 23 / 40

8 Auxiliary Definitions determine body of method Auxiliary Definitions correct overriding of methods CT(C) = class C extends D {C 1 f 1 ;... K M 1... M j = E m(e 1 x 1,... ) {return t; mbody(m, C) = (x 1..., t) CT(C) = class C extends D {C 1 f 1 ;... K M 1... ( j) M j F m(f 1 x 1,... ) {return t; mbody(m, D) = (y 1..., u) mbody(m, C) = (y 1..., u) Usage: evaluation steps override(m, Object, (E 1... ) E) CT(C) = class C extends D {C 1 f 1 ;... K M 1... M j = E m(e 1 x 1,... ) {return t; override(m, C, (E 1... ) E) CT(C) = class C extends D {C 1 f 1 ;... K M 1... ( j) M j F m(f 1 x 1,... ) {return t; override(m, D, (E 1,... ) E) override(m, C, (E 1,... ) E) Usage: typing rules Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 24 / 40 Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 25 / 40 Example class Recording extends Object { int high; int today; int low; Recording (int high, int today, int low) {... int dhigh() { return this.high; int dlow() { return this.low String unit() { return not set ; String asstring() { return String.valueOf(high).concat( ).concat (String.valueOf(low)).concat (unit()); class Temperature extends ARecording { Temperature (int high, int today, int low) { super(high, today, low); String unit() { return C ; fields(object) = fields(temperature) = fields(recording) = int high; int today; int low; mtype(unit, Recording) = () String mtype(unit, Temperature) = () String mtype(dhigh, Recording) = () int mtype(dhigh, Temperature) = () int override(dhigh, Object, () int) override(dhigh, Recording, () int) override(dhigh, Temperature, () int) mbody(unit, Recording) = (ε, not set ) mtype(unit, Temperature) = (ε, C ) Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 26 / 40 Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 27 / 40

9 Operational Semantics Operational Semantics Direct Evaluation Steps Operational Semantics (definition of the evaluation steps) evaluation: relation t t for one evaluation step E-InvkNew E-ProjNew fields(c) = C 1 f 1,... (new C(v 1,... )).f i v i mbody(m, C) = (x 1..., t) (new C(v 1,... )).m(u 1,... ) t[new C(v 1,... )/this, u 1,... /x 1,... ] E-CastNew C <: D (D)(new C(v 1,... )) new C(v 1,... ) Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 28 / 40 Operational Semantics Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 29 / 40 Operational Semantics Evaluation Steps in Context Example: Evaluation Steps E-Field t t t.f t.f ((Pair) (new Pair (new Pair (new A(), new B()).setfst (new B()), new B()).fst)).fst // [E Field], [E Cast], [E New Arg], [E InvkNew] E-Invk-Recv t t t.m(t 1,... ) t.m(t 1,... ) ((Pair) (new Pair (new Pair (new B(), new B()), new B()).fst)).fst // [E Field], [E Cast], [E ProjNew] E-Invk-Arg t i t i v.m(v 1,..., t i,... ) v.m(v 1,..., t i,... ) ((Pair) (new Pair (new B(), new B()))).fst // [E Field], [E CastNew] E-New-Arg t i t i new C(v 1,..., t i,... ) new C(v 1,..., t i,... ) (new Pair (new B(), new B())).fst // [E ProjNew] E-Cast t t (C)t (C)t new B() Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 30 / 40 Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 31 / 40

10 involved type judgments C <: D C is subtype of D A t : C Under type assumption A, the expression t has type C. F m(c 1 x 1,... ) {return t; OK in C Method declaration is accepted in class C. class C extends D {C 1 f 1 ;... K M 1... OK Class declaration is accepted Type assumptions defined by A ::= A, x : C Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 32 / 40 Accepted Class Declaration Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 33 / 40 Accepted Method Declaration K = C(D 1 g 1,..., C 1 f 1,... ) {super(g 1,... ); this.f 1 = f 1 ;... fields(d) = D 1 g 1... ( j) M j OK in C class C extends D {C 1 f 1 ;... K M 1... x 1 : C 1,..., this : C t : E E <: F CT(C) = class C extends D... override(m, D, (C 1,... ) F) F m(c 1 x 1,... ) {return t; OK in C Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 34 / 40 Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 35 / 40

11 Expression Has Type Type Rules for Type Casts T-Var x : C A A x : C T-Field A t : C fields(c) = C 1 f 1,... A t.f i : C i T-UCast A t : D D <: C A (C)t : C F-Invk A t : C ( i) A t i : C i ( i) C i <: D i mtype(m, C) = (D 1,... ) D A t.m(t 1,... ) : D T-DCast A t : D C <: D C D A (C)t : C F-New ( i) A t i : C i ( i) C i <: D i fields(c) = D 1 f 1,... A new C(t 1,... ) : C Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 36 / 40 Type Safety for Preservation and Progress yields type safety Preservation : If A t : C and t t, then A t : C with C <: C. Progress : (short version) If A t : C, then t v is a value or t contains a subexpression e Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 37 / 40 Problems in the Preservation Proof Type casts destroy preservation Consider the expression (A) ((Object)new B()) It holds (A) ((Object)new B()): A It holds (A) ((Object)new B()) (A) (new B()) But (A) (new B()) has no type! e (C)(new D(v 1,... )) with D <:C. All method calls and field accesses evaluate without errors. Type casts can fail. Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 38 / 40 Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 39 / 40

12 Problems in the Preservation Proof Type casts destroy preservation Consider the expression (A) ((Object)new B()) It holds (A) ((Object)new B()): A It holds (A) ((Object)new B()) (A) (new B()) But (A) (new B()) has no type! workaround: add additional rule for this case (stupid cast) next evaluation step fail Statement of Type Safety If A t : C, then one of the following cases applies: 1. t does not terminate i.e., there exists an infinite sequence of evaluation steps t = t 0 t 1 t t evaluates to a value v after a finite number of evaluation steps i.e., there exists a finite sequence of evaluation steps t = t 0 t 1... t n = v T-SCast A t : D C <:D D <:C A (C)t : C 3. t gets stuck at a failing cast i.e., there exists a finite sequence of evaluation steps We can prove preservation with this rule. t = t 0 t 1... t n where t n contains a subterm (C)(new D(v 1,... )) such that D <:C. Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 39 / 40 Peter Thiemann (Univ. Freiburg) Softwaretechnik (english draft) SWT 40 / 40