Selective Open Recursion

Transcription

1 Selective Open Recursion A Solution to the ragile Baselass roblem Kevin Donnelly, Jonathan Aldrich Selective Open Recursion p.1

2 odularity What? Why? Break complex systems into modules with specified interfaces Only expose in the interface those aspects of the code that are essential and unlikely to change Type systems can help us ensure that the things we want hidden, are hidden an reason about the correctness of each component in isolation an make changes to the implementation, using only local reasoning, without breaking the system Selective Open Recursion p.2

3 odularity Objectoriented programming languages provide a number of mechanisms for achieving some level of modularity Objectlient modularity sing public/private data members to enforce information hiding ublic/private methods and use of interfaces, restrict how an object can be used (allowing implementation changes) ObjectSubclass modularity rivate data and methods can be hidden from subclasses Selective Open Recursion p.3

4 odularity In objectoriented programming languages like Java there are a number of ways to inadvertantly break modularity. We can break objectclient modularity by, for example, inadvertantly returning a pointer to internal data in some toist method. (Ownership type systems tackle this problem) We can break objectsubclass modularity by exploiting the fragile baseclass problem. It is this flaw in modularity that our proposal for selective open recursion addresses. Selective Open Recursion p.4

5 The ragile Base lass roblem The ragile Base lass roblem exploits the tight coupling between a class and its subclasses caused by inheritence to tell implementation details about the base class. public class ountingset extends Set private int count; public void add(object o) super.add(o); count++; public void addall(ollection c) super.addall(c); count + c.size(); public int size() return count; Selective Open Recursion p.5

6 The ragile Base lass roblem The ountingset implementation is only correct in the usual java semantics if the add and addall methods are independent. If the Set class is implemented as follows, then ountingset doesn t work as expected. public class Set ist elements; public void add(object o) if (!elements.contains(o)) elements.add(o); public void addall(ollection c) Iterator i c.iterator(); while(i.hasnext()) add(i.next()); Selective Open Recursion p.6

7 The roblem? Open Recursion Java Open Recursion Semantics No distinction in between selfcalls which are merely for convenience of implementation (as the selfcall to add from addall), and which actually aught to be part of the subclassing interface (as for semantic events) As a result, all selfcalls must be thought of as part of the subclassing interface Our experiments on the Java standard library suggest that most selfcalls to public methods do no make use of open recursion semantics. Because open recursion is harder to reason about, the fact that it is rarely used suggests that it should not be the default selfcall semantics. Selective Open Recursion p.

8 Our roposal: Selective Open Recursion Selective Open Recursion alls on the object this are statically dispatched by default (i.e. selfcalls are treated as convenient helper calls, not semantic events of interest to subclasses) A keyword, open, which applies to public nonfinal methods and designates these methods as semantic events. alls to open methods use dynamically dispatched open recursion semantics Selective Open Recursion p.

9 Analyzing Java ibraries We have implemented an analysis which, given whole program information, finds which methods must be annotated with open in order to preserve their semantics. for each public or protected method program relies on open semantics of there is some method there is some in either does not override of every class whenever: that which overrides calls, the on this or it makes a super call to Selective Open Recursion p.9

10 Analyzing Java ibraries We applied out analysis to a portion of the JDK Java library (all packages starting with java except for java.nio and java.sql) Results: Open Annotations 99 method declarations analysed 1394 methods were overridden only 246 methods required open annotations (3% of total, 1% of overridden) Optimization otential call sites analysed 652 were selfcalls (on this) 16 were calls to open methods This means we can inline 6136 selfcalls that we would not otherwise be able to (2% of calls) Selective Open Recursion p.1

11 eatherweight OpenJava Syntax: extends class this super return open "! Selective Open Recursion p.11

12 * * > D. D. 6 6 * * % % : D D V T 6 * % : 1 1 D V T 6 * % 1 %% : eatherweight OpenJava Static Semantics: $% $% 2,345 ) * &('./, )+* &(' $% $% ;::: extends class 9 6 / 3< 5 5 )+* &(' $% > % AB3, %? >@?% > D % >% 9.E /5 $% 9.E /5 / KE G H I.JI > D > $% SR 9 2N O >% Q > D % 4 > D $% D $% R 9 Q 2N O >% > D % 4 WBX '4 > D Selective Open Recursion p.12

13 Y f ^ ] Y Y Ymg Y _ ^ e ^f p [ [ Y Y ^ ^ [ Y ^ f \ u u `ts k k ^ f ppp Y ^ m } [ ` Y mg ^ e ^ ] eatherweight OpenJava ore Static Semantics: gih ef abdc _\Q` Y Z [\ Yj this super extends Y e q _ n _ h gon Yj Y jlk [ h Z c ^adrc YqZ m f _ n class g ^zy x ewv b ` extends class kthis return g^ h e ^{ ^ y } y } y ` q~ ^ y Y } Z qz [\ Y ny ` v ^ y Selective Open Recursion p.13

14 I Š Œ %% Š. Š Œ %% Š I. R 2 5 R V T V T %% R eatherweight OpenJava Dynamic Semantics: ˆ : :: I : :: 9 %% 2? : : ˆ : :: I : :: : 9.E /5 / KE Ž * I. I : $% 3 Ž * D? 9 )X 4 Ž * Œ D this? R : D? 9 )X 4 WBX '4 Ž * Œ D this? R : 2 2? X4 Selective Open Recursion p.14 Ž * Œ 2? Œ R 2?

15 9 * %% : : eatherweight OpenJava helper )X The key to Selective Open Recursion semantics lies in the changes to the function. S is not defined in S. extends class 9 6 )X 9 Q )X S return? S. ::: class 9 6 )X? 9 )X The function replaces normal method calls to this on nonopen methods with bounded method calls )X 4 XO this )X 9 9 )X š 2 WBX : 9 : )X 4 OX )X 9. &/ * WBX : this 9 this )X Selective Open Recursion p.15

16 œ œ ž œ Ÿ œ ž eatherweight OpenJava Type Soundness (Exactly the same as for eatherweight Java) Theorem 1 (Type reservation) If roof: and "!, then there exists a By induction over the derivation of. "! such that Theorem 2 (rogress) If then either is a value, or with, or "! for some roof: By induction over the derivation of. Selective Open Recursion p.16

17 % Š / 5 Œ Œ Equivalence ocal Equivalence: 6 E 4 3 X 9 6 E 4 3 X E 4 3 X 6 1B * 6 6. extends class 9 6. extends class 9 6 Š Š Š 9 Š I 6ª I 6 : Š :: E 1B * 6 6 )X? 6 )X? 6 š 2 1 * return? 6 return? 6 Selective Open Recursion p.1

18 1 Œ 1 1 «R, X<< R E E % E Œ > % ± 2 š 2 < ' 5 Equivalence ocal Equivalence: 1 $% $% 1,,X, 1B * 2? 6 / A 3 1B * Œ 2? 6 > 6 3, E 43 > 6 E 4 š 2 < 3 O 5 1B * 2 34 &2 3 1 * 2 X 6 «6 1B * 2 &2 3, 1 * 6ª «6 6ª «6 2? % 6 «2? % 6 : > ± 6 š 2 < 3 O 5 1B * : 2? 6 Œ «: 2? 6 : $% 34 š 3 Œ 2? 6 Œ «2? 6 2 2? X4 1B * 2? % 6 «2? % 6 Selective Open Recursion p.1

19 1 Œ 1 1 R, X<< R E E R Œ > R Œ : > E Œ : Equivalence Global Equivalence: 1 $% $% 1,,X, WE * 2? 6 / AB3 WE * Œ 2? 6ª ² 9 6ª ² 9 6 > 6 3, E 43 > 6 E 4 š 2 < 3 O 5 WE * 2 34 &2 3 WE * 2 X 6 ² 9 6, WE * 2 &2 3 WE * 6 ² ² 9 6 : 2? 6 2? 6 6 ² 9 6 š 2 < 3 O 5 WE * 2? 6 Œ² 9 : 2? 6 Selective Open Recursion p.19

20 ³ œ œ ³ ³ ³ ³ ³»» ³»» Abstraction The abstraction theorem states that if two libraries, are locally equivalent, then any welltyped client code in a globally equivalent way with both libraries. Theorem 3 (lient Abstraction) and ³µ will execute If ³o, then such that ¹ and ³o, we have ³µ º ª. Theorem 4 (ibrary Abstraction) if ³µ, then ³ such that ¼ ³ and ³ ¼ ³, we have ³ ³µ. ³ Selective Open Recursion p.2

21 onclusions The fragile base class problem is caused by the failure to distinguish internal calls that are for convenience and those that are extension points for subclasses. Our proposal makes this distinction clear by the use of open Experiments on the Java library have shown that not using open recursion by default does not add much annotation burden and allows for potentially significant optimization gains The abstraction theorem shows that locally equivalent implementation of a library cannot be distinguished by the library s clients This allows more freedom to library designer s to change implementation without breaking subclass code. Selective Open Recursion p.21