Objects and Aspects: Ownership Types Neel Krishnaswami Department - - PowerPoint PPT Presentation

objects and aspects ownership types
SMART_READER_LITE
LIVE PREVIEW

Objects and Aspects: Ownership Types Neel Krishnaswami Department - - PowerPoint PPT Presentation

Objects and Aspects: Ownership Types Neel Krishnaswami Department of Computer Science Carnegie Mellon University neelk@cs.cmu.edu Overview The Problem An Introduction to Ownership Types Evaluating How Ownership Resolves the Problem


slide-1
SLIDE 1

Objects and Aspects: Ownership Types

Neel Krishnaswami

Department of Computer Science Carnegie Mellon University neelk@cs.cmu.edu

slide-2
SLIDE 2

Overview

  • The Problem
  • An Introduction to Ownership Types
  • Evaluating How Ownership Resolves the Problem
  • Future Directions

Objects and Aspects: Ownership Types 1

slide-3
SLIDE 3

The Problem

  • A central idea of OO is to encapsulate state
  • But there is no strong language support for this

Objects and Aspects: Ownership Types 2

slide-4
SLIDE 4

Aliasing: Threat or Menace?

This is an example from the Java 1.1 JDK: class Class { List signers; List getSigners() { return this.signers; } }

Objects and Aspects: Ownership Types 3

slide-5
SLIDE 5

Aliasing: Threat or Menace?

This is an example from the Java 1.1 JDK: class Class { List signers; List getSigners() { return this.signers; // clients can mutate signers field! } }

Objects and Aspects: Ownership Types 4

slide-6
SLIDE 6

Aliasing: Threat or Menace?

class JavaClass { List signers; List getSigners() { return this.signers; // clients can mutate signers field! } } Aliasing has caused a failure of encapsulation – the ability to modify an internal field of an object got exposed to a client, because the client received a reference to the object in the instance variable.

Objects and Aspects: Ownership Types 5

slide-7
SLIDE 7

An Introduction to Ownership Types

  • The Problem
  • An Introduction to Ownership Types
  • Evaluating How Ownership Resolves the Problem
  • Future Directions

Objects and Aspects: Ownership Types 6

slide-8
SLIDE 8

The Basic Idea Underlying Ownership

Ownership types represent an attempt to prevent aliasing- based failures of encapsulation.

  • Every object itself exists in a domain, which is a region
  • f the heap.
  • Every object can additionaly create one or more new do-

mains.

  • Each field of an object is annotated with the domain it

belongs to.

Objects and Aspects: Ownership Types 7

slide-9
SLIDE 9

A Graphical View of Ownership

world domain customer object bank object agent domain vault domain teller domain

Objects and Aspects: Ownership Types 8

slide-10
SLIDE 10

Access Permissions

In order for domains to be useful, we need to define a set

  • f access permissions on domains. To “Access” a domain d

means to:

  • Dereference an object field annotated with domain d
  • Invoke a method on an object in d
  • Receive a value from a method call that is in a domain

d.

Objects and Aspects: Ownership Types 9

slide-11
SLIDE 11

What May Be Accessed?

An object o in a domain d can access:

  • Other objects in the same domain d.
  • Other objects in the domains that d is contained in.
  • Objects in the domains e, f, g that it declares.
  • Objects in domains d′ that d has permission to access.

Very important: this is not a transitive relation! If d → e and e → f, then it does not follow that d → f.

Objects and Aspects: Ownership Types 10

slide-12
SLIDE 12

Public Domains and Link Annotations

  • Objects in domains d′ that d has permission to access.

This information comes from programmer annotations. A programmer can mark a declared domain public, in which case that domain may be accessed from any domain that can access the declaring object. A programmer can declare link specifications, which permit an object to declare access links between the domains it cre- ated and domains it can access.

Objects and Aspects: Ownership Types 11

slide-13
SLIDE 13

A Code Example

class Customer { domain agents; } class Bank { public domain tellers; private domain vault; link tellers -> vault; }

Objects and Aspects: Ownership Types 12

slide-14
SLIDE 14

A Graphical View of Ownership

world domain customer object bank object agent domain vault domain teller domain

Objects and Aspects: Ownership Types 13

slide-15
SLIDE 15

Link Soundness

This ownership system has a link soundness property. This is a proof that the type system actually enforces the access constraints – that is, if o can access o′ and o′ is in domain d, then o has permission to access d.

Objects and Aspects: Ownership Types 14

slide-16
SLIDE 16

An Introduction to Ownership Types

  • The Problem
  • An Introduction to Ownership Types
  • Evaluating How Ownership Resolves the Problem
  • Future Directions

Objects and Aspects: Ownership Types 15

slide-17
SLIDE 17

JDK 1.1, revisited

class Class { private domain internal; internal List signers; internal List getSigners() { return this.signers; } void foo() { internal List x = this.getSigners(); // do stuff using x } } Clients cannot invoke getSigners, since the domain internal is private and they cannot access it. They can only invoke foo.

Objects and Aspects: Ownership Types 16

slide-18
SLIDE 18

Making getSigners Available

class Class { private domain internal; internal List signers; world List getSigners() { world List copy = new List(); for(int i = 0; i < this.signers.size(); i++) { copy.add(this.signers.get(i)); } return copy; } }

Objects and Aspects: Ownership Types 17

slide-19
SLIDE 19

Generalizing To Iterators, 0/3

Now we will look at a more complex problem – iterator ob- jects. An iterator is an object with access to the internal state of the collection it iterates over, but which does not expose this to the outside world.

Objects and Aspects: Ownership Types 18

slide-20
SLIDE 20

Iterators, cont. 1/3

class Cons<T> assumes owner -> T.owner { Cons(T head, owner Cons<T> tail) { this.head = head; this.tail = tail; } T head;

  • wner Cons<T> tail;

}

  • wner is a keyword to name the owning domain of an object.

Objects and Aspects: Ownership Types 19

slide-21
SLIDE 21

Iterators, cont. 2/3

class Sequence<T> assumes owner -> T.owner { private domain internal; link internal -> T.owner; internal Cons<T> front; void add(T o) { this.front = new Cons<T>(o, this.front); } public domain iters; link iters -> T.owner, iters -> internal; iters Iterator<T> getIter() { return new SequenceIterator<T, owned>(this.front); } }

Objects and Aspects: Ownership Types 20

slide-22
SLIDE 22

Iterators, cont. 2/3

interface Iterator<T> { boolean hasNext(); T next(); } class SequenceIterator<T, domain list> implements Iterator<T> assumes list -> T.owner { SequenceIterator<T, domain list>(list Cons<T> head) { this.current = head; } list Cons<T> current; boolean hasNext() { return current != null; } T next() { T obj = this.current.head; this.current = this.current.tail; return obj; } }

Objects and Aspects: Ownership Types 21

slide-23
SLIDE 23

What Makes This Work

  • You can parameterize classes with domains as well as

types. Programmers can write code that works in any domain.

  • Public domains can safely access private ones, because of

the lack of transitivity. Stateful data can now be part of an object’s interface without breaking its encapsulation.

  • You can hide “extra” parameterization behind interfaces.

This lets the iterator implementation receive a domain without revealing it to clients.

Objects and Aspects: Ownership Types 22

slide-24
SLIDE 24

An Introduction to Ownership Types

  • The Problem
  • An Introduction to Ownership Types
  • Evaluating How Ownership Resolves the Problem
  • Future Directions

Objects and Aspects: Ownership Types 23

slide-25
SLIDE 25

Weaknesses With Ownership

  • Ownership transfers.

How can objects move between domains as the program evolves? (Uniqueness/linearity helps somewhat, but is overkill.)

  • Serialization.

(This is probably hopeless in the general case.)

  • Theoretical complexity – the type system is quite com-

plex, and we’ve “baked in” a fairly complex set of access

  • rules. It would be nice to simplify this.

Objects and Aspects: Ownership Types 24

slide-26
SLIDE 26

Future Work

  • Transplant to a mostly-functional setting.
  • Characterize what encapsulation really means via study-

ing type abstraction for stateful languages.

  • More access modes? Object creation, object update, and
  • bject read are quite different conceptually.
  • What is the relation to other work? Regions, confinement

types, modal logic, etc.

Objects and Aspects: Ownership Types 25