Weak Behavioral Subtyping for Types with Mutable Objects

Electronic Notes in Theoretical Computer Science URL httpwwwelsevier nlloc ateen tcsvo lume html pages Weak Behavioral Subtyping for Typ es with Mutable Ob jects Krishna Kishore Dhara and Gary T Leavens Department of Computer Science Atanaso Hal l Iowa State University Ames Iowa USA dhara cs iastate edu and leavens cs iastate edu Abstract This pap er studies the question of when one abstract data typeADTisabehav ioral subtyp e of another and prop oses a mo deltheoretic notion of weak b ehavioral subtyping Weak b ehavioral subtyping p ermits sup ertyp e abstraction to b e a sound and mo dular reasoning principle in a language with mutation and limited forms of aliasing The necessary restrictions on aliasing can b e statically checked Weak b e havioral subtyping allows typ es with mutable ob jects to b e subtyp es of typ es with immutable ob jects Intro duction Subtyping is a fundamental semantic concept in ob jectoriented OO lan guages In this pap er we study behavioral subtyping when one ADTs ob jects act like those of another Knowing the conditions on b ehavioral subtyping is imp ortant for guiding the design of ADTs It is also critical for proving the soundness of logics for OO program verication Previous work on the mo del theory of b ehavioral subtyping has not allowed mutation and aliasing But mutation and aliasing are imp ortant in practical OO programming and manytyp es o ccurring in practice have ob jects with mutable timevarying state Although it is p ossible to imagine an OO language where aliasing is eliminated entirely existing OO languages do p ermit aliasing Unlike Liskov and Wing wedonotallow arbi trary aliasing but instead seek a middle ground that p ermits more b ehavioral subtyp e relationships The purp ose of our study is ultimately to showhow to reason in a mo d ular fashion ab out OO programs By modular reasoning we mean reasoning such that conclusions ab out unchanged co de remain valid when new b ehav ioral subtyp es are added to a program One mo dular reasoning technique is This work was supp orted in part by the National Science Foundation under GrantCCR c Elsevier Science B V Open access under CC BY-NC-ND license. Dhara and Leavens supertype abstraction in which one reasons ab out the eects of metho d sends using the prop erties of the static typ es of the sub expressions The pur p ose and justication of a denition of b ehavioral subtypingisthatitmakes sup ertyp e abstraction sound Our technical approachtoshowing that a denition of b ehavioral sub typing makes sup ertyp e abstraction sound is to capture the conclusions of reasoning via sup ertyp e abstraction in a set of exp ected b ehaviors Behav iors that might o ccur b ecause of subtyping are called surprising if they fall outside this set Thus showing that a denition of b ehavioral subtyp e is ad equate means showing that no surprising b ehavior is p ossible when subtyping relationships are required to satisfy the denition In this pap er we dene weak b ehavioral subtyping This denition is weaker than either of Liskov and Wings denitions b ecause it allows typ es with mutable ob jects hereinafter mutable types tobesubtyp es of immutable typ es Wesketch the semantics of a programming language with the necessary aliasing control and showthatweak b ehavioral subtyping is adequate in the sense describ ed ab ove Finally we discuss related work and present some conclusions In this pap er we do not present the mo del theory of stronger denitions of b ehavioral subtyping The Problem Reasoning problem with behavioral subtyping and aliasing The following example motivates reasoning problems with b ehavioral subtyp ing Consider the typ es BoolSeq and StoreBool with the following metho ds The typ e BoolSeq is a typ e of b o olean sequences which has only immutable ob jects The messages one can send to a BoolSeq are the following method fetchs BoolSeq i Int Bool method updates BoolSeq i Int b Bool BoolSeq The update metho d pro duces a new ob ject which has the same state as the argument s except that in the ith p osition it contains v The typ e StoreBool has mutable ob jects It has the following metho ds A return typ e of Void indicates no result of any useful typ e is returned method fetchs BoolStore i Int Bool method storesBoolStore iInt bBool Void There is no subtyp e relationship b etween BoolSeq and StoreBool Sup pose we wish to reason ab out the part of a program whichwe will call an observation in which the following variables are available bseq BoolSeq storb StoreBool b Bool The observation itself consists of a variable declaration and three commands the declaration names a variable that will b e the output of the observation The messages not and equal have their standard meaning for Bool arguments output Bool Dhara and Leavens b fetchbseq storestorb notb output equalb fetchbseq What is the exp ected set of p ossible values for output in the ab ove observa tion The exp ected set dep ends on three p oints Whether ones reasoning technique p ermits one to assume that identiers of unrelated typ es suchas BoolSeq and StoreBool cannot b e directly aliased Whether bseq and storb can b e aliases for the same ob ject The notion of b ehavioral subtyping allowed These three p oints are not completely indep endent Using Liskov and Wings denitions of b ehavioral subtyp e BoolSeq and StoreBool cannot have a common subtyp e b ecause BoolSeq ob jects are immutable and thus a com mon subtyp e would have to violate a history constraint or would havea mu tator corresp onding to store that could not b e explained So using Liskov and Wings denition prohibits bseq and storb from b eing directly aliased If bseq and storb cannot b e directly aliased the set of exp ected results would be ftrue g If ones reasoning technique forces one to think ab out a case where bseq and storb might b e directly aliased then the set of exp ected results dep ends on the notion of b ehavioral subtyping used If one had a weaker notion of b ehavioral subtyping than Liskov and Wings then it might b e p ossible for BoolSeq and StoreBool to have a common subtyp e with mutable ob jects Then bseq and storb could b e directly aliased and so presumably the set of exp ected results for the observation ab ovewould b e ftrue false g Wehave not explored such reasoning techniques whichwere suggested to us by Ian Maung However b ecause ob jects of typ e BoolSeq are immutable and the call of a mutator store is used in the program it is dicult to imagine the sp ecication of a most general common subtyp e of BoolSeq and StoreBool Another problem we see is that psychologically programmers would tend to think that b ecause bseq is immutable the only p ossible result would b e true without considering aliasing Thus such a reasoning technique mightbe errorprone if used informallyWe leavetheinvestigation of such a reasoning technique and adequate notions of b ehavioral subtyping for it as an op en problem The remaining case is where ones reasoning technique p ermits one to assume that identiers of unrelated typ es cannot b e directly aliased Clearly in this case such an assumption has to b e enforced If it is then set of exp ected results of the observation ab oveisftrue g However in this case there is still the p ossibility that BoolSeq and StoreBool have a common subtyp e Allowing common subtyp es suchasMutableBSeq would havea great practical b enet That b enet however should b e weighed against any restrictions on aliasing Dhara and Leavens Thus our problem is twofold to dene a notion of b ehavioral subtyping that is weaker than Liskov and Wings and to state restrictions on aliasing such that it is adequate for reasoning We refer to our notion of subtyping as weak b ehavioral subtyping Reasoning with weak behavioral subtyping By reasoning we mean mo delbased reasoning with sup ertyp e abstraction and with the assumption that identiers of unrelated typ es cannot b e directly aliased For the soundness of such reasoning techniques the notion of weak b e havioral subtyping should prevent unexp ected b ehavior when subtyp e ob jects are manipulated according to sp ecications of their sup ertyp es As an example supp ose we wish to reason ab out an observation of the following variables bseq BoolSeq b Bool The observation itself is as follows where again the declaration gives the output variable for the observation output Bool b fetchbseq updatebseq notb output equalfetchbseq b Reasoning at the static typ es in the ab ove observation one would obtain the set of exp ected results values for output tobe ftrueg Consider a new typ e DestructBSeq which resp onds to the same set of metho ds as BoolSeq but such that the metho d update for DestructBSeq mutates its rst argument The question is can DestructBSeq be a weak b ehavioral subtyp e of BoolSeq If DestructBSeq were to b e a weak b ehavioral subtyp e of BoolSeq then one could have a state where bseq denotes an ob ject of typ e DestructBSeq The set of results of the ab ove observation in such a state is false whichis an unexp ected result This unexp ected b ehavior makes reasoning techniques based on sup ertyp e abstraction unsound Hence DestructBSeq cannot b e a weak b ehavioral subtyp e of BoolSeq We consider soundness of sup ertyp e abstraction as an imp ortant criteria for dening weak b ehavioral subtyp e re lations and show a no surprises result which guarantees exp ected b ehavior The Language INST and its Semantics Our mo deltheoretic approach to solving this problem was describ ed ab ove To carry out this approach

Load more