the runway language - gitlab · it is a ripe idea (c, c++, rust, swift, immutable.js, ...) :...

4/1/2019 OOP with Java

localhost:8080/COMSM0103/lectures/runway/ 1/78

The Runway Language where your programs take off

(a proposal)

1



History of languages 2



PsychologyAll languages are "the same", because they are all TuringComplete

But they differ in their psychological effect on programdesign and development

Arguably, Java has a bad psychological effect

It encourages a lack of robustness

The same (probably) applies to every other popular orpotentially popular OO language

3



Aims* Find the simplified essence of OO languages

* Combine Java's robustness and scripting's unfussiness

* Change one feature which is overdue for an upgrade

* Explore the consequences

Sources of ideas: Haskell, concurrency, teaching,design patterns, ... considered harmful

4



HaskellOne of the important contributions of Haskell to thewider world is that ideas from it spread out into otherlanguages

An early question for me was "what is the next idea thatshould make it across the gap"

This followed on from previous research in the Haskellarea

4a



ConcurrencyCurrent approaches to concurrency in most languagesseem (arguably) to border on the diabolical

Some previous research on deterministic concurrency infunctional languages seemed worth pursuing in otherlanguages

4b



TeachingIn my experience of teaching Java, it has a lot of strangedetails, but they are mostly easy to explain

But the need for, and the self-control required, to createtruly robust components (arguably the essence of OO) isunreasonably difficult to instill

4c



Design patternsDesign patterns are usually described as solutions tocommon OO problems

But another point of view is that they representweaknesses in current OO languages which requiretrickery to circumvent

The idioms they present should instead be natural

4d



... considered harmfulTry looking up:

pointers considered harmfulstatic considered harmfulconstructors considered harmfulnew considered harmfulinheritance considered harmful...

A lot of useful ideas emerge

4e



Grid.java

ExampleHere's a Java class for Oxo:

class Grid { char[][] cells; Grid(char[][] c) { cells = c; } char[][] getCells() { return cells; } }

These are three 'bugs', where the cells array is sharedwith a caller who could update it and damage the grid

5



Fixing the ExampleThe Java class can be made robust:

class Grid { private char[][] cells; Grid(char[][] c) { cells = copy(c); } char[][] getCells() { return copy(cells); } }

This is defensive copying, not done all the time, becauseit is 'too expensive'

6



A big shockA little while after learning Java, I got a big shock

It isn't just beginner classes that are fragile:

You can break Java library classes

7



Breaking a hash table

Set<Item> set = new HashSet<>(); set.add(item); item.update();

The hash code changed, the item is in the wrong slot

It is now a quantum hash table - the item is both in andnot in the set - i.e. it is broken

This is very unlikely to happen, if it does, it is not just abug, it is a cockroach

an item class other ways

8



An item class

class Item { private int n = 123; void update() { n++; } public int hashCode() { return n; } }

All that's needed is an update method which changesthe hash value

8a



Other waysA HashSet can be broken by changing the key of an item

Another possibility is for hashCode to read a valuefrom a global variable, and for the main program toupdate that global variable, changing the hash code

This is prevented in Runway by banning static variables

Another possibility is for the hashCode method toupdate the key of the item itself

This is prevented by insisting that hashCode-typemethods are getters - see later

8b



point.rw

Feature: private fieldsOne fix is easy: here's a Runway class:

int x, y; void new(x0, y0) { x = x0; y = y0; } int x() { return x; } int y() { return y; }

Fields are always private, no exceptions

notation, no class, getters and setters, testing

9



NotationI'm using Java-like notation for familiarity

There is no guarantee that Runway will actually be likethat in the long run

9a



No class declarationThe name of the 'class' is point, because it is in a filecalled point.rw

With Java classes, (a) you have be careful to make surethe name of the class inside the file matches thefilename, which isn't DRY and (b) the whole of the filehas an extra indent

9b



point.rw

Getters and settersGetters and setters can be declared as properties:

getter: x, y; setter: x, y; ...

The compiler checks that a getter method doesn'tchange the object, and that a setter matches its getter

Default methods are generated (remember that setterswith no validation are as bad as non-private fields)

9c



TestingScripting language programmers complain that privatefields prevent them from testing and debugging becausethey can't look at or print out the values of fields fromthe outside, and they are right

One possibility is this: instead of one starting pointmain (a stupid name), a module has run and test

When testing, fields of objects are accessible, read-only,in some way

9d



other.rw

AbbreviationOutside the point class, you can write:

point p; ... int n = p.x; p.x = n + 1;

Fields are never directly accessible, so field notation canbe reused, and p.x or p.x = v are short for p.x(),or p.x(v), when there is a suitable getter or setter

Unlike Java, a field can be read-only from outside theobject, but updatable inside, or updating can includevalidation, or the 'field' can be calculated

10



Problem: aliasingHash tables can be broken because of aliasing; an updatevia one pointer is visible via another

Aliasing is the only visible effect of pointers, and itcreates a lot of traps for the unwary (even for experts)

11



Feature: anti-aliasingIn Runway, an assignment makes a copy

point p.set(1,2); point q = p; q.set(3,4); assert(p.x == 1 && p.y == 2);

The copying is lazy

On line 2, q points to the same object as p

Copying happens on line 3 because q is "shared"

lazy copying

12



Lazy copyingWith no updates, aliasing is a good thing, it saves space

For efficient anti-aliasing Runway uses lazy copying

An assignment y = x of one object to another means"y becomes a copy of x" in the programmer's mind

But as an optimisation the copying is delayed untileither x or y is updated

This makes defensive copying in data structuresaffordable

12a



TechniquesLots of languages and libraries use related techniques -it is a ripe idea (C, C++, Rust, Swift, Immutable.js, ...) :

restrict keywordimmutabilityownershipcopy semanticslazy copyingcopy on writepersistent data structures

Runway just takes the idea to its logical conclusion

13



So: no pointersJava has no pointer notation, but you have tounderstand pointers properly to use Java well

Runway has no pointers in its mental model = semantics

Pointers are just an optimization technique, used tocope with variable sizes or to save memory

14



So: no nullLanguages have null as an accident of the pointernotation

The most common uses are as empty structures orcheap exceptions

A null structure is justified in procedural languages, butnot in OO languages

So Runway has tagged unions and cheap exceptions

Notes: unions, variants, exceptions wholeprogram analysis

15



UnionsHow should an empty list or tree be represented?

Null isn't available, and an exceptional value isn't OO,because you can't ask questions such as "are you empty?"

Inheritance with an empty structure as a separate typeworks but seems too heavy

The best bet seems to be a 'tagged union' - a notationwhich makes it nearly as convenient as an algebraic typein Haskell would be good

15a



stack.rw

VariantsHere's a possible linked stack definition using variants:

int x; stack xs; nil() { emptyStack s.nil(); this = s; } cons(int x0) { stack s; s.x = x0; s.xs = this; this = s; } bool empty() { return false; } int head() { return x; } stack tail() { return xs; } variant: emptyStack; nil() { } cons(int x0) { stack s; s.x = x0; s.xs = this; this = s; } bool empty() { return true; } int head() { return error(); } stack tail() { return error(); }

15b



ExceptionsJava's exceptions have three problems:

it is much harder to test exceptional behaviourthan normal behaviourunchecked exceptions are uncontrolledchecked exceptions require lots of boilerplatecode from the programmer

Runway fixes these problems by (a) treating exceptionsas values and (b) checking exception propagation bywhole-program analysis

15c



Whole program analysisRunway has a convention to support good analysis:whenever a module is recompiled, every module thatdepends on it either continues to use the old version oris recompiled

Compiling is fast enough nowadays that the old'separate compilation' convention is no longer needed

The worst case of recompilation efficiency would be alarge inter-dependent group of modules, but that's nowregarded as absurdly bad program design

15d



So: no identitySome say that 'object identity' is an essential aspect ofOO, but it is just an accident of pointers

Runway doesn't have it: identity comes from a containedid or a key in a lookup structure

So Runway has only one equality, value equality(hooray!) (perhaps with a key equality variation)

16



Key equalityKey equality works by declaring that certain fields in anobject form a key

This has the advantages that equality and comparisonand hashcodes are automatic, have the right properties,are consistent with each other, and cover most cases ofequality that programmers want

This needs to be in addition to value equality (andpossibly allowing for alternative keys)

16a



So: primitivesIn Java, objects and primitives are different

In many languages, they are made the same by makingprimitives act like objects ("boxing")

In Runway, they are made the same by making objectsact like primitives

Everybody knows y = x for primitives makes a copy

17



So: no cyclesPointing to o is the same as containing o

An object pointing to itself means containing itself

So it would be infinite

The lack of cycles has drastic consequences for programdesign and data structures, but they are well understood

18



So: no staticsA consequence of anti-aliasing is that static variables areout, because they have uncontrolled pointer aliasing:

Runway needs a different approach to global variables

19



Feature: anti-staticQuestion: What would you do without globals?

Answer: you would pass objects down in calls

Definition: making an object global is an abbreviationfor passing it to all the descendants of its owner

Notes: scope, singletons, escape

20



Scope of globalsThe scope of a Runway global is all the descendants ofits owner

That's a dynamic and relative scope

For static checking, perhaps an owner has a declaration"provide g to all descendants" and anything that uses ghas a declaration "require g from an ancestor"

20a



SingletonsA global can always be overridden with something else,so there is no such thing as a program-wide singleton

From the Runway point of view, the singleton designpattern is misguided

Singletons are known to be bad for testing andflexibility anyway

20b



EscapeIt would seem sensible to allow a grandparent whichprovides a global, a parent which is an ordinary listobject, say, which knows nothing about the global, andan item inside the list which accesses the global

But then it would also seem sensible to have a compile-time restriction (based on escape analysis?) whichprevents an item which uses a global from beingimplicitly passed out of the scope of the global

20c



So: no constructorsA constructor is static (because there isn't yet an objectto call a method on)

Conventional constructors and the new keyword are'considered harmful', because they don't obeyinheritance rules, and because they exposeimplementation details

The phrase new Thing() prevents you fromreturning a recycled or shared object, or a subclassedobject (hence factory patterns)

So Runway doesn't have conventional constructors

21



Feature: anti-new

point p; // create p as a copy of a default p.set(1,2); // initialize its fields

When you declare a variable, it is initialized to a (lazycopy of a) default object

That object has uninitialized fields, so it can't be useduntil they are initialized

set is an ordinary method, but with the property ofbeing a constructor constructor property

22



point.rw

Constructor propertyA method is a constructor if it writes to all theuninitialized fields of an object without reading fromany of them

It can be declared:

constructor: set; ...

Then the compiler checks that the method has thatproperty

22a



ComparisonHere are some ways of creating a point:

point p = new point(3, 4); // Java var p = new point(3, 4); // JavaScript var p = point(3, 4); // Swift point p.set(3, 4); // Runway

Runway's version is syntactically shortest

More importantly, it is semantically simplest

23



point.rw

Class = type = object

int x, y; set(x0, y0) { x = x0; y = y0; } x() { return x; } y() { return y; }

Is it a class? Is it a prototype? It's an object

Notes: names, private, singletons, inference

24



No class nameJava starts with class X, but that must match thefilename X.java so it is redundant

So in Runway, file point.rw defines an object calledpoint

Technically, point is a variable which is global to thedirectory it is in, so available to all files in the directory

24a



Private fieldsFor robustness, fields in Runway objects are alwaysprivate

But when testing rather than running a program, it ishelpful to be able to inspect field values

And the notation o.x is redundant and free to bereused to mean o.x() for getter x(), and o.x = ycould mean o.x(y) for setter x(_)

24b



SingletonsAn object like point can directly be used as a singletoninstead of as a type

But the design-pattern version of singletons, where aglobal variable is rigidly irreplaceable across a wholeprogram is (it is easy to argue) just wrong

A singleton is a potentially replaceable or duplicatableglobal variable

24c



Type inferenceIt seems reasonable to have type inference, where it iseasy

Exactly how far to take this in the language is unclear atpresent

Perhaps as far as Swift's type inference

24d



grid.rw

Feature: call by copy

... window.display(cells); ...

The 'default' calling mechanism is call-by-copy (i.e. call-by-value in the deep functional-programming/formal-semantics sense, not the usual shallow OO sense)

So even if the window object is untrusted and updatesthe argument, the grid object remains robust

However delegation, where you trust the software youbuild on, is an important OO principle (for DRYness)

25



program.rw

Feature: call by lend

... sorter.sort(&xs); ...

The & means the method can update or replace xs

This is call-by-reference with a twist: the choice is madein the call, not in the method signature, e.g. if all callsare implemented by reference:

o.f(x) --> temp = x; o.f(&temp);

swap, sort, calls, dots, this, self

26



SwappingThis works

swap(a,b) { t = a; a = b; b = t; } ... swap(&x, &y);

26a



SortingThis doesn't work

... swap(&a[i], &a[j]);

If allowed, it would swap two temporary variables, notthe array contents, but instead the compiler complainsthat you can't pass a non-variable expression byreference, so swap(a, i, j) is needed

26b



Implementation of callsAll arguments that may involve updating are passed byreference

A call f(x) is translated if necessary to t = x; f(t)which creates an extra reference so that a copy is made,then any update or replacement or copy is done to twhich is then discarded

26c



The dot notationIn OO, it is normal to write x.f(y), thinking ofmethod f as attached to x

In C notation, it is really f(x,y), but with foverloaded

In Runway, x.f(y) is equivalent to f(&x,y), so x isexpected to update itself as it wishes

26d



Updating thisA method call obj.f(x) is equivalent to a functioncall (in C, say) f(obj, x)

It is reasonable to assume that the 'special' firstargument is always an update argument, because if youdon't trust the object, you are going to tell it things, butnot ask it things, so it is OK for it to update itself

26e



Feature: self replacementSuppose you update a Runway object

p.set(3,4);

If p is shared, it must be replaced by a copy

That gives you a language feature for free: the ability ofan object to replace itself

Delegation is an important OO principle, and now anobject which you delegate to can do anything you can

26f



Feature: higher order callsRunway will allow functions to be passed, but a functionis always attached to an object as a method

The object is its closure (closures should not be aseparate concept, as in JavaScript)

A function is passed as an object with a marked method(maybe explicitly like Java's ...(x::f))

There is syntactic, semantic and implementation work todo here ( aliases, dispatch)

27



No aliasing

update(x, y) { x = x + 1; y = y * 2; } ... update(&z, &z);

This can't be allowed, because there is no sensiblepossible final value for z (if z is 2, x=3 and y=4)

Fortunately, this only arises if the same explicit variablename is used, so it shouldn't be an obscure issue

A call x.f(this) is also very dubious

27a



Feature: multiple dispatchRunway gets rid of the nonsense of the visitor designpattern by providing double, triple, ... dispatch

The visitor pattern looks good, then turns out to be veryobscure, and anyway it doesn't fully solve the problemyou are trying to solve (i.e. easy addition of one class ineither of two families)

Multiple dispatch is easy to implement, and as efficientas any of the alternatives

27b



InheritanceArguably, there are two kinds of inheritance:

a subtype makes the same semantic promisean interface requires only the same API

Java's extends inheritance is interface inheritance pluscode/field reuse, and is considered harmful

28



Feature: subtypes

vehicle car; car.set(...); car c;

Runway gives an absolute promise: c is a vehicle

statement theorem; theorem.restrict(); theorem t.set(s, p);

Maybe you could add methods, but not override them,or gain access to the private fields

29



point.rw

Feature: propertiesRunway has a notation for declaring properties, e.g.

constructor: set getter: x, y int x, y set(x0, y0) { x = x0; y = y0; }

For constructor, the compiler can check

For getter, it can also generate boiler-plate code

Properties are necessary for robustness

30



window.rw

Feature: delegation

delegate to r: width, height, area ... rectangle r;

This is composition ('has-a') inheritance, close to subtypeinheritance

(Possible optimisation in the implementation: extends)

31



car.rw

Feature: interfaces

like vehicle: car ... wheels() { return 4; }

Java problem: can't retro-fit interfaces in libraries

In Runway, any type can be used as an interface

32



rect.rw

window.rw

Feature: reusability

area() { return width() * height(); }

The area method is reusable in any type that haswidth() and height()

like rectangle: window reuse: area ...

33



record.rw

table.rw

Safe hash tables

getter: key; ...

type parameter: R like record: R new(R) { ... } ...

For a safe hash table, as well as anti-aliasing, the keymethod in the R type must be a getter, i.e. not cause anupdate to the record or read from a global variable

In Runway, properties are inherited as well as APIs

34



Memory shared threadsMemory sharing concurrency is diabolical:

The standards for C and Java define a 'lowest commondenominator' of hardware support and are incrediblycomplex and obscure

The Java library sources have thread issues in nearlyevery class; that's not orthogonal or encapsulated

non-determinism, deadlock, livelock, starvation, ...

35



Message passing threadsMessage passing provides a language in which to beexplicit about and reason about concurrency problems

But it doesn't solve any of them

Arguably, a classic case of building a substantial theoryaround a broken idea

36



Feature: threadsAn object can introduce a new thread

The thread 'owns' the object and all the data below it

Method calls on the object look normal, so the newthread is an annotation

Access to the result or an updated argument by theparent thread causes a synchronizing pause

This is message-passing concurrency

37



DeterminismThe intention is that the program with the threadannotation has identical functionality to the programwithout it

So, the concurrency can only be used for latency hiding

But that's enough for many purposes, including serversand graphics (graphics libraries always used to bethreaded, but they have typically moved to the callbackstyle, which is fairly diabolical)

38



Feature: eventsCommunications are handled via a very old concept: thesingle input stream of events

All events are in the stream, and the ordering is critical- it defines their relative timings

That means auto-dispatch to the right place is eitherbanned or implemented with extreme care

So: still deterministic

39



Feature: injectionNon-determinism is handled by adding one feature:

The program can inject an event into the stream (at atime-dependent position)

You can replay a program from a recorded event stream

Then you can debug and (regression) test programs!

40



Thought experimentsUnderstanding of the system at the moment is basedaround thought experiments of possible programs:

operating systemsplat the ratservergraphics library

41



Operating systemA program OS runs two other programs A and B asmodules, not as separate processes

It needs A and B to run in their own threads

It needs to set up a 'fake' system environment of globalvariables and devices etc. separately for A and B

And it needs to unzip the event stream into two eventstreams

42



Splat the ratThink of an X-Window style system:

The program sends a "hide rat" graphics request andasks for an acknowledgement to be injected into theevent stream

The player wins if the click event comes before theacknowledgement

43



ServerAn update request, in its own thread, updates a copy ofthe database, and ends by injecting a 'new databaseversion' event into the queue

Read requests after the injection see the new version

The update requests would have to be serialized

Or the database can be split into independent pieces toallow concurrent updating (like locking)

Or the updates could be merged, with retries (likespeculative versioning)

44



Graphics libraryThere is much work to be done here, but there is aprospect of a much more sensible system than usual

Semantically sensible latency hiding may depend onsplitting a window into independent subwindows whichcan be drawn on concurrently without interference

csijh.github.io

45

the runway language - gitlab · it is a ripe idea (c, c++, rust, swift, immutable.js, ...) :...

Documents