1. GUI Threading Explained and Verified Michael Ernst U. of Washington, Seattle, USA IMDEA Software Institute, Madrid, Spain joint work with Colin Gordon, Sai Zhang, Werner Dietl, and others http://checkerframework.org/

2. Hello from method1 void method1() { mylabel.setText("Hello from method1"); } void method2() { mylabel.setText("Hello from method2"); } // Corrected method2 void method2() { Display.syncExec(new Runnable { void run() { mylabel.setText("Hello from method2()"); } }); } Making the same change to method1 is unnecessary and dangerous (new concurrency errors) 2 Invalid UI updates http://www.myeclipseide.com/PNphpBB2-printview-t-26285-start-0.html

3. GUI threading errors are common One of the top 3 SWT exceptions Tens of thousands of search results >2700 Eclipse bug reports Possibly long-lived One >10 years old in Eclipse! 3 Swing Android

4. Accept user input Update the display Long-running computations A single-threaded GUI program Single-threaded program Problem: unresponsive UI

5. Accept user input Update the display A multi-threaded GUI program GUI thread Long-running computations Background worker thread Must not access the UI Simultaneous access to UI from 2 threads: Race condition Data corruption (lost & partial updates) Crashes

6. GUI thread discipline Only the UI thread may access UI objects Most GUI methods must run only on the UI thread E.g. JLabel.setText() Other threads should use: syncExec(new Runnable{ run(){ … } }) Advantages: Simple specification Responsive UI Atomic updates without explicit synchronization Problem: It’s easy to make mistakes

7. Programmer must remember calling context  For each method: Can I access the UI in the body of this method? When is it safe to call this method? UI libraries may not document this behavior well public void updateView() { setupTitle(this.title); } Idea: Automated program analysis to find and prevent UI threading errors

8. Two analyses to detect GUI threading errors Heuristic analysis Requires no programmer effort Finds many bugs in practice GUI Error Detector: https://guierrordetector.googlecode.com/ Type system Sound; gives a guarantee Requires modest programmer effort Yields machine-checked documentation GUI Effect Checker: http://checkerframework.org/ This talk Colin Gordon Sai Zhang

9. Where may a method be called? Only called from UI thread @UIEffect Safe to be called from any thread @SafeEffect “Effect” because this is an effect system A type system approximates values (e.g., Integer ) An effect system approximates side effects or behavior (Java’s checked exceptions are also an effect system.) @UIEffect @Safe Effect @UIEffect @SafeEffect Relationship between them:

10. Annotated code class JLabel { … @UIEffect public void setText(String s); } class Client { … @SafeEffect public void updateView() { myJlabel.setText("New Title"); // ERROR } @UIEffect public void refreshView() { myJlabel.setText("New Title"); // OK } 10

11. Polymorphic effects Runnable : Sometimes used for the UI thread Sometimes used for background threads Should it be annotated as @UIEffect or @SafeEffect ? Solution: polymorphism Analogy: List vs. List Similarly, Runnable vs. Runnable (Actual syntax: @PolyUI Runnable ) Preserves backward compatibility with the JDK interface Runnable { @??Effect public void run(); }

12. Using the GUI Effect Checker Run javac with GUI Effect Checker plug-in javac --processor GuiEffectChecker MyFile.java IDEs are also supported Examine error reports Add annotations to clarify program Repeat until you can’t fix more errors One-time process! Low incremental cost. 12 *.javadeveloper javac + GUI Effect Checker code annotations error reports UI-correct program

13. Case studies ProgramDefects found False positive warnings Annos/KLOC EclipseRunner1010 HudsonEclipse324 S3dropbox2021 SudokuSolver208 Eclipse Color Theme003 LogViewer0117 JVMMonitor097 Subclipse1138 Modest annotation burden: 7 annotations / 1000 LOC 4300 LOC / hour Few false positives Usually code smells Would be avoided if starting with GUI Effect Checker

14. Type qualifiers In Java 8: annotations on types @Untainted String query; List strings; myGraph = (@Immutable Graph) tmpGraph; class UnmodifiableList implements @Readonly List {} Backward-compatible: compile with any Java compiler List strings;

15. Benefits of type qualifiers Find bugs in programs Guarantee the absence of errors Improve documentation Improve code structure & maintainability Aid compilers, optimizers, and analysis tools Reduce number of assertions and run-time checks Possible negatives: Must write the types (or use type inference) False positives are possible (can be suppressed)

16. What bugs can you detect & prevent? Null dereferences Mutation and side-effects Concurrency: locking Security: encryption, tainting Aliasing Equality tests Strings: localization, regular expression syntax, signature representation, format string syntax Enumeractions Typestate (e.g., open/closed files) Users can write their own checkers @NonNull @Immutable @GuardedBy @Encrypted @OsTrusted, @Untainted… @Linear @Interned @Localized @Regex @FullyQualified @Format @Fenum @State The annotation you write: The property you care about:

17. Using a checker Run in IDE or on command line Works as a compiler plug-in (annotation processor) Familiar workflow and error messages % javac –processor NullnessChecker MyFile.java MyFile.java:9: incompatible types. nonNullVar = nullableValue; ^ found : @Nullable String required: @NonNull String 17

18. What a checker guarantees The program satisfies the type property. There are: no bugs (of particular varieties) no wrong annotations Caveat 1: only for code that is checked Native methods Reflection Code compiled without the pluggable type checker Suppressed warnings Indicates what code a human should analyze Checking part of a program is still useful Caveat 2: The checker itself might contain an error

19. Pluggable type-checking for bug detection and verification GUI Effect Checker: Polymorphic effect system for UI threading Simple & effective Finds bugs Modest annotation burden Additional checkers exist for dozens of other bugs Distributed with the Checker Framework Try it today! http://checkerframework.orghttp://checkerframework.org 19