1. David Evans http://www.cs.virginia.edu/~evans CS201j: Engineering Software University of Virginia Computer Science Lecture 12: Subtyping Rules What’s the difference between a Black Bear and a Grizzly Bear? When you climb up the tree, the Black Bear climbs up after you. The Grizzly Bear knocks down the tree. (Which is the behavioral subtype?) Killer BlackBearGrizzlyBear Climber Bear KillingBear

2. 15 October 2002CS 201J Fall 20022 Recap If B is a subtype of A, everywhere the code expects an A, a B can be used instead To implement a subtype, it is often useful to use the implementation of its supertype class B extends A B is a subtype of A B inherits from A class C implements F C is a subtype of F

3. 15 October 2002CS 201J Fall 20023 Subtyping Example public class Bear { public Bear () { } abstract public boolean chaseHuman (Human h); public void eatHuman (Human h) { if (chaseHuman (h)) say (“Yum Yum!”); } public void say (String s) { System.err.println (“Bear says: ” + s); } public class BlackBear extends Bear { public boolean chaseHuman (Human h) { // follow h and climb the tree return true; } public void say (String s) { System.err.println (“BlackBear says: ” + s); } BlackBear b = new BlackBear (); b.eatHuman (h);

4. How do we know if saying B is a subtype of A is safe?

5. 15 October 2002CS 201J Fall 20025 Substitution Principle If B is a subtype of A, everywhere the code expects an A, a B can be used instead For a function f (A), if f satisfies its specification when passed an object whose actual type is type A, f also satisfies its specification when passed an object whose actual type is B.

6. 15 October 2002CS 201J Fall 20026 What needs to be true? For a function f (a A), if f satisfies its specification when passed an object whose actual type is type A, f also satisfies its specification when passed an object whose actual type is B. public int f (a A, x X) { return a.m (x); }

7. 15 October 2002CS 201J Fall 20027 Subtype Condition 1: Signature Rule We can use a subtype method where a supertype methods is expected: –Subtype must implement all of the supertype methods –Argument types must not be more restrictive –Result type must be at least as restrictive –Subtype method must not throw exceptions that are not subtypes of exceptions thrown by supertype

8. 15 October 2002CS 201J Fall 20028 Signature Rule class A { public R A m (P A p) ; } class B extends A { public R B m (P B p) ; } R B must be a subtype of R A : R B <= R A P B must be a supertype of P A : P B >= P A covariant for results, contravariant for parameters

9. 15 October 2002CS 201J Fall 20029 Signature Examples public class Object { public boolean equals (Object o) ; } public class String extends Object { } public boolean equals (Object o) ;

10. 15 October 2002CS 201J Fall 200210 Signature Examples public class CellSet { // A set of Cell’s. public Cell choose () throws NoSuchElementException ; } public class ConwayCellSet extends CellSet { // A set of ConwayCell (<= Cell) objects. public ConwayCell choose () } public Cell choose () ; Return type must be a supertype.

11. 15 October 2002CS 201J Fall 200211 Java’s Rule Java compiler is stricter than this: doesn’t allow any variation in types (“novariant”): –Overriding method must have same return and parameter types –Overriding method can throw fewer exceptions.

12. 15 October 2002CS 201J Fall 200212 What needs to be true? For a function f (a A), if f satisfies its specification when passed an object whose actual type is type A, f also satisfies its specification when passed an object whose actual type is B. public int f (a A, x X) { // REQUIRES: a is initialized // EFFECTS: returns a.value * x.value return a.m (x); }

13. 15 October 2002CS 201J Fall 200213 Precondition of the subtype method must be weaker than the precondition of the supertype method. m A.pre  m B.pre Postcondition of the subtype method must be stronger than the postcondition of the supertype method. m B.post  m A.post Subtype Condition 2: Methods Rule

14. 15 October 2002CS 201J Fall 200214 Methods Rule Example public int f (a A, x X) { // REQUIRES: a is initialized // EFFECTS: returns a.value * x.value return a.m (x); } public class A { // An A may be initialized or uninitialized. // An initialized A has an associated int value. public int m (x X) { // REQUIRES: this is initialized } public class B extends A { // A B may be initialized or uninitialized. // A B may be awake or asleep. // An initialized B has an associated int value. public int m (x X) { // REQUIRES: this is initialized and awake } Can’t make the precondition stronger! The callsite might not satisfy it.

15. 15 October 2002CS 201J Fall 200215 Methods Rule Example public int f (a A, x X) { // REQUIRES: a is initialized // EFFECTS: returns a.value * x.value return a.m (x); } public class A { // An A may be initialized or uninitialized. // An initialized A has an associated int value. public int m (x X) { // REQUIRES: this is initialized } public class B extends A { // A B may be initialized or uninitialized. // A B may be awake or asleep. // An initialized B has an associated int value. public int m (x X) { // REQUIRES: nothing }

16. 15 October 2002CS 201J Fall 200216 Subtypes must preserve all properties described in the overview specification of the supertype. Subtype Condition 3: Properties

17. 15 October 2002CS 201J Fall 200217 Substitution Principle Is this the only way?

18. 15 October 2002CS 201J Fall 200218 Substitution Principle Summary Signatures: subtype methods must be type correct in supertype callsites: result is a subtype (covariant), parameters are supertypes (contravariant) Methods: subtype preconditions must be weaker than supertype preconditions (covariant); subtype postconditions must be stronger than supertype postconditions (contravariant) Properties: subtype must preserve all properties specified in supertype overview

19. 15 October 2002CS 201J Fall 200219 Eiffel’s Rules (Described in Bertrand Meyer paper out today)

20. 15 October 2002CS 201J Fall 200220 Eiffel Rules Skier set_roommate (Skier) Boy Girl The types of the parameters in the subtype method may be subtypes of the supertype parameters. How can Girl override set_roomate? set_roommate (Girl g) set_roommate (Boy b) Opposite of substitution principle!

21. 15 October 2002CS 201J Fall 200221 Can’t Get Up? s: skier; g: girl; b: boy; s := g;... s.set_roommate (b); Skier set_roommate (Skier) Boy Girl set_roomate (Girl)

22. 15 October 2002CS 201J Fall 200222 Meyer’s Excuse Strangely enough, some workers in the field have been advocating a contravariant policy. Here it would mean that if we go for example to class RANKED_GIRL, where the result of roommate is naturally redefined to be of type RANKED_GIRL, we may for the argument of routine share use type GIRL, or rather scaringly, SKIER of the most general kind. One type that is never permitted in this case is RANKED_GIRL! Here is what, under various mathematical excuses, some professors have been promoting. No wonder teenage pregnancies are on the rise.

23. 15 October 2002CS 201J Fall 200223 PS5 First part (due Thursday Oct 24): –Questions about subtyping rules Which rules make most sense? Which rules are most useful for real programs? –Exercises to learn about concurrency (Thursday) –Design a distributed simulation of something interesting Second part (due Halloween): –Implement your distributed simulation

24. 15 October 2002CS 201J Fall 200224 Charge Must it be assumed that because we are engineers beauty is not our concern, and that while we make our constructions robust and durable we do not also strive to make them elegant? Is it not true that the genuine conditions of strength always comply with the secret conditions of harmony? Gustav Eiffel