Java UI : Effects for Controlling UI Object Access

Abstract

Abstract. Most graphical user interface (GUI) libraries forbid accessing UI elements from threads other than the UI event loop thread. Violating this requirement leads to a program crash or an inconsistent UI. Unfortunately, such errors are all too common in GUI programs. We present a polymorphic type and effect system that prevents non-UI threads from accessing UI objects or invoking UI-thread-only methods. The type system still permits non-UI threads to hold and pass references to UI objects. We implemented this type system for Java and annotated 8 Java programs (over 140KLOC) for the type system, including several of the most popular Eclipse plugins. We confirmed bugs found by unsound prior work, found an additional bug and code smells, and demonstrated that the annotation burden is low. We also describe code patterns our effect system handles less gracefully or not at all, which we believe offers lessons for those applying other effect systems to existing code.

Cascade: A Universal Programmer-Assisted Type Qualifier Inference Tool

“…Qualifier systems have been developed in these frameworks for checking software properties such as null safety [8], [33], tainting [8], [33], format strings [35], [44], internationalization [33], regular expressions [36], UI threading [17], ownership [20], and immutability [21], [33], [40], [46].…”

“…Researchers have developed many qualifier systems to check software properties such as concurrency [17], ownership [20], [39], immutability [21], [40], safety against null dereferences [8], [33], and security [8], [16], [33], [35], [44]. Java 8 supports the syntactic features required by qualifier systems [2].…”

A theory of gradual effect systems

“…In addition, one is limited by the fact that the checker is conservative. Recently, several practical effect systems have been applied to existing libraries, and the empirical findings highlight the need to occasionally bypass static effect checking [12,17].…”

“…For instance, the JavaUI effect system [12], which prevents non-UI threads from accessing UI objects or invoking UI-threadonly methods, cannot be used to verify libraries that dynamically check which thread they are running on and adapt their behavior accordingly. As explained by the authors, the patterns of dynamic checks they found in existing code go beyond simple if-then-else statements and so cannot be handled simply by specializing the static type system.…”

“…In many cases there is a unique minimal set, but as above, there may not. 12 To finish, we coalesce this collection of minimal privileges, and remove any that are already statically known to be available based on Ξ. These steps are combined in the following function.…”