Wildcards Need Witness Protection
summary
Claim: Java's wildcard unsoundness is avoidable by requiring every wildcard to have a witness type when introduced (including from null), formalized in a core calculus and proved sound. Implements an Error Prone static analysis integrated into Bazel, scans several hundred million lines of Google Java, finds zero real failures and one false positive. Requires witness checks for null, new, generic calls and extends/implements to block dangerous subtype-asserting wildcards.
AI-written summary · about
chapters (16)
- 0:00Java’s unsound wildcards
- 2:28Wildcards break type safety
- 7:25Example code runtime failure
- 10:40Witness type requirement
- 13:29Testing fix at Google
- 17:21Possible fixes for unsoundness
- 18:45Conclusion and future impact
- 19:09Q&A: Fixing Scala or Kotlin?
- 20:14Q&A: Why Java should prevent this
- 21:20Q&A: Breaking existing Java code
- 22:22Q&A: Haskell pattern-matching
- 23:26Q&A: Null checks and runtime safety
- 24:10Q&A: Java generics erasure impact
- 24:30Q&A: Undecidability of wildcards
- 25:34Q&A: Paper’s proposed limits
- 26:17Q&A: Preventing wildcard transitivity
related talks
50mModern Java Puzzlers
36mJSpecify: Getting Rid of the Billion-Dollar Mistake in Java for Good This Time
56mJava Sucks (So C# Didn't Have To)
50mPattern Matching in Java Deep Dive
01h 20mGrowing the Java Language
41mNull Safety in Java with JSpecify and NullAway
08mInterview with Heinz Kabutz
56mThe Art of Java Language Pattern Matching