  In stream-based programming, data sources are abstracted as a stream of
values that can be manipulated via callback functions. Stream-based programming
is exploding in popularity, as it provides a powerful and expressive paradigm
for handling asynchronous data sources in interactive software. However,
high-level stream abstractions can also make it difficult for developers to
reason about control- and data-flow relationships in their programs. This is
particularly impactful when asynchronous stream-based code interacts with
thread-limited features such as UI frameworks that restrict UI access to a
single thread, since the threading behavior of streaming constructs is often
non-intuitive and insufficiently documented.
  In this paper, we present a type-based approach that can statically prove the
thread-safety of UI accesses in stream-based software. Our key insight is that
the fluent APIs of stream-processing frameworks enable the tracking of threads
via type-refinement, making it possible to reason automatically about what
thread a piece of code runs on -- a difficult problem in general.
  We implement the system as an annotation-based Java typechecker for Android
programs built upon the popular ReactiveX framework and evaluate its efficacy
by annotating and analyzing 8 open-source apps, where we find 33 instances of
unsafe UI access while incurring an annotation burden of only one annotation
per 186 source lines of code. We also report on our experience applying the
typechecker to two much larger apps from the Uber Technologies Inc. codebase,
where it currently runs on every code change and blocks changes that introduce
potential threading bugs.
