Proving Correctness of a Garbage Collector via Local Reasoning - PowerPoint PPT Presentation

Proving Correctness of a Garbage Collector via Local Reasoning Lars Birkedal [birkedal@itu.dk], Noah Torp-Smith [noah@itu.dk] The IT University of Copenhagen Joint work with John C. Reynolds, Carnegie Mellon University Spatial Logic Workshop, Nottingham, March 2003 – p.1/32

Motivation Spatial Logic Workshop, Nottingham, March 2003 – p.2/32

Motivation • Copying garbage collectors widely used, for example in implementations of functional languages. Spatial Logic Workshop, Nottingham, March 2003 – p.2/32

Motivation • Copying garbage collectors widely used, for example in implementations of functional languages. • A “non-toy” example. Yang’s proof of the Schoor-Waite algorithm is another such. Spatial Logic Workshop, Nottingham, March 2003 – p.2/32

Motivation • Copying garbage collectors widely used, for example in implementations of functional languages. • A “non-toy” example. Yang’s proof of the Schoor-Waite algorithm is another such. • Proof Carrying Code theory assumes an underlying memory allocator, but doesn’t treat it further. Spatial Logic Workshop, Nottingham, March 2003 – p.2/32

Preliminaries (1) Setup : A user language and an implemetation language , both standard while -languages, but with different memory interactions: ::= · · · | x := cons ( e 1 , e 2 ) | x.i := e | x := y.i C user ::= · · · | [ e ] := e | x := [ e ] C impl User language: No pointer arithmetic, “implicit type system”: Vals = Ints ⊎ Ptr , heaps map pointers to pairs of values. Implementation language: Pointer arithmetic, Heaps map lo- cations (a subset of integers) to integers. Spatial Logic Workshop, Nottingham, March 2003 – p.3/32

Preliminaries (2) Interface (informal): The command cons ( e 1 , e 2 ) in the user language results in a call to alloc in implementation language. alloc( l , n 1 , n 2 ) { if ( any_space_left ) { allocate 2 heap cells; store( n 1 , n 2 ); return address; } else { Garbage collect; alloc( l , n 1 , n 2 ); } } Spatial Logic Workshop, Nottingham, March 2003 – p.4/32

Preliminaries (3) • All values allocated by the user language at runtime (through cons -operations) are pairs of values, so the garbage collector only needs to deal with pairs of locations. A pointer is a first component of such a pair. Spatial Logic Workshop, Nottingham, March 2003 – p.5/32

Preliminaries (3) • All values allocated by the user language at runtime (through cons -operations) are pairs of values, so the garbage collector only needs to deal with pairs of locations. A pointer is a first component of such a pair. • Pointers are divisible by 8. Spatial Logic Workshop, Nottingham, March 2003 – p.5/32

Preliminaries (3) • All values allocated by the user language at runtime (through cons -operations) are pairs of values, so the garbage collector only needs to deal with pairs of locations. A pointer is a first component of such a pair. • Pointers are divisible by 8. • A simplifying assumption: Only one pointer in user language, call it root (more “root pointers” do not add anything interesting to the proof). Spatial Logic Workshop, Nottingham, March 2003 – p.5/32

Preliminaries (4) So a picture might look like this: root 0 1 2 42 3 4 5 Spatial Logic Workshop, Nottingham, March 2003 – p.6/32

Preliminaries (4) So a picture might look like this: root 0 1 2 42 3 4 5 Note that some cells cannot be “reached” from the root cell. These are ignored by copying collectors. Spatial Logic Workshop, Nottingham, March 2003 – p.6/32

Preliminaries (5) • A weak heap isomorphism ϕ : ( s ′ , h ′ ) ∼ = ( s, h ) is a bijection ϕ : dom ( h ′ ) ∼ = dom ( h ) such that for all p ∈ dom ( h ′ ) , h ( ϕ ( p )) = ϕ ∗ ( h ′ ( p )) , where ϕ ∗ is the extension of ϕ to all integers (pointers and nonpointers) with the identity on nonpointers. If also ϕ ( s ′ ( root )) = s ( root ) , we call ϕ a heap isomorphism . Spatial Logic Workshop, Nottingham, March 2003 – p.7/32

Preliminaries (5) • A weak heap isomorphism ϕ : ( s ′ , h ′ ) ∼ = ( s, h ) is a bijection ϕ : dom ( h ′ ) ∼ = dom ( h ) such that for all p ∈ dom ( h ′ ) , h ( ϕ ( p )) = ϕ ∗ ( h ′ ( p )) , where ϕ ∗ is the extension of ϕ to all integers (pointers and nonpointers) with the identity on nonpointers. If also ϕ ( s ′ ( root )) = s ( root ) , we call ϕ a heap isomorphism . • ( s, h ) is a garbage collected version of ( s ′ , h ′ ) , if there is a heap isomorphism ϕ : prune ( s, h ) ∼ = prune ( s ′ , h ′ ) . We do not have to remove anything. Spatial Logic Workshop, Nottingham, March 2003 – p.7/32

Preliminaries (5) • A weak heap isomorphism ϕ : ( s ′ , h ′ ) ∼ = ( s, h ) is a bijection ϕ : dom ( h ′ ) ∼ = dom ( h ) such that for all p ∈ dom ( h ′ ) , h ( ϕ ( p )) = ϕ ∗ ( h ′ ( p )) , where ϕ ∗ is the extension of ϕ to all integers (pointers and nonpointers) with the identity on nonpointers. If also ϕ ( s ′ ( root )) = s ( root ) , we call ϕ a heap isomorphism . • ( s, h ) is a garbage collected version of ( s ′ , h ′ ) , if there is a heap isomorphism ϕ : prune ( s, h ) ∼ = prune ( s ′ , h ′ ) . We do not have to remove anything. • So if GC is our garbage collector, and if GC, s, h � s ′ , h ′ the requirement is that ( s ′ , h ′ ) is a garbage collected version of ( s, h ) . Spatial Logic Workshop, Nottingham, March 2003 – p.7/32

Cheney’s Algorithm (1970) Spatial Logic Workshop, Nottingham, March 2003 – p.8/32

Cheney’s Algorithm (1970) Assumes 2 contigous “semi-spaces” of equal size, and OLD = [ startOld , endOld [ NEW = [ startNew , endNew [ , s ( root ) ∈ OLD . ALIVE = { p | p is reachable } . Copies ALIVE to NEW in a “structure preserving way” and resumes allocation there. Spatial Logic Workshop, Nottingham, March 2003 – p.8/32

Cheney’s Algorithm (1970) Assumes 2 contigous “semi-spaces” of equal size, and OLD = [ startOld , endOld [ NEW = [ startNew , endNew [ , s ( root ) ∈ OLD . ALIVE = { p | p is reachable } . Copies ALIVE to NEW in a “structure preserving way” and resumes allocation there. The example from before: � root 2 3 5 1 2 1 2 3 4 5 3 4 5 OLD scan root free NEW Spatial Logic Workshop, Nottingham, March 2003 – p.8/32

An Example Initializing code : Copy the root cell and update the first component to point to the copy: root 1 2 3 4 5 scan free Spatial Logic Workshop, Nottingham, March 2003 – p.9/32

An Example (2) Scanning a pointer-component (1) : If the first component of the cell it points to is not a pointer into NEW , we just copy the cell and update its first component. Then we update the component we are scanning: root 2 3 4 5 1 2 scan free Spatial Logic Workshop, Nottingham, March 2003 – p.10/32

An Example (3) ... and again: root 2 3 4 5 1 2 scan free Spatial Logic Workshop, Nottingham, March 2003 – p.11/32

An Example (4) Scanning a non-pointer component : Nothing happens. root 2 3 4 5 1 2 scan free Spatial Logic Workshop, Nottingham, March 2003 – p.12/32

An Example (5) Scanning two pointer components as before: root 2 3 5 1 2 3 4 5 scan free Spatial Logic Workshop, Nottingham, March 2003 – p.13/32

An Example (6) Scanning a pointer-component (2) : If the first component of the cell it points to is a pointer into NEW , we do not make another copy; we just update the component, we are scanning appropriately: root 2 3 5 1 2 3 4 5 scan free Spatial Logic Workshop, Nottingham, March 2003 – p.14/32

An Example (7) After this, nothing more interesting happens, and we update root : 2 3 5 1 2 3 4 5 scan root free Spatial Logic Workshop, Nottingham, March 2003 – p.15/32

An Example (7) After this, nothing more interesting happens, and we update root : 2 3 5 1 2 3 4 5 scan root free ...and we’re done! Spatial Logic Workshop, Nottingham, March 2003 – p.15/32

Extension of Separation Logic To formalize our partition, we extend the term language with finite sets of pointers : Spatial Logic Workshop, Nottingham, March 2003 – p.16/32

Extension of Separation Logic To formalize our partition, we extend the term language with finite sets of pointers : · · · | m fs ⊕ e | m fs ⊖ e | Itv ( e, e ) | · · · ::= m Spatial Logic Workshop, Nottingham, March 2003 – p.16/32

Extension of Separation Logic To formalize our partition, we extend the term language with finite sets of pointers : · · · | m fs ⊕ e | m fs ⊖ e | Itv ( e, e ) | · · · ::= m We will also need finite relations : ::= · · · | f ◦ g | f ⊚ g f Spatial Logic Workshop, Nottingham, March 2003 – p.16/32

Extension of Separation Logic To formalize our partition, we extend the term language with finite sets of pointers : · · · | m fs ⊕ e | m fs ⊖ e | Itv ( e, e ) | · · · ::= m We will also need finite relations : ::= · · · | f ◦ g | f ⊚ g f Semantics for ⊚ : extension with identity on non-pointers: [ [ f ⊚ h ] ] = { ( p, n ) | (( p, n ) ∈ [ [ h ] ] s ∧ n �∈ Ptr ) ∨ ( ∃ p ′ ∈ Ptr. ( p, p ′ ) ∈ [ ] s ∧ ( p ′ , n ) ∈ [ [ h ] [ f ] ] s ) } Spatial Logic Workshop, Nottingham, March 2003 – p.16/32

Extension of Separation Logic (2) We will also have new assertion forms. We mention some: Spatial Logic Workshop, Nottingham, March 2003 – p.17/32