Proving Correctness of Compilers Using Structured Graphs Patrick - PowerPoint PPT Presentation

u n i v e r s i t y o f c o p e n h a g e n d e p a r t m e n t o f c o m p u t e r s c i e n c e Faculty of Science Proving Correctness of Compilers Using Structured Graphs Patrick Bahr University of Copenhagen, Department of Computer Science paba@di.ku.dk Symposium on Functional and Logic Programming, Kanazawa, Japan; 6th June, 2014 Slide 1

u n i v e r s i t y o f c o p e n h a g e n d e p a r t m e n t o f c o m p u t e r s c i e n c e Introduction Trade-off in software verification: cleverness of vs. ease of implementation reasoning Patrick Bahr — Proving Correctness of Compilers Using Structured Graphs — FLOPS ’14, 6th June, 2014 Slide 2

u n i v e r s i t y o f c o p e n h a g e n d e p a r t m e n t o f c o m p u t e r s c i e n c e Trade-off in Compiler Verification Example: Hutton & Wright “Compiling Exceptions Correctly” Two compilers for a simple language with exceptions: • Simple but unrealistic compiler (tree shaped code!) � simple proofs • More realistic compiler with explicit jumps � much more complicated proofs Our Proposal: an intermediate approach • Transform compiler: use (acyclic) graphs instead of trees • Lift the correctness property from the tree-based to the graph-based compiler. Patrick Bahr — Proving Correctness of Compilers Using Structured Graphs — FLOPS ’14, 6th June, 2014 Slide 3

u n i v e r s i t y o f c o p e n h a g e n d e p a r t m e n t o f c o m p u t e r s c i e n c e Example: A Simple Language with Exceptions Based on Hutton & Wright “Compiling Exceptions Correctly” Source Language Arithmetic expressions + exceptions: data Expr = Val Int | Add Expr Expr | Throw | Catch Expr Expr Target Language Instruction set for a simple stack machine: data Code = PUSH Int Code | ADD Code | HALT | MARK Code Code | UNMARK Code | THROW Patrick Bahr — Proving Correctness of Compilers Using Structured Graphs — FLOPS ’14, 6th June, 2014 Slide 4

u n i v e r s i t y o f c o p e n h a g e n d e p a r t m e n t o f c o m p u t e r s c i e n c e A Simple Compiler Targeting A Stack Machine comp A :: Expr → Code → Code comp A ( Val n ) c = PUSH n c comp A ( Add x y ) c = comp A x ( comp A y ( ADD c )) comp A Throw c = THROW comp A ( Catch x h ) c = MARK ( comp A h c ) ( comp A x ( UNMARK c )) comp :: Expr → Code comp e = comp A e HALT Patrick Bahr — Proving Correctness of Compilers Using Structured Graphs — FLOPS ’14, 6th June, 2014 Slide 5

u n i v e r s i t y o f c o p e n h a g e n d e p a r t m e n t o f c o m p u t e r s c i e n c e A Simple Compiler Targeting A Stack Machine comp A :: Expr → Code → Code comp A ( Val n ) c = PUSH n ⊲ c comp A ( Add x y ) c = comp A x ⊲ comp A y ⊲ ADD ⊲ c comp A Throw c = THROW comp A ( Catch x h ) c = MARK ( comp A h ⊲ c ) ⊲ comp A x ⊲ UNMARK ⊲ c comp :: Expr → Code comp e = comp A e ⊲ HALT Patrick Bahr — Proving Correctness of Compilers Using Structured Graphs — FLOPS ’14, 6th June, 2014 Slide 5

u n i v e r s i t y o f c o p e n h a g e n d e p a r t m e n t o f c o m p u t e r s c i e n c e Semantics & Correctness Semantics Given by evaluator eval & virtual machine exec eval :: Expr → Maybe Int exec :: Code → Stack → Stack Theorem (compiler correctness) � [ Val n ] if eval e = Just n exec ( comp e ) [ ] = [ ] if eval e = Nothing Goal • Avoid the code duplication produced by the compiler. • Retain the simple equational reasoning to prove correctness. Patrick Bahr — Proving Correctness of Compilers Using Structured Graphs — FLOPS ’14, 6th June, 2014 Slide 6

u n i v e r s i t y o f c o p e n h a g e n d e p a r t m e n t o f c o m p u t e r s c i e n c e How Do We Achieve This? 1 trees ⇒ structured graphs (trees + explicit let bindings) 2 The VM is a fold, i.e. exec = fold execAlg 3 On graphs, the VM is defined as a fold with the same algebra: exec G = fold G execAlg 4 By parametricity, we obtain: exec G = exec ◦ unravel 5 By simple equational reasoning we show comp = unravel ◦ comp G 6 Hence: exec ◦ comp = exec G ◦ comp G Patrick Bahr — Proving Correctness of Compilers Using Structured Graphs — FLOPS ’14, 6th June, 2014 Slide 7

u n i v e r s i t y o f c o p e n h a g e n d e p a r t m e n t o f c o m p u t e r s c i e n c e Explicit Representation of Tree Types Tree Type: fixed point of a functor data Tree f = In ( f ( Tree f )) Code data type data Code F a = PUSH F Int | ADD F | HALT F a a | MARK F a | UNMARK F a | THROW F a ⇒ Code ≃ Tree Code F Smart Constructors PUSH T :: Int → Tree Code F → Tree Code F PUSH T n c = In ( PUSH F n c ) . . . Patrick Bahr — Proving Correctness of Compilers Using Structured Graphs — FLOPS ’14, 6th June, 2014 Slide 8

u n i v e r s i t y o f c o p e n h a g e n d e p a r t m e n t o f c o m p u t e r s c i e n c e Compiler with Explicit Tree Type comp A :: Expr → Tree Code F → Tree Code F comp A ( Val n ) c = PUSH T n ⊲ c comp A ( Add x y ) c = comp A x ⊲ comp A y ⊲ ADD T ⊲ c comp A Throw c = THROW T comp A ( Catch x h ) c = MARK T ( comp A h ⊲ c ) ⊲ comp A x ⊲ UNMARK T ⊲ c comp :: Expr → Tree Code comp e = comp A e ⊲ HALT T Patrick Bahr — Proving Correctness of Compilers Using Structured Graphs — FLOPS ’14, 6th June, 2014 Slide 9

u n i v e r s i t y o f c o p e n h a g e n d e p a r t m e n t o f c o m p u t e r s c i e n c e Structured Graphs (Oliveira & Cook, 2012) Definition data Graph ′ f v = GIn ( f ( Graph ′ f v )) | Let ( Graph ′ f v ) ( v → Graph ′ f v ) | Var v newtype Graph f = MkGraph ( ∀ v . Graph ′ f v ) G :: Expr → Graph ′ Code F v → Graph ′ Code F v comp A comp A G ( Val n ) c = PUSH G n ⊲ c comp A c = comp A G x ⊲ comp A G ( Add x y ) G y ⊲ ADD G ⊲ c comp A c = THROW G G Throw G ( Catch x h ) c = Let c ( λ c ′ → MARK G ( comp A comp A G h ⊲ Var c ′ ) ⊲ comp A G x ⊲ UNMARK G ⊲ Var c ′ ) comp G :: Expr → Graph Code comp G e = MkGraph ( comp A G e ⊲ HALT G ) Patrick Bahr — Proving Correctness of Compilers Using Structured Graphs — FLOPS ’14, 6th June, 2014 Slide 10

u n i v e r s i t y o f c o p e n h a g e n d e p a r t m e n t o f c o m p u t e r s c i e n c e Example comp ( Add ( Catch ( Val 1 ) ( Val 2 )) ( Val 3 )) � MARK T ( PUSH T 2 ⊲ PUSH T 3 ⊲ ADD T ⊲ HALT T ) ⊲ PUSH T 1 ⊲ UNMARK T ⊲ PUSH T 3 ⊲ ADD T ⊲ HALT T comp G ( Add ( Catch ( Val 1 ) ( Val 2 )) ( Val 3 )) � MkGraph ( Let ( PUSH G 3 ⊲ ADD G ⊲ HALT G ) ( λ v → MARK G ( PUSH G 2 ⊲ Var v ) ⊲ PUSH G 1 ⊲ UNMARK G ⊲ Var v )) Patrick Bahr — Proving Correctness of Compilers Using Structured Graphs — FLOPS ’14, 6th June, 2014 Slide 11

u n i v e r s i t y o f c o p e n h a g e n d e p a r t m e n t o f c o m p u t e r s c i e n c e Virtual Machine as a Fold Fold over Trees fold :: Functor f ⇒ ( f r → r ) → Tree f → r fold alg ( In t ) = alg ( fmap ( fold alg ) t ) Virtual Machine as a Fold exec G :: Graph Code → Stack → Stack exec G = fold G execAlg Folds on Graphs fold G :: Functor f ⇒ ( f r → r ) → Graph f → r fold G alg ( Graph g ) = fold ′ G g where fold ′ G ( GIn t ) = alg ( fmap fold ′ G t ) fold ′ G ( Let e f ) = fold ′ G ( f ( fold ′ G e )) fold ′ G ( Var x ) = x Patrick Bahr — Proving Correctness of Compilers Using Structured Graphs — FLOPS ’14, 6th June, 2014 Slide 12

u n i v e r s i t y o f c o p e n h a g e n d e p a r t m e n t o f c o m p u t e r s c i e n c e Correctness Argument for comp G Since, we know that comp is correct, it suffices to show that exec G ◦ comp G = exec ◦ comp Proof. (1) exec G ◦ comp G = exec ◦ unravel ◦ comp G (2) = exec ◦ comp Theorem fold G alg = fold alg ◦ unravel (1) Patrick Bahr — Proving Correctness of Compilers Using Structured Graphs — FLOPS ’14, 6th June, 2014 Slide 13

u n i v e r s i t y o f c o p e n h a g e n d e p a r t m e n t o f c o m p u t e r s c i e n c e Proof of (2) Lemma unravel ( comp G e ) = comp e Proof. By induction on e . The interesting part: unravel ( Let c ( λ c ′ → MARK G ( comp A G h ⊲ Var c ′ ) ⊲ comp A G x ⊲ UNMARK G ⊲ Var c ′ )) = MARK T ( comp A h ⊲ unravel c ) ⊲ comp A x ⊲ UNMARK T ⊲ unravel c Patrick Bahr — Proving Correctness of Compilers Using Structured Graphs — FLOPS ’14, 6th June, 2014 Slide 14

u n i v e r s i t y o f c o p e n h a g e n d e p a r t m e n t o f c o m p u t e r s c i e n c e Summary Our Approach • Replace tree type with graph type • Relate semantics of graph-based compiler via unravelling • Exploit parametricity to drastically simplify proof Motivation: Derive Compiler from Specification • Compilers can be derived by formal calculation • The result is often unsatisfactory (e.g. code duplication) • Goal: improve compilers by simple equational reasoning Patrick Bahr — Proving Correctness of Compilers Using Structured Graphs — FLOPS ’14, 6th June, 2014 Slide 15

u n i v e r s i t y o f c o p e n h a g e n d e p a r t m e n t o f c o m p u t e r s c i e n c e Open Questions / Future Work Beyond folds • What if the virtual machine is not a fold? • This seems impossible with HOAS-style graphs • Ad hoc reasoning for “Names for free”-style graphs possible Cyclic graphs • Our method is restricted to acyclic graphs. • Cyclic graphs require different reasoning principle. (fixed-point induction?) Patrick Bahr — Proving Correctness of Compilers Using Structured Graphs — FLOPS ’14, 6th June, 2014 Slide 16