Formally Proving a Compiler Transformation Safe Joachim Breitner - PowerPoint PPT Presentation

Formally Proving a Compiler Transformation Safe Joachim Breitner Haskell Symposium 2015 3 August 2015, Vancouver PROGRAMMING PARADIGMS GROUP 1 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP KIT – University of the State of Baden-Wuerttemberg and www.kit.edu National Research Center of the Helmholtz Association

Short summary I formally proved that Call Arity is safe. 2 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

Short summary I formally proved that Call Arity is safe. W H A B 2 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

Short summary I formally proved that Call Arity is safe. “W hat exactly have you shown?” H A B 2 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

Short summary I formally proved that Call Arity is safe. “W hat exactly have you shown?” “H ow did you prove that?” A B 2 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

Short summary I formally proved that Call Arity is safe. “W hat exactly have you shown?” “H ow did you prove that?” “A re you sure about this?” B 2 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

Short summary I formally proved that Call Arity is safe. “W hat exactly have you shown?” “H ow did you prove that?” “A re you sure about this?” “B ut, . . . !” 2 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

What exactly is. . . Call Arity? Call Arity is an arity analysis: let fac 10 = id let fac 10 y = y = fac x = ń y. fac (x+1) (y ∗ x) ⇒ fac x y = fac (x+1) (y ∗ x) in fac 0 1 in fac 0 1 3 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

What exactly is. . . Call Arity? Call Arity is an arity analysis: let fac 10 = id let fac 10 y = y = fac x = ń y. fac (x+1) (y ∗ x) ⇒ fac x y = fac (x+1) (y ∗ x) in fac 0 1 in fac 0 1 So far: Naive forward arity analysis, see Gill’s PhD thesis from 96 3 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

What exactly is. . . the problem? Eta-expanding a thunk is tricky: let thunk = f x let thunk y = f x y = ⇒ in . . . in . . . 4 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

What exactly is. . . the problem? Eta-expanding a thunk is tricky: let thunk = f x let thunk y = f x y = ⇒ in . . . in . . . Sharing can be lost! 4 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

What exactly is. . . the problem? Eta-expanding a thunk is tricky: let thunk = f x let thunk y = f x y = ⇒ in . . . in . . . Sharing can be lost! (unless “thunk” is used at most once in “. . . ”) 4 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

What exactly is. . . co-call cardinality analysis? x G 0 ( if p then x else y ) = p y x G 0 ( f x y ) = f y 5 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

What exactly is. . . Call Arity? Call Arity = Arity analysis with co-call cardinality analysis 6 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

What exactly is. . . Call Arity? Call Arity = Arity analysis with co-call cardinality analysis Now foldl can be a good consumer in list-fusion! 6 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

What exactly is. . . “safe”? Safety: It is safe for the compiler to apply the transformation, i.e. the performance will not degrade. 7 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

What exactly is. . . “safe”? Safety: It is safe for the compiler to apply the transformation, i.e. the performance will not degrade. Yes, it is synonymous to “improvement”. 7 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

What exactly is. . . could possibly go wrong? A bug in Call Arity ⇓ 8 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

What exactly is. . . could possibly go wrong? A bug in Call Arity ⇓ Too much eta-expansion ⇓ 8 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

What exactly is. . . could possibly go wrong? A bug in Call Arity ⇓ Too much eta-expansion ⇓ Loss of sharing ⇓ 8 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

What exactly is. . . could possibly go wrong? A bug in Call Arity ⇓ Too much eta-expansion ⇓ Loss of sharing ⇓ Work is duplicated ⇓ 8 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

What exactly is. . . could possibly go wrong? A bug in Call Arity ⇓ Too much eta-expansion ⇓ Loss of sharing ⇓ Work is duplicated ⇓ Allocation is increasing 8 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

What exactly is. . . could possibly go wrong? A bug in Call Arity ⇓ Too much eta-expansion ⇓ Loss of sharing ⇓ Work is duplicated Theorem: Call Arity does not ⇓ increase the number Allocation is increasing of allocations 8 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

What exactly is. . . could possibly go wrong? A bug in Call Arity No (such) bug ⇓ Too much eta-expansion ⇓ ⇑ Loss of sharing ⇓ Work is duplicated Theorem: Call Arity does not ⇓ increase the number Allocation is increasing of allocations 8 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

How did you prove that? 1st ingredient Sufficiently detailed semantics: Launchbury’s natural semantics for lazy evaluation. : e ⇓ ∆ : v Γ heap before final value current expression heap afterwards 9 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

How did you prove that? 1st ingredient Sufficiently detailed semantics: Sestoft’s mark-1 virtual machine ) ⇒ ( Γ ′ , e ′ , S ′ ( Γ , e , S ) current heap next stack current expression next expression next heap current stack 9 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

How did you prove that? 2nd ingredient Abstract view on what calls what: Trace trees! 10 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

How did you prove that? 2nd ingredient Abstract view on what calls what: Trace trees! x p T 0 ( if p then x else y ) = y x x y f T 0 ( f x y ) = x y y 10 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

How did you prove that? 2nd ingredient Abstract view on what calls what: Trace trees! x p T 0 ( if p then x else y ) = y x x y f T 0 ( f x y ) = x y y Co-call graphs approximates trace trees It even is a Galois immersion. 10 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

How did you prove that? 3nd ingredient A way to handle a large proof: Refinement proofs 11 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

How did you prove that? 3nd ingredient A way to handle a large proof: Refinement proofs Arity Arity Arity analysis analysis analysis + + + impl. approx. impl. ← − − ← − − − − ← − − Call Arity any a a co-call cardinality trace tree graph analysis analysis analysis 11 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

Are you sure? Isabelle H O L Syntax (using Nominal logic) ∀ Semantics (Launchbury, Sestoft, denotational) = Data types (Co-call graphs, trace trees) α λ β → ... and of course the proofs 12 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

But. . . The formalization gap! 13 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

But. . . The formalization gap! 13 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

But. . . The formalization gap! 13 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP

But. . . The formalization gap! 13 2015-09-03 Joachim Breitner - Formally Proving a Compiler Transformation Safe PROGRAMMING PARADIGMS GROUP