Closure conversion is safe for space

Abstract

We formally prove that closure conversion with flat environments for CPS lambda calculus is correct (preserves semantics) and safe for time and space, meaning that produced code preserves the time and space required for the execution of the source program. We give a cost model to pre-and post-closure-conversion code by formalizing profiling semantics that keep track of the time and space resources needed for the execution of a program, taking garbage collection into account. To show preservation of time and space we set up a general, łgarbage-collection compatiblež, binary logical relation that establishes invariants on resource consumption of the related programs, along with functional correctness. Using this framework, we show semantics preservation and space and time safety for terminating source programs, and divergence preservation and space safety for diverging source programs. This is the first formal proof of space-safety of a closure-conversion transformation. The transformation and the proof are parts of the CertiCoq compiler pipeline from Coq (Gallina) through CompCert Clight to assembly language. Our results are mechanized in the Coq proof assistant. CCS Concepts: • Software and its engineering → General programming languages.

Compiling with continuations, correctly

“…We need to show that (σ , e ′ ) ⇓ f trg OOT. From the hypothesis that the source diverges, we have that σ ; e ⇓ (f ,c ) src OOT for some c. Therefore, from the first hypothesis, we know that there exists f ′ ≥ f such that (σ , e ′ ) ⇓ This style of reasoning is employed by both the CakeML [Owens et al 2016[Owens et al , 2017 and the CertiCoq [Paraskevopoulou and Appel 2019; compilers. CertiCoq generalizes the previous lemma to also apply to transformations that may reduce the amount of steps that a program takes.…”

“…[Ahmed 2006;Appel and McAllester 2001]. Although logical relations are most frequently indexed by types, untyped logical relations are not uncommon [Acar et al 2008;Owens et al 2017;Paraskevopoulou and Appel 2019].…”

“…Similar relations indexed by local and global invariants have been used in other parts of CertiCoq in order to prove that transformations preserve terminating and diverging executions and to derive upper bounds on the resource consumption of programs [Paraskevopoulou and Appel 2019;. The logical relation we present here is used extensively to prove correct transformations in the λ ANF (λ CPS is a subset of λ ANF ) middle-end pipeline of CertiCoq.…”

Coinductive Natural Semantics for Compiler Verification in Coq

“…In CertiCoq, (intermediate) languages semantics and proofs of correctness are based on big-step semantics (for terminating computations). However, big-step semantics is refined with other notions such as step-indexed logical relations and context-based semantics [40,42] to account for additional properties, for instance, compositionality. In addition, the idea of adapting this technique to be useful for general-purpose programming languages is barely mentioned in [40].…”

Reasonable Space for the $λ$-Calculus, Logarithmically

“…The space inefficiency of environment machines is also observed by Krishnaswami et al [26], who propose some techniques to alleviate it in the context of functional-reactive programming and based on linear types. The relevance for space of disabling environment sharing is also stressed by Paraskevopoulou and Appel [31] in their cost-aware study of closure conversion. A characterization of PSPACE in the -calculus is given by Gaboardi et al [21], but it relies on alternating time rather than on a notion of space.…”