Verifying an Open Compiler Using Multi-language Semantics

Abstract

Abstract. Existing verified compilers are proved correct under a closed-world assumption, i.e., that the compiler will only be used to compile whole programs. We present a new methodology for verifying correct compilation of program components, while formally allowing linking with target code of arbitrary provenance. To demonstrate our methodology, we present a two-pass type-preserving open compiler and prove that compilation preserves semantics. The central novelty of our approach is that we define a combined language that embeds the source, intermediate, and target languages and formalizes a semantics of interoperability between them, using boundaries in the style of Matthews and Findler. Compiler correctness is stated as contextual equivalence in the combined language. Note to reader: We use blue, red, and purple to typeset terms in various languages. This paper will be difficult to follow unless read/printed in color.

FunTAL: reasonably mixing a functional language with assembly

“…As mentioned in §1, Perconti and Ahmed [22] proved correctness of a functionallanguage compiler that performs closure conversion and heap allocation. We can easily adapt our multi-language to verify correctness of a code-generation pass from their allocation target A to T, changing FT to AT.…”

“…We also build on multi-languages used for compiler correctness [2,20,22] which embed the source (higher-level) and target (lower-level) languages of a compiler, though none of that work considers interoperability with a language as low-level as assembly.…”

“…Perconti and Ahmed [1,22] argue that correctness theorems for verified compilers that account for such linking must include mixed-language reasoning. Specifically, they set up multi-languages that specify the rules of source-target interoperability and then express compiler correctness as multi-language equivalence between a source component e S and its compiled version e T .…”

“…Note that Perconti and Ahmed [22] left the design of a multilanguage that embeds assembly as future work. Since they did not show how to verify a code generation pass to assembly, they didn't need to define interoperability between a high-level, expression-based language and a low-level language with direct jumps.…”

“…It builds on prior logical relations for mutable state [4,10,22], but is the first to support reasoning about equivalence of programs that mix assembly with lambdas (including callbacks between them), and of assembly components comprised of different numbers of basic blocks. The central novelty lies in the mechanics of accommodating assembly and equivalence of multi-block components.…”