-
Notifications
You must be signed in to change notification settings - Fork 16
Reduction semantics #109
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Reduction semantics #109
Changes from 9 commits
9ad8d55
db96405
2330933
d8ad9ed
79e59f6
d7e176d
86c9778
97b2800
515e806
12d2624
b09f2fa
12ad434
b570d38
6082dc5
b304d86
ff3c5e0
f44c8d1
7335969
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -808,8 +808,8 @@ This abbreviation will be formalised with an auxiliary function or other means i | |
|
|
||
| - `suspend <tagidx>` | ||
| - Use a control tag to suspend the current computation. | ||
| - `suspend $t : [t1*] -> [t2*]` | ||
| - iff `C.tags[$t] = tag $ft` | ||
| - `suspend $e : [t1*] -> [t2*]` | ||
| - iff `C.tags[$e] = tag $ft` | ||
| - and `C.types[$ft] ~~ func [t1*] -> [t2*]` | ||
|
|
||
| - `switch <typeidx> <tagidx>` | ||
|
|
@@ -833,6 +833,147 @@ events and only `(on $e switch)` handlers can handle `switch` | |
| events. The handler search continues past handlers for the wrong kind | ||
| of event, even if they use the correct tag. | ||
|
|
||
| #### Store extensions | ||
|
|
||
| * New store component `conts` for allocated continuations | ||
| - `S ::= {..., conts <cont>?*}` | ||
|
|
||
| * A continuation is a context annotated with its hole's arity | ||
| - `cont ::= (E : n)` | ||
|
||
|
|
||
|
|
||
| #### Administrative instructions | ||
|
|
||
| * `(ref.cont a)` represents a continuation value, where `a` is a *continuation address* indexing into the store's `conts` component | ||
| - `ref.cont a : [] -> [(ref $ct)]` | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. There may be many valid choices of There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @rossberg, can you answer this? |
||
| - iff `S.conts[a] = epsilon \/ S.conts[a] = (E : n)` | ||
| + iff `E[val^n] : t2*` | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. There are two ways of doing this. The first is the one displayed here, where type-checking the There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Hm, I'd generally prefer the first option, since that is a more faithful reflection of the intended runtime representation that erases these types. We really want to know that this is sound, so ideally, even a mechanised soundness proof would model the store without introducing additional type information that may affect the result in subtle ways. Invoke is different in that functions are already type-annotated in the source program, and these types are in fact kept around in real implementations (e.g., to perform link-time type-checks). There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Does typechecking the instructions inside the continuation require a type context There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. In the WasmFX-Cert mechanisation in the Rocq proof assistant, we use the empty context. This is ultimately irrelevant since all continuations start off as a function call and the body of a function call is typechecked using a different typing context as per the typing rules of (plain) WebAssembly |
||
| + and `(val : t1)^n` | ||
| - and `$ct ~~ cont $ft` | ||
| - and `$ft ~~ [t1^n] -> [t2*]` | ||
dhil marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| * `(suspend.addr ea)` represents a `(suspend $e)` instruction where the tag index `$e` has been replaced with the physical address `ea` of the tag. | ||
| - `suspend.addr ea : [t1*] -> [t2*]` | ||
| - iff `S.tags[ea].type ~~ [t1*] -> [t2*]` | ||
|
|
||
| * `(switch.addr $ct ea)` represents a `(switch $ct $e)` instruction where the tag index `$e` has been replaced with the physical address `ea` of the tag. | ||
| - `switch.addr $ct ea : [t1* (ref null $ct1)] -> [t2*]` | ||
| - iff `S.tags[$e].type ~~ [] -> [t*]` | ||
| - and `C.types[$ct] ~~ cont [t1* (ref null? $ct2)] -> [te1*]` | ||
| - and `te1* <: t*` | ||
| - and `C.types[$ct2] ~~ cont [t2*] -> [te2*]` | ||
| - and `t* <: te2*` | ||
|
|
||
| * `(prompt{<hdl>*} <instr>* end)` represents an active handler | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Sidenote: the Iris-WasmFX mechanisation adds one more immediate argument to the |
||
| - `(prompt{hdl*}? instr* end) : [] -> [t*]` | ||
| - iff `instr* : [] -> [t*]` in the empty context | ||
| - and `(hdl : [t*])*` | ||
|
|
||
| The administrative structure `hdl` is defined as | ||
| ``` | ||
| hdl ::= (<tagaddr> $l) | (<tagaddr> switch) | ||
| ``` | ||
|
||
|
|
||
| where | ||
|
|
||
| * `(a $l)` represents a tag-label association | ||
| - `(a $l) : [t2*]` | ||
| - iff `(S.tags[a].type ~~ [te1*] -> [te2*])*` | ||
| - and `(label $l : [te1'* (ref null? $ct')])*` | ||
| - and `([te1*] <: [te1'*])*` | ||
| - and `($ct' ~~ cont $ft')*` | ||
| - and `([te2*] -> [t2*] <: $ft')*` | ||
mlegoupil marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
|
|
||
| * `(a switch)` represents a tag-switch association | ||
| - `(a switch) : [t2*]` | ||
| - iff `(S.tags[b].type ~~ [] -> [te2*])*` | ||
mlegoupil marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
|
|
||
|
|
||
| #### Handler contexts | ||
|
|
||
| ``` | ||
| H^ea ::= | ||
| _ | ||
| val* H^ea instr* | ||
| label_n{instr*} H^ea end | ||
| frame_n{F} H^ea end | ||
| catch{...} H^ea end | ||
| prompt{hdl*} H^ea end (iff ea notin hdl*) | ||
| ``` | ||
|
|
||
|
|
||
| #### Reduction | ||
|
|
||
| * `S; F; (ref.null t) (cont.new $ct) --> S; F; trap` | ||
|
|
||
| * `S; F; (ref.func fa) (cont.new $ct) --> S'; F; (ref.cont |S.conts|)` | ||
| - iff `S' = S with conts += (E : n)` | ||
| - and `E = _ (invoke fa)` | ||
| - and `$ct ~~ cont $ft` | ||
| - and `$ft ~~ [t1^n] -> [t2*]` | ||
tlively marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| * `S; F; (ref.null t) (cont.bind $ct $ct') --> S; F; trap` | ||
|
|
||
| * `S; F; (ref.cont ca) (cont.bind $ct $ct') --> S; F; trap` | ||
| - iff `S.conts[ca] = epsilon` | ||
|
|
||
| * `S; F; v^n (ref.cont ca) (cont.bind $ct $ct') --> S'; F; (ref.cont |S.conts|)` | ||
| - iff `S.conts[ca] = (E' : n')` | ||
| - and `$ct' ~~ cont $ft'` | ||
| - and `$ft' ~~ [t1'*] -> [t2'*]` | ||
dhil marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| - and `n = n' - |t1'*|` | ||
| - and `S' = S with conts[ca] = epsilon with conts += (E : |t1'*|)` | ||
| - and `E = E'[v^n _]` | ||
|
|
||
| * `S; F; (ref.null t) (resume $ct hdl*) --> S; F; trap` | ||
|
|
||
| * `S; F; (ref.cont ca) (resume $ct hdl*) --> S; F; trap` | ||
| - iff `S.conts[ca] = epsilon` | ||
|
|
||
| * `S; F; v^n (ref.cont ca) (resume $ct hdl*) --> S'; F; prompt{hdl'*} E[v^n] end` | ||
| - iff `S.conts[ca] = (E : n)` | ||
| - and `S' = S with conts[ca] = epsilon` | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
|
||
| - and `hdl'*` is obtained by translating the `<tagidx>` from `hdl*` into `<tagaddr>` using `F.tag`: | ||
| - if `on $a $l` is in `hdl*` and `F.tags[$e]=ea`, then `ea $l` is in `hdl'*` | ||
| - if `on $a switch` is in `hdl'*` and `F.tags[$e]=ea`, then `ea switch` is in `hdl'*` | ||
|
||
|
|
||
| * `S; F; (ref.null t) (resume_throw $ct $e hdl*) --> S; F; trap` | ||
|
|
||
| * `S; F; (ref.cont ca) (resume_throw $ct $e hdl*) --> S; F; trap` | ||
| - iff `S.conts[ca] = epsilon` | ||
|
|
||
| * `S; F; v^m (ref.cont ca) (resume_throw $ct $e hdl*) --> S'; F; prompt{hdl'*} E[v^m (throw $e)] end` | ||
tlively marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
dhil marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
| - iff `S.conts[ca] = (E : n)` | ||
| - and `S.tags[F.tags[$e]].type ~~ [t1^m] -> [t2*]` | ||
| - and `S' = S with conts[ca] = epsilon` | ||
|
||
| - and `hdl'*` is obtained by translating the `<tagidx>` from `hdl*` into `<tagaddr>` using `F.tag`: | ||
| - if `on $a $l` is in `hdl*` and `F.tags[$e]=ea`, then `ea $l` is in `hdl'*` | ||
| - if `on $a switch` is in `hdl'*` and `F.tags[$e]=ea`, then `ea switch` is in `hdl'*` | ||
|
|
||
| * `S; F; (prompt{hdl*} v* end) --> S; F; v*` | ||
|
|
||
| * `S; F; (suspend $e) --> S; F; (suspend.addr ea)` | ||
| - iff `ea = F.tags[$e]` | ||
|
|
||
| * `S; F; (prompt{hdl1* (ea $l) hdl2*} H^ea[v^n (suspend.addr ea)] end) --> S'; F; v^n (ref.cont |S.conts|) (br $l)` | ||
tlively marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
| - iff `ea notin tagaddr(hdl1*)` | ||
| - and `S.tags[ea].type ~~ [t1^n] -> [t2^m]` | ||
| - and `S' = S with conts += (H^ea : m)` | ||
|
|
||
| * `S; F; (switch $ct $e) --> S; F; (switch.addr $ct ea)` | ||
| - iff `ea = F.tags[$e]` | ||
|
|
||
| * `S; F; (prompt{hdl1* (ea switch) hdl2*} H^ea[v^n (ref.cont ca) (switch.addr $ct ea)] end) --> S''; F; prompt{hdl1* (ea switch) hdl2*} E[v^n (ref.cont |S.conts|)] end` | ||
| - iff `S.conts[ca] = (E : n')` | ||
| - and `n' = 1 + n` | ||
| - and `ea notin tagaddr(hdl1*)` | ||
|
||
| - and `$ct ~~ cont $ft` | ||
| - and `$ft ~~ [t1* (ref $ct2)] -> [t2*]` | ||
| - and `$ct2 ~~ cont $ft2` | ||
| - and `$ft2 ~~ [t1'^m] -> [t2'*]` | ||
| - and `S' = S with conts[ca] = epsilon` | ||
| - and `S'' = S' with conts += (H^ea : m)` | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Sidenote: the Iris-WasmFX mechanisation does not yet have the There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Update: the Iris-WasmFX mechanisation now has the
dhil marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| ### Binary format | ||
|
|
||
| We extend the binary format of composite types, heap types, and instructions. | ||
|
|
@@ -856,7 +997,7 @@ The opcode for heap types is encoded as an `s33`. | |
|
|
||
| #### Instructions | ||
|
|
||
| We use the use the opcode space `0xe0-0xe5` for the seven new instructions. | ||
| We use the use the opcode space `0xe0-0xe5` for the six new instructions. | ||
|
|
||
| | Opcode | Instruction | Immediates | | ||
| | ------ | ------------------------ | ---------- | | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sidenote: the Iris-WasmFX mechanisation stores more than just the arity
ntogether with the contextE, it stores the actual expected typet1* -> t2*. Transforming the presentation from the mechanisation to this one is simple (n = length(t1*)).There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That is interesting. Is that merely for convenience (i.e., not having to guess the type non-deterministically in the proof), or would soundness actually break without fixing the types?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is so that the logical relation can later have more to go on. The type soundness could be proved in a mechanisation that only decorates contexts with the arity
nwith minor changes to the proofs