240 lines
12 KiB
Lean4
240 lines
12 KiB
Lean4
import Spa.Language.Traces
|
||
|
||
/-!
|
||
|
||
# Properties of the Object Language, CFGs, and Traces
|
||
|
||
This module encodes some properties of the language, mostly those having to do
|
||
with connecting the computational view (the `Spa.Graph`s, on which static
|
||
analyses are executed) to the semantic view (such as `EvalStmt`, which
|
||
encodes the expected formal behavior of the language). In particular,
|
||
to prove that our computationally-implemented static analyses are correct,
|
||
we need to show that our computational model of their execution (the CFG)
|
||
matches the formal description. Thus, the key result `cfg_sufficient`.
|
||
|
||
Many lemmas and definitions here aim are used to prove that result,
|
||
by allowing inductive proofs on the construction of the CFG:
|
||
the bits where we _build up_ the trace corresponding to each
|
||
proof tree are exactly those when we have two graphs (through
|
||
which traces exist) and we want to combine these graphs, while
|
||
showing also that a combined trace exists as well. -/
|
||
|
||
namespace Spa
|
||
|
||
open Graph
|
||
|
||
section Embeddings
|
||
|
||
variable {g₁ g₂ : Graph} {ρ₁ ρ₂ : Env}
|
||
|
||
/-- When two graphs are overlaid, for each trace in the left graph,
|
||
a corresponding trace exists in the combined graph. -/
|
||
noncomputable def Trace.overlay_left {idx₁ idx₂ : g₁.Index}
|
||
(tr : Trace g₁ idx₁ idx₂ ρ₁ ρ₂) :
|
||
Trace (g₁ ∙ g₂) (idx₁.castAdd g₂.size) (idx₂.castAdd g₂.size) ρ₁ ρ₂ :=
|
||
tr.embed (GGraph.Embed.overlayLeft g₁ g₂)
|
||
|
||
/-- When two graphs are overlaid, for each trace in the right graph,
|
||
a corresponding trace exists in the combined graph. -/
|
||
noncomputable def Trace.overlay_right {idx₁ idx₂ : g₂.Index}
|
||
(tr : Trace g₂ idx₁ idx₂ ρ₁ ρ₂) :
|
||
Trace (g₁ ∙ g₂) (idx₁.natAdd g₁.size) (idx₂.natAdd g₁.size) ρ₁ ρ₂ :=
|
||
tr.embed (GGraph.Embed.overlayRight g₁ g₂)
|
||
|
||
/-- When two graphs are sequenced, for each trace in the first graph,
|
||
a corresponding trace exists in the combined graph. -/
|
||
noncomputable def Trace.sequence_left {idx₁ idx₂ : g₁.Index}
|
||
(tr : Trace g₁ idx₁ idx₂ ρ₁ ρ₂) :
|
||
Trace (g₁ ⤳ g₂) (idx₁.castAdd g₂.size) (idx₂.castAdd g₂.size) ρ₁ ρ₂ :=
|
||
tr.embed (GGraph.Embed.sequenceLeft g₁ g₂)
|
||
|
||
/-- When two graphs are sequenced, for each trace in the second graph,
|
||
a corresponding trace exists in the combined graph. -/
|
||
noncomputable def Trace.sequence_right {idx₁ idx₂ : g₂.Index}
|
||
(tr : Trace g₂ idx₁ idx₂ ρ₁ ρ₂) :
|
||
Trace (g₁ ⤳ g₂) (idx₁.natAdd g₁.size) (idx₂.natAdd g₁.size) ρ₁ ρ₂ :=
|
||
tr.embed (GGraph.Embed.sequenceRight g₁ g₂)
|
||
|
||
/-- Equivalent of `Trace.overlay_left` for end-to-end traces. -/
|
||
noncomputable def EndToEndTrace.overlay_left (etr : EndToEndTrace g₁ ρ₁ ρ₂) :
|
||
EndToEndTrace (g₁ ∙ g₂) ρ₁ ρ₂ := by
|
||
obtain ⟨i₁, h₁, i₂, h₂, tr⟩ := etr
|
||
exact ⟨i₁.castAdd g₂.size, List.mem_append_left _ (List.mem_map_of_mem _ h₁),
|
||
i₂.castAdd g₂.size, List.mem_append_left _ (List.mem_map_of_mem _ h₂),
|
||
tr.overlay_left⟩
|
||
|
||
/-- Equivalent of `Trace.overlay_right` for end-to-end traces. -/
|
||
noncomputable def EndToEndTrace.overlay_right (etr : EndToEndTrace g₂ ρ₁ ρ₂) :
|
||
EndToEndTrace (g₁ ∙ g₂) ρ₁ ρ₂ := by
|
||
obtain ⟨i₁, h₁, i₂, h₂, tr⟩ := etr
|
||
exact ⟨i₁.natAdd g₁.size, List.mem_append_right _ (List.mem_map_of_mem _ h₁),
|
||
i₂.natAdd g₁.size, List.mem_append_right _ (List.mem_map_of_mem _ h₂),
|
||
tr.overlay_right⟩
|
||
|
||
/-- Execute the left operand and follow the connecting edge to the right operand. -/
|
||
noncomputable def EndToEndTrace.beforeRight {ρ₃ : Env}
|
||
(left : EndToEndTrace g₁ ρ₁ ρ₂) (right : EndToEndTrace g₂ ρ₂ ρ₃) :
|
||
Traceₗ (g₁ ⤳ g₂) (left.entry.castAdd g₂.size) (right.entry.natAdd g₁.size) ρ₁ ρ₂ := by
|
||
refine left.trace.sequence_left.addEdge ?_
|
||
exact List.mem_append_right _
|
||
(List.mem_product.mpr
|
||
⟨List.mem_map_of_mem _ left.exit_mem, List.mem_map_of_mem _ right.entry_mem⟩)
|
||
|
||
/-- When two graphs are sequenced, two end-to-end traces through the respective
|
||
graphs can be sequenced to create an end-to-end trace in the combined
|
||
graph. This is only possible for end-to-end traces and not for general
|
||
`Trace`s, because sequencing only introduces edges from the output nodes
|
||
of one graph to the input nodes of another graph. A non-end-to-end trace
|
||
need to conclude at the output node, so it cannot necessarily be sequenced
|
||
with a trace in another graph. -/
|
||
noncomputable def EndToEndTrace.concat {ρ₃ : Env} (etr₁ : EndToEndTrace g₁ ρ₁ ρ₂)
|
||
(etr₂ : EndToEndTrace g₂ ρ₂ ρ₃) : EndToEndTrace (g₁ ⤳ g₂) ρ₁ ρ₃ := by
|
||
exact ⟨etr₁.entry.castAdd g₂.size, List.mem_map_of_mem _ etr₁.entry_mem,
|
||
etr₂.exit.natAdd g₁.size, List.mem_map_of_mem _ etr₂.exit_mem,
|
||
(etr₁.beforeRight etr₂).appendTrace etr₂.trace.sequence_right⟩
|
||
|
||
|
||
end Embeddings
|
||
|
||
section Loop
|
||
|
||
variable {g : Graph} {ρ₁ ρ₂ ρ₃ : Env}
|
||
|
||
/-- A trace through a body CFG still exists (up to reindexing) in a zero-or-more loop CFG. -/
|
||
noncomputable def Trace.loop {idx₁ idx₂ : g.Index} (tr : Trace g idx₁ idx₂ ρ₁ ρ₂) :
|
||
Trace (Graph.loop g) (idx₁.natAdd 2) (idx₂.natAdd 2) ρ₁ ρ₂ :=
|
||
tr.embed (GGraph.Embed.loop g)
|
||
|
||
/-- The beginning node of a loop graph is empty. -/
|
||
private lemma loop_nodes_at_in :
|
||
(Graph.loop g).nodes g.loopIn = none :=
|
||
Fin.append_left (fun _ : Fin 2 => none) g.nodes 0
|
||
|
||
/-- The ending node of a loop graph is empty. -/
|
||
private lemma loop_nodes_at_out :
|
||
(Graph.loop g).nodes g.loopOut = none :=
|
||
Fin.append_left (fun _ : Fin 2 => none) g.nodes 1
|
||
|
||
/-- Execute the empty loop header and follow its edge into this body execution. -/
|
||
noncomputable def EndToEndTrace.beforeBody (body : EndToEndTrace g ρ₁ ρ₂) :
|
||
Traceₗ (Graph.loop g) g.loopIn (body.entry.natAdd 2) ρ₁ ρ₁ := by
|
||
refine (Trace.single (loop_nodes_at_in ▸ EvalBasicStmtOpt.none)).addEdge ?_
|
||
refine List.mem_append_left _ (List.mem_append_left _ (List.mem_append_right _ ?_))
|
||
exact List.mem_map_of_mem _ (List.mem_map_of_mem _ body.entry_mem)
|
||
|
||
/-- Equivlaent of `Trace.loop` for end-to-end traces. -/
|
||
noncomputable def EndToEndTrace.loop (etr : EndToEndTrace g ρ₁ ρ₂) :
|
||
EndToEndTrace (Graph.loop g) ρ₁ ρ₂ := by
|
||
-- the edge (2 ↑ʳ etr.exit) → out, reached through the third edge group
|
||
have hout : (etr.exit.natAdd 2, g.loopOut) ∈ (Graph.loop g).edges := by
|
||
refine List.mem_append_left _ (List.mem_append_right _ ?_)
|
||
exact List.mem_map_of_mem _ (List.mem_map_of_mem _ etr.exit_mem)
|
||
refine ⟨g.loopIn, List.mem_singleton_self _, g.loopOut, List.mem_singleton_self _, ?_⟩
|
||
exact (etr.beforeBody.appendTrace etr.trace.loop) ++< hout >++
|
||
Trace.single (loop_nodes_at_out ▸ EvalBasicStmtOpt.none)
|
||
|
||
/-- The zero-or-more times loop has an edge to return back to the top, to continue after an iteration. -/
|
||
private lemma loop_edge_out_in :
|
||
((g.loopOut, g.loopIn) : (Graph.loop g).Edge) ∈ (Graph.loop g).edges := by
|
||
refine List.mem_append_right _ ?_
|
||
exact List.mem_cons_self _ _
|
||
|
||
/-- Complete an iteration and follow the back edge before the remaining loop execution. -/
|
||
noncomputable def EndToEndTrace.beforeRest
|
||
(iteration : EndToEndTrace (Graph.loop g) ρ₁ ρ₂)
|
||
(rest : EndToEndTrace (Graph.loop g) ρ₂ ρ₃) :
|
||
Traceₗ (Graph.loop g) iteration.entry rest.entry ρ₁ ρ₂ := by
|
||
refine iteration.trace.addEdge ?_
|
||
have hout := iteration.exit_mem
|
||
have hin := rest.entry_mem
|
||
simp only [Graph.loop_inputs, Graph.loop_outputs, List.mem_singleton] at hin hout
|
||
simpa only [hin, hout] using (loop_edge_out_in (g := g))
|
||
|
||
/-- Two traces through a loop can be combined, since a loop can be executed any number of times. -/
|
||
noncomputable def EndToEndTrace.loop_concat (etr₁ : EndToEndTrace (Graph.loop g) ρ₁ ρ₂)
|
||
(etr₂ : EndToEndTrace (Graph.loop g) ρ₂ ρ₃) :
|
||
EndToEndTrace (Graph.loop g) ρ₁ ρ₃ := by
|
||
exact ⟨etr₁.entry, etr₁.entry_mem, etr₂.exit, etr₂.exit_mem,
|
||
etr₁.beforeRest etr₂ ++ etr₂.trace⟩
|
||
|
||
/-- A loop can be executed zero times. -/
|
||
noncomputable def EndToEndTrace.loop_empty {ρ : Env} : EndToEndTrace (Graph.loop g) ρ ρ := by
|
||
have hedge : ((g.loopIn, g.loopOut) : (Graph.loop g).Edge) ∈ (Graph.loop g).edges :=
|
||
List.mem_append_right _ (List.mem_cons_of_mem _ (List.mem_cons_self _ _))
|
||
exact ⟨g.loopIn, List.mem_singleton_self _, g.loopOut, List.mem_singleton_self _,
|
||
Trace.single (loop_nodes_at_in ▸ EvalBasicStmtOpt.none) ++< hedge >++
|
||
Trace.single (loop_nodes_at_out ▸ EvalBasicStmtOpt.none)⟩
|
||
|
||
end Loop
|
||
|
||
/-- A CFG consisting of only a single node has a trace through it corresponding to that node. -/
|
||
noncomputable def EndToEndTrace.singleton {o : Option BasicStmt} {ρ₁ ρ₂ : Env}
|
||
(h : EvalBasicStmtOpt ρ₁ o ρ₂) : EndToEndTrace (Graph.singleton o) ρ₁ ρ₂ :=
|
||
⟨(0 : Fin 1), List.mem_singleton_self _, (0 : Fin 1), List.mem_singleton_self _,
|
||
Trace.single h⟩
|
||
|
||
/-- If a CFG's only node is empty, the no-op trace exists through it. -/
|
||
noncomputable def EndToEndTrace.singleton_nil (ρ : Env) :
|
||
EndToEndTrace (Graph.singleton none) ρ ρ :=
|
||
EndToEndTrace.singleton EvalBasicStmtOpt.none
|
||
|
||
/-- Invoking 'Graph.wrap` (which ensures a single entry and exit node for a CFG)
|
||
does not invalidate traces in the original graph. -/
|
||
noncomputable def EndToEndTrace.wrap {g : Graph} {ρ₁ ρ₂ : Env}
|
||
(etr : EndToEndTrace g ρ₁ ρ₂) : EndToEndTrace (Graph.wrap g) ρ₁ ρ₂ :=
|
||
(EndToEndTrace.singleton_nil ρ₁).concat (etr.concat (EndToEndTrace.singleton_nil ρ₂))
|
||
|
||
/-- Reach the selected root entry through the program's empty wrapper node. -/
|
||
noncomputable def EndToEndTrace.beforeRoot {g : Graph} {ρ₁ ρ₂ : Env}
|
||
(root : EndToEndTrace g ρ₁ ρ₂) :
|
||
Traceₗ (Graph.wrap g) (Graph.wrapInput g)
|
||
(((GGraph.Embed.sequenceLeft g (Graph.singleton none)).trans
|
||
(GGraph.Embed.sequenceRight (Graph.singleton none) _)).f root.entry) ρ₁ ρ₁ :=
|
||
(EndToEndTrace.singleton_nil ρ₁).beforeRight (root.concat (EndToEndTrace.singleton_nil ρ₂))
|
||
|
||
/-- Key result: the control flow graph admits every execution that's made
|
||
possible by a language's semantics. Thus, the CFG encodes _at least_ all
|
||
semantically-possible executions. Informally, we can conclude from this
|
||
that if we compute a result that using the graph's edges to determine
|
||
what's possible, this result will not disagree with the semantics.
|
||
|
||
Note that a CFG like $K_4$ (where the nodes are basic blocks) is
|
||
technically also a sufficient graph, but is very likely meaningless in that
|
||
it grossly overestimates the possible execution paths in the language, and
|
||
thus is bound to produce less-than-specific results. There is as yet no
|
||
result in this framework that the CFG we produce is _minimal_: loosely,
|
||
posessing only edges for things that are admitted by the semantics.
|
||
This is difficult to state (in its strongest form, this would
|
||
require the CFG to be able to detect something like `while (alwaysFalse)`,
|
||
and so remains a TODO. -/
|
||
noncomputable def Stmt.cfg_sufficient {s : Stmt} {ρ₁ ρ₂ : Env}
|
||
(h : EvalStmt ρ₁ s ρ₂) : EndToEndTrace s.cfg ρ₁ ρ₂ := by
|
||
induction h with
|
||
| basic ρ₁ ρ₂ bs hbs =>
|
||
exact EndToEndTrace.singleton (EvalBasicStmtOpt.some hbs)
|
||
| andThen ρ₁ ρ₂ ρ₃ s₁ s₂ _ _ ih₁ ih₂ =>
|
||
exact ih₁.concat ih₂
|
||
| ifTrue ρ₁ ρ₂ e z s₁ s₂ _ _ _ ih =>
|
||
exact ih.overlay_left
|
||
| ifFalse ρ₁ ρ₂ e s₁ s₂ _ _ ih =>
|
||
exact ih.overlay_right
|
||
| whileTrue ρ₁ ρ₂ ρ₃ e z s _ _ _ _ ih₁ ih₂ =>
|
||
exact (ih₁.loop).loop_concat ih₂
|
||
| whileFalse ρ e s _ =>
|
||
exact EndToEndTrace.loop_empty
|
||
|
||
namespace Program
|
||
|
||
noncomputable def trace (p : Program) {ρ : Env} (h : EvalStmt [] p.rootStmt ρ) :
|
||
Trace p.cfg p.initialState p.finalState [] ρ := by
|
||
obtain ⟨i₁, h₁, i₂, h₂, tr⟩ := EndToEndTrace.wrap (Stmt.cfg_sufficient h)
|
||
rw [Graph.wrap_inputs, List.mem_singleton] at h₁
|
||
rw [Graph.wrap_outputs, List.mem_singleton] at h₂
|
||
subst h₁; subst h₂
|
||
exact tr
|
||
|
||
end Program
|
||
|
||
|
||
end Spa
|