A certified framework for compiling and executing garbage-collected languages

Abstract

We describe the design, implementation, and use of a machinecertified framework for correct compilation and execution of programs in garbage-collected languages. Our framework extends Leroy's Coq-certified Compcert compiler and Cminor intermediate language. We add: (i) a new intermediate language, GCminor, that includes primitives for allocating memory in a garbage-collected heap and for specifying GC roots; (ii) a precise, low-level specification for a Cminor library for garbage collection; and (iii) a proven semantics-preserving translation from GCminor to Cminor plus the GC library. GCminor neatly encapsulates the interface between mutator and collector code, while remaining simple and flexible enough to be used with a wide variety of source languages and collector styles. Front ends targeting GCminor can be implemented using any compiler technology and any desired degree of verification, including full semantics preservation, type preservation, or informal trust.As an example application of our framework, we describe a compiler for Haskell that translates the Glasgow Haskell Compiler's Core intermediate language to GCminor. To support a simple but useful memory safety argument for this compiler, the front end uses a novel combination of type preservation and runtime checks, which is of independent interest.

A new verified compiler backend for CakeML

“…Garbage Collection GCMinor (McCreight et al 2010) is an intermediate language with GC primitives, that can be compiled down to CMinor with calls to a verified GC. They do not run into the same problem as we do because register allocation occurs in CompCert after CMinor.…”

Portable Software Fault Isolation

“…Any higher-level intermediate stage would introduce source-language dependence. Cminor is used in other work as a natural target in the CompCert stack for compiling various source languages [31].…”

A kripke logical relation between ML and assembly

“…They prove in Coq that various collectors implement this interface, and that various mutator programs respect it. In more recent work, McCreight et al [19] extend Leroy's Compcert compiler [18] with support for garbage collection, by building the mutator-collector interface into the design of a new intermediate language, GCminor. They prove semantics preservation (mostly) for a compiler from a purely functional, typed language-Dminor-to GCminor, but (as in Compcert) not compositional correctness.…”

“…Of particular note is Leroy's Compcert project [18], in which he used the Coq proof assistant to both program and verify a multi-pass optimizing compiler from Cminor (a C-like intermediate language) to PowerPC assembly. Dargaye [13] has adapted the Compcert framework to a compiler for a pure mini-ML language, and McCreight et al [19] have extended it to support interfacing with a garbage collector. Independently, Chlipala [10,12] has developed verified compilers for both pure and impure functional core languages, the former garbage-collected, with a focus on using custom Coq tactics to provide significant automation of verification.…”