Provably Correct Compiler Generation

Abstract

We have designed, implemented, and proved the correctness of a compiler generator that accepts action semantic descriptions of imperative programming languages. We have used it to generate compilers for both a toy language and a non-trivial subset of Ada. The generated compilers emit absolute code for an abstract RISC machine language that is assembled into code for the SPARC and the HP Precision Architecture. The generated code is an order of magnitude better than that produced by compilers generated by the classical systems of Mosses, Paulson, and Wand. Our machine language needs no runtime type-checking and is thus more realistic than those considered in previous compiler proofs. We use solely algebraic specifications; proofs are given in the initial model. The use of action semantics makes the processable language specifications easy to read and pleasant to work with. We view our compiler generator as a promising first step towards user-friendly and automatic generation of realistic and provably correct compilers. AckowledgementsThe author thanks Peter Mosses for advice and support. The author also thanks Peter Ørbaek for implementing the Cantor system.Overviews Det er et langsigtet mål, for de der arbejder med oversaetter generering og korrekthed, at konstruere en sprog-designer's arbejdsbaenk, med henblik på støtte af sprog-design processen. Hovedkomponterne i sådan en arbejdsbaenk er:• Et specifikations-sprog hvis specifikationer er lette at vedligeholde, og tilgaengelige uden kendskab til den underliggende teori; og• En oversaetter generator som genererer realistiske og bevisligt korrekte oversaettere ud fra sådanne specifikationer.ii Med sådan en arbejdsbaenk kan sprog-designeren:• Dokumentere design beslutninger;• Eksperimentere med det nye sprog efter en aendring; og• Aflevere en oversaetter til programmørerne umiddelbart efter designet er faerdigt.Hidtidigt arbejde har ikke formået at bevise korrektheden af nogen realistisk oversaetter generator. Derimod er det lykkedes i flere projekter at generere oversaettere, der tåler sammenligning med kommercielt tilgaengelige oversaetere. Disse projekters' erfaring eq at det bliver lettere at generere gode oversaetere, hvis:• En sprog definition ikke indeholder en fuldstaendig implementations model; og• Specifikations-sproget er rettet mod sprog, som traditionelt implementeres via en oversaetter.Vi har designet, implementeret og bevist korrektheden af en oversaetter generator, som potentielt kunne blive en komponent i en sprog-designer's arbejdsbaenk. Sum specifikations-sprog benytter vi Mosses' aktions-notation, som blev designet netop med henblik på at undgå at et sprog-design fastlaegger en implementations model. Den centrale komponent i oversaetter generatoren er en oversaetter fra aktions-notation til absolut kode for en abstrakt RISC maskine. Når oversaetter-generatoren gives en sprog-definition i aktions-notation, så bliver den sammensat med aktions-oversaetteren, hvilket tilsammen giver en korrekt oversaetter for det definerede sprog, idet vi h...

Oasis: An Optimizing Action-based Compiler Generator

“…Comparing these figures with what Palsberg obtained with the CANTOR system [20,19] shows that the compilers we generate are two orders of magnitude faster than his, and that the code size is also two orders of magnitude smaller than his. It should be noted that Palsberg's tests were also run on a Sun SparcStation ELC.…”

“…This is a major performance enhancement in relation to earlier approaches to compiler generation based on Action Semantics [20,19,3], as well as compared to other semantics based compiler generators.…”

“…We are thus lead to choose a wholly static type system. Our type-checker is related to the one given by Palsberg in [20], but our typechecker is also capable of handing unfoldings that are not tail-recursive. This imposes some problems, since fixpoints have to be computed in the type lattice.…”

“…The tables below show some results from using the generated HypoPL compiler to compile some example programs (the same programs as used in [20,19]…”

“…If this is the case, the "or" can't trap the failure, a run-time error should be indicated and the program stopped (in the absence of commitment, an alternative action may be performed). In the CANTOR system [20,19], a significant amount of run-time is used to check for such committed failures. Our analysis is able to statically determine the possibility of committed failures in most cases, thus much fewer run-time checks need to be inserted.…”