The next 700 compiler correctness theorems (functional pearl)

Abstract

Compiler correctness is an old problem, with results stretching back beyond the last half-century. Founding the field, John McCarthy and James Painter set out to build a łcompletely trustworthy compilerž. And yet, until quite recently, even despite truly impressive verification efforts, the theorems being proved were only about the compilation of whole programs, a theoretically quite appealing but practically unrealistic simplification. For a compiler correctness theorem to assure complete trust, the theorem must reflect the reality of how the compiler will be used.There has been much recent work on more realistic łcompositionalž compiler correctness aimed at proving correct compilation of components while supporting linking with components compiled from different languages using different compilers. However, the variety of theorems, stated in remarkably different ways, raises questions about what researchers even mean by a łcompiler is correct. ž In this pearl, we develop a new framework with which to understand compiler correctness theorems in the presence of linking, and apply it to understanding and comparing this diversity of results. In doing so, not only are we better able to assess their relative strengths and weaknesses, but gain insight into what we as a community should expect from compiler correctness theorems of the future.

CapablePtrs: Securely Compiling Partial Programs Using the Pointers-as-Capabilities Principle

“…Notice that condition (i) usually 4 even follows from whole-program correctness, namely, whole-program backward simulation (together with some structural lemmas about linking and compilation). Whole-program backward simulation is a standard [14,15] formal criterion for considering a compiler bug-free with respect to a given source semantics.…”

CompCertO: compiling certified open C components

“…As a result, common wisdom holds semantics preservation to be a lost cause for compositional compiler correctness [20]. Instead, research has focused on compositional reasoning methods based on contextual refinement, side-stepping the need for compositional semantics preservation [10,22].…”

“…A general survey, discussion and synthesis of various compositional compiler correctness results is provided by Patterson and Ahmed [20]. We focus on CompCert extensions.…”

CompCertM: CompCert with C-assembly linking and lightweight modular verification

“…The reason is that, as discussed above, allowing different memory relations would introduce different rely/guarantee conditions thereby breaking simulation after linking (i.e., horizontal compositionality) due to the mismatch between different rely/guarantee conditions. Second, proving vertical compositionality for open simulations is in general very technical and involved [Neis et al 2015;Patterson and Ahmed 2019]. Indeed the proof for structured simulations is about 5,000 SLOC in Coq.…”

“…Multi-language semantics. Ahmed and her collaborators propose multi-language semantics [New et al 2016;Patterson and Ahmed 2019;Patterson et al 2017;Perconti and Ahmed 2014;Scherer et al 2018] as an approach to prove compositional correctness and full abstraction of a compiler for both assembly-like and higher-order languages. Specifically, they define a language that combines all of the source, intermediate and target languages, and prove contextual equivalence and/or full abstraction for each translation pass in the combined language using logical relations (with back-translations).…”