Verifying a Concurrent Garbage Collector Using a Rely-Guarantee Methodology

Abstract

Concurrent garbage collection algorithms are an emblematic challenge in the area of concurrent program verification. In this paper, we address this problem by proposing a mechanized proof methodology based on the popular RelyGuarantee (RG) proof technique. We design a specific compiler intermediate representation (IR) with strong type guarantees, dedicated support for abstract concurrent data structures, and high-level iterators on runtime internals. In addition, we define an RG program logic supporting an incremental proof methodology where annotations and invariants can be progressively enriched. We formalize the IR, the proof system, and prove the soundness of the methodology in the Coq proof assistant. Equipped with this IR, we prove a fully concurrent garbage collector where mutators never have to wait for the collector.

A Verified Generational Garbage Collector for CakeML

“…Gammie et al [5] verify a detailed model of a state-of-the-art concurrent mark-and-sweep collector in Isabelle/HOL, with respect to an x86-TSO memory model. A related effort by Zakowski et al [20] uses Coq to verify a concurrent mark-and-sweep collector expressed in a purpose-built compiler intermediate representation rather than the pseudocode of Gammie et al, although Zakowski et al verifies theirs with respect to an interleaving semantics.…”

Verifying a Concurrent Garbage Collector with a Rely-Guarantee Methodology

“…Using the Coq proof assistant, we achieved the following: (i) formalizing the syntax and semantics of RtIR and the soundness of an associated RG program logic, (ii) a number of tactics and structural lemmas to facilitate the so-called stability proofs required by the RG methodology, (iii) a realistic implementation of Domani et al's algorithm [8] in RtIR and (iv) an RG proof ensuring that the collector never frees references accessible by the running threads. Our formal development is available online [42].…”

“…Describing the algorithm and code in full details is out of the scope of this paper. We refer the reader to [8] and to the formal proof [42] for details.…”

“…Finally, the right color should be assigned to newly allocated objects. For space reasons, we elide the details of the alloc procedure that we have implemented, and refer to [42,8] for details.…”

Verified compilation of linearizable data structures

“…One major challenge in this landscape is the verification of an executable runtime system for such languages and an emblematic runtime service is garbage collection. In [31], we recently presented a Coq formalization of a fully concurrent garbage collector, where mutators never have to wait for the collector. This work and other similar proof efforts [25,10,9,7,8,11,12] are important stepping stones towards a realistic, Our approach in [31] is based on a dedicated intermediate representation (IR) that features strong type guarantees, dedicated support for abstract concurrent data structures, and high-level iterators on runtime internals (e.g.…”