SSL Proofs Review and Approach

This section encodes SSL’s axioms and rules into those in UFRL, and shows that encoded SSL axioms are derivable and that the encoding translates proofs in SSL into proofs in UFRL.

The correctness judgment of SSL, a Hoare-formula tau S ta1

u, means that S is partially correct,

and S can only access the regions that are guaranteed by a. Consider the region guaranteed by a as its implicit frame. Thus, the proof obligation is to show that the following encoding into UFRL is valid (in Section 6.2.5):

$Γs tauSta1u iff

$Γu rreads fptspaqs tTRrrassu S tTRrra1ssur modifies pMVpSq, fpt_spaqq, freshpfpt_spa1q ´ rqs

where r is a region variable, such that TRrrass ñ r “ fpt_spaq and r R MVpSq

(6.1) where MVpSq is the set of variables that S may modify, and r snapshots the set of locations of fpt_spaq in the pre-state. This translation is not the only way to establish the equivalence, e.g., the

read effects can be anything from H to fpt_spaq. This encoding corresponds to the definition of validity for Hoare-formula in SSL, which is presented next.

The definition of validity for SL Hoare-formulas uses the notion of partial correctness that are used for FRL and UFRL: statements are not permitted to encounter errors in states that satisfy the precondition, but may still loop forever.

Definition 17 (Validity of SSL Hoare-formula). Let Γ be a well-formed type environment. Let S be a statement. Let a and a1 _{be assertions in SSL. Let pσ, Hq be a Γ-state. Then tauSta}1_u

is valid in pσ, Hq, written σ, H (Γ

s tauSta1u, if and only if whenever σ, H (Γs a, then

MSrrΓ $ S : okpΓ1_{qsspσ, Hq ‰ err and if pσ}1_{, H}1_{q “ MSrrΓ $ S : okpΓ}1_{qsspσ, Hq, then σ}1_{, H}1 ₍Γ1

s

a1_.

A SSL Hoare-formula tauSta1

u is valid, written (Γs tauSta1u, if and only if for all states pσ, Hq ::

σ, H (Γ

s tauSta1u.

The locality properties [73, 87] of SSL Hoare-formula are:

1. Safety Monotonicity: for all states pσ, Hq and heaps H1_{, such that HKH}1_{, if}

MSrrΓ $ S : okpΓ1

qsspσ, Hq ‰ err, then MSrrΓ $ S : okpΓ1qsspσ, H ¨ H1q ‰ err.

2. Termination Monotonicity: for all states pσ, Hq and heaps H1_{, such that HKH}1_{, if}

MSrrΓ $ S : okpΓ1

qsspσ, Hq terminates normally, then MSrrΓ $ S : okpΓ1qsspσ, H ¨ H1q ter-

minates normally.

3. Frame Property: for all states pσ, H0q and heaps H1, such that H0KH1, if

MSrrΓ $ S : okpΓ1_{qsspσ, H}

0q ‰ err and MSrrΓ $ S : okpΓ1qsspσ, H0¨ H1q “ pσ1, H1q,

then there is a subheap H1

0 Ď H1 such that H01KH1, H01 ¨ H1 “ H1, and

MSrrΓ $ S : okpΓ1

qsspσ, H0q “ pσ1, H01q.

Hoare-style proof rules for SSL are found in Fig. 6.2, following Parkinson’s work [77]. In the figure, the shorthand newspT , xq means x.f1 ÞÑ defaultpT1q ˚ ¨ ¨ ¨ ˚ x.fn ÞÑ defaultpTnq, where

the fi : Ti are defined by pf1 : T1, . . . , fn : Tnq “ fieldspT q. SSL expressions (e) are used in the

syntax of the statements, instead of FRL expressions (E), although the statements of SSL are those of FRL, the expressions have the same syntax and meaning, by Lemma 11.

The following lemma states the frame property of SL Hoare-formulas semantically. It is used in the proof of Lemma 8 later. The proof is found in Appendix F.

Lemma 13. Let Γ be a well-formed type environment. Let a and a1 _{be assertions and S}

be a statement, such that (Γ_s tauSta1u. Let pσ, Hq be a Γ-state. If σ, H (Γ_s a and

MSrrΓ $ S : okpΓ1_{qsspσ, Hq “ pσ}1_{, H}1_{q, then:}

1. for allx P dompσq, if σ1_{pxq ‰ σpxq, then x P MVpSq.}

2. for all po, f q P dompHq, if H1

ro, f s ‰ Hro, f s, then po, f q P E rrΓ $ fptspaq : regionsspσq.

3. for all po, f q P pErrΓ1

$ fptspa1q : regionsspσ1q ´ E rrΓ $ fptspaq : regionsspσqq, it is that

po, f q P pdompH1q ´ dompHqq.

There are several lemmas connecting FRL and UFRL separation operator (¨_{{¨) to SL’s separating}

conjunction operator (˚). These lemmas are used to prove the frame rule case of the Theorem that the translation between SSL and UFRL preserves provability (Theorem 9 in Section 6.2.5). The following lemma says that the footprints of assertions in a separating conjunction are also separated in the sense of FRL’s separation operator.

Lemma 14. Let Γ be a well-formed type environment. Let pσ, hq be a Γ-state. Let a1 anda2 be

assertions in SSL. Then

σ, h (Γ_s a1˚ a2impliesσ, h (Γu efspTRrra2ssq¨{¨modifiesfpt_spa₁q

Informally, the proof goes as follows. By the semantics of separating conjunction, it is known that a1 and a2 hold on disjoint heaps, say h1 and h2, respectively. By Corollary 4, it must be true that

(SKIPs) $Γs ttrueuskip; ttrueu

(VARs) $Γs ttrueuvar x : T ; tx “ defaultpT qu

(ALLOCs) $Γs tau x :“ new T ; ta ˚ newspT , xqu, where x R FVpaq

(ASGNs) $Γs ttrueu x :“ e; tx “ eu, where x R FVpeq

(UPDs) $Γs tx.f ÞÑ u x.f :“ e; tx.f ÞÑ eu

(ACCs) $Γs tx1.f ÞÑ zux :“ x1.f ; tx “ z ˚ x1.f ÞÑ zu, where x ‰ x1, x1 ‰ z and x ‰ z

(IFs)

$Γ_s ta ^ eu S1ta1u, $Γs ta ^ eu S2ta1u

$Γ_s tau if e tS1uelsetS2u ta1u

(WHILEs)

$Γ_s tI ^ eu S tIu $Γs tIu while e tSu tI ^ eu

(SEQs) $Γs tau S1tbu, $Γ 1 s tbu S2ta1u $Γs tau S1S2ta1u FVpxq “ txu FVpnullq “ H FVpnq “ H

FVpe1 “ e2q “ FVpe1q Y FVpe2q FVpe1 ‰ e2q “ FVpe1q Y FVpe2q

FVpx.f ÞÑ eq “ txu Y FVpeq FVpa1˚ a2q “ FVpa1q Y FVpa2q

FVpa1^ a2q “ FVpa1q Y FVpa2q FVpb ñ aq “ FVpbq Y FVpaq

FVpD x.y.f “ x ˚ aq “ ptyu Y FVpaqq ´ txu

ErrΓ $ fpt_spa1q : regionsspσq Ď domph1q. So the following holds.

for all reads RE ď efspTRrra2ssq :: RE !! fptspa1q. (6.2)

In addition, by definition of separator (Fig. 3.7), the following must be true

for all readsX ď efspTRrra2ssq :: reads X¨{¨modifiesfpt_spa1q. (6.3)

Using Eq. (6.3) together with Eq. (6.2) and the definition of separator (Fig. 3.7), proves that efspTRrra2ssq¨{¨modifiesfpt_spa₁q.

The above lemma handles locations on the heap, but the frame rule also concerns variables, which are the subject of the following two lemmas.

The following lemma states that free variables are preserved by the encoding. It can be proved by induction on the structure of SSL assertions.

Lemma 15. Let a be an assertion in SSL. Then FVpaq “ FVpTRrrassq.

The following lemma shows that the set of variables in a framed assertion (c in the frame rule of SSL) are such that readVarpefspTRrrcssqq is a subset of FVpTRrrcssq. The lemma is proved by induction on the structure of SSL assertions.

Lemma 16. Let c be an assertion in SSL, then readVarpefspTRrrcssqq Ď FVpTRrrcssq.