Abstract Automating Proofs of Guaranteed Optimization

∗ ∗
(1)
where p, p are programs, → means ‘rewrites to,’ and O is the optimizer. We target de-optimizing rewrites that capture common patterns of software engineering abstraction, for example introducing proxies and temporary objects, so as to construct compilers that reliably reduce the ‘abstraction penalty’ associated with high-level languages. Compilers with the guaranteed optimization property produce programs that are ‘optimal’ with respect to certain criteria, such as program size or static operation counts. If J is some criterion function on programs (e.g., textual size), and the optimizer never makes programs worse with respect to J , then the guaranteed optimization property implies: J (Op) ≤ min J (p )
Veldhuizen
Fig. 1. Sketch of the guaranteed optimization property. Each point represents a program and thin arrows indicate de-optimizing rewrites. The optimizer guarantees that it will undo any sequence of de-optimizing rewrites (bold arrows) in a single step (dashed arrow). Each circle represents an equivalence class of programs under ∗ ↔. Every program in an equivalence class is optimized to the same program.
can usefully be mechanized. This has allowed us to scale up the guaranteed optimization technique from theory to practice. We faced a decision of whether or not to use an existing general-purpose theorem prover. Using an existing tool would give more assurance in correctness. However, we decided that maintaining a description of the compiler for the proof tool together with the proof script as the compiler was modified would be too onerous. We had in mind a fully automated prover that would simply answer ‘yes, the property holds’ or ‘no, the property does not hold because ...’ when the compiler was modified. For this reason we have implemented a specialized theorem prover that outputs human-readable proofs; in the future we plan to output proofs in mechanically-checkable form for input to another prover. 1.2 Related work and contributions
1
Introduction
Guaranteed optimization is a technique for building compilers that have proven guarantees of what optimizations they perform [14, 15]. One gives a system of rewrite rules that ‘de-optimize’ programs, for example: x → if true then x else y x → car(cons(x, y )) The guaranteed optimization theorem states that any amount of de-optimization can be applied to a source program via such rules, and the compiler is guar1
Email: . Fax: +46 31 165655
c 2005 Published by Elsevier Science B. V.
Veldhuizen
anteed to undo it all in a single pass: If p → p then Op = Op .
p ∈[p] ∗
(2)
∗
where [p] = {p | p ↔ p } is the equivalence class of program p under ↔ [14, §3.9]. That is, after optimization the value of the criterion function is at most its value for the optimal program in the equivalence class. Figure 1 illustrates. Finding programs optimal with respect to an approximate program ∗ equivalence such as ↔ is the best one can do, exact program equivalence being undecidable. The use of de-optimizing rewrite rules is a little odd, but it leads to a practical proof technique. The obvious solution of reversing the direction of the rewrites fails, since such rules when inverted have side-conditions that require a global analysis to satisfy; this is, after all, why we do program analysis. The use of de-optimizing rewrites gives fairly intuitive guarantees of what optimizations the compiler will perform. There is also a nice theory property: the de-optimizing rewrites give an inductive definition of a program equivalence for which the compiler is a complete decision procedure. 1.1 The automated verification connection.
Automating Proofs of Guaranteed Optimization
Todd L. Veldhuizen 1
Department of Computer Science Indiana University Bloomington, Indiana, USA
Abstract Guaranteed optimization is a technique for building compilers that have proven guarantees of what optimizations they perform. Such compilers optimize predictably and thoroughly, finding optimal forms of programs with respect to an approximate program equivalence. Guaranteed optimization is a “design-by-proof” technique: in attempting to verify a compiler has a certain property one uncovers failures in its design, and when the proof finally succeeds the compiler has the desired property. The proof technique is somewhat cumbersome, so maintaining the proof as the compiler evolves can be tedious. We describe a specialized theorem prover for guaranteed optimization that has been successfully used to verify a ial compiler having 8 simultaneous program analyses. Key words: Program analysis, optimizing compilers, compiler verification, guaranteed optimization.