Download presentation
Presentation is loading. Please wait.
1
Static Contract Checking for Haskell
Dana N. Xu University of Cambridge Ph.D. Supervisor: Simon Peyton Jones Microsoft Research Cambridge
2
From Types to Contracts
head [] = BAD head (x:xs) = x head :: [a] -> a …(head 1)… head {xs | not (null xs)} -> {r | True} …(head [])… BAD means “should not happen: crash” Type null :: [a] -> Bool null [] = True null (x:xs) = False Bug! Program errors give us headache. It is always good to detect bugs at the early stage of software development. I’d be desirable if a compiler can do the job. With type, a compiler can tell (head 1) is a bug. With contract, a compiler can tell (head []) is a bug. The precondition says that the input should not be an empty list. Arbitrary Haskell boolean expression is allowed to specify the condition. Contract (arbitrary Haskell boolean expression) Bug!
3
Glasgow Haskell Compiler (GHC)
What we want Adapt Findler-Felleisen’s ideas for dynamic (high-order) contract checking. Do static contract checking for a lazy language. Contract Haskell function Glasgow Haskell Compiler (GHC) Where the bug is Why it is a bug
4
Three Outcomes (1) Definitely Safe (no crash, but may loop)
(2) Definite Bug (definitely crashes) (3) Possible Bug
5
Sorting (==>) True x = x (==>) False x = True sorted [] = True
sorted (x:[]) = True sorted (x:y:xs) = x <= y && sorted (y : xs) insert :: Int -> [Int] -> [Int] insert {i | True} -> {xs | sorted xs} -> {r | sorted r} merge :: [Int] -> [Int] -> [Int] merge {xs | sorted xs}->{ys | sorted ys}->{r | sorted r} bubbleHelper :: [Int] -> ([Int], Bool) bubbleHelper {xs | True} -> {r | not (snd r) ==> sorted (fst r)} insertsort, mergesort, bubblesort {xs | True} -> {r | sorted r} 5
6
AVL Tree (&&) True x = x (&&) False x = False
balanced :: AVL -> Bool balanced L = True balanced (N t u) = balanced t && balanced u && abs (depth t - depth u) <= 1 data AVL = L | N Int AVL AVL insert, delete :: AVL -> Int -> AVL insert {x | balanced x} -> {y | True} -> {r | notLeaf r && balanced r && 0 <= depth r - depth x && depth r - depth x <= 1 } delete {x | balanced x} -> {y | True} -> {r | balanced r && 0 <= depth x - depth r && depth x - depth r <= 1}
7
The Contract Idea for Higher-Order Function [Findler/Felleisen]
f1 :: (Int -> Int) -> Int f1 ({x | x > 0} -> {y | y >= 0}) -> {r | r >= 0} f1 g = (g 0) - 1 f2 :: {r | True} f2 = f1 (\x -> x – 5) Blame f1: f1 calls g with wrong argument f1 does not satisfy its post-condition f3 :: {r | True} f3 = f1 (\x -> x – 1) Blame f2: f2 calls f1 with wrong argument f3 is Ok. Can’t tell at run-time
8
What is a Contract? Contract t ::= {x | p} Predicate Contract
arbitrary Haskell boolean expression Ok = {x | True} Contract t ::= {x | p} Predicate Contract | x:t1 -> t2 Dependent Function Contract | (t1, t2) Tuple Contract | Any Polymorphic Any Contract 3 { x | x > 0 } (3, []) Any 3 { x | True } (3, []) (Ok, {ys | null ys}) arbitrary constructor inc x:{x | x>0} -> {y | y == x + 1} Postcondition can mention argument Precondition Postcondition
9
Beauty of Contract Checking
What we want? Check f <contract_of_f> If main Ok , then the whole program cannot crash. If not, show which function to blame and why. Beauty of Contract Checking
10
Symbolically simplify See if BAD is syntactically in e’.
Define e t Construct e t (e “ensures” t) Main Theorem e t iff e t is crash-free (related to Blume&McAllester:JFP’06) some e’ Symbolically simplify (e t) See if BAD is syntactically in e’. If yes, DONE; else give BLAME [POPL’10] ESC/Haskell [Haskell’06]
11
Wrappers and ( pronounced ensures pronounced requires)
e {x | p} = case p[e/x] of True -> e False -> BAD e x:t1 -> t2 = v. (e (v t1)) t2[(vt1)/x] e (t1, t2) = case e of (e1, e2) -> (e1 t1, e2 t2) e Any = UNR related to [Findler-Felleisen:ICFP02]
12
Wrappers and ( pronounced ensures pronounced requires)
e {x | p} = case p[e/x] of True -> e False -> UNR e x:t1 -> t2 = v. (e (v t1)) t2[v t1/x] e (t1, t2) = case e of (e1, e2) -> (e1 t1, e2 t2) e Any = BAD The tag for BAD is a bit sudden, but the gist of contract checking is to blame the right function. related to [Findler-Felleisen:ICFP02]
13
Some Interesting Details
Theory Practice Contracts that loop Contracts that crash Lovely Lemmas Adding tags, e.g. BAD “f” Achieves precise blaming More tags to trace functions to blame Achieves the same goal of [Meunier:POPL06] Using a theorem prover Counter-example guided unrolling
14
Lovely Lemmas
15
Summary Static contract checking is a fertile and under-researched area Distinctive features of our approach Full Haskell in contracts; absolutely crucial Declarative specification of “satisfies” Nice theory (with some very tricky corners) Static proofs Modular Checking Compiler as theorem prover
16
After Ph.D. Postdoc project in 2009: probabilistic contract for component base design [ATVA’2010] Current project at Xavier Leroy’s team (INRIA) - a verifying compiler: 1. Apply the idea to OCaml compiler by allowing both static and dynamic contract checking 2. Connect with Coq to verify more programs statically. 3. Use Coq to prove the correctness of the framework. 4. Apply new ideas back to Haskell (e.g. GHC).
17
Static and Dynamic Program with Specifications
checking Dynamic checking Compile time error attributes blame to the right place Run time error attributes blame to the right place No blaming means Program cannot crashs Or, more plausibly: If you guarantee that f t, then the program cannot crash
19
What exactly does it mean e “satisfies” contract t?
to say that e “satisfies” contract t? e t
20
When does e satisfy a contract?
Brief, declarative… e satisfies a contract iff this condition holds. Mention example before explain function contract satisfaction. Talk about contract function and tuple briefly, then emphasize predicate contract. inc x:{x | x > 0} -> {y | y == x + 1} Postcondition can mention argument Precondition Postcondition
21
When does e satisfy a contract?
The delicate one is the predicate contract. Our decision: e {x | p} iff e is crash-free Question: What expression is crash-free ? e is crash-free iff no blameless context can make e crash e is crash-free iff C. BAD s C. C[e] * BAD
22
Crash-free Examples Lemma:
\x -> x YES (1, True) (1, BAD) NO \x -> if x > 0 then x else (BAD, x) \x -> if x*x >= 0 then x + 1 else BAD Hmm.. YES Lemma: e is syntactically safe => e is crash-free.
23
When does e satisfy a contract?
See the paper for … Why e must be crash-free to satisfy predicate contract? Why divergent expression satisfies all contract? What if contract diverges (i.e. p diverges)? What if contract crashes (i.e. p crashes)? Talk about contract function and tuple briefly, then emphasize predicate contract.
24
How can we mechanically check that e “satisfies” contract t?
e t ???
25
Example e Ok = e head { xs | not (null xs) } -> Ok
head:: [a] -> a head [] = BAD head (x:xs) = x head { xs | not (null xs) } -> Ok head {xs | not (null xs)} -> Ok = \v. head (v {xs | not (null xs)}) Ok e Ok = e = \v. head (v {xs | not (null xs)}) = \v. head (case not (null v) of True -> v False -> UNR)
26
So head [] fails with UNR, not BAD, blaming the caller
null :: [a] -> Bool null [] = True null (x:xs) = False not :: Bool -> Bool not True = False not False = True \v. head (case not (null v) of True -> v False -> UNR) Now inline ‘not’ and ‘null’ = \v. head (case v of [] -> UNR (p:ps) -> p) Now inline ‘head’ head:: [a] -> a head [] = BAD head (x:xs) = x = \v. case v of [] -> UNR (p:ps) -> p So head [] fails with UNR, not BAD, blaming the caller
27
Static and Dynamic Program with Specifications
[Flanaghan, Mitchell, Pottier] [Findler, Felleisen, Blume, Hinze, Loh, Runciman, Chitil] Program with Specifications Static checking Dynamic checking Compile time error attributes blame to the right place Run time error attributes blame to the right place
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.