rocq/theories/Sites.v
Where a name is defined, and what definitions_dominate/3 says of its uses (formal.md, Campaign 3; rocq.md, Where a name is defined).
ir.pl reads a function's definitions twice: as the list of definitions single_definitions/3 filters (Validate.v's all_defs), and as the definition sites block_sites//1 records for the strict SSA check (temp_sites). The run-level invariant needs both at once: the relation a single definition states holds wherever its site dominates the running point. This file joins the two through one list of every definition with its site, def_positions.
Decisions
| Decision | Why |
|---|---|
positions are sites, the validator's own | site_dominates/4 is then the order the invariant uses, with no second notion of position |
def_positions is a new list, proved equal to all_defs without sites | Validate.v, the transcription the gates compare, stays as it is |
| a single definition is unique by counting | single_definitions/3 keeps a name defined once in the list; two positions would be two entries |
Every definition with its site
The definitions the instructions is make in the block labelled l, the first at index j: each name an instruction defines, with its site at the instruction's index and the instruction as its definition.
Every definition of the function f with its site: its parameters at SParam, then each block's block_positions. The one list that joins the two ways the validator reads definitions.
Forgets the site of a definition, leaving the pair of a name and its definition that all_defs lists.
Without their sites, the definitions inst_positions lists for some instructions are those all_defs lists for them, whatever the label and first index.
Explore proof 6 tactics
Initial goal
intros l j is
revert j
induction is as | i rest IH ; intros j ; reflexivity |
simpl
rewrite map_app , IHj + 1 , map_map
reflexivity
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
all_defs, Validate.v's list of every definition that single_definitions/3 filters, is def_positions without the sites.
Explore proof 14 tactics
Initial goal
intros f
unfold all_defs , def_positions
rewrite map_app , map_map
f_equal
induction fn_blocksf as | b bs IH ; reflexivity |
simpl
rewrite map_app , <- IH
f_equal
unfold block_positions
rewrite map_app , map_map , <- inst_positions_defsb_labelb 0
f_equal
apply map_ext
intros d k pairs
reflexivity
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
The sites temp_sites records
A map m from each name to sites is sound for the function f when every site it records for a name n is a position of def_positions that defines n.
Records the site s for the name n in front of n's list in m, as temp_sites does.
Recording a site s for n keeps the map sound when s is the position of some definition of n in f.
Explore proof 10 tactics
Initial goal
intros f m n s d Hm Hd k ss s′ E Hin
unfold add_site in E
rewrite nm_find_add in E
destruct name_eqbk n eqn: Ek
2 open–apply name_eqb_true in Ek
2 opensubst k
2 openinjection E as ←
2 opendestruct Hin as ← | Hin ; eauto |
2 opendestruct nm_findn m as ss0 | eqn: E0 ; exact Hm_ _ _ E0 Hin | destruct Hin
–exact Hm_ _ _ E Hin
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Recording a list of sites, the name and site g gives each element of xs, keeps the map sound when each is the position of some definition in f.
Explore proof 6 tactics
Initial goal
intros A f g xs
induction xs as | x xs IH ; intros m Hm Hx ; exact Hm |
simpl
apply IH ; | intros y Hy ; apply Hx ; right ; exact Hy
destruct Hxx or_introleq_refl as d Hd
exact add_site_ok_ _ _ _ _ Hm Hd
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
The fold temp_sites makes over the instructions is of the block labelled l, from index j, keeps the map sound when every position inst_positions lists for them is one of f's.
Explore proof 14 tactics
Initial goal
intros f l is
induction is as | i rest IH ; intros j m Hm Hp ; exact Hm |
simpl
apply IH ; | intros t Ht ; apply Hp ; simpl ; apply in_or_app ; right ; exact Ht
apply fold_sites_ok_ f λdk ⇒ fstdk, SAtl j ; exact Hm |
intros dk Hdk
exists DInsti
apply Hp
simpl
apply in_or_app
left
apply in_map_iff
exists dk
auto
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Every site block_sites//1 records for a name n in temp_sites, the sites the validator's strict SSA check reads, is a position of def_positions that defines n.
Proof 46 steps Qed
A single definition has one position
Filtering a mapped list keeps as many elements as filtering the list by the test composed with the map.
Explore proof 3 tactics
Initial goal
intros A B p g l
induction l as | x l IH ; simpl ; reflexivity |
destruct pgx ; simpl ; auto
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
A name n that single_definitions/3 keeps, with its definition d, has exactly one position in def_positions, and that position holds d.
Explore proof 32 tactics
Initial goal
intros f n d H
destruct lookup_some_in_ _ _ _ H as n′ & En & Hin
apply name_eqb_true in En
subst n′
unfold single_definitions in Hin
apply filter_In in Hin as Hall Hcount
apply Nat.eqb_eq in Hcount
simpl in Hcount
rewrite all_defs_positions in Hall , Hcount
rewrite filter_map_length in Hcount
apply in_map_iff in Hall as n0 s d0 & Ed & Hs
unfold drop_site in Ed
simpl in Ed
injection Ed as → →
set L := filterλt ⇒ name_eqbn fstdrop_sitet def_positionsf in Hcount
assert HL : ∀s′ d′, Inn, s′, d′ def_positionsf → Inn, s′, d′ L
2 openfocused goal
{intros s′ d′ Hs′
2 opendeferred goal
apply filter_In
2 opendeferred goal
split ; exact Hs′ |
2 opendeferred goal
apply name_eqb_true
2 opendeferred goal
reflexivity
deferred goal
exists s
split ; exact Hs |
intros s′ d′ Hs′
pose proof HL_ _ Hs as H1
pose proof HL_ _ Hs′ as H2
destruct L as | t | t′ L′ ; simpl in Hcount ; try discriminate Hcount
destruct H1 as E1 |
destruct H2 as E2 |
rewrite E1 in E2
injection E2 as E3 E4
auto
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
A use is dominated by its single definition
In a function f whose definitions dominate their uses (definitions_dominate), a name o with a single definition d that the instruction at place k of a reachable block b uses is defined at a site that dominates that place (site_dominates).
Proof 30 steps Qed
Positions and instructions
name_eqb is symmetric.
Explore proof 10 tactics
Initial goal
intros a b
destruct name_eqba b eqn: E ; symmetry
2 open–apply name_eqb_true in E
2 opensubst
2 openapply name_eqb_true
2 openreflexivity
–apply name_eqb_false
intros →
apply name_eqb_false in E
exact Eeq_refl
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
A position that inst_positions lists for the instructions is of the block labelled l, from index j, is that of some instruction i at place k of is, at index j + k, and names a temporary i defines.
Explore proof 18 tactics
Initial goal
intros l j is
revert j
induction is as | i rest IH ; intros j n s d H ; destruct H |
simpl in H
apply in_app_or in H as H | H
2 openfocused goal
–apply in_map_iff in H as dk & E & Hdk
2 opendeferred goal
injection E as ← ← ←
2 opendeferred goal
exists O, i
2 opendeferred goal
split ; reflexivity |
2 opendeferred goal
split ; replace j + Z.of_nat0 with j by lia ; reflexivity |
2 opendeferred goal
split ; reflexivity |
2 opendeferred goal
apply in_map
2 opendeferred goal
exact Hdk
deferred goal
–destruct IH_ _ _ _ H as k & i′ & Hk & → & → & Hn
exists Sk, i′
split ; exact Hk |
split ; replace j + Z.of_natSk with j + 1 + Z.of_natk by lia ; reflexivity |
auto
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Conversely, inst_positions lists each temporary dk that the instruction i at place k of is defines, at index j + k.
Explore proof 16 tactics
Initial goal
intros l j is
revert j
induction is as | i0 rest IH ; intros j k i dk Hk Hdk ; destruct k ; discriminate Hk |
simpl
apply in_or_app
destruct k as | k ; simpl in Hk
2 openfocused goal
–injection Hk as ←
2 opendeferred goal
left
2 opendeferred goal
apply in_map_iff
2 opendeferred goal
exists dk
2 opendeferred goal
split ; | exact Hdk
2 opendeferred goal
replace j + Z.of_nat0 with j by lia
2 opendeferred goal
reflexivity
deferred goal
–right
replace j + Z.of_natSk with j + 1 + Z.of_natk by lia
exact IH_ _ _ _ Hk Hdk
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
A position of f at index j of the block labelled d, holding the instruction i, comes from a block of f labelled d whose instruction at place j is i, and i defines the name.
Explore proof 18 tactics
Initial goal
intros f n d j i H
unfold def_positions in H
apply in_app_or in H as H | H
2 open–apply in_map_iff in H as p & E & _
2 opendiscriminate E
–apply in_flat_map in H as b & Hb & H
unfold block_positions in H
apply in_app_or in H as H | H
2 open+apply in_map_iff in H as d′ k′ pairs & E & _
2 opendiscriminate E
+destruct inst_positions_in_ _ _ _ _ _ H as k & i′ & Hk & Es & Ed & Hn
injection Es as Ed′ Ej
injection Ed as ←
exists b, k
split ; exact Hb |
split ; exact eq_symEd′ |
split ; exact Hk |
split ; lia | exact Hn
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
The instruction i at place k of a block b of f defines each of its temporaries dk at index k of b.
Explore proof 11 tactics
Initial goal
intros f b k i dk Hb Hk Hdk
unfold def_positions
apply in_or_app
right
apply in_flat_map
exists b
split ; exact Hb |
unfold block_positions
apply in_or_app
right
exact inst_positions_nth_ 0 _ _ _ _ Hk Hdk
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
A phi of a block b of f defines its name d at index -1 of b.
Explore proof 13 tactics
Initial goal
intros f b d k pairs Hb Hp
unfold def_positions
apply in_or_app
right
apply in_flat_map
exists b
split ; exact Hb |
unfold block_positions
apply in_or_app
left
apply in_map_iff
exists Phid k pairs
auto
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
A single definition's operands are not redefined under it
Where dominance between blocks is antisymmetric, as dom_antisym gives, a site s that dominates index j of the block labelled d, where d at j dominates index k of the block labelled l, is not index k of l itself.
Explore proof 9 tactics
Initial goal
intros doms Hanti d j l k s H1 H2 →
unfold site_dominates in H1 , H2
rewrite name_eqb_sym_dl d in H1
destruct name_eqbd l eqn: E
2 open–apply Z.ltb_lt in H1
2 openapply Z.ltb_lt in H2
2 openlia
–apply name_eqb_false in E
exact Eeq_symHanti_ _ H1 H2
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
In a function f whose definitions dominate their uses, where the single definition of n by the instruction i, at index j of block d, dominates index k of a reachable block l, no operand x of i that has a single definition is defined at that index. So defining a name at a point leaves every relation in scope there between a definition and its operands' values as it was.
Explore proof 17 tactics
Initial goal
intros f b0 rest doms n d j i x l k D Hf Hdoms Hdd Hn Hpos Hr Hsd Hx Honce Hu
destruct position_inst_ _ _ _ _ Hpos as b & kk & Hb & Hl & Hkk & → & _
assert Hrd : is_reachabledoms d = true
2 openfocused goal
{unfold site_dominates in Hsd
2 opendeferred goal
destruct name_eqbd l eqn: E
3 openfocused goal
deferred goal
–apply name_eqb_true in E
3 opendeferred goal
deferred goal
subst
3 opendeferred goal
deferred goal
exact Hr
2 opendeferred goal
deferred goal
–exact proj1dominates_reachable_ _ _ Hdoms _ _ Hsd
deferred goal
unfold once_has in Honce
destruct lookupx single_definitionsf as dx | eqn: Ex ; | discriminate Honce
subst d
destruct use_dominated_ _ _ _ _ _ _ Hdd Hb Hrd Hkk Hu Ex as s & Hs & Hsdom
destruct once_position_ _ _ Ex as s0 & Hs0 & Huniq
destruct Huniq_ _ Hs as → _
destruct Huniq_ _ Hx as Esite _
exact site_strictdoms dom_antisym_ _ _ Hdoms _ _ _ _ _ Hsdom Hsd eq_symEsite
No remaining goals.
Qed
✓ Proof checked and closed by Rocq.
Source script
Definitions that dominate a point
The dominator intervals of the function f as the validator computed them (block_intervals), or the empty map where it computed none.
The single definition of n in f is at a site that dominates index k of the block labelled l, by the validator's intervals fn_doms.