1. 31 Oct, 2018 2 commits
    • Robbert Krebbers's avatar
      Fine-grained post-conditions for forked-off threads. · ebf06f91
      Robbert Krebbers authored
      This commit extends the state interpretation with an additional parameter to
      talk about the number of forked-off threads, and a fixed postcondition for each
      forked-off thread:
          state_interp : Λstate → list Λobservation → nat → iProp Σ;
          fork_post : iProp Σ;
      This way, instead of having `True` as the post-condition of `Fork`, one can
      have any post-condition, which is then recorded in the state interpretation.
      The point of keeping track of the postconditions of forked-off threads, is that
      we get an (additional) stronger adequacy theorem:
          Theorem wp_strong_all_adequacy Σ Λ `{invPreG Σ} s e σ1 v vs σ2 φ :
             (∀ `{Hinv : invG Σ} κs,
               (|={⊤}=> ∃
                   (stateI : state Λ → list (observation Λ) → nat → iProp Σ)
                   (fork_post : iProp Σ),
                 let _ : irisG Λ Σ := IrisG _ _ _ Hinv stateI fork_post in
                 stateI σ1 κs 0 ∗ WP e @ s; ⊤ {{ v,
                   let m := length vs in
                   stateI σ2 [] m -∗ [∗] replicate m fork_post ={⊤,∅}=∗ ⌜ φ v ⌝ }})%I) →
            rtc erased_step ([e], σ1) (of_val <$> v :: vs, σ2) →
            φ v.
      The difference with the ordinary adequacy theorem is that this one only applies
      once all threads terminated. In this case, one gets back the post-conditions
      `[∗] replicate m fork_post` of all forked-off threads.
      In Iron we showed that we can use this mechanism to make sure that all
      resources are disposed of properly in the presence of fork-based concurrency.
    • Jacques-Henri Jourdan's avatar
      Get rid of useless IntoVal uses. · 3c5086b2
      Jacques-Henri Jourdan authored
  2. 29 Oct, 2018 3 commits
    • Jacques-Henri Jourdan's avatar
      wp_pures. · 2950fca6
      Jacques-Henri Jourdan authored
    • Robbert Krebbers's avatar
      Move `Atomic`, `IntoVal` and `AsVal` instances to lifting. · 2b23e75f
      Robbert Krebbers authored
      Other heap_lang related instances in that file too. Now, the tactics
      file only contains stuff related to actual tactics.
    • Jacques-Henri Jourdan's avatar
      A specific constructor for injecting values in expressions · 9646293e
      Jacques-Henri Jourdan authored
      We add a specific constructor to the type of expressions for injecting
      values in expressions.
      The advantage are :
      - Values can be assumed to be always closed when performing
        substitutions (even though they could contain free variables, but it
        turns out it does not cause any problem in the proofs in
        practice). This means that we no longer need the `Closed` typeclass
        and everything that comes with it (all the reflection-based machinery
        contained in tactics.v is no longer necessary). I have not measured
        anything, but I guess this would have a significant performance
      - There is only one constructor for values. As a result, the AsVal and
        IntoVal typeclasses are no longer necessary: an expression which is
        a value will always unify with `Val _`, and therefore lemmas can be
        stated using this constructor.
      Of course, this means that there are two ways of writing such a thing
      as "The pair of integers 1 and 2": Either by using the value
      constructor applied to the pair represented as a value, or by using
      the expression pair constructor. So we add reduction rules that
      transform reduced pair, injection and closure expressions into values.
      At first, this seems weird, because of the redundancy. But in fact,
      this has some meaning, since the machine migth actually be doing
      something to e.g., allocate the pair or the closure.
      These additional steps of computation show up in the proofs, and some
      additional wp_* tactics need to be called.
  3. 18 Oct, 2018 4 commits
  4. 05 Oct, 2018 7 commits
  5. 04 Oct, 2018 1 commit
  6. 28 Jun, 2018 1 commit
    • Ralf Jung's avatar
      Make CAS slightly more realistic · 53216eb5
      Ralf Jung authored
      This restricts CAS to only be able to compare literals with literals, NONEV with NONEV and NONEV with SOMEV for a literal.
  7. 18 Jun, 2018 2 commits
  8. 18 May, 2018 1 commit
  9. 03 Mar, 2018 1 commit
  10. 13 Jan, 2018 1 commit
  11. 07 Dec, 2017 1 commit
  12. 05 Dec, 2017 1 commit
  13. 23 Nov, 2017 1 commit
  14. 09 Nov, 2017 4 commits
  15. 08 Nov, 2017 2 commits
  16. 01 Nov, 2017 3 commits
  17. 30 Oct, 2017 1 commit
  18. 04 Oct, 2017 2 commits
  19. 26 Sep, 2017 1 commit
    • Robbert Krebbers's avatar
      Fix issue #98. · e17ac4ad
      Robbert Krebbers authored
      We used to normalize the goal, and then checked whether it was of
      a certain shape. Since `uPred_valid P` normalized to `True ⊢ P`,
      there was no way of making a distinction between the two, hence
      `True ⊢ P` was treated as `uPred_valid P`.
      In this commit, I use type classes to check whether the goal is of
      a certain shape. Since we declared `uPred_valid` as `Typeclasses
      Opaque`, we can now make a distinction between `True ⊢ P` and
      `uPred_valid P`.
  20. 25 Sep, 2017 1 commit