@@ -356,12 +356,12 @@ \section{Evolving WebAssembly}
356
356
integrated into the WebAssembly specification; as of the time of this writing
357
357
only five proposals have done so\cite {FinishedProposals }.
358
358
The first such proposal was standardized relatively early in WebAssembly's
359
- life---prior even to the initial 1.0 release---with the mutable globals
360
- proposal \cite {MutableGlobalProposal } on June 6,
359
+ life---prior even to the initial 1.0 release---with the Mutable Globals
360
+ Proposal \cite {MutableGlobalProposal } on June 6,
361
361
2018\cite {MeetingNotes2018 -06 -06 }.
362
- The multi -value proposal , which was in phase 4 at the time of the original
363
- mechanization and already included in it, and the non-trapping float -to-int and
364
- sign-extension operators proposals mechanized in this project were all
362
+ The Multi -value Proposal , which was in phase 4 at the time of the original
363
+ mechanization and already included in it, and the Non-Trapping Float -to-Int and
364
+ Sign-Extension Operators proposals mechanized in this project were all
365
365
integrated at once on March 11, 2020\cite {MeetingNotes2020 -03 -11 }.
366
366
Finally, the JavaScript BigInt to WebAssembly i64 Integration
367
367
proposal\cite {JSBigIntProposal }, a proposal which does not modify
@@ -581,7 +581,7 @@ \chapter{Incremental Soundness}
581
581
My project builds on the existing Isabelle proof, extending the initial
582
582
mechanization to include extensions provided by three late-stage proposals:
583
583
Non-trapping Float-to-Int Conversions\cite {NontrappingFloatToIntProposal },
584
- Sign Extension Operations \cite {SignExtensionOpsProposal },
584
+ Sign Extension Operators \cite {SignExtensionOpsProposal },
585
585
and Tail Call\cite {TailCallProposal }.
586
586
Definitions and proofs for the type checker and interpreter are also updated
587
587
accordingly.
@@ -629,22 +629,22 @@ \chapter{Incremental Soundness}
629
629
assertion being shown simply by \texttt {3 }, for example.
630
630
While the meaning of such names can be shown using an Isabelle command,
631
631
reading such a proof can quickly become confusing even to advanced users.
632
- Finally, such numeric indices can also cause issues when refactoring or
632
+ Finally, these numeric indices can also cause issues when refactoring or
633
633
adding to proofs, as in the case of my mechanization, where the definition
634
634
of a new instruction type causes all subsequent instruction types to have
635
635
their corresponding indices shifted accordingly.
636
636
Thus, it was common for me to have to adjust a reference from \texttt {14 }
637
637
to \texttt {15 } because of the newly-added rule \texttt {12 }, for example.
638
638
639
639
At the outset of my mechanization, two of the newly-mechanized proposals,
640
- non-trapping float -to-int conversions and sign extension operations ,
640
+ Non-Trapping Float -to-Int Conversions and Sign Extension Operators ,
641
641
were at phase 4.
642
642
After the mechanized proofs were completed as part of this project,
643
- they (along with the multi -value proposal already present in the initial
643
+ they (along with the Multi -value Proposal already present in the initial
644
644
mechanization), have advanced to phase 5 and were fully integrated
645
645
into version 1.1 of the WebAssembly specification as of April 9,
646
646
2020\cite {Phase5Advancement }.
647
- Tail call remains a phase 3 proposal currently in the implementation
647
+ Tail Call remains a phase 3 proposal currently in the implementation
648
648
phase\cite {WasmProposals }.
649
649
650
650
\section {Non-trapping Float-to-Int Conversions }
@@ -680,30 +680,24 @@ \section{Non-trapping Float-to-Int Conversions}
680
680
conversion operation that failed and trapped.
681
681
At a high level, the new \texttt {cvt\_ sat } saturating conversion function
682
682
behaves identically to the existing \texttt {cvt }, it simply fails in fewer
683
- cases.
684
- As a result, the required additions were straightforward to model based on the
685
- existing definition.
683
+ cases; as a result the required additions were straightforward to model based
684
+ on the existing definition.
686
685
Because the new instructions do not trap, I initially set out to model the
687
686
\texttt {cvt\_ sat } collection of operations so that they did not return an
688
687
\texttt {Option } and simply returned a value in all cases.
689
- This was a mistake, as \texttt {cvt } returns \texttt {None } not only
690
- when the conversion failed, but also when no such instruction exists
691
- to perform the conversion for the given types, such as a hypothetical
692
- conversion from an \texttt {f64 } to an \texttt {f64 }.
693
- In order for the new saturating conversion function to fit nicely
694
- into the existing mechanization, it must to be able to return \texttt {None }
695
- when the operation was impossible, such as converting to the same type as
696
- the original input type.
697
- After struggling to modify the surrounding proofs to handle such impossible
698
- conversions elsewhere, I decided on a different course and reverted
699
- \texttt {cvt\_ sat } to return an \texttt {Option } like the non-saturating
700
- version, but which always returns \texttt {Some } value when performing a
701
- truncation.
702
- This resulted in a straightforward addition of less resistance, which
703
- maintains language's proof of soundness without requiring drastic changes to
704
- the existing theorems and lemmas.
705
- During the mechanization of this proposal, 172 lines were added and 176
706
- modified; many such modifications being numeric index adjustments.
688
+ This was a mistake, in order for the new saturating conversion function to fit
689
+ nicely into the existing mechanization, it must to be able to return
690
+ \texttt {None } when the operation was impossible, such as converting to the same
691
+ type as the original input type.
692
+ After struggling to modify the surrounding proofs to handle impossible
693
+ conversions elsewhere, reverting \texttt {cvt\_ sat } to return an \texttt {Option }
694
+ like the non-saturating version, but which always returns \texttt {Some } value
695
+ when performing a truncation, resulted in a straightforward addition of less
696
+ resistance, maintaining the language's proof of soundness without requiring
697
+ drastic changes to the existing theorems and lemmas.
698
+ Overall, 172 lines were added and 176 lines were modified during the
699
+ mechanization of this proposal, many of the modifications being minor numeric
700
+ index adjustments accounting for the new rules.
707
701
708
702
\section {Sign Extension Operators }
709
703
@@ -771,9 +765,8 @@ \section{Sign Extension Operators}
771
765
that a sign-extension operation always either succeeds or results
772
766
in an error if the types are invalid, which Isabelle was able to prove
773
767
trivially by case analysis.
774
- Overall, 104 lines were added and 223 modified during the mechanization of this
775
- proposal, many of the modifications being minor numeric index adjustments
776
- accounting for the new rules.
768
+ During the mechanization of this proposal 104 lines were added and 223
769
+ modified, many modifications being minor numeric index adjustments.
777
770
778
771
\section {Tail Call }
779
772
@@ -866,16 +859,15 @@ \section{Tail Call}
866
859
This mistake was brought to the attention of the maintainers and was fixed
867
860
shortly thereafter\cite {TailInvokeIssue10 }.
868
861
869
- While the oversight was relatively minor in terms of size, only a single
870
- letter's difference, finding otherwise easily-overlooked mistakes is one of the
871
- primary strengths of mechanization in proofs, as mentioned earlier in this
872
- document.
873
- Whereas the human eye can easily disregard a small typo or gloss over that
874
- seems obvious, proof assistants insist that everything be proved without a
862
+ Despite the oversights relatively minor size, only a single letter's
863
+ difference, finding otherwise easily-overlooked mistakes is one of the primary
864
+ strengths of mechanization in proofs as mentioned earlier in this document;
865
+ while the human eye can easily disregard a small typo or gloss over something
866
+ that seems obvious, proof assistants insist that everything be proved without a
875
867
doubt.
876
- While this typo may have been caught by a reviewer before being fully adopted
877
- into the official language specification, the statement existed in its
878
- incorrect state for over two years, since its initial
868
+ This typo may have been caught by a reviewer before being fully adopted into
869
+ the official language specification, though the statement existed in its
870
+ incorrect state for over two years, since the proposal's initial
879
871
authoring\cite {TailInvokeTypoHistory }.
880
872
881
873
\chapter {Related Work }
@@ -913,14 +905,15 @@ \chapter{Related Work}
913
905
Notable features of the language include its novel ownership and borrowing
914
906
lifetime model for references and their valid lifetimes, and its composable
915
907
trait-based inheritance scheme.
916
- Like JSCert, the full language is too massive of an undertaking to be
908
+ Like with JSCert, the full language is too massive of an undertaking to be
917
909
implemented at once---in fact, no full language specification even exists to
918
910
use as a starting point---so the authors reduced the language to a
919
911
continuation-passing style language that includes the core lifetime features
920
912
mentioned above named $ \lambda _{\textrm {Rust}}$ .
921
- Iris\cite {Iris }, a `` Higher-Order Concurrent Separation Logic Framework, implemented and
922
- verified in the Coq proof assistant'' provides built-in support for ownership
923
- reasoning, making it a fitting choice for a proof assistant for this task.
913
+ Iris\cite {Iris }, a `` Higher-Order Concurrent Separation Logic Framework,
914
+ implemented and verified in the Coq proof assistant'' provides built-in support
915
+ for ownership reasoning, making it a fitting choice for a proof assistant for
916
+ this task.
924
917
\citeauthor {RustBeltRelaxed } extended this work, accounting for relaxed-memory
925
918
operations in use by concurrent Rust programs\cite {RustBeltRelaxed }.
926
919
@@ -978,15 +971,16 @@ \chapter{Conclusion}
978
971
infancy and becoming familiar with its evolution process will be of immense
979
972
benefit to me as a web developer as the language and ecosystem matures.
980
973
On a higher level, my efforts in understanding and modeling a language
981
- specification and its type system and proving its soundness has given me a
974
+ specification and its type system and proving its soundness have given me a
982
975
deeper understanding of programming language design and type theory as a whole.
983
976
Small details in an instruction's execution or typing rules often have large
984
- implications when the program is checked or executed.
977
+ implications when the program is validated or executed.
978
+
985
979
Even for a rather simple language like WebAssembly with its four primitive
986
980
types, small instruction set, and straightforward memory and execution models,
987
- issues can quickly arise and soundness is lost if a language feature is modeled
988
- even slightly incorrectly---for example when asserting that an incorrect number
989
- of values are present.
981
+ issues can quickly arise and soundness can be lost if a language feature is
982
+ modeled even slightly incorrectly---for example when asserting that an
983
+ incorrect number of values are present.
990
984
Ensuring soundness and proper execution is critical when designing a language
991
985
so that it holds the properties that it claims to: the type system will prevent
992
986
bugs and the language will do what the programmer tells it to.
@@ -996,8 +990,6 @@ \chapter{Conclusion}
996
990
Proof mechanization is one way to ease this burden, providing language
997
991
authors a more foolproof way to keep their promises to their users.
998
992
999
- % \appendix
1000
-
1001
993
\clearpage
1002
994
1003
995
\bibliography {thesis,wasm-cg,proof-assistants}
0 commit comments