src/HOL/MicroJava/BV/Correct.thy
author wenzelm
Sat Nov 01 14:20:38 2014 +0100 (2014-11-01)
changeset 58860 fee7cfa69c50
parent 55524 f41ef840f09d
child 58886 8a6cac7c7247
permissions -rw-r--r--
eliminated spurious semicolons;
nipkow@8011
     1
(*  Title:      HOL/MicroJava/BV/Correct.thy
kleing@12516
     2
    Author:     Cornelia Pusch, Gerwin Klein
nipkow@8011
     3
    Copyright   1999 Technische Universitaet Muenchen
nipkow@8011
     4
*)
nipkow@8011
     5
kleing@12911
     6
header {* \isaheader{BV Type Safety Invariant} *}
kleing@9757
     7
haftmann@33954
     8
theory Correct
haftmann@33954
     9
imports BVSpec "../JVM/JVMExec"
haftmann@33954
    10
begin
nipkow@8011
    11
haftmann@35416
    12
definition approx_val :: "[jvm_prog,aheap,val,ty err] \<Rightarrow> bool" where
kleing@13006
    13
  "approx_val G h v any == case any of Err \<Rightarrow> True | OK T \<Rightarrow> G,h\<turnstile>v::\<preceq>T"
nipkow@8011
    14
haftmann@35416
    15
definition approx_loc :: "[jvm_prog,aheap,val list,locvars_type] \<Rightarrow> bool" where
kleing@10056
    16
  "approx_loc G hp loc LT == list_all2 (approx_val G hp) loc LT"
kleing@10056
    17
haftmann@35416
    18
definition approx_stk :: "[jvm_prog,aheap,opstack,opstack_type] \<Rightarrow> bool" where
kleing@10496
    19
  "approx_stk G hp stk ST == approx_loc G hp stk (map OK ST)"
kleing@9757
    20
haftmann@35416
    21
definition correct_frame  :: "[jvm_prog,aheap,state_type,nat,bytecode] \<Rightarrow> frame \<Rightarrow> bool" where
kleing@10056
    22
  "correct_frame G hp == \<lambda>(ST,LT) maxl ins (stk,loc,C,sig,pc).
kleing@10056
    23
                         approx_stk G hp stk ST  \<and> approx_loc G hp loc LT \<and> 
kleing@10056
    24
                         pc < length ins \<and> length loc=length(snd sig)+maxl+1"
nipkow@8011
    25
haftmann@35416
    26
primrec correct_frames  :: "[jvm_prog,aheap,prog_type,ty,sig,frame list] \<Rightarrow> bool" where
haftmann@35416
    27
  "correct_frames G hp phi rT0 sig0 [] = True"
haftmann@35416
    28
| "correct_frames G hp phi rT0 sig0 (f#frs) =
haftmann@35416
    29
    (let (stk,loc,C,sig,pc) = f in
haftmann@35416
    30
    (\<exists>ST LT rT maxs maxl ins et.
haftmann@35416
    31
      phi C sig ! pc = Some (ST,LT) \<and> is_class G C \<and> 
haftmann@35416
    32
      method (G,C) sig = Some(C,rT,(maxs,maxl,ins,et)) \<and>
haftmann@35416
    33
    (\<exists>C' mn pTs. ins!pc = (Invoke C' mn pTs) \<and> 
haftmann@35416
    34
           (mn,pTs) = sig0 \<and> 
haftmann@35416
    35
           (\<exists>apTs D ST' LT'.
haftmann@35416
    36
           (phi C sig)!pc = Some ((rev apTs) @ (Class D) # ST', LT') \<and>
haftmann@35416
    37
           length apTs = length pTs \<and>
haftmann@35416
    38
           (\<exists>D' rT' maxs' maxl' ins' et'.
haftmann@35416
    39
             method (G,D) sig0 = Some(D',rT',(maxs',maxl',ins',et')) \<and>
haftmann@35416
    40
             G \<turnstile> rT0 \<preceq> rT') \<and>
haftmann@35416
    41
     correct_frame G hp (ST, LT) maxl ins f \<and> 
haftmann@35416
    42
     correct_frames G hp phi rT sig frs))))"
nipkow@8011
    43
haftmann@35416
    44
definition correct_state :: "[jvm_prog,prog_type,jvm_state] \<Rightarrow> bool"
haftmann@35416
    45
                  ("_,_ |-JVM _ [ok]"  [51,51] 50) where
kleing@10042
    46
"correct_state G phi == \<lambda>(xp,hp,frs).
nipkow@8011
    47
   case xp of
kleing@13006
    48
     None \<Rightarrow> (case frs of
kleing@13006
    49
             [] \<Rightarrow> True
kleing@13006
    50
             | (f#fs) \<Rightarrow> G\<turnstile>h hp\<surd> \<and> preallocated hp \<and> 
kleing@12516
    51
      (let (stk,loc,C,sig,pc) = f
kleing@12516
    52
             in
kleing@12516
    53
                         \<exists>rT maxs maxl ins et s.
kleing@10625
    54
                         is_class G C \<and>
kleing@12516
    55
                         method (G,C) sig = Some(C,rT,(maxs,maxl,ins,et)) \<and>
kleing@9757
    56
                         phi C sig ! pc = Some s \<and>
kleing@12516
    57
       correct_frame G hp s maxl ins f \<and> 
kleing@12516
    58
             correct_frames G hp phi rT sig fs))
kleing@13006
    59
   | Some x \<Rightarrow> frs = []" 
kleing@9757
    60
kleing@9757
    61
wenzelm@35355
    62
notation (xsymbols)
wenzelm@35355
    63
 correct_state  ("_,_ \<turnstile>JVM _ \<surd>"  [51,51] 50)
kleing@10060
    64
kleing@11252
    65
kleing@11252
    66
lemma sup_ty_opt_OK:
kleing@11252
    67
  "(G \<turnstile> X <=o (OK T')) = (\<exists>T. X = OK T \<and> G \<turnstile> T \<preceq> T')"
wenzelm@52998
    68
  by (cases X) auto
kleing@11252
    69
kleing@11252
    70
kleing@11085
    71
section {* approx-val *}
kleing@9757
    72
kleing@11252
    73
lemma approx_val_Err [simp,intro!]:
kleing@9757
    74
  "approx_val G hp x Err"
kleing@11252
    75
  by (simp add: approx_val_def)
kleing@9757
    76
kleing@11252
    77
lemma approx_val_OK [iff]: 
kleing@11252
    78
  "approx_val G hp x (OK T) = (G,hp \<turnstile> x ::\<preceq> T)"
kleing@11252
    79
  by (simp add: approx_val_def)
kleing@9757
    80
kleing@11252
    81
lemma approx_val_Null [simp,intro!]:
kleing@11252
    82
  "approx_val G hp Null (OK (RefT x))"
kleing@11252
    83
  by (auto simp add: approx_val_def)
kleing@9757
    84
kleing@11252
    85
lemma approx_val_sup_heap:
kleing@11252
    86
  "\<lbrakk> approx_val G hp v T; hp \<le>| hp' \<rbrakk> \<Longrightarrow> approx_val G hp' v T"
kleing@11252
    87
  by (cases T) (blast intro: conf_hext)+
kleing@9757
    88
kleing@11252
    89
lemma approx_val_heap_update:
kleing@13006
    90
  "\<lbrakk> hp a = Some obj'; G,hp\<turnstile> v::\<preceq>T; obj_ty obj = obj_ty obj'\<rbrakk> 
kleing@13006
    91
  \<Longrightarrow> G,hp(a\<mapsto>obj)\<turnstile> v::\<preceq>T"
wenzelm@52998
    92
  by (cases v) (auto simp add: obj_ty_def conf_def)
kleing@9757
    93
kleing@11252
    94
lemma approx_val_widen:
kleing@11252
    95
  "\<lbrakk> approx_val G hp v T; G \<turnstile> T <=o T'; wf_prog wt G \<rbrakk>
kleing@11252
    96
  \<Longrightarrow> approx_val G hp v T'"
wenzelm@52998
    97
  by (cases T') (auto simp add: sup_ty_opt_OK intro: conf_widen)
kleing@9757
    98
kleing@11085
    99
section {* approx-loc *}
kleing@9757
   100
kleing@11252
   101
lemma approx_loc_Nil [simp,intro!]:
kleing@11252
   102
  "approx_loc G hp [] []"
kleing@11252
   103
  by (simp add: approx_loc_def)
kleing@11252
   104
kleing@9757
   105
lemma approx_loc_Cons [iff]:
kleing@11252
   106
  "approx_loc G hp (l#ls) (L#LT) = 
kleing@11252
   107
  (approx_val G hp l L \<and> approx_loc G hp ls LT)"
kleing@9757
   108
by (simp add: approx_loc_def)
kleing@9757
   109
kleing@11252
   110
lemma approx_loc_nth:
kleing@11252
   111
  "\<lbrakk> approx_loc G hp loc LT; n < length LT \<rbrakk>
kleing@11252
   112
  \<Longrightarrow> approx_val G hp (loc!n) (LT!n)"
kleing@11252
   113
  by (simp add: approx_loc_def list_all2_conv_all_nth)
kleing@11252
   114
kleing@11252
   115
lemma approx_loc_imp_approx_val_sup:
kleing@11252
   116
  "\<lbrakk>approx_loc G hp loc LT; n < length LT; LT ! n = OK T; G \<turnstile> T \<preceq> T'; wf_prog wt G\<rbrakk> 
kleing@11252
   117
  \<Longrightarrow> G,hp \<turnstile> (loc!n) ::\<preceq> T'"
kleing@11252
   118
  apply (drule approx_loc_nth, assumption) 
kleing@11252
   119
  apply simp
kleing@11252
   120
  apply (erule conf_widen, assumption+)
kleing@11252
   121
  done
kleing@11252
   122
kleing@11252
   123
lemma approx_loc_conv_all_nth:
kleing@11252
   124
  "approx_loc G hp loc LT = 
kleing@11252
   125
  (length loc = length LT \<and> (\<forall>n < length loc. approx_val G hp (loc!n) (LT!n)))"
kleing@11252
   126
  by (simp add: approx_loc_def list_all2_conv_all_nth)
kleing@11252
   127
kleing@11252
   128
lemma approx_loc_sup_heap:
kleing@11252
   129
  "\<lbrakk> approx_loc G hp loc LT; hp \<le>| hp' \<rbrakk>
kleing@11252
   130
  \<Longrightarrow> approx_loc G hp' loc LT"
kleing@11252
   131
  apply (clarsimp simp add: approx_loc_conv_all_nth)
kleing@11252
   132
  apply (blast intro: approx_val_sup_heap)
kleing@11252
   133
  done
kleing@11252
   134
kleing@11252
   135
lemma approx_loc_widen:
kleing@11252
   136
  "\<lbrakk> approx_loc G hp loc LT; G \<turnstile> LT <=l LT'; wf_prog wt G \<rbrakk>
kleing@11252
   137
  \<Longrightarrow> approx_loc G hp loc LT'"
kleing@11252
   138
apply (unfold Listn.le_def lesub_def sup_loc_def)
kleing@11252
   139
apply (simp (no_asm_use) only: list_all2_conv_all_nth approx_loc_conv_all_nth)
kleing@11252
   140
apply (simp (no_asm_simp))
kleing@11252
   141
apply clarify
kleing@11252
   142
apply (erule allE, erule impE) 
kleing@11252
   143
 apply simp
kleing@11252
   144
apply (erule approx_val_widen)
kleing@11252
   145
 apply simp
kleing@11252
   146
apply assumption
kleing@10056
   147
done
kleing@9757
   148
kleing@13052
   149
lemma loc_widen_Err [dest]:
kleing@13052
   150
  "\<And>XT. G \<turnstile> replicate n Err <=l XT \<Longrightarrow> XT = replicate n Err"
kleing@13052
   151
  by (induct n) auto
kleing@13052
   152
  
kleing@13052
   153
lemma approx_loc_Err [iff]:
kleing@13052
   154
  "approx_loc G hp (replicate n v) (replicate n Err)"
kleing@13052
   155
  by (induct n) auto
kleing@13052
   156
kleing@11252
   157
lemma approx_loc_subst:
kleing@11252
   158
  "\<lbrakk> approx_loc G hp loc LT; approx_val G hp x X \<rbrakk>
kleing@11252
   159
  \<Longrightarrow> approx_loc G hp (loc[idx:=x]) (LT[idx:=X])"
blanchet@55524
   160
apply (unfold approx_loc_def list_all2_iff)
kleing@9757
   161
apply (auto dest: subsetD [OF set_update_subset_insert] simp add: zip_update)
kleing@10056
   162
done
kleing@9757
   163
kleing@11252
   164
lemma approx_loc_append:
kleing@11252
   165
  "length l1=length L1 \<Longrightarrow>
kleing@10056
   166
  approx_loc G hp (l1@l2) (L1@L2) = 
kleing@10056
   167
  (approx_loc G hp l1 L1 \<and> approx_loc G hp l2 L2)"
blanchet@55524
   168
  apply (unfold approx_loc_def list_all2_iff)
kleing@11252
   169
  apply (simp cong: conj_cong)
kleing@11252
   170
  apply blast
kleing@11252
   171
  done
kleing@9757
   172
kleing@11085
   173
section {* approx-stk *}
kleing@9757
   174
kleing@9757
   175
lemma approx_stk_rev_lem:
kleing@9757
   176
  "approx_stk G hp (rev s) (rev t) = approx_stk G hp s t"
kleing@11252
   177
  apply (unfold approx_stk_def approx_loc_def)
kleing@11252
   178
  apply (simp add: rev_map [THEN sym])
kleing@11252
   179
  done
kleing@9757
   180
kleing@9757
   181
lemma approx_stk_rev:
kleing@9757
   182
  "approx_stk G hp (rev s) t = approx_stk G hp s (rev t)"
kleing@11252
   183
  by (auto intro: subst [OF approx_stk_rev_lem])
kleing@9757
   184
kleing@11252
   185
lemma approx_stk_sup_heap:
kleing@11252
   186
  "\<lbrakk> approx_stk G hp stk ST; hp \<le>| hp' \<rbrakk> \<Longrightarrow> approx_stk G hp' stk ST"
kleing@11252
   187
  by (auto intro: approx_loc_sup_heap simp add: approx_stk_def)
kleing@9757
   188
kleing@11252
   189
lemma approx_stk_widen:
kleing@11252
   190
  "\<lbrakk> approx_stk G hp stk ST; G \<turnstile> map OK ST <=l map OK ST'; wf_prog wt G \<rbrakk>
kleing@11252
   191
  \<Longrightarrow> approx_stk G hp stk ST'" 
kleing@11252
   192
  by (auto elim: approx_loc_widen simp add: approx_stk_def)
kleing@9757
   193
kleing@9757
   194
lemma approx_stk_Nil [iff]:
kleing@9757
   195
  "approx_stk G hp [] []"
kleing@11252
   196
  by (simp add: approx_stk_def)
kleing@9757
   197
kleing@9757
   198
lemma approx_stk_Cons [iff]:
kleing@11252
   199
  "approx_stk G hp (x#stk) (S#ST) = 
kleing@11252
   200
  (approx_val G hp x (OK S) \<and> approx_stk G hp stk ST)"
kleing@11252
   201
  by (simp add: approx_stk_def)
kleing@9757
   202
kleing@9757
   203
lemma approx_stk_Cons_lemma [iff]:
kleing@9757
   204
  "approx_stk G hp stk (S#ST') = 
kleing@10496
   205
  (\<exists>s stk'. stk = s#stk' \<and> approx_val G hp s (OK S) \<and> approx_stk G hp stk' ST')"
kleing@11252
   206
  by (simp add: list_all2_Cons2 approx_stk_def approx_loc_def)
kleing@11252
   207
kleing@11252
   208
lemma approx_stk_append:
kleing@11252
   209
  "approx_stk G hp stk (S@S') \<Longrightarrow>
kleing@11252
   210
  (\<exists>s stk'. stk = s@stk' \<and> length s = length S \<and> length stk' = length S' \<and> 
kleing@11252
   211
            approx_stk G hp s S \<and> approx_stk G hp stk' S')"
kleing@11252
   212
  by (simp add: list_all2_append2 approx_stk_def approx_loc_def)
kleing@9757
   213
kleing@11252
   214
lemma approx_stk_all_widen:
berghofe@22271
   215
  "\<lbrakk> approx_stk G hp stk ST; \<forall>(x, y) \<in> set (zip ST ST'). G \<turnstile> x \<preceq> y; length ST = length ST'; wf_prog wt G \<rbrakk> 
kleing@11252
   216
  \<Longrightarrow> approx_stk G hp stk ST'"
kleing@11252
   217
apply (unfold approx_stk_def)
kleing@11252
   218
apply (clarsimp simp add: approx_loc_conv_all_nth all_set_conv_all_nth)
kleing@11252
   219
apply (erule allE, erule impE, assumption)
kleing@11252
   220
apply (erule allE, erule impE, assumption)
kleing@11252
   221
apply (erule conf_widen, assumption+)
kleing@11252
   222
done
kleing@9757
   223
kleing@11085
   224
section {* oconf *}
kleing@9757
   225
kleing@11252
   226
lemma oconf_field_update:
kleing@13006
   227
  "\<lbrakk>map_of (fields (G, oT)) FD = Some T; G,hp\<turnstile>v::\<preceq>T; G,hp\<turnstile>(oT,fs)\<surd> \<rbrakk>
kleing@13006
   228
  \<Longrightarrow> G,hp\<turnstile>(oT, fs(FD\<mapsto>v))\<surd>"
kleing@11252
   229
  by (simp add: oconf_def lconf_def)
kleing@9757
   230
kleing@11252
   231
lemma oconf_newref:
kleing@11252
   232
  "\<lbrakk>hp oref = None; G,hp \<turnstile> obj \<surd>; G,hp \<turnstile> obj' \<surd>\<rbrakk> \<Longrightarrow> G,hp(oref\<mapsto>obj') \<turnstile> obj \<surd>"
kleing@11252
   233
  apply (unfold oconf_def lconf_def)
kleing@11252
   234
  apply simp
kleing@11252
   235
  apply (blast intro: conf_hext hext_new)
kleing@11252
   236
  done
kleing@9757
   237
kleing@11252
   238
lemma oconf_heap_update:
kleing@11252
   239
  "\<lbrakk> hp a = Some obj'; obj_ty obj' = obj_ty obj''; G,hp\<turnstile>obj\<surd> \<rbrakk>
kleing@11252
   240
  \<Longrightarrow> G,hp(a\<mapsto>obj'')\<turnstile>obj\<surd>"
kleing@11252
   241
  apply (unfold oconf_def lconf_def)
nipkow@44890
   242
  apply (fastforce intro: approx_val_heap_update)
kleing@11252
   243
  done
kleing@9757
   244
kleing@11085
   245
section {* hconf *}
kleing@9757
   246
kleing@11252
   247
lemma hconf_newref:
kleing@11252
   248
  "\<lbrakk> hp oref = None; G\<turnstile>h hp\<surd>; G,hp\<turnstile>obj\<surd> \<rbrakk> \<Longrightarrow> G\<turnstile>h hp(oref\<mapsto>obj)\<surd>"
kleing@11252
   249
  apply (simp add: hconf_def)
kleing@11252
   250
  apply (fast intro: oconf_newref)
kleing@11252
   251
  done
kleing@9757
   252
kleing@11252
   253
lemma hconf_field_update:
kleing@11252
   254
  "\<lbrakk> map_of (fields (G, oT)) X = Some T; hp a = Some(oT,fs); 
kleing@11252
   255
     G,hp\<turnstile>v::\<preceq>T; G\<turnstile>h hp\<surd> \<rbrakk> 
kleing@11252
   256
  \<Longrightarrow> G\<turnstile>h hp(a \<mapsto> (oT, fs(X\<mapsto>v)))\<surd>"
kleing@11252
   257
  apply (simp add: hconf_def)
nipkow@44890
   258
  apply (fastforce intro: oconf_heap_update oconf_field_update 
kleing@11252
   259
                  simp add: obj_ty_def)
kleing@11252
   260
  done
kleing@9757
   261
kleing@12545
   262
section {* preallocated *}
kleing@12545
   263
kleing@12545
   264
lemma preallocated_field_update:
kleing@12545
   265
  "\<lbrakk> map_of (fields (G, oT)) X = Some T; hp a = Some(oT,fs); 
kleing@12545
   266
     G\<turnstile>h hp\<surd>; preallocated hp \<rbrakk> 
kleing@12545
   267
  \<Longrightarrow> preallocated (hp(a \<mapsto> (oT, fs(X\<mapsto>v))))"
kleing@12545
   268
  apply (unfold preallocated_def)
kleing@12545
   269
  apply (rule allI)
kleing@12545
   270
  apply (erule_tac x=x in allE)
kleing@12545
   271
  apply simp
kleing@12545
   272
  apply (rule ccontr)  
kleing@12545
   273
  apply (unfold hconf_def)
kleing@12545
   274
  apply (erule allE, erule allE, erule impE, assumption)
kleing@12545
   275
  apply (unfold oconf_def lconf_def)
kleing@12545
   276
  apply (simp del: split_paired_All)
kleing@12545
   277
  done  
kleing@12545
   278
kleing@12545
   279
kleing@13052
   280
lemma 
kleing@13052
   281
  assumes none: "hp oref = None" and alloc: "preallocated hp"
kleing@13052
   282
  shows preallocated_newref: "preallocated (hp(oref\<mapsto>obj))"
kleing@13052
   283
proof (cases oref)
kleing@13052
   284
  case (XcptRef x) 
wenzelm@52998
   285
  with none alloc have False by (auto elim: preallocatedE [of _ x])
kleing@13052
   286
  thus ?thesis ..
kleing@13052
   287
next
kleing@13052
   288
  case (Loc l)
kleing@13052
   289
  with alloc show ?thesis by (simp add: preallocated_def)
kleing@13052
   290
qed
kleing@13052
   291
  
kleing@11085
   292
section {* correct-frames *}
kleing@9757
   293
kleing@9757
   294
lemmas [simp del] = fun_upd_apply
kleing@9757
   295
kleing@11252
   296
lemma correct_frames_field_update [rule_format]:
kleing@11252
   297
  "\<forall>rT C sig. 
kleing@13006
   298
  correct_frames G hp phi rT sig frs \<longrightarrow> 
kleing@13006
   299
  hp a = Some (C,fs) \<longrightarrow> 
kleing@13006
   300
  map_of (fields (G, C)) fl = Some fd \<longrightarrow> 
kleing@10042
   301
  G,hp\<turnstile>v::\<preceq>fd 
wenzelm@58860
   302
  \<longrightarrow> correct_frames G (hp(a \<mapsto> (C, fs(fl\<mapsto>v)))) phi rT sig frs"
kleing@9757
   303
apply (induct frs)
kleing@9757
   304
 apply simp
kleing@10920
   305
apply clarify
kleing@11252
   306
apply (simp (no_asm_use))
kleing@10920
   307
apply clarify
kleing@10920
   308
apply (unfold correct_frame_def)
kleing@10920
   309
apply (simp (no_asm_use))
kleing@11252
   310
apply clarify
kleing@9757
   311
apply (intro exI conjI)
kleing@11252
   312
    apply assumption+
kleing@11252
   313
   apply (erule approx_stk_sup_heap)
kleing@11252
   314
   apply (erule hext_upd_obj)
kleing@11252
   315
  apply (erule approx_loc_sup_heap)
kleing@11252
   316
  apply (erule hext_upd_obj)
kleing@11252
   317
 apply assumption+
kleing@11252
   318
apply blast
kleing@10056
   319
done
kleing@9757
   320
kleing@11252
   321
lemma correct_frames_newref [rule_format]:
kleing@11252
   322
  "\<forall>rT C sig. 
kleing@11252
   323
  hp x = None \<longrightarrow> 
kleing@11252
   324
  correct_frames G hp phi rT sig frs \<longrightarrow>
kleing@13681
   325
  correct_frames G (hp(x \<mapsto> obj)) phi rT sig frs"
kleing@9757
   326
apply (induct frs)
kleing@9757
   327
 apply simp
kleing@11252
   328
apply clarify
kleing@11252
   329
apply (simp (no_asm_use))
kleing@11252
   330
apply clarify
kleing@11252
   331
apply (unfold correct_frame_def)
kleing@11252
   332
apply (simp (no_asm_use))
kleing@11252
   333
apply clarify
kleing@9757
   334
apply (intro exI conjI)
kleing@11252
   335
    apply assumption+
kleing@11252
   336
   apply (erule approx_stk_sup_heap)
kleing@11252
   337
   apply (erule hext_new)
kleing@11252
   338
  apply (erule approx_loc_sup_heap)
kleing@11252
   339
  apply (erule hext_new)
kleing@11252
   340
 apply assumption+
kleing@11252
   341
apply blast
kleing@10056
   342
done
nipkow@8011
   343
nipkow@8011
   344
end