1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
|
(* *********************************************************************)
(* *)
(* The Compcert verified compiler *)
(* *)
(* Xavier Leroy, INRIA Paris-Rocquencourt *)
(* *)
(* Copyright Institut National de Recherche en Informatique et en *)
(* Automatique. All rights reserved. This file is distributed *)
(* under the terms of the GNU General Public License as published by *)
(* the Free Software Foundation, either version 2 of the License, or *)
(* (at your option) any later version. This file is also distributed *)
(* under the terms of the INRIA Non-Commercial License Agreement. *)
(* *)
(* *********************************************************************)
(** Error reporting and the error monad. *)
Require Import String.
Require Import Coqlib.
Close Scope string_scope.
Set Implicit Arguments.
(** * Representation of error messages. *)
(** Compile-time errors produce an error message, represented in Coq
as a list of either substrings or positive numbers encoding
a source-level identifier (see module AST). *)
Inductive errcode: Type :=
| MSG: string -> errcode
| CTX: positive -> errcode.
Definition errmsg: Type := list errcode.
Definition msg (s: string) : errmsg := MSG s :: nil.
(** * The error monad *)
(** Compilation functions that can fail have return type [res A].
The return value is either [OK res] to indicate success,
or [Error msg] to indicate failure. *)
Inductive res (A: Type) : Type :=
| OK: A -> res A
| Error: errmsg -> res A.
Implicit Arguments Error [A].
(** To automate the propagation of errors, we use a monadic style
with the following [bind] operation. *)
Definition bind (A B: Type) (f: res A) (g: A -> res B) : res B :=
match f with
| OK x => g x
| Error msg => Error msg
end.
Definition bind2 (A B C: Type) (f: res (A * B)) (g: A -> B -> res C) : res C :=
match f with
| OK (x, y) => g x y
| Error msg => Error msg
end.
(** The [do] notation, inspired by Haskell's, keeps the code readable. *)
Notation "'do' X <- A ; B" := (bind A (fun X => B))
(at level 200, X ident, A at level 100, B at level 200)
: error_monad_scope.
Notation "'do' ( X , Y ) <- A ; B" := (bind2 A (fun X Y => B))
(at level 200, X ident, Y ident, A at level 100, B at level 200)
: error_monad_scope.
Remark bind_inversion:
forall (A B: Type) (f: res A) (g: A -> res B) (y: B),
bind f g = OK y ->
exists x, f = OK x /\ g x = OK y.
Proof.
intros until y. destruct f; simpl; intros.
exists a; auto.
discriminate.
Qed.
Remark bind2_inversion:
forall (A B C: Type) (f: res (A*B)) (g: A -> B -> res C) (z: C),
bind2 f g = OK z ->
exists x, exists y, f = OK (x, y) /\ g x y = OK z.
Proof.
intros until z. destruct f; simpl.
destruct p; simpl; intros. exists a; exists b; auto.
intros; discriminate.
Qed.
Open Local Scope error_monad_scope.
(** This is the familiar monadic map iterator. *)
Fixpoint mmap (A B: Type) (f: A -> res B) (l: list A) {struct l} : res (list B) :=
match l with
| nil => OK nil
| hd :: tl => do hd' <- f hd; do tl' <- mmap f tl; OK (hd' :: tl')
end.
Remark mmap_inversion:
forall (A B: Type) (f: A -> res B) (l: list A) (l': list B),
mmap f l = OK l' ->
list_forall2 (fun x y => f x = OK y) l l'.
Proof.
induction l; simpl; intros.
inversion_clear H. constructor.
destruct (bind_inversion _ _ H) as [hd' [P Q]].
destruct (bind_inversion _ _ Q) as [tl' [R S]].
inversion_clear S.
constructor. auto. auto.
Qed.
(** * Reasoning over monadic computations *)
(** The [monadInv H] tactic below simplifies hypotheses of the form
<<
H: (do x <- a; b) = OK res
>>
By definition of the bind operation, both computations [a] and
[b] must succeed for their composition to succeed. The tactic
therefore generates the following hypotheses:
x: ...
H1: a = OK x
H2: b x = OK res
*)
Ltac monadInv1 H :=
match type of H with
| (OK _ = OK _) =>
inversion H; clear H; try subst
| (Error _ = OK _) =>
discriminate
| (bind ?F ?G = OK ?X) =>
let x := fresh "x" in (
let EQ1 := fresh "EQ" in (
let EQ2 := fresh "EQ" in (
destruct (bind_inversion F G H) as [x [EQ1 EQ2]];
clear H;
try (monadInv1 EQ2))))
| (bind2 ?F ?G = OK ?X) =>
let x1 := fresh "x" in (
let x2 := fresh "x" in (
let EQ1 := fresh "EQ" in (
let EQ2 := fresh "EQ" in (
destruct (bind2_inversion F G H) as [x1 [x2 [EQ1 EQ2]]];
clear H;
try (monadInv1 EQ2)))))
| (mmap ?F ?L = OK ?M) =>
generalize (mmap_inversion F L H); intro
end.
Ltac monadInv H :=
match type of H with
| (OK _ = OK _) => monadInv1 H
| (Error _ = OK _) => monadInv1 H
| (bind ?F ?G = OK ?X) => monadInv1 H
| (bind2 ?F ?G = OK ?X) => monadInv1 H
| (?F _ _ _ _ _ _ _ _ = OK _) =>
((progress simpl in H) || unfold F in H); monadInv1 H
| (?F _ _ _ _ _ _ _ = OK _) =>
((progress simpl in H) || unfold F in H); monadInv1 H
| (?F _ _ _ _ _ _ = OK _) =>
((progress simpl in H) || unfold F in H); monadInv1 H
| (?F _ _ _ _ _ = OK _) =>
((progress simpl in H) || unfold F in H); monadInv1 H
| (?F _ _ _ _ = OK _) =>
((progress simpl in H) || unfold F in H); monadInv1 H
| (?F _ _ _ = OK _) =>
((progress simpl in H) || unfold F in H); monadInv1 H
| (?F _ _ = OK _) =>
((progress simpl in H) || unfold F in H); monadInv1 H
| (?F _ = OK _) =>
((progress simpl in H) || unfold F in H); monadInv1 H
end.
|
