Optimizing and Evaluating Transient Gradual Typing

Michael M. Vitousek; Jeremy G. Siek; Avik Chaudhuri

arXiv:1902.07808·cs.PL·February 22, 2019

Optimizing and Evaluating Transient Gradual Typing

Michael M. Vitousek, Jeremy G. Siek, Avik Chaudhuri

PDF

TL;DR

This paper analyzes the performance costs of transient gradual typing in Python, introduces static analysis to reduce overhead, and demonstrates near-zero slowdown when combined with JIT compilation.

Contribution

It presents a static analysis and optimization that significantly reduces runtime overhead of transient gradual typing in Python implementations.

Findings

01

Transient approach causes up to 6x slowdown in CPython.

02

Static analysis reduces overhead, making partially typed programs nearly as fast as untyped.

03

Combining with PyPy's JIT eliminates runtime overhead.

Abstract

Gradual typing enables programmers to combine static and dynamic typing in the same language. However, ensuring a sound interaction between the static and dynamic parts can incur significant runtime cost. In this paper, we perform a detailed performance analysis of the transient gradual typing approach implemented in Reticulated Python, a gradually typed variant of Python. The transient approach inserts lightweight checks throughout a program rather than installing proxies on higher order values. We show that, when running Reticulated Python and the transient approach on CPython, performance decreases as programs evolve from dynamic to static types, up to a 6x slowdown compared to equivalent Python programs. To reduce this overhead, we design a static analysis and optimization that removes redundant runtime checks. The optimization employs a static type inference algorithm that solves…

Figures21

Click any figure to enlarge with its caption.

Equations290

{α <: β, ϵ \to ζ <: δ, bool <: ζ, int <: γ, (δ : \to) = η \to θ, int <: η, β <: η}

{α <: β, ϵ \to ζ <: δ, bool <: ζ, int <: γ, (δ : \to) = η \to θ, int <: η, β <: η}

α = β = str, γ = int, δ = ⋆ \to bool, ϵ = η = ⋆, ζ = θ = bool

α = β = str, γ = int, δ = ⋆ \to bool, ϵ = η = ⋆, ζ = θ = bool

\begin{array}[]{lrcl}\text{variables}&x,y\\ \text{numbers}&n&\in&\mathbb{Z}\\ \lambda^{\star}_{s}~{}\text{expressions}&s&::=&x\mid n\mid s+s\mid\lambda(x{:}U){\to}U.~{}s\mid s~{}s\mid\texttt{ref}_{U}~{}s\mid{!}s\mid s{:=}s\\ \lambda^{\Downarrow}_{d}~{}\text{expressions}&d&::=&x\mid n\mid d+d\mid\lambda(x{:}\alpha){\to}\alpha.~{}d\mid d~{}d\mid\texttt{let}~{}x=d~{}\texttt{in}~{}d\mid\texttt{ref}_{\alpha}~{}d\mid\\ &&&{!}d\mid d{:=}d\mid d{\Downarrow}S\\ \text{types}&U&::=&\star\mid\textsf{int}\mid\textsf{ref}~{}U\mid U\to U\\ \text{type tags}&S&::=&\star\mid\textsf{int}\mid~{}{\to}~{}\mid\textsf{ref}\\ \end{array}

\begin{array}[]{lrcl}\text{variables}&x,y\\ \text{numbers}&n&\in&\mathbb{Z}\\ \lambda^{\star}_{s}~{}\text{expressions}&s&::=&x\mid n\mid s+s\mid\lambda(x{:}U){\to}U.~{}s\mid s~{}s\mid\texttt{ref}_{U}~{}s\mid{!}s\mid s{:=}s\\ \lambda^{\Downarrow}_{d}~{}\text{expressions}&d&::=&x\mid n\mid d+d\mid\lambda(x{:}\alpha){\to}\alpha.~{}d\mid d~{}d\mid\texttt{let}~{}x=d~{}\texttt{in}~{}d\mid\texttt{ref}_{\alpha}~{}d\mid\\ &&&{!}d\mid d{:=}d\mid d{\Downarrow}S\\ \text{types}&U&::=&\star\mid\textsf{int}\mid\textsf{ref}~{}U\mid U\to U\\ \text{type tags}&S&::=&\star\mid\textsf{int}\mid~{}{\to}~{}\mid\textsf{ref}\\ \end{array}

\vbox \vbox ⋆ \sim U

\vbox \vbox ⋆ \sim U

\begin{array}[]{rcl}U_{1}\to U_{2}&\rhd&U_{1}\to U_{2}\\ \star&\rhd&\star\to\star\\ \textsf{ref}~{}U&\rhd&\textsf{ref}~{}U\\ \star&\rhd&\textsf{ref}~{}\star\end{array}

\begin{array}[]{rcl}U_{1}\to U_{2}&\rhd&U_{1}\to U_{2}\\ \star&\rhd&\star\to\star\\ \textsf{ref}~{}U&\rhd&\textsf{ref}~{}U\\ \star&\rhd&\textsf{ref}~{}\star\end{array}

\begin{array}[]{rcl}\lfloor U_{1}\to U_{2}\rfloor&=&{\to}\\ \lfloor\textsf{ref}~{}U\rfloor&=&\textsf{ref}\\ \lfloor\textsf{int}\rfloor&=&\textsf{int}\\ \lfloor\star\rfloor&=&\star\end{array}

\begin{array}[]{rcl}\lfloor U_{1}\to U_{2}\rfloor&=&{\to}\\ \lfloor\textsf{ref}~{}U\rfloor&=&\textsf{ref}\\ \lfloor\textsf{int}\rfloor&=&\textsf{int}\\ \lfloor\star\rfloor&=&\star\end{array}

\frac{\vbox Γ ( x ) = U \vbox}{\vbox \vbox Γ ⊢ x ⇝ x : U}

\frac{\vbox Γ ( x ) = U \vbox}{\vbox \vbox Γ ⊢ x ⇝ x : U}

\frac{\vbox Γ ⊢ s ⇝ d : U U ⊳ ref U ^{'} \vbox}{\vbox \vbox Γ ⊢ ! s ⇝ ! ( d ⇓ ref ) ⇓ ⌊ U ^{'} ⌋ : U ^{'}}

\frac{\vbox Γ ⊢ s _{1} ⇝ d _{1} : U _{1} U _{1} \sim int Γ ⊢ s _{2} ⇝ d _{2} : U _{2} U _{2} \sim int \vbox Γ ⊢ s _{2} ⇝ d _{2} : U _{2} U _{2} \sim int \vbox}{\vbox \vbox Γ ⊢ s _{1} + s _{2} ⇝ d _{1} ⇓ int + d _{2} ⇓ int : int}

\begin{array}[]{rrcl}\text{type variables}&\alpha,\beta,\gamma\\ \text{leaf types}&V&::=&\alpha\mid\star\\ \text{constraint types}&A&::=&V\mid\textsf{int}\mid\textsf{ref}~{}V\mid V\to V\\ \text{constraints}&C&::=&A<:A\mid(A{:}S)=A\\ \text{constraint sets}&\Omega&\in&\mathcal{P}(C)\end{array}

\begin{array}[]{rrcl}\text{type variables}&\alpha,\beta,\gamma\\ \text{leaf types}&V&::=&\alpha\mid\star\\ \text{constraint types}&A&::=&V\mid\textsf{int}\mid\textsf{ref}~{}V\mid V\to V\\ \text{constraints}&C&::=&A<:A\mid(A{:}S)=A\\ \text{constraint sets}&\Omega&\in&\mathcal{P}(C)\end{array}

\begin{array}[]{rcl}V_{1}\to V_{2}&\rhd_{\to}&V_{1}\to V_{2}\\ \alpha&\rhd_{\to}&\beta\to\gamma\\ &\lx@intercol\;\;\text{with}~{}\beta,\gamma~{}\text{fresh}\hfil\lx@intercol\\ \textsf{ref}~{}V&\rhd_{\textsf{ref}}&\textsf{ref}~{}V\\ \alpha&\rhd_{\textsf{ref}}&\textsf{ref}~{}\beta\\ &\lx@intercol\;\;\text{with}~{}\beta~{}\text{fresh}\hfil\lx@intercol\\ \textsf{int}&\rhd_{\textsf{int}}&\textsf{int}\\ V&\rhd_{\textsf{int}}&\textsf{int}\\ A&\rhd_{\star}&A\end{array}

\begin{array}[]{rcl}V_{1}\to V_{2}&\rhd_{\to}&V_{1}\to V_{2}\\ \alpha&\rhd_{\to}&\beta\to\gamma\\ &\lx@intercol\;\;\text{with}~{}\beta,\gamma~{}\text{fresh}\hfil\lx@intercol\\ \textsf{ref}~{}V&\rhd_{\textsf{ref}}&\textsf{ref}~{}V\\ \alpha&\rhd_{\textsf{ref}}&\textsf{ref}~{}\beta\\ &\lx@intercol\;\;\text{with}~{}\beta~{}\text{fresh}\hfil\lx@intercol\\ \textsf{int}&\rhd_{\textsf{int}}&\textsf{int}\\ V&\rhd_{\textsf{int}}&\textsf{int}\\ A&\rhd_{\star}&A\end{array}

\frac{\vbox Γ ⊢ d : A _{1} ; Ω A _{1} ⊳ _{S} A _{2} \vbox}{\vbox \vbox Γ ⊢ d ⇓ S : A _{2} ; Ω \cup {( A _{1} : S ) = A _{2} }}

\frac{\vbox Γ ⊢ d : A _{1} ; Ω A _{1} ⊳ _{S} A _{2} \vbox}{\vbox \vbox Γ ⊢ d ⇓ S : A _{2} ; Ω \cup {( A _{1} : S ) = A _{2} }}

\frac{\vbox Γ ⊢ d _{1} : V _{1} \to V _{2} ; Ω _{1} Γ ⊢ d _{2} : A ; Ω _{2} \vbox}{\vbox \vbox Γ ⊢ d _{1} d _{2} : V _{2} ; Ω _{1} \cup Ω _{2} \cup { A <: V _{1} }}

\frac{\vbox Γ ⊢ d _{1} : ref V ; Ω _{1} Γ ⊢ d _{2} : A ; Ω _{2} \vbox}{\vbox \vbox Γ ⊢ d _{1} := d _{2} : int ; Ω _{1} \cup Ω _{2} \cup { A <: V }}

\frac{\vbox Γ ( x ) = A \vbox}{\vbox \vbox Γ ⊢ x : A ; \emptyset}

V_{1} <: ⋆, V_{2} \to V_{3} <: ⋆

V_{1} <: ⋆, V_{2} \to V_{3} <: ⋆

\vbox \vbox ⊢ V : { V <: ⋆ }

\vbox \vbox ⊢ V : { V <: ⋆ }

\begin{array}[]{rrcl}\text{types}&T&::=&T\to T\mid\textsf{ref}~{}T\mid\textsf{int}\mid\star\mid\alpha\\ \text{constraints}&C&::=&A<:A\mid(A{:}S)=A\hbox{\pagecolor{tableblue}$\mid A=A\mid\alpha:S\mid\alpha\triangleq T$}\\ \text{maps}&\sigma&::=&\alpha\mapsto T,\ldots,\alpha\mapsto T\end{array}

\begin{array}[]{rrcl}\text{types}&T&::=&T\to T\mid\textsf{ref}~{}T\mid\textsf{int}\mid\star\mid\alpha\\ \text{constraints}&C&::=&A<:A\mid(A{:}S)=A\hbox{\pagecolor{tableblue}$\mid A=A\mid\alpha:S\mid\alpha\triangleq T$}\\ \text{maps}&\sigma&::=&\alpha\mapsto T,\ldots,\alpha\mapsto T\end{array}

\begin{array}[]{rcl}\mathit{parts}(\star)&=&\emptyset\\ \mathit{parts}(\textsf{int})&=&\emptyset\\ \mathit{parts}(\alpha)&=&\emptyset\\ \mathit{parts}(\alpha_{1}\to\alpha_{2})&=&\{\alpha_{1},\alpha_{2}\}\\ \mathit{parts}(\textsf{ref}~{}\alpha)&=&\{\alpha\}\end{array}

\begin{array}[]{rcl}\mathit{parts}(\star)&=&\emptyset\\ \mathit{parts}(\textsf{int})&=&\emptyset\\ \mathit{parts}(\alpha)&=&\emptyset\\ \mathit{parts}(\alpha_{1}\to\alpha_{2})&=&\{\alpha_{1},\alpha_{2}\}\\ \mathit{parts}(\textsf{ref}~{}\alpha)&=&\{\alpha\}\end{array}

\begin{array}[]{rcl}\lceil\textsf{int}\rceil&=&\textsf{int}\\ \lceil\textsf{ref}\rceil&=&\textsf{ref}~{}\star\\ \lceil{\to}\rceil&=&\star\to\star\\ \lceil\star\rceil&=&\star\end{array}

\begin{array}[]{rcl}\lceil\textsf{int}\rceil&=&\textsf{int}\\ \lceil\textsf{ref}\rceil&=&\textsf{ref}~{}\star\\ \lceil{\to}\rceil&=&\star\to\star\\ \lceil\star\rceil&=&\star\end{array}

\begin{array}[]{rl}\Omega\cup\{V_{1}\to V_{2}<:\star\}&\longrightarrow\Omega\cup\{\star<:V_{1},~{}V_{2}<:\star\}\\ \Omega\cup\{V_{1}\to V_{2}<:V_{3}\to V_{4}\}&\longrightarrow\Omega\cup\{V_{3}<:V_{1},~{}V_{2}<:V_{4}\}\\ \Omega\cup\{\textsf{ref}~{}V<:\star\}&\longrightarrow\Omega\cup\{V=\star\}\\ \Omega\cup\{\textsf{ref}~{}V_{1}<:\textsf{ref}~{}V_{2}\}&\longrightarrow\Omega\cup\{V_{1}=V_{2}\}\\ \Omega\cup\{V<:V\}&\longrightarrow\Omega\\ \Omega\cup\{\textsf{int}<:\star\}&\longrightarrow\Omega\\ \Omega\cup\{V_{1}\to V_{2}=V_{3}\to V_{4}\}&\longrightarrow\Omega\cup\{V_{1}=V_{3},V_{2}=V_{4}\}\\ \Omega\cup\{\textsf{ref}~{}V_{1}=\textsf{ref}~{}V_{2}\}&\longrightarrow\Omega\cup\{V_{1}=V_{2}\}\\ \Omega\cup\{A=A\}&\longrightarrow\Omega\\ \Omega\cup\{A=\alpha\}&\longrightarrow\Omega\cup\{\alpha=A\}\\ &\begin{array}[]{ll}\quad\text{where}&A\neq\alpha^{\prime}\end{array}\\ \Omega\cup\{\alpha=A\}&\longrightarrow\Omega[\alpha/A]\cup\{\alpha\triangleq A\}\\ &\begin{array}[]{ll}\quad\text{where}&\alpha\not\in\mathit{vars}(A)~{}\text{and}~{}(\alpha\triangleq T)\not\in\Omega\end{array}\\ \Omega\cup\{(A{:}S)=A\}&\longrightarrow\Omega\\ \Omega\cup\{\alpha:S,(\alpha{:}S)=A\}&\longrightarrow\Omega\cup\{\alpha=A\}\\ &\begin{array}[]{ll}\quad\text{where}&((\alpha{:}S^{\prime})=A^{\prime})\not\in\Omega\\ &A\neq\alpha\end{array}\\ \Omega\cup\{\alpha:S_{1},(\alpha{:}S_{2})=A\}&\longrightarrow\Omega\cup\{\alpha:S_{1}\}\cup\{\alpha^{\prime}=\star\mid\forall\alpha^{\prime}\in\mathit{parts}(A)\}\\ &\begin{array}[]{ll}\quad\text{where}&S_{1}\neq S_{2}\end{array}\\ \Omega\cup\{(\alpha{:}S)=A_{1},(\alpha{:}S)=A_{2}\}&\longrightarrow\Omega\cup\{(\alpha{:}S)=A_{1},A_{2}=A_{1}\}\\ \Omega\cup\{\alpha:S\}&\longrightarrow\Omega\cup\{\alpha=A\}\\ &\begin{array}[]{ll}\quad\text{where}&((\alpha{:}S^{\prime})=A^{\prime})\not\in\Omega~{}\text{and}~{}(\alpha\triangleq T)\not\in\Omega~{}\text{and}{}\\ &(\alpha=A^{\prime})\not\in\Omega~{}\text{and}~{}\alpha\rhd_{S}A\end{array}\end{array}

\begin{array}[]{rl}\Omega\cup\{V_{1}\to V_{2}<:\star\}&\longrightarrow\Omega\cup\{\star<:V_{1},~{}V_{2}<:\star\}\\ \Omega\cup\{V_{1}\to V_{2}<:V_{3}\to V_{4}\}&\longrightarrow\Omega\cup\{V_{3}<:V_{1},~{}V_{2}<:V_{4}\}\\ \Omega\cup\{\textsf{ref}~{}V<:\star\}&\longrightarrow\Omega\cup\{V=\star\}\\ \Omega\cup\{\textsf{ref}~{}V_{1}<:\textsf{ref}~{}V_{2}\}&\longrightarrow\Omega\cup\{V_{1}=V_{2}\}\\ \Omega\cup\{V<:V\}&\longrightarrow\Omega\\ \Omega\cup\{\textsf{int}<:\star\}&\longrightarrow\Omega\\ \Omega\cup\{V_{1}\to V_{2}=V_{3}\to V_{4}\}&\longrightarrow\Omega\cup\{V_{1}=V_{3},V_{2}=V_{4}\}\\ \Omega\cup\{\textsf{ref}~{}V_{1}=\textsf{ref}~{}V_{2}\}&\longrightarrow\Omega\cup\{V_{1}=V_{2}\}\\ \Omega\cup\{A=A\}&\longrightarrow\Omega\\ \Omega\cup\{A=\alpha\}&\longrightarrow\Omega\cup\{\alpha=A\}\\ &\begin{array}[]{ll}\quad\text{where}&A\neq\alpha^{\prime}\end{array}\\ \Omega\cup\{\alpha=A\}&\longrightarrow\Omega[\alpha/A]\cup\{\alpha\triangleq A\}\\ &\begin{array}[]{ll}\quad\text{where}&\alpha\not\in\mathit{vars}(A)~{}\text{and}~{}(\alpha\triangleq T)\not\in\Omega\end{array}\\ \Omega\cup\{(A{:}S)=A\}&\longrightarrow\Omega\\ \Omega\cup\{\alpha:S,(\alpha{:}S)=A\}&\longrightarrow\Omega\cup\{\alpha=A\}\\ &\begin{array}[]{ll}\quad\text{where}&((\alpha{:}S^{\prime})=A^{\prime})\not\in\Omega\\ &A\neq\alpha\end{array}\\ \Omega\cup\{\alpha:S_{1},(\alpha{:}S_{2})=A\}&\longrightarrow\Omega\cup\{\alpha:S_{1}\}\cup\{\alpha^{\prime}=\star\mid\forall\alpha^{\prime}\in\mathit{parts}(A)\}\\ &\begin{array}[]{ll}\quad\text{where}&S_{1}\neq S_{2}\end{array}\\ \Omega\cup\{(\alpha{:}S)=A_{1},(\alpha{:}S)=A_{2}\}&\longrightarrow\Omega\cup\{(\alpha{:}S)=A_{1},A_{2}=A_{1}\}\\ \Omega\cup\{\alpha:S\}&\longrightarrow\Omega\cup\{\alpha=A\}\\ &\begin{array}[]{ll}\quad\text{where}&((\alpha{:}S^{\prime})=A^{\prime})\not\in\Omega~{}\text{and}~{}(\alpha\triangleq T)\not\in\Omega~{}\text{and}{}\\ &(\alpha=A^{\prime})\not\in\Omega~{}\text{and}~{}\alpha\rhd_{S}A\end{array}\end{array}

\begin{array}[]{rcll}S\sqcup S&=&S\\ S_{1}\sqcup S_{2}&=&\star&\text{if}~{}S_{1}\neq S_{2}\end{array}

\begin{array}[]{rcll}S\sqcup S&=&S\\ S_{1}\sqcup S_{2}&=&\star&\text{if}~{}S_{1}\neq S_{2}\end{array}

\begin{array}[]{rcl}\lfloor\textsf{int}\rfloor&=&\textsf{int}\\ \lfloor\textsf{ref}~{}V\rfloor&=&\textsf{ref}\\ \lfloor V_{1}\to V_{2}\rfloor&=&{\to}\\ \lfloor\star\rfloor&=&\star\end{array}

\begin{array}[]{rcl}\lfloor\textsf{int}\rfloor&=&\textsf{int}\\ \lfloor\textsf{ref}~{}V\rfloor&=&\textsf{ref}\\ \lfloor V_{1}\to V_{2}\rfloor&=&{\to}\\ \lfloor\star\rfloor&=&\star\end{array}

\frac{\vbox Ω = Ω ^{'} \cup { A _{1} <: α , \dots , A _{n} <: α } α \in vars ( Ω ^{'} ) \lor n > 0 \vbox \forall i \leq n , A _{i} \neq = α ^{'} \land α \neq \in vars ( A _{i} ) S = ⊔ _{i \leq n} ⌊ A _{i} ⌋ Ω ^{'} solvable α Ω normal Ω \cup { α : S } ⇓ σ \vbox}{\vbox \vbox Ω ⇓ σ}

\frac{\vbox Ω = Ω ^{'} \cup { A _{1} <: α , \dots , A _{n} <: α } α \in vars ( Ω ^{'} ) \lor n > 0 \vbox \forall i \leq n , A _{i} \neq = α ^{'} \land α \neq \in vars ( A _{i} ) S = ⊔ _{i \leq n} ⌊ A _{i} ⌋ Ω ^{'} solvable α Ω normal Ω \cup { α : S } ⇓ σ \vbox}{\vbox \vbox Ω ⇓ σ}

\frac{\vbox Ω ⟶ ^{*} Ω ^{'} Ω ^{'} ⇓ σ \vbox}{\vbox \vbox Ω ⇓ σ}

\frac{\vbox Ω = Ω _{1} \cup Ω _{2} \cup Ω _{3} \cup Ω _{4} Ω _{2} = { α _{1} ≜ T _{1} , \dots , α _{n} ≜ T _{n} } Ω _{3} = {( α : S _{1} ) = A _{1} , \dots , ( α : S _{m} ) = A _{m} } \vbox Ω _{4} = { α <: V _{1} , \dots , α <: V _{p} } α \neq \in vars ( Ω _{1} ) \forall i \leq n , α _{i} \neq = α \forall j \leq m , α \neq \in vars ( A _{j} ) \vbox}{\vbox \vbox Ω solvable α}

\frac{\vbox Ω = Ω _{1} \cup Ω _{2} \cup Ω _{3} \cup Ω _{4} Ω _{2} = { α _{1} ≜ T _{1} , \dots , α _{n} ≜ T _{n} } Ω _{3} = {( α : S _{1} ) = A _{1} , \dots , ( α : S _{m} ) = A _{m} } \vbox Ω _{4} = { α <: V _{1} , \dots , α <: V _{p} } α \neq \in vars ( Ω _{1} ) \forall i \leq n , α _{i} \neq = α \forall j \leq m , α \neq \in vars ( A _{j} ) \vbox}{\vbox \vbox Ω solvable α}

\begin{array}[]{rcl}a&\in&\text{addresses}\\ e&::=&a\mid x\mid n\mid e+e\mid\lambda x.~{}e\mid(e~{}e)\mid\texttt{let}~{}x=e~{}\texttt{in}~{}e\mid\texttt{ref}~{}e\mid{!}e\mid e{:=}e\mid e{\Downarrow}S\mid\mathtt{fail}\\ \Sigma&::=&\cdot\mid\Sigma,a{:}T\end{array}

\begin{array}[]{rcl}a&\in&\text{addresses}\\ e&::=&a\mid x\mid n\mid e+e\mid\lambda x.~{}e\mid(e~{}e)\mid\texttt{let}~{}x=e~{}\texttt{in}~{}e\mid\texttt{ref}~{}e\mid{!}e\mid e{:=}e\mid e{\Downarrow}S\mid\mathtt{fail}\\ \Sigma&::=&\cdot\mid\Sigma,a{:}T\end{array}

\frac{\vbox Γ , x : α ; σ ⊢ d ⇝ e : T ⊢ T <: σ β \vbox}{\vbox \vbox Γ ; σ ⊢ λ ( x : α ) \to β . d ⇝ λ x . e : σ α \to σ β}

\frac{\vbox Γ , x : α ; σ ⊢ d ⇝ e : T ⊢ T <: σ β \vbox}{\vbox \vbox Γ ; σ ⊢ λ ( x : α ) \to β . d ⇝ λ x . e : σ α \to σ β}

\frac{\vbox Γ ; σ ⊢ d _{1} ⇝ e _{1} : T _{1} \to T _{2} Γ ; σ ⊢ d _{2} ⇝ e _{2} : T _{1}^{'} ⊢ T _{1}^{'} <: T _{1} \vbox}{\vbox \vbox Γ ; σ ⊢ d _{1} d _{2} ⇝ ( e _{1} e _{2} ) : T _{2}}

\frac{\vbox Γ ; σ ⊢ d ⇝ e : ref T \vbox}{\vbox \vbox Γ ; σ ⊢ ! d ⇝ ! e : T}

\frac{\vbox Γ ( x ) = A \vbox}{\vbox \vbox Γ ; σ ⊢ x ⇝ x : σ A}

\frac{\vbox Γ ; σ ⊢ d _{1} ⇝ e _{1} : int Γ ; σ ⊢ d _{2} ⇝ e _{2} : int \vbox}{\vbox \vbox Γ ; σ ⊢ d _{1} + d _{2} ⇝ e _{1} + e _{2} : int}

\frac{\vbox Γ ; σ ⊢ d ⇝ e : ⋆ S \neq = ⋆ \vbox}{\vbox \vbox Γ ; σ ⊢ d ⇓ S ⇝ e ⇓ S : ⌈ S ⌉}

\begin{array}[]{rcl}\lceil{\to}\rceil&=&\star\to\star\\ \lceil\textsf{ref}\rceil&=&\textsf{ref}~{}\star\\ \lceil\textsf{int}\rceil&=&\textsf{int}\\ \lceil\star\rceil&=&\star\end{array}

\begin{array}[]{rcl}\lceil{\to}\rceil&=&\star\to\star\\ \lceil\textsf{ref}\rceil&=&\textsf{ref}~{}\star\\ \lceil\textsf{int}\rceil&=&\textsf{int}\\ \lceil\star\rceil&=&\star\end{array}

\begin{array}[]{rcl}\lfloor T_{1}\to T_{2}\rfloor&=&{\to}\\ \lfloor\textsf{ref}~{}T\rfloor&=&\textsf{ref}\\ \lfloor\textsf{int}\rfloor&=&\textsf{int}\\ \lfloor\star\rfloor&=&\star\end{array}

\begin{array}[]{rcl}\lfloor T_{1}\to T_{2}\rfloor&=&{\to}\\ \lfloor\textsf{ref}~{}T\rfloor&=&\textsf{ref}\\ \lfloor\textsf{int}\rfloor&=&\textsf{int}\\ \lfloor\star\rfloor&=&\star\end{array}

\vbox \vbox \to ⪯ \to

Peer Reviews

No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.

Videos

No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.

Full text

1

Optimizing and Evaluating Transient Gradual Typing

Michael M. Vitousek

Indiana University

[email protected]

,

Jeremy G. Siek

Indiana University

[email protected]

and

Avik Chaudhuri

Facebook Inc.

[email protected]

Abstract.

Gradual typing enables programmers to combine static and dynamic typing in the same language. However, ensuring a sound interaction between the static and dynamic parts can incur significant runtime cost. In this paper, we perform a detailed performance analysis of the transient gradual typing approach implemented in Reticulated Python, a gradually typed variant of Python. The transient approach (Vitousek et al., 2017) inserts lightweight checks throughout a program rather than installing proxies on higher order values. We show that, when running Reticulated Python and the transient approach on CPython, performance decreases as programs evolve from dynamic to static types, up to a 6 ${\scaleobj{1}{\times}}$ slowdown compared to equivalent Python programs.

To reduce this overhead, we design a static analysis and optimization that removes redundant runtime checks. The optimization employs a static type inference algorithm that solves traditional subtyping constraints and also a new kind of check constraint. We evaluate the resulting performance and find that for many programs, the efficiency of partially typed programs is close to their untyped counterparts, removing most of the slowdown of transient checks. Finally, we measure the efficiency of Reticulated Python programs when running on PyPy, a tracing JIT. We find that combining PyPy with our type inference algorithm reduces the overall overhead to zero.

††journal: PACMPL††article: 1††publicationmonth: 1††copyright: none

1. Introduction

Gradual typing enables programmers to gradually evolve their programs from the flexibility of dynamic typing to the security of static typing (Siek and Taha, 2006; Tobin-Hochstadt and Felleisen, 2006). Over the last decade, gradual typing has been of great interest to both the research community (Rastogi et al., 2012; Takikawa et al., 2012; Swamy et al., 2014; Siek et al., 2015b; Ren et al., 2013; Allende et al., 2013a; Ahmed et al., 2011), and to industry, which has introduced several languages with elements of gradual typing, such as TypeScript (Microsoft, 2012), Flow (Facebook, 2014), and Dart (Google, 2011). Many existing gradually typed languages operate by translating a surface language program into a dynamically typed language by erasing types. We refer to the latter as the target language. This type erasure approach is safe in the sense that programs do not elicit undefined behavior as long as the target language is itself safe (for example, because the target language performs runtime checking in every primitive operation). However, we would like gradually typed languages to also be sound with respect to type annotations, that is, a variable annotated with a static type should only be inhabited by values of the appropriate type (Vitousek et al., 2017). To achieve this kind of soundness, runtime checks are required on the boundaries between statically and dynamically typed code.

1.1. Strategies for Runtime Checks

Several strategies have been used to implement runtime type checking for gradually typed languages, and these strategies are appropriate for different target languages and design goals. The traditional approach in the research literature is to insert casts during translation at the site of every implicit conversion between typed and dynamic code (Siek and Taha, 2006; Tobin-Hochstadt and Felleisen, 2006; Allende et al., 2013a; Swamy et al., 2014). At runtime, these casts ensure that values correspond to their expected static type. A cast on a value with first-order type is a constant-time operation that either succeeds or fails, but for higher-order types such as functions and references a cast installs a proxy on the casted value. The proxy ensures that, in the future, the value behaves according to the target type of the cast. This approach is called the guarded strategy (Vitousek et al., 2014).

In recent papers, Vitousek et al. (2014, 2017) identified a number of challenges that make the guarded strategy inappropriate for certain domains. In particular, unless the target language has powerful support for proxies (such as Racket’s chaperones (Strickland et al., 2012)), interaction between proxied values and foreign functions or target-language code may fail in unexpected ways (Allende et al., 2013b; Van Cutsem and Miller, 2013). Such is the case in Python and these problems were borne out in Reticulated Python, an experimental implementation of gradual typing for Python 3 (Vitousek et al., 2014).

As an alternative, Vitousek et al. (2014) introduced the transient strategy. In this approach, the translation inserts constant-time checks throughout the gradually typed program. These checks do not create proxies but only inspect the type tag (Appel, 2007) of the value, failing if it does not correspond to the type constructor the value is statically expected to have (such as int or ${\to}$ , but not $\textsf{int}\to\textsf{int}$ ).

To make up for the “transient” nature of these checks, they are inserted pervasively into the program rather than just at the sites of implicit conversions. The translation inserts checks into the program at every function call site, at the entry of every function body (to check that each argument corresponds to its parameter’s type), and at the site of every dereference.

For example, consider the program in Figure 1a, written in a gradually typed language. Here, the makeEq function is a curried equality function on integers with type $\textsf{int}\to\textsf{int}\to\textsf{bool}$ . It is called to produce the eqFive function on line 12, which is then called at line 14 on the result of calling the idDyn function on a string. Because the result of idDyn has static type $\star$ (representing the dynamic type), this program should pass static typechecking, but a runtime check is needed to detect that at runtime the value being passed into eqFive is actually a string and raise an error.

No matter what strategy is used, in a sound gradually typed language the result should be a runtime error. The transient strategy achieves this goal by inserting checks (such as n@int, which checks that n is an integer) as shown in Figure 1b. Type annotations have been erased, and the bodies of makeEq and its internal function now contain checks at lines 6 and 8 to ensure that, whatever arguments they are passed are definitely ints. Similarly, the call to makeEq at line 12 also contains a check, to ensure that the result of the function call is a function. Note that this check does not ensure that the call returns a value of type $\textsf{int}\to\textsf{bool}$ —such a check cannot be performed by immediate inspection of the runtime value, but it can verify that the result is a function. It is then up to the function itself to check that it is only passed ints (as it does with the argument checks discussed above), and additional checks are inserted when eqFive is called on lines 13 and 14 to ensure that the result of that call is a bool.

When this program executes, an error will be raised by the check at line 8, because the call to eqFive at line 14 passed in a string. This result is expected and correct; if the error had not arisen, there would be an uncaught type error in the body of makeEq’s inner function, as a string would inhabit the int-typed variable m. This error could then (depending on the semantics of equality testing) lead to a confusing, difficult to debug error. As it is, the programmer is simply informed that a type mismatch occurred and where.

Vitousek et al. (2017) showed that this approach supports the open-world soundness property, which states that programs written in a gradually typed language, translated into a dynamic target language, and then embedded in arbitrary code native to that dynamic language, will only “go wrong” due to errors in the native code. The translated, gradually typed program will not be the source of any errors (other than errors caught by transient checks) even in the presence of unmoderated interaction with the “open world.”

1.2. Performance of Transient Gradual Typing

Performance is also of critical concern for gradually typed languages. The runtime checks required for sound gradual typing inevitably impose some degree of runtime overhead, but ideally this overhead would be minimized or made up for by type-based compiler optimizations. Since gradual typing is designed to allow programmers to gradually vary their programs between static and dynamic (Siek et al., 2015a), it is also important that adding or removing individual annotations does not dramatically degrade the program’s performance. Takikawa et al. (2016) examine the performance of Typed Racket with this criterion in mind by studying programs through the lens of a typing lattice made up of differently-typed configurations of the same program. The top of the lattice is a fully typed configuration of the program and the bottom is unannotated, and incrementally adding types moves up the lattice.

Takikawa et al. show that in Typed Racket, certain configurations result in catastrophic slowdown compared to either the top or bottom configurations. This indicates that the guarded semantics incurs a substantial cost when interaction between static and dynamic code is frequent. Many of their benchmarks show mean overheads of over 30 ${\scaleobj{1}{\times}}$ and worst cases of over 100 ${\scaleobj{1}{\times}}$ , which “projects an extremely negative image of sound gradual typing” (Takikawa et al., 2016).

In this work, we aim to establish whether the transient strategy faces the same problem. Vitousek et al. (2017) performed an initial performance evaluation of Reticulated Python benchmarks and found that overheads (compared to an untyped, standard Python version of the same program) ranged from negligible to over a 5 ${\scaleobj{1}{\times}}$ slowdown. However, this analysis was limited to examining a single configuration, the configuration closest to being fully typed. As shown by Takikawa et al. (2016), this is insufficient to make a strong claim about the overall performance of Reticulated Python.

To obtain a clearer picture of Reticulated’s performance, we analyze the performance of ten benchmarks across their typing lattices. Since Reticulated Python uses fine-grained gradual typing (where the choice to use static types exists on the level of individual identifiers) rather than coarse-grained (where the choice is per-module) as is Typed Racket (Takikawa et al., 2016), the size of the typing lattice is too large to generate and test every possible configuration. Instead, we generate samples from the lattice by randomly removing type annotations from a fully-typed version of the benchmark, replacing them with the dynamic type and taking care to ensure that each level in the lattice is equally sampled. Each sample is then translated to standard Python 3 using Reticulated Python and executed with CPython, the reference Python runtime.

With this approach, we found that the cost of transient gradual typing increases as the number of type annotations grows. As a program evolves from dynamic to static, its performance linearly degrades, with the worst performance in the most static configurations. This is because each static type annotation induces checks to ensure that values correspond to that type. This is, of course, counter to one hypothetical benefit of static typing—ideally, static types should aid performance, or at least not degrade it. On the other hand, the linear degradation of performance to a worst case 6 ${\scaleobj{1}{\times}}$ overhead means that the catastrophic configurations encountered in Typed Racket never occur and the cost of adding an individual type annotation to a program is predictable.

1.3. Reducing the Burden of Pervasive Checks

The transient approach inserts checks throughout the program, but not all checks are necessary for the program to be sound because some checks may be redundant and always succeed. To remove unnecessary checks, we perform type inference on the program after checks have been inserted. Our inference algorithm is based on those of Aiken and Fähndrich (1995) and Rastogi et al. (2012) and uses subtyping constraints as well as new check constraints, generated by transient checks. We prove that our algorithm can soundly remove unnecessary checks in a transient calculus similar to that of Vitousek et al. (2017)

We modified Reticulated Python to support this optimization and measured its performance, again sampling from the typing lattices at all levels. With redundant checks removed, the linear increase in execution times disappears, resulting in the fully-typed configurations displaying negligible overhead and a 6% average overhead over all sampled configurations.

1.4. Transient Gradual Typing on a Tracing JIT

While this analysis removes many checks statically, the nature of transient checks suggests that they could also be dynamically optimized away by a JIT. Fortunately, there is a tracing JIT for Python 3, PyPy (Bolz et al., 2009). Reticulated Python compiles to standard Python 3, so it is suitable to use with PyPy. We found that gradually typed programs running on PyPy displayed much less overhead than the same configurations running on CPython—the average overhead over all configurations was 3% with PyPy compared to 2.21 ${\scaleobj{1}{\times}}$ with CPython, suggesting that PyPy is able to optimize away most of the overhead of transient checks. Some benchmarks still incurred a linear increase in time as types were added, but to a lesser degree than with CPython (with a worst case overhead of 2.61 ${\scaleobj{1}{\times}}$ ). By combining PyPy with our type inference optimization, the average overhead was reduced to zero.

1.5. Contributions

In this work, we measure the performance of transient gradual typing in Reticulated Python and design techniques to improve it. Our contributions are:

•

We analyze the performance of Reticulated Python programs across their typing lattices, finding an average overhead of 2.21 ${\scaleobj{1}{\times}}$ and much better worst-case performance than Typed Racket (Section 2).

•

We develop a type inference optimization for reducing the number of checks needed by the transient approach, and prove it correct (Section 3).

•

We implement this optimization in Reticulated Python and show that it reduces the average overhead to just 6% across all typing lattices (Section 4).

•

We analyze both the unoptimized and optimized versions of Reticulated when running under a tracing JIT, and find that it performs very well, especially in combination with our optimization (Section 5).

Section 6 discusses related work, and Section 7 concludes.

2. Performance of Transient Gradual Typing

Before investigating approaches to improve the performance of transient gradual typing, we first establish the performance characteristics of Reticulated Python across the typing lattice (Takikawa et al., 2016). Vitousek et al. (2017) developed a blame-tracking technique for transient gradual typing, allowing programmers to trace runtime type errors back to the crossing-points between static and dynamic that led to the error, but for this analysis we disable blame tracking. Conducting the evaluation with blame tracking is important future work.

2.1. Experimental Setup

We selected ten Python 3 programs and translated them to Reticulated Python by inserting type annotations. These benchmarks are mostly drawn from the official Python benchmark suite,111https://github.com/python/performance with several drawn from the analysis of Takikawa et al. (2016) and translated from Racket to Python. In most cases, the resulting Reticulated programs are fully annotated with static types. However, even with a fully annotated program, the Reticulated type checker can assign expressions the type Any (the Reticulated Python name for the dynamic type), such as an if-then-else expression where the branches have different types; we did not attempt to guarantee that such cases do not arise.

To examine the typing lattice for a benchmark, we first count the number of type constructors that appear in the program’s annotations. We call this the type weight of a program. For example, the presence of the type List[int] in a program’s annotations adds 2 to its weight, and Callable[[int], bool] (which is the Reticulated representation of the type $\textsf{int}\to\textsf{bool}$ ) adds 3. We then divide the type weight into a maximum of 100 intervals: a program with a type weight of 300 would have intervals $[0,3),[3,6),\ldots,[297,300)$ . Programs with a total type weight of less than 100 naturally have fewer than 100 intervals. For each interval, we randomly erase type annotations and replace them with Any, until the program’s type weight falls within the interval. This process can “dynamize” types underneath type constructors; both Any and List[Any] are possible types that could be generated from an original type annotation List[int]. Each partially-dynamized program is a configuration from the typing lattice at the level corresponding to its type weight. We generate ten configurations per interval, plus a single fully-typed configuration consisting of the original program, for a maximum of 1001 configurations.

Each configuration was executed on an Intel Core i3-4130 CPU with 8GB of RAM running Ubuntu Server 14.04. Configurations were executed repeatedly on CPython 3.4.3 and average runtimes were recorded.

2.2. Results

Figure 2 shows the execution times for configurations across the typing lattice for each benchmark. Each graph corresponds to one benchmark, and each red circle in the graph represents the average execution time of one configuration. The dashed line marks the execution time of the untyped version of the benchmark in standard Python 3. (The blue triangles show the performance of optimized configurations, discussed below in Section 4). Moving from left to right moves up the lattice from untyped to typed, execution time is shown on the left $y$ axis, and relative overhead compared to the untyped program is shown on the right $y$ axis—higher $y$ coordinates indicates slower performance.

Over the entire typing lattices of all benchmarks, Reticulated Python incurs an average overhead of 2.21 ${\scaleobj{1}{\times}}$ compared to the untyped Python versions of the benchmarks. Typically the slowest configurations are the ones with the highest type weight: fully typed configurations have an average overhead of 3.63 ${\scaleobj{1}{\times}}$ . The slowest configuration is from the nbody benchmark at 5.95 ${\scaleobj{1}{\times}}$ .

Performance degrades as types are added because changing an annotation from Any to a static type results in checks being inserted. The graphs of pystone, snake, and others display a linear degradation because each check is executed approximately the same number of times when the configuration runs. Graphs with greater variance, such as that of spectral_norm, arise when some checks are executed more often than others, so different configurations at the same point in the lattice perform differently depending on which annotations are dynamized. The configurations from meteor_contest form two large clusters: the parameter fps of the solve function has type List[List[List[Set[int]]]]; solve loops over the second and third dimensions of this value and every iteration of a loop includes a check if the loop’s target is typed, and so replacing fps’s annotation with Any or List[Any] dramatically reduces the amount of time spent performing transient checks.

Vitousek et al. (2017) examined some of these benchmarks and compared the performance of untyped configurations to configurations that were close to fully-typed. We find different results in some of these cases: for example, we report an overhead of 5.19 ${\scaleobj{1}{\times}}$ for the nbody benchmark in the fully-typed configuration, while they found an overhead of less than 2 ${\scaleobj{1}{\times}}$ . This is because we increased the expressivity of Reticulated Python’s type annotations and type system to handle a fully static version of nbody (for example, by allowing type annotations to be placed on functions with default arguments). On the other hand, some of our changes to Reticulated Python’s semantics resulted in better performance. For example, Reticulated now checks whether an object is an instance of a class rather than checking that it supports all the methods of the class. As a result, the spectral_norm benchmark’s overhead was reduced from over 5 ${\scaleobj{1}{\times}}$ to 2.98 ${\scaleobj{1}{\times}}$ in fully-typed configurations.

Overall, the performance cost of transient gradual typing in Reticulated Python is significant, but unlike Typed Racket (Takikawa et al., 2016), the cost is generally predictable across the lattice and it never approaches worst cases of over 100 ${\scaleobj{1}{\times}}$ . Takikawa et al. (2016) suggest that in some contexts an overhead of less than 3 ${\scaleobj{1}{\times}}$ is a cutoff for real-world releasability (with the notation 3-deliverable) while an overhead in the range 3 ${\scaleobj{1}{\times}}$ to 10 ${\scaleobj{1}{\times}}$ is usable for development purposes (written 3/10-usable). While they note that such values are “rather liberal” and are unacceptable in many applications, they provide a minimal criterion to evaluate the acceptability of overheads. With Reticulated Python and the baseline transient semantics, the average overhead over every sampled configuration falls within the 3-deliverable range, and all configurations are at least 3/10-usable. This result is in concordance with the analysis of Greenman and Migeed (2018), who found an overall performance cost of no worse than one order of magnitude in Reticulated Python programs and also found that the cost of gradual typing increased as programs became more statically-typed.

2.3. Module-Based Configurations

Our sampling methodology is different from the methodology used by Takikawa et al. (2016), in which all possible configurations of the tested Typed Racket programs were tested, because the space of possible configurations is much larger in Reticulated Python since Reticulated Python uses fine-grained gradual typing and Typed Racket is coarse-grained. We expect that the fact that dynamic and static are much more intermingled in most of our configurations than they are in Typed Racket would result in our configurations showing even more overhead due to run-time type enforcement. However, to ensure that our sampling did not miss pathological cases that are drawn out by module-level gradual typing, we generated typing lattices equivalent to those that would be generated by Typed Racket for two of our test cases (cases that Takikawa et al. (2016) also analyzed). For these cases, the sieve and snake benchmarks, we recreated configurations equivalent to those possible in Typed Racket. While the difference in languages precludes a direct comparison, this analysis ensures that if there was some specific interaction between static and dynamic displayed in the Typed Racket configurations that led to a mean overhead of 102.49 ${\scaleobj{1}{\times}}$ (for sieve) or 32.30 ${\scaleobj{1}{\times}}$ (for snake), we would also encounter it.

Figure 3 shows the performance of the typing lattices of sieve and snake when generated on a per-module basis à la Typed Racket. The performance of these configurations are in line with the overall performance of the benchmarks using our sampling methodology—compare the graphs for sieve and snake in Figure 2. In these graphs, the configurations (red circles) that perform worst show approximately the same proportional overhead (the scale shown on the right $y$ -axis) as the worst case configurations of the module-based lattices. Similarly, the mean overheads of the module-based lattices would, if plotted on the graphs in Figure 2, be close to average. This suggests that the configurations tested by Takikawa et al. (2016) are not exceptional cases.

2.4. Comparison to Guarded Gradual Typing

While our performance results compare favorably to those reported by Takikawa et al. (2016) in Typed Racket, this is an imprecise comparison because of the different underlying languages involved. As a better comparison between the transient approach and the traditional proxy-based “guarded” approach, we took one configuration of the sieve as a case study. Specifically, this was a configuration whose equivalent Typed Racket program showed approximately 100 $\times$ overhead. For this configuration, we manually created a cast-inserted, proxy-based version of the program. Vitousek et al. (2014, 2017) showed that in general the proxy-based or guarded approach is incompatible with Python, but those incompatibilities do not arise in this limited example.

We found that the performance of the guarded version of the program had an overhead of 11.73 $\times$ over the standard Python version, compared to an overhead of 1.43 $\times$ for the transient version. Through varying the parameters of the benchmark, we observe that the execution times for guarded sieve show the same computational complexity as untyped and transient sieve, indicating that the difference in performance is not a result of the use of proxies increasing the complexity of the program. By instrumenting the guarded version of the program, we verified that there were no chains of proxies—in no case was there a value more than two “layers” deep (i.e. a proxy of a proxy of a value). The high overhead of the guarded approach compared to the transient approach, therefore, is attributable to a large constant factor. Through profiling, we found that the largest contributor to this overhead was the indirection performed by proxies at their use sites, followed by casting, proxy instantiation, and calls from translated user code into the casting code. By contrast, the transient version’s reduced overhead comes almost entirely from the runtime inspection of values performed by the code implementing transient checks, and from the calls to these checks. Python performs these inspections very efficiently, and so the overall overhead is relatively low, despite the frequency of the checks.

3. Optimizing Transient Gradual Typing

To improve Reticulated Python’s performance, we aim to reduce the number of checks while preserving those required for soundness. The basic idea of transient gradual typing is to use pervasive runtime checks to verify that values correspond to their expected static types. With the transient approach, type annotations are untrusted: they do not provide information to be relied on, but rather are claims that must be verified. Therefore, to reduce the runtime burden of transient gradual typing, we move this verification from runtime to compile time wherever possible. We do so by using type inference to determine when types can be trusted and do not need runtime verification.

Our inference process is based on the approaches of Aiken and Wimmers (1993) and Rastogi et al. (2012), using subtyping constraints and also a new form of constraint, the check constraint. To determine which checks are redundant, our inference algorithm occurs after transient checks have already been inserted, because the existence of a check in one part of a program can allow checks elsewhere to be removed. Check constraints let the system reason conditionally about checks, and they express the idea of transient checks: the type of the check expression $e{\Downarrow}S$ and the type of the expression being checked $e$ are constrained to be equal if, when solved for, the type of $e$ corresponds to the type tag $S$ (for example, if the type of $e$ is solved to be $\alpha\to\beta$ and $S$ is ${\to}$ ). If that is not the case, for example if $S$ is ${\to}$ and the type of $e$ is solved to be $\star$ , then the type of the overall check $e{\Downarrow}S$ is constrained to be the most general type that corresponds with $S$ (in this example, $\star\to\star$ ).

3.1. Overall approach

We generate sets of check constraints and subtype constraints from programs and find a solution that maps type variables to types, and then remove redundant checks. Our approach is as follows:

•

Perform transient check insertion as described by Vitousek et al. (2017).

•

Assign a unique type variable to every function argument, return type, and reference in the program.

•

Perform a syntax-directed constraint generation pass.

•

Solve the constraint system to obtain a mapping from type variables to types.

•

Using this mapping, perform a syntax-directed translation to the final target language. For each check in the program, if the inferred type of the term being checked and the tag it is checked against agree, remove the check, otherwise retain it.

As an example, we return to the program shown in Figure 1a, which shows a curried equality function written in a gradually typed language and which should pass static typechecking but fail due to a transient check at runtime. Figure 4a shows the result of this program after the first phase of our optimizing translation. In this phase, transient checks have been inserted exactly as in Figure 1b, but instead of the programmer’s type annotations being erased, they have been replaced by type variables $\alpha,\beta,\gamma,\delta,\epsilon,\zeta$ .

Our system infers types (which may be entirely different from the programmer’s annotations) for these type variables by generating subtyping constraints and special check constraints. Check constraints are generated by transient checks, and serve to connect the type of the checked expression with the type it is used at after the check. For example, at line 12, the result of makeEq(5) has type $\delta$ , and is then checked to ensure that it is a function ( $\Downarrow$$\rightarrow$ ). The type of the result of this check, and therefore the type of eqFive, is $\eta\to\theta$ , where $\eta,\theta$ are fresh type variables. This type is linked to $\delta$ by a check constraint $(\delta{:}{{\to}})=\eta\to\theta$ , which can be read as “if $\delta$ is solved to be a function, then its solution is equal to $\eta\to\theta$ .” We use check constraints rather than equality constraints (Hindley, 1969; Milner, 1978) because the same variable can be checked against many different types at different points in the program. Check constraints are only generated by transient checks where the checked type tag corresponds to a non-base type, because constraints of the form $(\gamma{:}\textsf{int})=\textsf{int}$ (as would be generated on line 6) add no new information to the system: the type on the right will be int whether $\gamma$ is solved to be int or not.

Subtyping constraints are also generated from the program. For example, because the call to makeEq on line 12 has an integer argument, it generates the constraint $\textsf{int}<:\gamma$ , meaning that $\gamma$ is constrained to be a supertype of int. The full set of constraints for this example is:

[TABLE]

We then solve this constraint set to obtain a mapping from each variable to a single non-variable type. The only subtyping constraint on $\delta$ is that $\epsilon\to\zeta<:\delta$ , so we determine that $\delta$ must be a function and that $\epsilon\to\zeta=\eta\to\theta$ . This, combined with the fact that both int and (transitively) str must be subtypes of $\eta$ due to the calls on lines 13 and 14, means that the only solution for $\eta$ and $\epsilon$ is $\star$ (the dynamic type). In all, the solution we find for this constraint set is

[TABLE]

Some of the transient checks in Figure 4a verify information that the constraint solution has already confirmed. For example, the check at line 6 verifies that n is an integer—but n’s type $\gamma$ was statically inferred to be integer, and so this check is not needed. However, the check at line 8, which verifies that m is an integer, is not redundant: the type $\star$ was inferred for m’s variable $\epsilon$ . In fact, this check is needed for soundness because it will fail with a string on line 14. The final program, with redundant checks removed and all annotations erased, is listed in Figure 4b.

For the purposes of this example we do not include constraints based on potential interaction with the open world. If this program were to be visible to the open world and potentially used by untyped Python clients, we would need to generate the additional constraints $\star<:\alpha$ and $\star<:\gamma$ in order to maintain open-world soundness, because the open world could pass arbitrary values into these functions (Vitousek et al., 2017).

3.2. Constraint Generation with Check Constraints

In this section we describe our approach to generating type constraints for programs in a transient calculus $\lambda^{\Downarrow}_{d}$ . Programs in $\lambda^{\Downarrow}_{d}$ are not the surface programs written by the programmer, and $\lambda^{\Downarrow}_{d}$ is not a gradually typed language. Instead, $\lambda^{\Downarrow}_{d}$ programs are the result of translating programs in a gradually typed surface language $\lambda^{\star}_{s}$ into $\lambda^{\Downarrow}_{d}$ . This translation, which along with the syntax for $\lambda^{\star}_{s}$ is shown in Figure 5, inserts transient checks throughout translated programs in order to enforce the type annotations present in the surface program, exactly as described by Vitousek et al. (2017). The $\lambda^{\Downarrow}_{d}$ calculus is analogous to the cast calculi in guarded gradual typing (Siek and Taha, 2006; Wadler and Findler, 2009; Herman et al., 2007) and the transient translation from $\lambda^{\star}_{s}$ to $\lambda^{\Downarrow}_{d}$ is nearly identical to the translation from the surface $\lambda^{\star}_{\to}$ calculus to the target $\lambda^{\Downarrow}_{\ell}$ calculus presented by Vitousek et al. (2017) (except that the calculi presented here elide features needed for blame tracking). The $\lambda^{\star}_{s}$ calculus includes functions and mutable references (with syntax $\texttt{ref}_{U}~{}s$ for introducing a reference with type $U$ , ${!}s$ for dereferencing, and $s{:=}s$ for mutation).

Figure 5 shows the syntax for $\lambda^{\Downarrow}_{d}$ , which supports all the features of $\lambda^{\star}_{s}$ as well as transient checks, written $d{\Downarrow}S$ . The meta-variable $d$ ranges over expressions of $\lambda^{\Downarrow}_{d}$ . In the dynamic semantics for $\lambda^{\Downarrow}_{d}$ (defined by translation into a third calculus $\lambda^{\to}_{e}$ in Figure 11 with evaluation rules given in Figure 14) such checks examine the value of an expression $d$ to determine if it corresponds to the type tag $S$ , and fails if not. Type tags, shown in Figure 5, correspond to type constructors. Functions and references are annotated with type variables.

To infer types for these type variables such that the overall program is well-typed, we first generate constraints using the syntax-directed rules defined in Figure 6, in the style of Aiken and Fähndrich (1995). These rules generate sets $\Omega$ of constraints $C$ over types $A$ , also defined in Figure 6. Types $A$ are not inductively defined—function and reference types can only contain type variables or $\star$ , not arbitrary types.

The rules in Figure 6 generate constraints. Subtyping constraints are generated from function and reference introduction and elimination sites, to ensure that any solution found for these variables is well-typed.

The rule for transient checks differs from the others. First, there is the question of what constraint type to give the result of a check. Consider the program $\lambda(x{:}\alpha){\to}\beta.~{}(x{\Downarrow}{{\to}})$ . In the body of the function $x$ has type $\alpha$ , but the type of the check expression $x{\Downarrow}{{\to}}$ ought to be a function, because the check will fail at runtime if $x$ is not a function. The check cannot, however, specify argument and return types. Therefore the type of $x{\Downarrow}{{\to}}$ is a function whose argument and return types are fresh type variables. This type is obtained using the $\rhd_{S}$ relation in Figure 6, where $S$ is the type tag checked against (in this case ${\to}$ ). If the type on the left already corresponds to $S$ , the type on the right is the same, but if it is a variable the right-hand side is a new type that corresponds to $S$ but is otherwise inhabited by fresh variables.

Checks do not generate subtype constraints: checking that something with type $\alpha$ is a function should not introduce the constraint $\alpha<:\beta\to\gamma$ , because the solution to $\alpha$ might not actually be a function. For example, if all values that flow into a variable with type $\alpha$ are integers, then at runtime this check will fail, which is an acceptable behavior for gradually typed programs. However, if only functions inhabit $x$ , then the argument and return types of those functions must be equal to $\beta$ and $\gamma$ respectively. Check expressions instead generate check constraints, written $(A_{1}{:}S)=A_{2}$ , which constrain the solution for $A_{2}$ so that, if the solution of $A_{1}$ corresponds to the type tag $S$ , then $A_{1}=A_{2}$ .

Note that these type-directed constraint generation rules show that $\lambda^{\Downarrow}_{d}$ is not a gradually typed language: for example, the application rule requires that the expression in function position has a function type, not that it be consistent with a function type. This is because the translation process in Figure 5 has inserted check expressions throughout the program already; any well-typed, closed $\lambda^{\star}_{s}$ terms can be translated to a well-typed $\lambda^{\Downarrow}_{d}$ term.

Theorem 1.

If $\emptyset\vdash s\leadsto d:U$ , then $\emptyset\vdash d:A;\Omega$ .

This lemma is an immediate corollary of Lemma 4, given in Appendix B.

3.2.1. Constraints from the open world

The constraint generation system in Figure 6 is sufficient to find a solution if the program does not interact with external code (a closed world), but not if the program can interact with code that may not know about or respect the types it expects. Vitousek et al. (2017) showed that transient check insertion ensures safety in open world contexts, but optimizing transient programs based only on internal information could result in the deletion of checks critical to preserving open-world safety.

Fortunately, Rastogi et al. (2012) observed that the overall type of a program will encode the information flows that it exchanges with the open world. Figure 7 shows additional constraints generated from the overall type of a program to protect it from the open world. Constraints such as $\star<:V$ constrain $V$ to be dynamic, while constraints like $V<:\star$ allow $V$ to be more specific types, but guarantee that any type variables that flow through $V$ in a contravariant position will be constrained to $\star$ . For example, given the constraints

[TABLE]

the rules shown below in Section 3.3 guarantee that $V_{2}$ will be constrained to $\star$ ; this is essential because $V_{2}$ is in a contravariant position, and if the a function with type $V_{2}\to V_{3}$ flows into the open world, the open world can pass whatever it wishes into $V_{2}$ . This also allows our analysis to be modular: individual modules can be optimized in isolation by making pessimistic assumptions about what kinds of values flow from one module to another.

3.3. Computing Constraint Solutions

We compute solutions $\sigma$ for constraint sets $\Omega$ with an approach based on the algorithm of Aiken and collaborators (Aiken and Fähndrich, 1995; Aiken et al., 1994; Aiken and Wimmers, 1993), but with the addition of check constraints, requiring constraint sets to be solved incrementally.

Figure 8 shows rules for simplifying constraint sets. These rules introduce three additional forms of constraints: equality constraints $A_{1}=A_{2}$ indicate equality between $A_{1}$ and $A_{2}$ (Hindley, 1969; Milner, 1978), tag constraints $\alpha:S$ indicate that the solution to the variable $\alpha$ must have the type constructor corresponding to $S$ , and definition constraints $\alpha\triangleq T$ constrain the solution of variables $\alpha$ to be exactly $T$ , which is a “full” inductive type as shown in Figure 8.

The first six rules decompose subtyping constraints, and are followed by rules for decomposing equalities. Equality constraints on variables $\alpha=A$ immediately become definition constraints $\alpha\triangleq A$ (exploiting the fact that all shallow types $A$ are syntactically also full types $T$ ) and result in $\alpha$ being substituted by $A$ in the rest of the constraint set. Tag constraints $\alpha:S_{1}$ and check constraints $(\alpha{:}S_{2})=A$ combine to generate equality constraints for $\alpha$ : if the tag constraint’s tag and the check constraint’s tag are equal ( $S_{1}=S_{2}$ ) then the constraint $\alpha=A$ is added. Otherwise, the leaves (or parts) of $A$ are constrained to be $\star$ , indicating that the system was unable to prove that the check that generated the check constraint will succeed. The next rule causes multiple check constraints on the same variable and tag to be combined, and finally, if the system contains a tag constraint but no check constraint on its variable, the variable is constrained to be a type with a constructor corresponding to $S$ but fresh variables in its leaves.

Figure 9 shows the solution algorithm $\Omega\Downarrow\sigma$ . This algorithm applies the simplification rules until exhaustion and then selects an unsolved variable $\alpha$ and determines its tag. The variable to be solved can only appear at the top level of subtyping constraints (e.g., $\alpha\to\beta<:\star\not\in\Omega$ ). Further, $\alpha$ must have only other variables or $\star$ as upper bounds—but this requirement is satisfied by all constraints generated from the rules in Figure 6. These conditions are specified by the $\Omega~{}\text{solvable}~{}\alpha$ relation in Figure 9. If these conditions hold, $\alpha$ ’s tag is the join of all the lower bounds of $\alpha$ (using the $\sqcup$ operator in Figure 9). The resulting tag constraint is then added to $\Omega$ and the result is simplified. This process terminates once $\Omega$ is only inhabited by definition constraints, and results in a substitution $\sigma$ generated from these constraints.

3.4. Check Removal

When a constraint set $\Omega$ is solved by a substitution $\sigma$ , the types in $\sigma$ can be relied on because they were inferred directly from the program. They may be more or less precise, or entirely different, from the programmer’s annotated types. Figure 11 shows the rules for translating the program to final target language, $\lambda^{\to}_{e}$ , which is defined in Figure 10. This translation uses $\sigma$ to decide which checks can be deleted, as shown in rules DCheckRemove, DCheckKeep, and DCheckFail: if the inferred type for the checked expression $d$ is found to be more or equally precise (with the $\preceq$ operator) than the tag it is checked against, then the check can be removed by DCheckRemove. If the type of $d$ is less precise (which is only the case when $d$ ’s type is $\star$ ), the check remains by DCheckKeep, and if $S$ and $d$ ’s type are unrelated, then the check will always fail at runtime, so by DCheckFail the check is replaced by fail, an expression which errors when evaluated. Since this expression always fails, it would be reasonable to additionally warn the programmer of the error at compile-time, and Reticulated Python’s implementation of this algorithm does so. However, the DCheckFail rule does not cause the program to be statically rejected, because this analysis is a runtime optimization that maintains the semantics of the gradually typed language, where a check would detect a runtime error and fail.

3.4.1. Soundness of constraint solving

To prove that the solution algorithm shown in Figure 9 generates valid solutions to constraint sets, we must first define what a solution to a constraint set $\Omega$ must consist of. A constraint set is solved by a mapping $\sigma$ if all the constraints in $\Omega$ are satisfied, and a subtyping constraint $A_{1}<:A_{2}$ is satisfied if $\vdash\sigma A_{1}<:\sigma A_{2}$ , where $\sigma A$ is the substitution of all variables in $A$ with their definitions in $\sigma$ , resulting in a type $T$ , and using the subtyping relation on $T$ defined in Figure 12. Note that the subtyping rules for types $T$ do not admit $\star$ as a universal supertype (i.e. $\top$ ): function types are only subtypes of $\star$ if the function is a subtype of $\star\to\star$ , which in turn requires the function’s source type to be $\star$ itself. This is required to ensure that function types that are passed into $\star$ cannot make any assumptions about what arguments are passed into them. Similar reasoning applies to why references are only subtypes of $\star$ if they are subtypes of $\textsf{ref}~{}\star$ .

A check constraint $(A_{1}{:}S)=A_{2}$ can be satisfied in one of two ways: first, if $\sigma A_{1}$ corresponds to the tag $S$ , then the check constraint is simply an equality constraint, and it is satisfied if $\sigma A_{1}$ is syntactically equal to $\sigma A_{2}$ , written $\vdash\sigma A_{1}=\sigma A_{2}$ . On the other hand, if $\sigma A_{1}$ does not correspond to $S$ , then all that can be known about $\sigma A_{2}$ is that it does correspond to $S$ , since the transient check that generated the constraint will fail if values flowing through it do not. If $S$ is ${\to}$ , then $\lfloor\sigma A_{2}\rfloor=~{}{\to}$ but the argument and return types of $\sigma A_{2}$ must be dynamic—the values flowing through the check may be from the open world, beyond the reach of the analysis. Likewise, reference types must be references to $\star$ if they are on the right of a check constraint with a mismatch between the checked type on the left and the tag.

Therefore, the definition of a solution $\sigma$ to $\Omega$ is as follows:

Definition 0.

A mapping $\sigma$ is a solution to $\Omega$ if:

(1)

For all $A_{1}<:A_{2}\in\Omega$ , $\vdash\sigma A_{1}<:\sigma A_{2}$ . 2. (2)

For all $(A_{1}{:}S)=A_{2}\in\Omega$ :

(a)

If $\lfloor\sigma A_{1}\rfloor=S$ , then $\vdash\sigma A_{1}=\sigma A_{2}$ . 2. (b)

Otherwise, for all $\alpha\in\mathit{parts}(A_{2})$ , $\vdash\sigma\alpha=\star$ . 3. (3)

For all $A_{1}=A_{2}\in\Omega$ , $\vdash\sigma A_{1}=\sigma A_{2}$ . 4. (4)

For all $\alpha\triangleq T\in\Omega$ , $\vdash\sigma\alpha=T$ . 5. (5)

For all $\alpha:S\in\Omega$ , $\lfloor\sigma\alpha\rfloor=S$ .

We can now prove that the solution algorithm in Figure 9 generates valid solutions.

Theorem 3.

If $\Omega\Downarrow\sigma$ , then $\sigma$ is a solution to $\Omega$ .

This proof is shown in Appendix B.5 and is by induction on $\Omega\Downarrow\sigma$ . It relies on a lemma showing that a solution to any $\Omega$ is also a solution for $\Omega^{\prime}$ if $\Omega^{\prime}\longrightarrow\Omega$ .

3.4.2. Correctness of check removal

To show that our our approach preserves the semantics of the program, we prove that any check that would be removed by the translation process (as given in Figure 11) cannot fail if it remained in the program. Given some $\lambda^{\Downarrow}_{d}$ program $d$ , suppose that the constraint generation process from Figure 6 gives $d$ the type $A$ (which may be a variable) and generates the constraints $\Omega$ , and assume that $\Omega$ is solved by some $\sigma$ . We can translate $d$ directly into $\lambda^{\to}_{e}$ by simply erasing its type annotations, without using $\sigma$ to perform the syntax-directed optimization process from Figure 11. This erased program $|d|$ , generated using the erasure rules defined in Figure 13, contains all the checks originally present in $d$ . Suppose that $|d|$ evaluates to a value using the small-step dynamic semantics for $\lambda^{\to}_{e}$ defined in Figure 14, and is then checked against the type tag of its solution, $\lfloor\sigma A\rfloor$ . We prove that this check will always succeed at runtime. This is the same criterion used to actually remove checks in Figure 11, so by showing that the checks that would be removed are redundant, we verify that they can be removed.

In this theorem, $d$ may be an open term— $\rho(|d|)$ substitutes values from an environment $\rho$ (defined and given a typing judgment in Figure 13) into $|d|$ .

Theorem 4.

Suppose $\Gamma\vdash d:A;\Omega$ and $\sigma$ is a solution to $\Omega$ and $\Sigma\vdash\rho:\sigma\Gamma$ and $\Sigma\vdash\mu$ and $\langle\rho(|d|),\mu\rangle\longrightarrow^{*}\langle v,\mu^{\prime}\rangle$ . If $\lfloor\sigma A\rfloor\preceq S$ , then $\langle v{\Downarrow}S,\mu^{\prime}\rangle\not\longrightarrow\mathtt{fail}$ .

This proof is shown in Appendix B.4. It relies on a preservation lemma and a lemma showing that, from the canonical forms lemma on $\lambda^{\to}_{e}$ , any value $v$ with type $\sigma A$ will necessarily correspond to that type.

4. Performance of Optimized Transient Gradual Typing

In this section we apply the above approach to optimize Reticulated Python, and summarize Reticulated’s performance characteristics when running on CPython. This required expanding the type system and constraint generation of Section 3 to handle Python features such as objects and classes, data structures such as lists and dictionaries, bound and unbound methods, and variadic functions. In addition, the constraint generation includes polymorphic functions and intersection types, although they only occur in the pre-loaded type definitions for Python libraries and builtin functions.222Link to repository removed for the purpose of double-blind review.

Figure 2, as previously discussed, shows the execution time and overheads for optimized configurations from the typing lattice of each benchmark when executed using CPython. Optimized configurations are shown as blue triangles. Performance is dramatically improved compared to the unoptimized (red circle) configurations. In several benchmarks, the overhead is entirely eliminated because the optimization is able to delete nearly every check in every configuration from the typing lattice. For these results, we make the closed world assumption for the benchmarks.

The suffixtree benchmark, which Takikawa et al. (2016) tested in Typed Racket and found overheads of up to 105 ${\scaleobj{1}{\times}}$ , also performs worse than other benchmarks in Reticulated Python after optimization: although it has negligible overhead in configurations with high type weight, some configurations with intermediate type weight still have an overhead of over 2 ${\scaleobj{1}{\times}}$ . This is because suffixtree, unlike the other benchmarks, cannot be fully statically typed using Reticulated Python’s type system: the version with the highest type weight, used to generate the other samples, still includes a function, node_follow, whose return type cannot be given a static type by the Reticulated Python type system or the inference process, because it can return either functions or booleans. Because node_follow’s return values flow into statically typed code, checks will be needed. In most configurations, checks occur when the result of node_follow passes into a statically typed function, and checks can be removed from the rest of the program. However, some configurations allow the dynamic values to flow further into the program before encountering a check; the dynamicity has “infected” more of the program and degraded performance.

Figure 15 summarizes the performance results for both optimized and unoptimized Reticulated Python under CPython. This table shows the mean overhead, maximum overhead, and overhead for the fully typed (or nearest to fully typed) configurations for each benchmark with the original unoptimized approach and with our optimization. Without optimization, the average of all configurations from each benchmark meets the cutoff of 3-deliverability as suggested by Takikawa et al. (2016), meaning that their overheads were 3 ${\scaleobj{1}{\times}}$ or less, but most static cases in the benchmarks are not 3-deliverable. Our optimization dramatically improves the results: not only are all configurations 3-deliverable, but all fully typed configurations pass the stricter cutoff of 1.25-deliverability, with slowdowns of 25% or less over the original untyped program. In all, we found that with the optimization, the average overhead across the typing lattices of all benchmarks was only 6%.

5. Performance on PyPy, a Tracing JIT

The analysis described in Section 3 and evaluated in Section 4 removed checks when they can be statically guaranteed to never fail, which suggests that a dynamic analysis could accomplish the same task. We examined this question using a tracing JIT implementation of Python 3, PyPy (Bolz et al., 2009).

Figure 16 shows the typing lattices for our benchmarks when run on PyPy, both with the standard and optimized transient approaches. Figure 17 summarizes these results. Without static check removal, PyPy’s performance varies but is almost always better than CPython’s relative to the baseline performance of the untyped benchmarks. PyPy performs on average 4.3 ${\scaleobj{1}{\times}}$ better than CPython on its own when comparing untyped benchmarks, so when examining the performance cost of transient gradual typing, we always compare to the untyped execution time for the implementation. In some benchmarks (float, nbody, sieve, spectral_norm) configurations across the typing lattice perform almost as well as the untyped version of the program without any static optimizations. In other cases (pystone, chaos, snake) performance still degrades as types are added, although to a lesser degree than with CPython. In one case, go, transient gradual typing significantly improves performance on average, suggesting that transient checks may cause the JIT compiler to activate earlier or with better traces than it would otherwise. All configurations were 3-deliverable and most were 1.25-deliverable even without optimization, with an overall mean slowdown of 3%, though some configurations have significant overhead (up to 2.61 ${\scaleobj{1}{\times}}$ ).

The best results were obtained by combining our optimization and the PyPy JIT. When run with optimized transient gradual typing, the average overhead was 0% over the baseline, and every configuration fell within the 1.25x-deliverable range. The result is an approach that appears practical for real-world applications. In future work, we will further examine the interactions between JITs and the transient approach, for example, to better understand the speedups seen in go.

Reticulated Python is not the only approach to gradual typing that can use a tracing JIT—Bauman et al. (2017) showed that Pycket, a language based on Typed Racket but implemented in RPython (a language for automatically generating tracing JITs that PyPy itself is implemented in) (Bolz et al., 2009), performed better than standard Typed Racket but still displayed worst-case overheads of up to 10.5 ${\scaleobj{1}{\times}}$ . Pycket uses the guarded strategy, and while the tracing JIT was successful at reducing the overhead of that approach, our results suggest that the transient enforcement strategy is especially suited to use with tracing JITs.

6. Related Work

Gradual type systems.

In our work, checks are removed when we infer that the types they verify can be trusted. This is suggestive of the strict confined gradual typing of Allende et al. (2014), which allows programmers to restrict types such that their inhabitants must never have passed through dynamic code (indicated by ${\downarrow}T$ ) or will never pass through dynamic code in the future (indicated by ${\uparrow}T$ ). If a term has type ${\downarrow}T$ , the type system verifies that value originated from an introduction form for values of that type. We suspect that this information could be used to remove transient checks or perform other optimizations.

Our approach is also related to concrete types (Wrigstad et al., 2010; Richards et al., 2015), which are inhabited only by non-proxied values (using the guarded cast strategy). Concrete types have limited interoperability with dynamic types and with like types, which are the types of values which may or may not be proxied. While the formulation of concrete vs. like types given by Wrigstad et al. (2010) is appropriate for the guarded semantics, splitting types into those which can be statically relied on and those which need runtime verification is similar to our approach.

Performance analysis for gradual typing.

Takikawa et al. (2016) performed the most detailed analysis of the effect of gradual typing on efficiency to date, in the context of Typed Racket, a mature gradually typed language. They introduced the typing lattice to evaluate gradually typed languages and found that the overhead of Typed Racket in some configurations was high enough to threaten the viability of gradual typing; our paper finds a more optimistic result in a different context and with a very different approach to gradual typing. Greenman and Migeed (2018) analyzed Reticulated Python programs across the typing lattice using a sampling-based methodology similar to ours, and reported performance results similar to those that we report in Section 2.

Muehlboeck and Tate (2017) designed a gradually typed language with nominal object types and without structural types or functions and examined its performance across the lattices of several benchmarks, finding negligible overhead.

Rastogi et al. (2012) analyzed the performance of ActionScript, a gradually typed language, by taking fully-typed benchmarks and removing all type annotations except for those on interfaces. They found that this resulted in significant overhead compared to the original fully-typed versions. They then used a inference-based optimization (discussed below) to reconstruct type annotations; this fully recovered performance in most benchmarks.

Type inference.

Aiken and Wimmers (1993) generalize equational constraints used in standard Hindley-Milner type inference (Hindley, 1969; Milner, 1978) to subset constraints $T\subseteq S$ . In this work types are interpreted as subsets of a semantic domain of values and the subset relation is equivalent to subtyping. Their type system includes union and intersection types and generates systems of constraints that may be simplified by rewriting, similar to the rules for constraint simplification shown in Figure 8. Aiken and Fähndrich (1995) specialize this approach to determine where coercions are needed in dynamically typed programs with tagging and untagging in order to optimize Scheme programs. This approach is similar to ours, except that while our type system is much simpler and does not include untagged types and values, transient checks must generate check constraints. Check constraints are similar to the conditional constraints of Pottier (2000), but rather than allowing arbitrary implications, check constraints reason exclusively about type tags.

Soft type systems (Cartwright and Fagan, 1991; Aiken et al., 1994) use a similar approach to integrating static and dynamic typing with type inference, but with a different goal: to allow programs written in dynamically typed languages to leverage the benefits of static typing. Soft type systems use type inference to determine where runtime type checks must be inserted into dynamically typed programs so they are well-typed in some static type system. Cartwright and Fagan (1991) reconstruct types for their language and determine where checks are needed using circular unification on equality constraints (Weis, 1987) over an encoding of the supertypes of each type in the program which factors out subtyping (Rémy, 1989). Aiken et al. (1994) adapt subset constraint generation to soft typing with similar results. The runtime checks, or narrowers, used in soft typing are similar to transient checks: a narrower checks that a value corresponds to a specific type constructor. The value is returned unmodified if so, and an error is raised if not. Narrowers serve a different purpose than checks, however: narrowers let programs written in dynamically typed languages pass static typechecking for optimization, while checks enforce the programmer’s claims about the types of terms.

The constraint system used by Flow’s type inference system, described for the Flowcore calculus by Chaudhuri et al. (2017), reasons about tags and tagchecks in order to find sound typings for JavaScript programs, though it relies on and trusts type annotations at module boundaries. Likewise Guha et al. (2011) relate type tags and types similarly to our approach and their tagchecks are equivalent to transient checks, but their goal is to insert the tagchecks needed to type function bodies with respect to their (trusted) annotations, rather than to detect violations of those annotations by untrusted callers.

Rastogi et al. (2012) present an approach to optimizing gradually typed programs by inferring more precise types for program annotations, while preserving the program’s semantics. Our approach to ensuring interoperability is based on theirs: visible variables in the overall type of a program and their co- or contravariant positions encodes escape analysis, and solutions that can soundly interoperate with arbitrary code can be generated by adding constraints on these variables. Our constraints, however, are based on subtyping rather than on consistency, because our constraints arise from checks and from elimination forms rather than from casts, which are appropriate for guarded gradual typing rather than transient.

7. Conclusions

Gradual typing allows programmers to combine static and dynamic typing in the same language, but allowing interaction between static and dynamic code while ensuring soundness incurs a runtime cost. Takikawa et al. (2016) found that this cost can be serious obstacle to the practical use of Typed Racket, a popular gradually typed language which uses the guarded approach to gradual typing. In this paper, we perform a detailed performance analysis of the transient approach in Reticulated Python by analyzing configurations from the typing lattices of ten benchmarks. We show that, in combination with the standard Python interpreter, performance under the transient design degrades as programs evolve from dynamic to static types, to a maximum of 6 ${\scaleobj{1}{\times}}$ slowdown compared to equivalent untyped Python programs. To reduce this overhead, we use an static type inference algorithm based on subtyping and check constraints to optimize programs after transient checks are inserted. This allows many redundant checks to be removed. We evaluated the performance of this approach with an implementation in Reticulated Python and found that performance across the typing lattices of our benchmarks improved to nearly the efficiency of the original programs—a very promising result for the practicality of gradual typing. Finally, we re-analyzed our Reticulated Python benchmarks using PyPy, a tracing JIT, as a backend, and found that it produced good performance even without type inference, and that it displayed a no overhead when used in combination with our static optimization.

Appendix A Appendix: Semantics

Figure 18 shows the static type system for $\lambda^{\star}_{s}$ . Figure 19 shows the shallow static type system for $\lambda^{\Downarrow}_{d}$ . Figure 20 relates surface types $U$ with constraint types $A$ .

Figure 21 shows the syntax for $\lambda^{\to}_{e}$ , the final target language of translation. Figure 22 defines the Curry-style type system for $\lambda^{\to}_{e}$ .

Figure 23 shows the dynamic semantics of $\lambda^{\to}_{e}$ , while utility relations are shown in Figure 24. Figure 25 relates weaker heap types with stronger ones.

Figure 26 shows rules for translating $\lambda^{\Downarrow}_{d}$ to $\lambda^{\to}_{e}$ directly by removing type annotations (without removing checks). It also shows definition and typing rules for value environments.

Appendix B Appendix: Proofs

B.1. Soundness of $\lambda^{\star}_{s}$

Lemma 0.

If $A_{1}\rhd_{\lfloor U\rfloor}A_{2}$ , then $U\approx A_{2}$ .

Proof.

By cases on $A_{1}\rhd_{\lfloor U\rfloor}A_{2}$ . ∎

Lemma 0.

Suppose $U\approx A$ .

(1)

If $U\rhd U_{1}\to U_{2}$ , then $A\rhd_{{\to}}V_{1}\to V_{2}$ . 2. (2)

If $U\rhd\textsf{ref}~{}U^{\prime}$ , then $A\rhd_{\textsf{ref}}\textsf{ref}~{}V$ . 3. (3)

If $U\sim\textsf{int}$ , then $A\rhd_{\textsf{int}}\textsf{int}$ .

Proof.

We prove part 1 by cases on $U$ . If $U=\star$ , then $A=V$ , and $V\rhd_{{\to}}{?}V\to{!}V$ . If $U=U_{1}\to U_{2}$ , then either $A=V$ and the theorem holds as above, or $A=\textsf{ref}~{}V_{1}{V_{2}}$ , and $A\rhd_{{\to}}V_{1}\to V_{2}$ .

The proofs of parts 2 and 3 are similar. ∎

Lemma 0.

If $\Gamma\vdash d:A;\Omega$ and for all $x\in\mathit{dom}(\Gamma)$ , $\Gamma^{\prime}(x)=\Gamma(x)$ , then $\Gamma^{\prime}\vdash d:A;\Omega$ .

Proof.

Induction on $\Gamma\vdash d:A;\Omega$ . ∎

Lemma 0.

If $\Gamma\vdash s\leadsto d:U$ and for all $x\in\mathit{dom}(\Gamma)$ , $\Gamma(x)\approx\Gamma^{\prime}(x)$ , then $\Gamma^{\prime}\vdash d:A;\Omega$ and $U\approx A$ .

Proof.

By induction on $\Gamma\vdash s\leadsto d:U$ .

**Case: **

UAbs:

[TABLE]

By IVar, $\Gamma^{\prime},x:X\vdash x:X;\emptyset$ .

Have that $X\rhd_{\lfloor U_{1}\rfloor}A_{1}$ .

By ICheck, $\Gamma^{\prime},x:X\vdash x{\Downarrow}\lfloor U_{1}\rfloor:A_{1};\emptyset$ .

By Lemma 1, $U_{1}\approx A_{1}$ .

By the IH, $\Gamma^{\prime},x{:}A_{1}\vdash d:A_{2};\Omega$ and $U_{2}^{\prime}\approx A_{2}$ .

By Lemma 3, $\Gamma^{\prime},x{:}X,x{:}A_{1}\vdash d:A_{2};\Omega$ .

By ILet, $\Gamma^{\prime},x{:}X\vdash\texttt{let}~{}x=x{\Downarrow}\lfloor U_{1}\rfloor~{}\texttt{in}~{}d:A_{2};\Omega$ .

By IAbs, $\Gamma^{\prime}\vdash\lambda(x{:}X){\to}Y.~{}\texttt{let}~{}x=x{\Downarrow}\lfloor U_{1}\rfloor~{}\texttt{in}~{}d:X\to Y;\Omega,A_{2}<:Y$ .

Have that $U_{1}\to U_{2}\approx X\to Y$ .

**Case: **

UApp:

[TABLE]

By the IH, $\Gamma^{\prime}\vdash d_{1}:A_{1};\Omega_{1}$ and $U\approx A_{1}$ .

By Lemma 2, $A_{1}\rhd_{{\to}}V_{1}\to V_{2}$ .

By ICheck, $\Gamma^{\prime}\vdash d_{1}{\Downarrow}{\to}:V_{1}\to V_{2}$ .

By the IH, $\Gamma^{\prime}\vdash d_{2}:A_{2};\Omega_{2}$ and $U_{1}^{\prime}\approx A_{2}$ .

By IApp, $\Gamma^{\prime}\vdash(d_{1}{\Downarrow}{\to})~{}d_{2}:V_{2};\Omega_{1},\Omega_{2},A_{2}<:V_{1}$ .

Have that $V_{2}\rhd_{\lfloor U_{2}\rfloor}A_{3}$ .

By ICheck, $\Gamma^{\prime}\vdash((d_{1}{\Downarrow}{\to})~{}d_{2}){\Downarrow}\lfloor U_{2}\rfloor:A_{3};\Omega_{1},\Omega_{2},A_{2}<:V_{1}$ .

By Lemma 1, $U_{2}\approx A_{3}$ .

**Case: **

URef:

[TABLE]

By the IH, $\Gamma^{\prime}\vdash d:A;\Omega$ and $U_{2}\approx A$ .

By IRef, $\Gamma^{\prime}\vdash\texttt{ref}_{X}~{}d:\textsf{ref}~{}X;\Omega,A<:X$ .

Have that $\textsf{ref}~{}U\approx\textsf{ref}~{}X$ .

**Case: **

UDeref:

[TABLE]

By the IH, $\Gamma^{\prime}\vdash d:A_{1};\Omega$ and $U\approx A_{1}$ .

By Lemma 2, $A_{1}\rhd_{\textsf{ref}}\textsf{ref}~{}V$ .

By ICheck, $\Gamma^{\prime}\vdash d{\Downarrow}\textsf{ref}:\textsf{ref}~{}V;\Omega$ .

By IDeref, $\Gamma^{\prime}\vdash{!}(d{\Downarrow}\textsf{ref}):V;\Omega$ .

Have that $V\rhd_{\lfloor U^{\prime}\rfloor}A_{2}$ .

By ICheck, $\Gamma^{\prime}\vdash{!}(d{\Downarrow}\textsf{ref}){\Downarrow}\lfloor U^{\prime}\rfloor:A_{2};\Omega$ .

By Lemma 1, $U^{\prime}\approx A_{2}$ .

**Case: **

UUpdt:

[TABLE]

By the IH, $\Gamma^{\prime}\vdash d_{1}:A_{1};\Omega_{1}$ and $U\approx A_{1}$ .

By Lemma 2, $A_{1}\rhd_{\textsf{ref}}\textsf{ref}~{}V$ .

By ICheck, $\Gamma^{\prime}\vdash d_{1}{\Downarrow}\textsf{ref}:\textsf{ref}~{}V;\Omega_{1}$ .

By the IH, $\Gamma^{\prime}\vdash d_{2}:A_{2};\Omega_{2}$ and $U^{\prime\prime}\approx A_{2}$ .

By IUpdt, $\Gamma^{\prime}\vdash d_{1}{\Downarrow}\textsf{ref}{:=}d_{2}:\textsf{int};\Omega_{1},\Omega_{2},A_{2}<:V$ .

**Case: **

UAdd:

[TABLE]

By the IH, $\Gamma^{\prime}\vdash d_{1}:A_{1};\Omega_{1}$ and $U_{1}\approx A_{1}$ .

By Lemma 2, $A_{1}\rhd_{\textsf{int}}\textsf{int}$ .

By ICheck, $\Gamma^{\prime}\vdash d_{1}{\Downarrow}\textsf{int}:\textsf{int};\Omega_{1}$ .

By the IH, $\Gamma^{\prime}\vdash d_{2}:A_{2};\Omega_{2}$ and $U_{2}\approx A_{2}$ .

By Lemma 2, $A_{2}\rhd_{\textsf{int}}\textsf{int}$ .

By ICheck, $\Gamma^{\prime}\vdash d_{2}{\Downarrow}\textsf{int}:\textsf{int};\Omega_{2}$ .

By IAdd, $\Gamma^{\prime}\vdash d_{1}{\Downarrow}\textsf{int}~{}+~{}d_{2}{\Downarrow}\textsf{int}:\textsf{int};\Omega_{1},\Omega_{2}$ .

**Case: **

UVar:

[TABLE]

Have that $\Gamma^{\prime}(x)=A$ and $U\approx A$ .

By IVar, $\Gamma^{\prime}\vdash x:A;\emptyset$ .

**Case: **

UInt: Immediate.

∎

B.2. Soundness of $\lambda^{\Downarrow}_{d}$

Lemma 0.

If $\sigma$ is a solution to $\Omega_{1}\cup\Omega_{2}$ , then $\sigma$ is a solution to $\Omega_{1}$ and $\sigma$ is a solution to $\Omega_{2}$ .

Proof.

Since $\sigma$ is a solution for every constraint in $\Omega$ , and for all $C\in\Omega_{1}$ , $C\in\Omega$ , so $\sigma$ is a solution for every constraint in $\Omega_{1}$ , so it is a solution to $\Omega_{1}$ . Likewise for $\Omega_{1}$ . ∎

Lemma 0.

If $\vdash T_{1}<:T_{2}$ and $\vdash T_{2}<:T_{3}$ , then $\vdash T_{1}<:T_{3}$ .

Proof.

Straightforward induction. ∎

Lemma 0.

If $\lfloor T_{1}\rfloor\preceq S$ and $\vdash T_{2}<:T_{1}$ , then $\lfloor T_{2}\rfloor\preceq S$ .

Proof.

Cases on $T_{1}$ . ∎

Lemma 0.

If $\Gamma\vdash d:A;\Omega$ and $\sigma$ is a solution for $\Omega$ , then $\Gamma;\sigma\vdash d\leadsto e:T$ and $\vdash T<:\sigma A$ .

Proof.

By induction on $\Gamma\vdash d:A;\Omega$

**Case: **

IVar:

[TABLE]

Have that $\Gamma(x)=A$ .

By DVar, $\Gamma;\sigma\vdash x\leadsto x:\sigma A$ .

**Case: **

IAbs:

[TABLE]

Since $\sigma$ is a solution for $\Omega\cup\{A<:\beta\}$ , by Lemma 5, $\sigma$ is a solution for $\Omega$ .

By the IH, $\Gamma,x{:}\alpha;\sigma\vdash d\leadsto e:T$ and $\vdash T^{\prime}<:\sigma A$ .

Since $\sigma$ is a solution to $\Omega,A<:\beta$ , $\vdash\sigma A<:\sigma\beta$ .

By Lemma 6, $\vdash T^{\prime}<:\sigma\beta$ .

By DAbs, $\Gamma;\sigma\vdash\lambda(x{:}\alpha){\to}\beta.~{}d\leadsto\lambda x.~{}e:\sigma\alpha\to\sigma\beta$ .

**Case: **

IApp:

[TABLE]

Since $\sigma$ is a solution for $\Omega_{1},\Omega_{2},A_{1}<:V_{1},A<:V_{1}\to V_{2}$ , by Lemma 5, $\sigma$ is a solution for $\Omega_{1}$ and $\sigma$ is a solution for $\Omega_{2}$ .

By the IH, $\Gamma;\sigma\vdash d_{1}\leadsto e_{1}:T_{1}$ and $\vdash T_{1}<:\sigma V_{1}\to\sigma V_{2}$ .

Therefore $T_{1}=T_{11}\to T_{12}$ and $\vdash\sigma V_{1}<:T_{11}$ and $\vdash T_{12}<:\sigma V_{2}$ .

By the IH, $\Gamma;\sigma\vdash d_{2}\leadsto e_{2}:T_{2}$ and $\vdash T_{2}<:\sigma A$ .

Since $\sigma$ is a solution to $\Omega,A<:V_{1}$ , $\vdash\sigma A<:\sigma V_{1}$ .

By Lemma 6, $\vdash T_{2}<:T_{11}$ .

By DApp, $\Gamma;\sigma\vdash d_{1}~{}d_{2}\leadsto(e_{1}~{}e_{2})^{\scaleobj{.8}{\lozenge}}:T_{12}$ .

**Case: **

ICheck:

[TABLE]

By the IH, $\Gamma;\sigma\vdash d\leadsto e:T$ and $\vdash T<:\sigma A_{1}$ .

If $S=\star$ , then $A_{2}=A_{1}$ , and by DCheckRemove, $\Gamma;\sigma\vdash d{\Downarrow}S\leadsto e:T$ .

We proceed by cases on $A_{1}$ and $\lfloor\sigma A_{1}\rfloor$ .

**Case: **

$A_{1}\neq\alpha$ and $S=\lfloor\sigma A_{1}\rfloor$ :

Then $S=\lfloor A_{1}\rfloor$ .

Then $A_{2}=A_{1}$ .

By Lemma 7, $S=\lfloor T\rfloor$ .

By DCheckRemove, $\Gamma;\sigma\vdash d{\Downarrow}S\leadsto e:T$ .

**Case: **

$A_{1}\neq\alpha$ and $S$ is not the constructor of $\sigma A_{1}$ : Vacuous, since $S\neq\star$ .

**Case: **

$A_{1}=\alpha$ and $S$ is the constructor of $\sigma A_{1}$ :

Then $\sigma A_{1}=\sigma A_{2}$ .

Therefore $\vdash T<:\sigma A_{2}$ .

By Lemma 7, $\lfloor T\rfloor\preceq S$ .

By DCheckRemove, $\Gamma;\sigma\vdash d{\Downarrow}S\leadsto e:T$ .

**Case: **

$A_{1}=\alpha$ and $S$ is not the constructor of $\sigma A_{1}$ :

Since $\sigma$ is a solution for $\Omega\cup\{(A_{1}{:}S)=A_{2}\}$ , for all $\beta\in\mathit{parts}(A_{2})$ , $\sigma\beta=\star$ .

By the definition of $\rhd_{S}$ , since $S\neq\star$ , $\lfloor A_{2}\rfloor=S$ .

Therefore $\sigma A_{2}=\lceil S\rceil$ .

If $T=\star$ , then by DCheckKeep, $\Gamma;\sigma\vdash d{\Downarrow}S\leadsto e{\Downarrow}S:\lceil S\rceil$ .

Otherwise, by DCheckFail, $\Gamma;\sigma\vdash d{\Downarrow}S\leadsto\mathtt{fail}:\lceil S\rceil$ .

**Case: **

IRef:

[TABLE]

By the IH, $\Gamma;\sigma\vdash d\leadsto e:T^{\prime}$ and $\vdash T^{\prime}<:\sigma A$ .

Since $\sigma$ is a solution to $\Omega\cup\{A<:\alpha\}$ , $\vdash\sigma A<:\sigma\alpha$ .

By Lemma 6, $\vdash T^{\prime}<:\sigma\alpha$ .

By DRef, $\Gamma;\sigma\vdash\texttt{ref}_{\alpha}~{}d\leadsto\texttt{ref}~{}e:\textsf{ref}~{}\sigma\alpha$ .

**Case: **

IDeref:

[TABLE]

By the IH, $\Gamma;\sigma\vdash d\leadsto e:T$ and $\vdash T<:\textsf{ref}~{}\sigma V$ .

Therefore $T=\textsf{ref}~{}T^{\prime}$ and $\vdash T^{\prime}<:\sigma V$ .

By DDeref, $\Gamma;\sigma\vdash{!}d\leadsto{!}e^{{\scaleobj{.8}{\lozenge}}}:T^{\prime}$ .

**Case: **

IUpdt:

[TABLE]

Since $\sigma$ is a solution to $\Omega_{1}\cup\Omega_{2}\cup\{A<:V\}$ , by Lemma 5, $\sigma$ is a solution to $\Omega_{1}$ and $\sigma$ is a solution to $\Omega_{2}$ and $\sigma$ is a solution to $\{A<:V\}$ .

By the IH, $\Gamma;\sigma\vdash d_{1}\leadsto e_{1}:T_{1}$ and $\vdash T_{1}<:\textsf{ref}~{}\sigma V$ .

Therefore $T_{1}=\textsf{ref}~{}T_{1}^{\prime}$ and $\vdash\sigma V<:T_{1}^{\prime}$

By the IH, $\Gamma;\sigma\vdash d_{2}\leadsto e_{2}:T_{2}$ and $\vdash T_{2}<:\sigma A$ .

Since $\sigma$ is a solution to $\{A<:V\}$ , $\vdash\sigma A<:\sigma V$ .

By Lemma 6, $\vdash T_{2}<:T_{1}^{\prime}$ .

By DDeref, $\Gamma;\sigma\vdash d_{1}{:=}d_{2}\leadsto e_{1}{:=}^{{\scaleobj{.8}{\lozenge}}}e_{2}:\textsf{int}$ .

**Case: **

IAdd:

[TABLE]

Since $\sigma$ is a solution to $\Omega_{1}\cup\Omega_{2}$ , by Lemma 5, $\sigma$ is a solution to $\Omega_{1}$ and $\sigma$ is a solution to $\Omega_{2}$ .

By the IH, $\Gamma;\sigma\vdash d_{1}\leadsto e_{1}:T_{1}$ and $\vdash T_{1}<:\textsf{int}$ .

By the IH, $\Gamma;\sigma\vdash d_{2}\leadsto e_{2}:T_{2}$ and $\vdash T_{2}<:\textsf{int}$ .

Therefore $T_{1}=T_{2}=\textsf{int}$ .

Therefore by DAdd, $\Gamma;\sigma\vdash d_{1}~{}+~{}d_{2}\leadsto(e_{1}~{}+~{}e_{2})^{\scaleobj{.8}{\lozenge}}:\textsf{int}$ .

**Case : **

IInt: Immediate by DInt.

∎

Lemma 0.

If $\Gamma\vdash d:A;\Omega_{1}$ and $\vdash A:\Omega_{2}$ and $\sigma$ is a solution for $\Omega_{1}\cup\Omega_{2}$ , then $\Gamma;\sigma\vdash d\leadsto e:T$ and $\vdash T<:\sigma A$ .

Proof.

By Lemma 5, $\sigma$ is a solution for $\Omega_{1}$ .

By Lemma 8, $\Gamma;\sigma\vdash d\leadsto e:T$ and $\vdash T<:\sigma A$ . ∎

Lemma 0.

If $\Gamma;\sigma\vdash d\leadsto e:T$ , then $\sigma\Gamma;\emptyset\vdash e:T$ .

Proof.

By induction on $\Gamma;\sigma\vdash d\leadsto e:T$ .

**Case : **

OAbs:

[TABLE]

By the IH, $\sigma\Gamma,x{:}\sigma\alpha{;}\emptyset\vdash e:T$ .

By TSubsump, $\sigma\Gamma,x{:}T_{1}{;}\emptyset\vdash e:\sigma\beta$ .

By TAbs, $\sigma\Gamma{;}\emptyset\vdash\lambda x.~{}e:\sigma\alpha\to\sigma\beta$ .

**Case : **

OLet:

[TABLE]

By the IH, $\sigma\Gamma{;}\emptyset\vdash e_{1}:T_{1}$ .

By the IH, $\sigma\Gamma,x{:}T_{1}{;}\emptyset\vdash e_{2}:T_{2}$ .

By TLet, $\sigma\Gamma{;}\emptyset\vdash\texttt{let}~{}x=e_{1}~{}\texttt{in}~{}e_{2}:T_{2}$ .

**Case : **

OApp:

[TABLE]

By the IH, $\sigma\Gamma{;}\emptyset\vdash e_{1}:T_{1}\to T_{2}$ .

By the IH, $\sigma\Gamma{;}\emptyset\vdash e_{2}:T_{1}^{\prime}$ .

By TSubsump, $\sigma\Gamma{;}\emptyset\vdash e_{2}:T_{2}$ .

By TApp, $\sigma\Gamma{;}\emptyset\vdash(e_{1}~{}e_{2})^{\scaleobj{.8}{\lozenge}}:T_{2}$ .

**Case : **

ORef:

[TABLE]

By the IH, $\sigma\Gamma{;}\emptyset\vdash e:T$ .

By TSubsump, $\sigma\Gamma{;}\emptyset\vdash e:\sigma\alpha$ .

By TRef, $\sigma\Gamma{;}\emptyset\vdash\texttt{ref}~{}e:\textsf{ref}~{}\sigma\alpha$ .

**Case : **

ODeref:

[TABLE]

By the IH, $\sigma\Gamma{;}\emptyset\vdash e:\textsf{ref}~{}T$ .

By TDeref, $\sigma\Gamma{;}\emptyset\vdash{!}e^{{\scaleobj{.8}{\lozenge}}}:T$ .

**Case : **

OUpdt:

[TABLE]

By the IH, $\sigma\Gamma{;}\emptyset\vdash e_{1}:\textsf{ref}~{}T$ .

By the IH, $\sigma\Gamma{;}\emptyset\vdash e_{2}:T^{\prime}$ .

By TSubsump, $\sigma\Gamma{;}\emptyset\vdash e_{2}:T$ .

By TDeref, $\sigma\Gamma{;}\emptyset\vdash e_{1}{:=}^{{\scaleobj{.8}{\lozenge}}}e_{2}:\textsf{int}$ .

**Case : **

OVar:

[TABLE]

Have that $\sigma\Gamma(x)=\sigma A$ .

By TVar, $\sigma\Gamma{;}\emptyset\vdash x:\sigma A$ .

**Case : **

OInt: Immediate from TInt.

**Case : **

OAdd:

[TABLE]

By the IH, $\sigma\Gamma{;}\emptyset\vdash e_{1}:\textsf{int}$ .

By the IH, $\sigma\Gamma{;}\emptyset\vdash e_{2}:\textsf{int}$ .

By TAdd, $\sigma\Gamma{;}\emptyset\vdash e_{1}~{}+^{\scaleobj{.8}{\lozenge}}~{}e_{2}:\textsf{int}$ .

**Case : **

OCheckRemove:

[TABLE]

Immediate from the IH.

**Case : **

OCheckKeep:

[TABLE]

By the IH, $\sigma\Gamma{;}\emptyset\vdash e:\star$ .

By TCheck, $\sigma\Gamma{;}\emptyset\vdash e{\Downarrow}S:\lceil S\rceil$ .

**Case : **

OCheckFail:

[TABLE]

Immediate from TFail.

∎

B.3. Soundness of $\lambda^{\to}_{e}$

Lemma 0 (Inversion).

Suppose $\Gamma{;}\Sigma\vdash e:T$ . Then:

•

If $e=\lambda x.~{}e$ , then there exists $T_{1}$ such that $\Gamma,x{:}T_{1}{;}\Sigma\vdash e:T_{2}$ and $\vdash T_{1}\to T_{2}<:T$ .

•

If $e=a$ , then $\Sigma(a)=T^{\prime}$ and $\vdash\textsf{ref}~{}T^{\prime}<:T$ .

•

If $e=n$ , then $\vdash\textsf{int}<:T$ .

•

If $e=e{\Downarrow}S$ , then either:

(1)

$\Gamma{;}\Sigma\vdash e:\star$ * and $\vdash\lceil S\rceil<:T$ , or* 2. (2)

$\Gamma{;}\Sigma\vdash e:T^{\prime}$ * and $\lfloor T^{\prime}\rfloor\preceq S$ and $\vdash T^{\prime}<:T$ , or* 3. (3)

$\Gamma{;}\Sigma\vdash e:T^{\prime\prime}$ * and $\lfloor T^{\prime}\rfloor\not\preceq S$ and $T^{\prime\prime}\neq\star$ .*

•

If $e=x$ , then $\Gamma(x)=T^{\prime}$ and $\vdash T^{\prime}<:T$ .

•

If $e=(e_{1}~{}e_{2})^{\scaleobj{.8}{\lozenge}}$ , then $\Gamma{;}\Sigma\vdash e_{1}:T_{1}\to T_{2}$ and $\Gamma{;}\Sigma\vdash e_{2}:T_{1}$ and $\vdash T_{2}<:T$ .

•

If $e=(e_{1}~{}e_{2})^{\scaleobj{.8}{\blacklozenge}}$ , then $\Gamma{;}\Sigma\vdash e_{1}:\star$ and $\Gamma{;}\Sigma\vdash e_{2}:\star$ and $\vdash\star<:T$ .

•

If $e=\texttt{let}~{}x=e_{1}~{}\texttt{in}~{}e_{2}$ , then $\Gamma{;}\Sigma\vdash e_{1}:T_{1}$ and $\Gamma{,}x:T_{1}{;}\Sigma\vdash e_{2}:T_{2}$ and $\vdash T_{2}<:T$ .

•

If $e=\texttt{ref}~{}e$ , then $\Gamma{;}\Sigma\vdash e:T^{\prime}$ and $\vdash\textsf{ref}~{}T^{\prime}<:T$ .

•

If $e={!}e^{{\scaleobj{.8}{\lozenge}}}$ , then $\Gamma{;}\Sigma\vdash e:\textsf{ref}~{}T^{\prime}$ and $\vdash T^{\prime}<:T$ .

•

If $e={!}e^{{\scaleobj{.8}{\blacklozenge}}}$ , then $\Gamma{;}\Sigma\vdash e:\star$ and $\vdash\star<:T$ .

•

If $e=e_{1}{:=}^{{\scaleobj{.8}{\lozenge}}}e_{2}$ , then $\Gamma{;}\Sigma\vdash e_{1}:\textsf{ref}~{}T^{\prime}$ and $\Gamma{;}\Sigma\vdash e_{2}:T^{\prime}$ and $\vdash\textsf{int}<:T$ .

•

If $e=e_{1}{:=}^{{\scaleobj{.8}{\blacklozenge}}}e_{2}$ , then $\Gamma{;}\Sigma\vdash e_{1}:\star$ and $\Gamma{;}\Sigma\vdash e_{2}:\star$ and $\vdash\textsf{int}<:T$ .

•

If $e=e_{1}~{}+^{\scaleobj{.8}{\lozenge}}~{}e_{2}$ , then $\Gamma{;}\Sigma\vdash e_{1}:\textsf{int}$ and $\Gamma{;}\Sigma\vdash e_{2}:\textsf{int}$ and $\vdash\textsf{int}<:T$ .

•

If $e=e_{1}~{}+^{\scaleobj{.8}{\blacklozenge}}~{}e_{2}$ , then $\Gamma{;}\Sigma\vdash e_{1}:\star$ and $\Gamma{;}\Sigma\vdash e_{2}:\star$ and $\vdash\textsf{int}<:T$ .

Proof.

Induction on $\Gamma{;}\Sigma\vdash e:R$ . ∎

Lemma 0 (Canonical forms).

Suppose $\emptyset{;}\Sigma\vdash v:T$ and $\Sigma\vdash\mu$ .

(1)

If $T=\textsf{int}$ , then $v=n$ . 2. (2)

If $T=T_{1}\to T_{2}$ , then $v=\lambda x.~{}e$ . 3. (3)

If $T=\textsf{ref}~{}T^{\prime}$ , then $v=a$ and $\mu(a)=v^{\prime}$ . 4. (4)

If $T=\star$ , then $\exists T^{\prime}$ , $T^{\prime}\neq\star$ , such that $\emptyset{;}\Sigma\vdash v:T^{\prime}$ .

Proof.

We prove each part separately.

(1)

We prove by induction on $\emptyset{;}\Sigma\vdash v:\textsf{int}$ . Most cases vacuous.

**Case : **

TInt

[TABLE]

Immediate.

**Case : **

TSubsump

[TABLE]

Since $\vdash T_{1}<:\textsf{int}$ , $T_{1}=\textsf{int}$ .

By the IH, $v=n$ . 2. (2)

We prove by induction on $\emptyset{;}\Sigma\vdash v:T_{1}\to T_{2}$ . Most cases vacuous.

**Case : **

TAbs

[TABLE]

Immediate.

**Case : **

TSubsump

[TABLE]

Since $\vdash T^{\prime}<:T_{1}\to T_{2}$ , $T^{\prime}=T_{1}^{\prime}\to T_{2}^{\prime}$ .

By the IH, $v=\lambda x.~{}e$ . 3. (3)

We prove by induction on $\emptyset{;}\Sigma\vdash v:\textsf{ref}~{}T^{\prime}$ . Most cases vacuous.

**Case : **

TAddr

[TABLE]

Immediately have $v=a$ . Since $\Sigma(a)=T^{\prime}$ , exists $v^{\prime}$ such that $\mu(a)=v^{\prime}$ .

**Case : **

TSubsump

[TABLE]

Since $\vdash T^{\prime\prime}<:\textsf{ref}~{}T^{\prime}$ , $T^{\prime\prime}=\textsf{ref}~{}T^{\prime\prime\prime}$ .

By the IH, $v=a$ and $\mu(a)=v^{\prime}$ . 4. (4)

We prove by induction on $\emptyset{;}\Sigma\vdash v:\star$ . Most cases vacuous.

**Case : **

TSubsump

[TABLE]

If $T^{\prime}=\star$ , then we apply the IH to find that $\exists T^{\prime\prime}$ , $T^{\prime\prime}\neq\star$ , such that $\emptyset{;}\Sigma\vdash v:T^{\prime\prime}$ .

If $T^{\prime}\neq\star$ , then immediate.

∎

Lemma 0 (Heap weakening).

If $\Gamma{;}\Sigma\vdash e:T$ and $\Sigma^{\prime}\sqsubseteq\Sigma$ , then $\Gamma{;}\Sigma^{\prime}\vdash e:T$ .

Proof.

By induction on $\Gamma{;}\Sigma\vdash e:T$ . Only interesting case:

**Case : **

TAddr:

[TABLE]

Because $\Sigma^{\prime}\sqsubseteq\Sigma$ , $\Sigma^{\prime}(a)=T$ .

By TAddr, $\Gamma{;}\Sigma\vdash a:\textsf{ref}~{}T$ .

∎

Lemma 0 (Heap extension).

If $\Sigma\vdash\mu$ and $\emptyset{;}\Sigma{,}a{:}T\vdash v:T$ and $a\not\in\textit{dom}(\Sigma)$ , then $\Sigma{,}a{:}T\vdash\mu[a:=v]$ .

Proof.

Since $a\not\in\textit{dom}(\Sigma)$ , for all $a^{\prime}\in\textit{dom}(\Sigma)$ , $\Sigma(a^{\prime})=(\Sigma{,}a{:}T)(a^{\prime})$ .

Therefore $\Sigma{,}a{:}T\sqsubseteq\Sigma$ .

Suppose $a^{\prime}\in\textit{dom}(\Sigma{,}a{:}T)$ . If $a=a^{\prime}$ , then immediately $\emptyset{;}\Sigma{,}a{:}T\vdash\mu[a:=v](a):(\Sigma{,}a{:}T)(a)$ .

If $a\neq a^{\prime}$ , then $\emptyset{;}\Sigma\vdash\mu(a^{\prime}):\Sigma(a^{\prime})$ .

Immediately have $\mu(a^{\prime})=\mu[a:=v](a^{\prime})$ and $\Sigma(a^{\prime})=(\Sigma{,}a{:}T)(a^{\prime})$ .

By Lemma 13, $\emptyset{;}\Sigma{,}a{:}T\vdash\mu[a:=v](a^{\prime}):(\Sigma{,}a{:}T)(a^{\prime})$ .

Therefore, $\Sigma{,}a{:}T\vdash\mu[a:=v]$ . ∎

Lemma 0 (Substitution).

If $\Gamma{,}x{:}T_{1}{;}\Sigma\vdash e:T_{2}$ and $\Gamma{;}\Sigma\vdash v:T_{1}$ , then $\Gamma{;}\Sigma\vdash e[x/v]:T_{2}$ .

Proof.

By induction on $\Gamma{,}x{:}T_{1}{;}\Sigma\vdash e:T_{2}$ . Only interesting cases:

**Case: **

TVar:

[TABLE]

If $y\neq x$ , then $\Gamma(x)=T_{2}$ . Then by TVar, $\Gamma{;}\Sigma\vdash y:T_{2}$ .

If $y=x$ , then $y[x/v]=v$ and $(\Gamma{,}x{:}T_{1})(x)=T_{1}$ , so $T_{1}=T_{2}$ . Have immediately that $\Gamma{;}\Sigma\vdash v:T_{2}$ .

**Case: **

TAbs:

[TABLE]

If $y=x$ , then $(\lambda y.~{}e)[x/v]=\lambda y.~{}e$ and $\Gamma{,}x{:}T_{1}{,}y{:}T_{1}^{\prime}\equiv\Gamma{,}y{:}T_{1}^{\prime}$ .

Therefore $\Gamma{,}y{:}T_{1}^{\prime}{;}\Sigma\vdash e:T_{2}^{\prime}$ .

By TAbs, $\Gamma{;}\Sigma\vdash\lambda y.~{}e:T_{1}^{\prime}\to T_{2}^{\prime}$ .

If $y\neq x$ , then $\Gamma{,}x{:}T_{1}{,}y{:}T_{1}^{\prime}\equiv\Gamma{,}y{:}T_{1}^{\prime}{,}x{:}T_{1}$ .

Therefore $\Gamma{,}y{:}T_{1}^{\prime}{,}x{:}T_{1}{;}\Sigma\vdash e:T_{2}^{\prime}$ .

By the IH, $\Gamma{,}y{:}T_{1}^{\prime}\Sigma\vdash e[x/v]:T_{2}^{\prime}$ .

By TAbs, $\Gamma{;}\Sigma\vdash\lambda y.~{}e[x/v]:T_{1}^{\prime}\to T_{2}^{\prime}$ .

**Case: **

TLet:

[TABLE]

By the IH, $\Gamma{;}\Sigma\vdash e_{1}[x/v]:T^{\prime}$ .

If $y=x$ , then $(\texttt{let}~{}y=e_{1}~{}\texttt{in}~{}e_{2})[x/v]=\texttt{let}~{}y=e_{1}[x/v]~{}\texttt{in}~{}e_{2}$ and $\Gamma{,}x{:}T_{1}{,}y{:}T^{\prime}\equiv\Gamma{,}y{:}T^{\prime}$ .

Therefore $\Gamma{,}y{:}T^{\prime}{;}\Sigma\vdash e_{2}:T_{2}$ .

By TLet, $\Gamma{;}\Sigma\vdash\texttt{let}~{}y=e_{1}[x/v]~{}\texttt{in}~{}e_{2}:T_{2}$ .

If $y\neq x$ , then $\Gamma{,}x{:}T_{1}{,}y{:}T^{\prime}\equiv\Gamma{,}y{:}T^{\prime}{,}x{:}T_{1}$ .

Therefore $\Gamma{,}y{:}T^{\prime}{,}x{:}T_{1}{;}\Sigma\vdash e_{2}:T_{2}$ .

By the IH, $\Gamma{,}y{:}T^{\prime}\Sigma\vdash e_{2}[x/v]:T_{2}$ .

By TLet, $\Gamma{;}\Sigma\vdash\texttt{let}~{}y=e_{1}[x/v]~{}\texttt{in}~{}e_{2}[x/v]:T_{2}$ .

∎

Lemma 0.

If $\emptyset;\Sigma\vdash v:T$ and $\lfloor T\rfloor\not\preceq S$ and $S\not\preceq\lfloor T\rfloor$ , then $\neq\textit{hastype}(v,S)$ .

Proof.

By cases on $T$ .

**Case: **

$T=\textsf{int}$ : By Lemma 12, $v=n$ . Have that $S\not\in\{\textsf{int},\star\}$ , so $\neg\textit{hastype}(n,S)$ .

**Case: **

$T=T_{1}\to T_{2}$ : By Lemma 12, $v=\lambda x.~{}e$ . Have that $S\not\in\{{\to},\star\}$ , so $\neg\textit{hastype}(\lambda x.~{}e,S)$ .

**Case: **

$T=\textsf{ref}~{}T^{\prime}$ : By Lemma 12, $v=a$ . Have that $S\not\in\{\textsf{ref},\star\}$ , so $\neg\textit{hastype}(a,S)$ .

**Case: **

$T=\star$ : Vacuous.

∎

Lemma 0 (Preservation).

Suppose $\emptyset{;}\Sigma\vdash e:T$ and $\Sigma\vdash\mu$ . If $\langle e,\mu\rangle\longrightarrow\langle e^{\prime},\mu^{\prime}\rangle$ , then $\emptyset{;}\Sigma^{\prime}\vdash e^{\prime}:T$ and $\Sigma^{\prime}\vdash\mu^{\prime}$ and $\Sigma^{\prime}\sqsubseteq\Sigma$ .

Proof.

By induction on $\langle e,\mu\rangle\longrightarrow\langle e^{\prime},\mu^{\prime}\rangle$ .

**Case : **

ECheck:

[TABLE]

By Lemma 11, we have three cases:

**Case: **

$\emptyset;\Sigma\vdash v:T^{\prime}$ and $\lfloor T^{\prime}\rfloor\preceq S$ and $\vdash T^{\prime}<:T$ :

Immediate by subsumption.

**Case: **

$\emptyset;\Sigma\vdash v:T^{\prime\prime}$ and $\lfloor T^{\prime}\rfloor\not\preceq S$ and $T^{\prime\prime}\neq\star$ :

Vacuous, by Lemma 16.

**Case: **

$\emptyset{;}\Sigma\vdash v{\Downarrow}S:\lceil S\rceil$ and $\emptyset{;}\Sigma\vdash v:\star$ .

We proceed by cases on $S$ :

**Subcase : **

$S=\star$ : Then $\lceil S\rceil=\star$ , and the theorem holds.

**Subcase : **

$S=\textsf{int}$ : Then $\lceil S\rceil=\textsf{int}$ . Because $\textit{hastype}(v,\textsf{int})$ , $v=n$ . Thus by TInt, $\emptyset{;}\Sigma\vdash v:\textsf{int}$ .

**Subcase : **

$S=\to$ : Then $\lceil S\rceil=\star\to\star$ .

Because $\textit{hastype}(v,\to)$ , $v=\lambda x.~{}e$ .

By Lemma 11, for some $T_{1},T_{2}$ have $\emptyset{,}x{:}T_{1}{;}\Sigma\vdash e:T_{2}$ and $\vdash T_{1}\to T_{2}<:\star$ .

Then have that $\vdash T_{2}<:\star$ and $\vdash\star<:T_{1}$ , and hence $T_{1}=\star$ .

By TSubsump, $\emptyset{,}x{:}\star{;}\Sigma\vdash e:\star$ .

Therefore $\emptyset{;}\Sigma\vdash\lambda x.~{}e:\star\to\star$ .

**Subcase : **

$S=\textsf{ref}$ : Then $\lceil S\rceil=\textsf{ref}~{}\star$ .

Because $\textit{hastype}(v,\to)$ , $v=a$ .

By Lemma 11, for some $T^{\prime}$ have $\Sigma(a)=T^{\prime}$ and $\vdash\textsf{ref}~{}T^{\prime}<:\star$ .

Then have that $\vdash T^{\prime}<:\star$ and $\vdash\star<:T^{\prime}$ , and hence $T^{\prime}=\star$ .

Therefore by TAddr $\emptyset{;}\Sigma\vdash a:\textsf{ref}~{}\star$ .

**Case : **

ECheckFail: Vacuous.

**Case : **

EFail: Vacuous.

**Case : **

ERef:

[TABLE]

By Lemma 11, for some $T^{\prime}$ have $\emptyset{;}\Sigma\vdash v:T^{\prime}$ and $\vdash\textsf{ref}~{}T^{\prime}<:T$ .

Let $\Sigma^{\prime}=\Sigma{,}a{:}T^{\prime}$ .

Then by TAddr, $\emptyset{;}\Sigma^{\prime}\vdash a:\textsf{ref}~{}T^{\prime}$ .

By TSubsump, $\emptyset{;}\Sigma^{\prime}\vdash a:T$ .

Since $a$ is fresh, $\Sigma^{\prime}\sqsubseteq\Sigma$ .

By Lemma 13, $\emptyset{;}\Sigma^{\prime}\vdash v:T^{\prime}$ .

By Lemma 14, $\Sigma^{\prime}\vdash\mu[x:=v]$ .

**Case : **

EApp:

[TABLE]

We proceed by cases on $w$ .

**Subcase : **

$w={\scaleobj{.8}{\lozenge}}$ :

By Lemma 11, for some $T_{1},T_{2}$ have $\emptyset{;}\Sigma\vdash\lambda x.~{}e:T_{1}\to T_{2}$ and $\emptyset{;}\Sigma\vdash v:T_{1}$ and $\vdash T_{2}<:T$ .

By Lemma 11, for some $T_{1}^{\prime},T_{2}^{\prime}$ have $\emptyset{,}x{:}T_{1}^{\prime}{;}\Sigma\vdash e:T_{2}^{\prime}$ and $\vdash T_{1}^{\prime}\to T_{2}^{\prime}<:T_{1}\to T_{2}$ .

Hence $\vdash T_{1}<:T_{1}^{\prime}$ and $\vdash T_{2}^{\prime}<:T_{2}$ .

By TSubsump, $\emptyset{;}\Sigma\vdash v:T_{1}^{\prime}$ .

By Lemma 15, $\emptyset{;}\Sigma\vdash e[x/v]:T_{2}^{\prime}$ .

By TSubsump, $\emptyset{;}\Sigma\vdash e[x/v]:T_{2}$ , and by TSubsump again $\emptyset{;}\Sigma\vdash e[x/v]:T$ .

**Subcase : **

$w={\scaleobj{.8}{\blacklozenge}}$ :

By Lemma 11, have $\emptyset{;}\Sigma\vdash\lambda x.~{}e:\star$ and $\emptyset{;}\Sigma\vdash v:\star$ and $\vdash\star<:T$ .

Therefore $\star=T$ .

By Lemma 11, for some $T_{1},T_{2}$ have $\emptyset{,}x{:}T_{1}{;}\Sigma\vdash e:T_{2}$ and $\vdash T_{1}\to T_{2}<:\star$ .

Hence $\vdash\star<:T_{1}$ , and therefore $T_{1}=\star$ , and $\vdash T_{2}<:\star$ .

By Lemma 15, $\emptyset{;}\Sigma\vdash e[x/v]:T_{2}$ .

By TSubsump, $\emptyset{;}\Sigma\vdash e[x/v]:\star$ .

**Case : **

ELet:

[TABLE]

By Lemma 11, for some $T_{1},T_{2}$ have $\emptyset{;}\Sigma\vdash v:T_{1}$ and $\emptyset{,}x{:}T_{1}{;}\Sigma\vdash e:T_{2}$ and $\vdash T_{2}<:T$ .

By Lemma 15, $\emptyset{;}\Sigma\vdash e[x/v]:T_{2}$ .

By TSubsump, $\emptyset{;}\Sigma\vdash e[x/v]:T$ .

**Case : **

EDeref:

[TABLE]

We proceed by cases on $w$ .

**Subcase : **

$w={\scaleobj{.8}{\lozenge}}$ :

By Lemma 11, for some $T^{\prime}$ have $\emptyset{;}\Sigma\vdash a:\textsf{ref}~{}T^{\prime}$ and $\vdash T^{\prime}<:T$ .

By Lemma 11, $\Sigma(a)=T^{\prime\prime}$ and $\vdash\textsf{ref}~{}T^{\prime\prime}<:\textsf{ref}~{}T^{\prime}$ .

Hence $\vdash T^{\prime}<:T^{\prime\prime}$ and $\vdash T^{\prime\prime}<:T^{\prime}$ .

Since $\Sigma\vdash\mu$ , $\emptyset{;}\Sigma\vdash\mu(a):T^{\prime\prime}$ . By TSubsump, $\emptyset{;}\Sigma\vdash\mu(a):T^{\prime}$ , and by TSubsump again $\emptyset{;}\Sigma\vdash\mu(a):T$ .

**Subcase : **

$w={\scaleobj{.8}{\blacklozenge}}$ :

By Lemma 11, have $\emptyset{;}\Sigma\vdash a:\star$ and $\vdash\star<:T$ .

Therefore $\star=T$ .

By Lemma 11, $\Sigma(a)=T^{\prime}$ and $\vdash\textsf{ref}~{}T^{\prime}<:\star$ .

Hence $\vdash T^{\prime}<:\star$ and $\vdash\star<:T^{\prime}$ , so $T^{\prime}=\star$ .

Since $\Sigma\vdash\mu$ , $\emptyset{;}\Sigma\vdash\mu(a):\star$ .

**Case : **

EUpdt:

[TABLE]

By TInt, $\emptyset{;}\Sigma\vdash 0:\textsf{int}$ .

We continue by cases on $w$ .

**Subcase : **

$w={\scaleobj{.8}{\lozenge}}$ :

By Lemma 11, for some $T^{\prime}$ have $\emptyset{;}\Sigma\vdash a:\textsf{ref}~{}T^{\prime}$ and $\emptyset{;}\Sigma\vdash v:T^{\prime}$ and $\vdash\textsf{int}<:T$ .

By TSubsump, $\emptyset{;}\Sigma\vdash 0:T$ . By Lemma 11, $\Sigma(a)=T^{\prime\prime}$ and $\vdash\textsf{ref}~{}T^{\prime\prime}<:\textsf{ref}~{}T^{\prime}$ .

Hence $\vdash T^{\prime}<:T^{\prime\prime}$ and $\vdash T^{\prime\prime}<:T^{\prime}$ .

By TSubsump, $\emptyset{;}\Sigma\vdash v:T^{\prime\prime}$ .

Therefore $\Sigma\vdash\mu[a:=v]$ .

**Subcase : **

$w={\scaleobj{.8}{\blacklozenge}}$ :

By Lemma 11, have $\emptyset{;}\Sigma\vdash a:\star$ and $\emptyset{;}\Sigma\vdash v:\star$ and $\vdash\textsf{int}<:T$ .

By TSubsump, $\emptyset{;}\Sigma\vdash 0:T$ . By Lemma 11, $\Sigma(a)=T^{\prime}$ and $\vdash\textsf{ref}~{}T^{\prime}<:\star$ .

Hence $\vdash T^{\prime}<:\star$ and $\vdash\star<:T^{\prime}$ , so $T^{\prime}=\star$ .

Therefore $\Sigma\vdash\mu[a:=v]$ .

**Case : **

EAdd:

[TABLE]

By Lemma 11 (applying once for each case on $w$ ), $\vdash\textsf{int}<:T$ .

Immediately have $\emptyset{;}\Sigma\vdash n^{\prime}:\textsf{int}$ .

By TSubsump, $\emptyset{;}\Sigma\vdash n^{\prime}:T$ .

∎

Lemma 0 (Multi-step preservation).

Suppose $\emptyset{;}\Sigma\vdash e:T$ and $\Sigma\vdash\mu$ . If $\langle e,\mu\rangle\longrightarrow*\langle e^{\prime},\mu^{\prime}\rangle$ , then $\emptyset{;}\Sigma^{\prime}\vdash e^{\prime}:T$ and $\Sigma^{\prime}\vdash\mu^{\prime}$ and $\Sigma^{\prime}\sqsubseteq\Sigma$ .

Proof.

By induction on $\langle e,\mu\rangle\longrightarrow*\langle e^{\prime},\mu^{\prime}\rangle$ .

**Cases: **

where $\langle e,\mu\rangle\longrightarrow^{*}\mathtt{fail}$ are vacuous.

**Case: **

$\langle e,\mu\rangle\longrightarrow^{*}\langle e,\mu\rangle$ : Immediate.

**Case: **

[TABLE]

By Lemma 17, $\emptyset;\Sigma^{\prime}\vdash e^{\prime}:T$ and $\Sigma^{\prime}\vdash\mu^{\prime}$ and $\Sigma^{\prime}\sqsubseteq\Sigma$ .

By the IH, $\emptyset;\Sigma^{\prime\prime}\vdash e^{\prime\prime}:T$ and $\Sigma^{\prime\prime}\vdash\mu^{\prime\prime}$ and $\Sigma^{\prime\prime}\sqsubseteq\Sigma^{\prime}$ .

By transitivity of equality on types, $\Sigma^{\prime\prime}\sqsubseteq\Sigma$ .

∎

Lemma 0 (Progress).

Suppose $\emptyset{;}\Sigma\vdash e:T$ and $\Sigma\vdash\mu$ . Then either

•

$\langle e,\mu\rangle\longrightarrow\langle e^{\prime},\mu^{\prime}\rangle$ ,

•

$\langle e,\mu\rangle\longrightarrow\mathtt{fail}$ ,

•

$e$ * is a value, or*

•

$\langle e,\mu\rangle~{}\textsf{stuck}~{}{\scaleobj{.8}{\blacklozenge}}$ .

Proof.

By induction on $\emptyset{;}\Sigma\vdash e:T$ .

For each case, if there exists some $E,e^{\prime}$ with $e^{\prime}$ not a value such that $e=E[e^{\prime}]$ , then by the IH, $e^{\prime}$ is either a value, it steps to fail or another expression, or it is an error blaming ${\scaleobj{.8}{\blacklozenge}}$ . If it steps to an expression, then $e$ steps to an expression by EStep. If it steps to fail, then $e$ steps to fail by EFail. If $\langle e^{\prime},\mu\rangle~{}\textsf{stuck}~{}{\scaleobj{.8}{\blacklozenge}}$ , then $\langle e,\mu\rangle~{}\textsf{stuck}~{}{\scaleobj{.8}{\blacklozenge}}$ .

We now proceed to each case, assuming that no such $E,e^{\prime}$ exists.

**Cases : **

TAbs, TAddr, and TInt: Immediately have $e=v$ .

**Case : **

TVar: Vacuous.

**Case : **

TSubsump: with $T=T_{2}$ ,

[TABLE]

Immediate from the IH.

**Case : **

TCheck: with $T=\lceil S\rceil$ ,

[TABLE]

Assume $e^{\prime}=v$ . Then either $\textit{hastype}(v,S)$ or $\neg\textit{hastype}(v,S)$ .

In the former case, by ECheck, $\langle v{\Downarrow}S,\mu\rangle\longrightarrow\langle v,\mu\rangle$ .

Otherwise, by ECheckFail, $\langle v{\Downarrow}S,\mu\rangle\longrightarrow\mathtt{fail}$ .

**Case : **

TRedundantCheck:

[TABLE]

Assume $e^{\prime}=v$ . Then either $\textit{hastype}(v,S)$ or $\neg\textit{hastype}(v,S)$ .

In the former case, by ECheck, $\langle v{\Downarrow}S,\mu\rangle\longrightarrow\langle v,\mu\rangle$ .

Otherwise, by ECheckFail, $\langle v{\Downarrow}S,\mu\rangle\longrightarrow\mathtt{fail}$ .

**Case : **

TFailCheck:

[TABLE]

Assume $e^{\prime}=v$ . Then either $\textit{hastype}(v,S)$ or $\neg\textit{hastype}(v,S)$ .

In the former case, by ECheck, $\langle v{\Downarrow}S,\mu\rangle\longrightarrow\langle v,\mu\rangle$ .

Otherwise, by ECheckFail, $\langle v{\Downarrow}S,\mu\rangle\longrightarrow\mathtt{fail}$ .

**Case : **

TFail:

[TABLE]

Immediately by EFail, $\langle\mathtt{fail},\mu\rangle\longrightarrow\mathtt{fail}$ .

**Case : **

TRef: with $T=\textsf{ref}~{}T^{\prime}$ ,

[TABLE]

Assume $e^{\prime}=v$ .

By ERef, with $a$ fresh, $\langle\texttt{ref}~{}v,\mu\rangle\longrightarrow\langle a,\mu[a:=v]\rangle$ .

**Case : **

TApp: with $T=T_{2}$ ,

[TABLE]

Assume $e_{1}=v_{1}$ and $e_{2}=v_{2}$ .

By Lemma 12, $v_{1}=\lambda x.~{}e_{1}^{\prime}$ .

By EApp, $\langle((\lambda x.~{}e_{1}^{\prime})~{}v_{2})^{\scaleobj{.8}{\lozenge}},\mu\rangle\longrightarrow\langle e_{1}^{\prime}[x/v_{2}],\mu\rangle$ .

**Case : **

TAppOW: with $T=\star$ ,

[TABLE]

Assume $e_{1}=v_{1}$ and $e_{2}=v_{2}$ .

Have that $v_{1}\in\{a,n,\lambda x.~{}e_{1}^{\prime}\}$ .

If $v_{1}=a$ or $v_{1}=n$ , $\langle(v_{1}~{}v_{2})^{\scaleobj{.8}{\blacklozenge}},\mu\rangle~{}\textsf{stuck}~{}{\scaleobj{.8}{\blacklozenge}}$ .

Otherwise, $v_{1}=\lambda x.~{}e_{1}^{\prime}$ and $\langle((\lambda x.~{}e_{1}^{\prime})~{}v_{2})^{\scaleobj{.8}{\blacklozenge}},\mu\rangle\longrightarrow\langle e_{1}^{\prime}[x/v_{2}],\mu\rangle$ .

**Case : **

TLet: with $T=T_{2}$ ,

[TABLE]

Assume $e_{1}=v$ .

By ELet, $\langle\texttt{let}~{}x=v~{}\texttt{in}~{}e_{2},\mu\rangle\longrightarrow\langle e_{2}[x/v],\mu\rangle$ .

**Case : **

TAdd: with $T=\textsf{int}$ ,

[TABLE]

Assume $e_{1}=v_{1}$ and $e_{2}=v_{2}$ .

By Lemma 12, $v_{1}=n_{1}$ and $v_{2}=n_{2}$ .

By EAdd, with $n^{\prime}=n_{1}+n_{2}$ , $\langle n_{1}~{}+^{\scaleobj{.8}{\lozenge}}~{}n_{2},\mu\rangle\longrightarrow\langle n^{\prime},\mu\rangle$ .

**Case : **

TAddOW: with $T=\textsf{int}$ ,

[TABLE]

Assume $e_{1}=v_{1}$ and $e_{2}=v_{2}$ .

Have that $v_{1}\in\{a,n_{1},\lambda x.~{}e_{1}^{\prime}\}$ .

If $v_{1}=a$ or $v_{1}=\lambda x.~{}e$ , $\langle e_{1}~{}+^{\scaleobj{.8}{\blacklozenge}}~{}e_{2},\mu\rangle~{}\textsf{stuck}~{}{\scaleobj{.8}{\blacklozenge}}$ .

Otherwise $v_{1}=n_{1}$ .

By the same reasoning, either $\langle e_{1}~{}+^{\scaleobj{.8}{\blacklozenge}}~{}e_{2},\mu\rangle~{}\textsf{stuck}~{}{\scaleobj{.8}{\blacklozenge}}$ or $v_{2}=n_{2}$ .

By EAdd, with $n^{\prime}=n_{1}+n_{2}$ , $\langle n_{1}~{}+^{\scaleobj{.8}{\lozenge}}~{}n_{2},\mu\rangle\longrightarrow\langle n^{\prime},\mu\rangle$ .

**Case : **

TDeref:

[TABLE]

Assume $e^{\prime}=v$ .

By Lemma 12, $v=a$ and $\mu(a)=v^{\prime}$ .

By EDeref, $\langle{!}a^{{\scaleobj{.8}{\lozenge}}},\mu\rangle\longrightarrow\langle\mu(a),\mu\rangle$ .

**Case : **

TDerefOW: with $T=\star$ ,

[TABLE]

Assume $e^{\prime}=v$ .

Have that $v\in\{a,n,\lambda x.~{}e_{1}^{\prime}\}$ .

If $v=n$ or $v=\lambda x.~{}e$ , $\langle{!}e^{\prime{\scaleobj{.8}{\blacklozenge}}},\mu\rangle~{}\textsf{stuck}~{}{\scaleobj{.8}{\blacklozenge}}$ .

Otherwise $v=a$ .

If $a\not\in\textit{dom}(\mu)$ , then $\langle{!}a^{{\scaleobj{.8}{\blacklozenge}}},\mu\rangle~{}\textsf{stuck}~{}{\scaleobj{.8}{\blacklozenge}}$ .

Otherwise, by EDeref, $\langle{!}a^{{\scaleobj{.8}{\lozenge}}},\mu\rangle\longrightarrow\langle\mu(a),\mu\rangle$ .

**Case : **

TUpdt: with $T=\textsf{int}$ ,

[TABLE]

Assume $e_{1}=v_{1}$ and $e_{2}=v_{2}$ .

By Lemma 12, $v_{1}=a$ .

By EUpdt, $\langle a{:=}^{{\scaleobj{.8}{\lozenge}}}v_{2},\mu\rangle\longrightarrow\langle 0,\mu[a:=v_{2}]\rangle$ .

**Case : **

TDerefOW: with $T=\textsf{int}$ ,

[TABLE]

Assume $e_{1}=v_{1}$ and $e_{2}=v_{2}$ .

Have that $v_{1}\in\{a,n,\lambda x.~{}e_{1}^{\prime}\}$ .

If $v_{1}=n$ or $v_{1}=\lambda x.~{}e$ , $\langle v_{1}{:=}^{{\scaleobj{.8}{\blacklozenge}}}v_{2},\mu\rangle~{}\textsf{stuck}~{}{\scaleobj{.8}{\blacklozenge}}$ .

Otherwise $v_{1}=a$ .

If $a\not\in\textit{dom}(\mu)$ , then $\langle a{:=}^{{\scaleobj{.8}{\blacklozenge}}}v_{2},\mu\rangle~{}\textsf{stuck}~{}{\scaleobj{.8}{\blacklozenge}}$ .

Otherwise, by EDeref, $\langle a{:=}^{{\scaleobj{.8}{\blacklozenge}}}v_{2},\mu\rangle\longrightarrow\langle 0,\mu[a:=v_{2}]\rangle$ .

∎

Corollary 0.

If $\emptyset\vdash d:A;\Omega$ and $\sigma$ is a solution for $\Omega$ , then:

•

$\emptyset\vdash\sigma d\leadsto e:T$ , and

•

$\emptyset;\emptyset\vdash e:T$ , and

•

if $\langle e,\emptyset\rangle\longrightarrow^{*}\langle v,\mu\rangle$ , then $\Sigma\vdash\mu$ and $\emptyset;\Sigma\vdash v:T$ and $\vdash T<:\sigma A$ .

Proof.

By Lemma 9, $\emptyset\vdash\sigma d:T$ and $\vdash T<:\sigma A$ .

By Lemma 10, $\emptyset\vdash\sigma d\leadsto e:T$ .

If for all $\varsigma$ such that $\langle e,\emptyset\rangle\longrightarrow\varsigma$ , there exists some $\varsigma^{\prime}$ such that $\varsigma\longrightarrow\varsigma^{\prime}$ , then the theorem is satisfied.

Otherwise, there exists some $\varsigma$ such that $\varsigma\not\longrightarrow\varsigma^{\prime}$ .

If $\varsigma=\mathtt{fail}$ , then the theorem is satisfied.

Otherwise, $\varsigma=\langle e^{\prime},\mu\rangle$ .

By repeating Lemma 17, $\emptyset;\Sigma\vdash e^{\prime}:T$ and $\Sigma\vdash\mu$ .

By Lemma 19, either $e^{\prime}=v$ or $\langle e,\mu\rangle~{}\textsf{stuck}~{}{\scaleobj{.8}{\blacklozenge}}$ . ∎

B.4. Analysis correctness

Lemma 0.

If $\Gamma\vdash d:A;\Omega$ and $\sigma$ is a solution for $\Omega$ , then $\sigma\Gamma;\emptyset\vdash|d|:\sigma A$ .

Proof.

By induction on $\Gamma\vdash d:A;\Omega$ .

**Case: **

IVar:

[TABLE]

Have that $\sigma\Gamma(x)=\sigma A$ .

By TVar, $\sigma\Gamma;\emptyset\vdash x:\sigma A$ .

**Case: **

IAbs:

[TABLE]

Since $\sigma$ is a solution for $\Omega\cup\{A<:\beta\}$ , by Lemma 5, $\sigma$ is a solution for $\Omega$ .

By the IH, $\sigma\Gamma,x{:}\sigma\alpha;\emptyset\vdash|d|:\sigma A$ .

Since $\sigma$ is a solution to $\Omega\cup\{A<:Y\}$ , $\vdash\sigma A<:\sigma\beta$ .

By TSubsump, $\sigma\Gamma,x{:}\sigma\alpha;\emptyset\vdash|d|:\sigma\beta$ .

By TAbs, $\sigma\Gamma;\emptyset\vdash\lambda x.~{}|d|:\sigma\alpha\to\sigma\beta$ .

**Case: **

IApp:

[TABLE]

Since $\sigma$ is a solution for $\Omega_{1}\cup\Omega_{2}\cup\{A<:V_{1}\}$ , by Lemma 5, $\sigma$ is a solution for $\Omega_{1}$ and $\sigma$ is a solution for $\Omega_{2}$ and $\sigma$ is a solution for $A<:V_{1}$ .

By the IH, $\sigma\Gamma;\emptyset\vdash|d_{1}|:\sigma V_{1}\to\sigma V_{2}$ .

By the IH, $\sigma\Gamma;\emptyset\vdash|d_{2}|:\sigma A$ .

Since $\sigma$ is a solution to $\{A<:V_{1}\}$ , $\vdash\sigma A<:\sigma V_{1}$ .

By TSubsump, $\sigma\Gamma;\emptyset\vdash|d_{2}|:\sigma V_{1}$ .

By TApp, $\sigma\Gamma;\emptyset\vdash(|d_{1}|~{}|d_{2}|)^{\scaleobj{.8}{\lozenge}}:\sigma V_{2}$ .

**Case: **

ICheck:

[TABLE]

By the IH, $\sigma\Gamma;\emptyset\vdash|d|:\sigma A_{1}$ .

If $S=\star$ then $A_{2}=A_{1}$ , and by TRedundantCheck, $\sigma\Gamma;\emptyset\vdash|d|{\Downarrow}S:\sigma A_{2}$ .

Otherwise, we proceed by cases on $A_{1}$ and $\sigma A_{1}$ .

**Case: **

$A_{1}\neq V$ and $S$ is the constructor of $\sigma A_{1}$ :

Then $S$ is the constructor of $A_{1}$ .

Then $A_{2}=A_{1}$ .

By TRedundantCheck, $\sigma\Gamma;\emptyset\vdash|d|{\Downarrow}S:\sigma A_{2}$ .

**Case: **

$A_{1}\neq V$ and $S$ is not the constructor of $\sigma A_{1}$ : Vacuous, since $S\neq\star$ .

**Case: **

$A_{1}=V$ and $S$ is the constructor of $\sigma A_{1}$ :

Then $\sigma A_{1}=\sigma A_{2}$ .

By TRedundantCheck, $\sigma\Gamma;\emptyset\vdash|d|{\Downarrow}S:\sigma A_{2}$ .

**Case: **

$A_{1}=V$ and $S$ is not the constructor of $\sigma A_{1}$ :

Since $\sigma$ is a solution to $\Omega$ , for all $\alpha\in\mathit{parts}(A_{2})$ of $A_{2}$ , $\sigma\alpha=\star$ .

Therefore $\lceil S\rceil=\sigma A_{2}$ .

Cases on $\vdash\sigma A_{1}<:\star$ :

**Subcase: **

$\vdash\sigma A_{1}<:\star$ :

By TSubsump, $\sigma\Gamma;\emptyset\vdash|d|:\star$ .

By TCheck, $\sigma\Gamma;\emptyset\vdash|d|{\Downarrow}S:\lceil S\rceil$ .

**Subcase: **

$\vdash\sigma A_{1}\not<:\star$ :

Since $S$ is not the constructor of $\sigma A_{1}$ and $S\neq\star$ , $\lfloor\sigma A_{1}\rfloor\not\preceq S$ .

By TFailCheck, $\sigma\Gamma;\emptyset\vdash|d|{\Downarrow}S:\lceil S\rceil$ .

**Case: **

IRef:

[TABLE]

By the IH, $\sigma\Gamma;\emptyset\vdash|d|:\sigma A$ .

Since $\sigma$ is a solution to $\Omega,A<:X$ , $\vdash\sigma A<:\sigma X$ .

By TSubsump, $\sigma\Gamma;\emptyset\vdash|d|:\sigma X$ .

By TRef, $\sigma\Gamma;\emptyset\vdash\texttt{ref}~{}|d|:\textsf{ref}~{}\sigma X$ .

**Case: **

IDeref:

[TABLE]

By the IH, $\sigma\Gamma;\emptyset\vdash|d|:\textsf{ref}~{}\sigma V$ .

By TDeref, $\sigma\Gamma;\emptyset\vdash{!}|d|^{{\scaleobj{.8}{\lozenge}}}:\sigma V$ .

**Case: **

IUpdt:

[TABLE]

Since $\sigma$ is a solution to $\Omega_{1}\cup\Omega_{2}\cup\{A<:V\}$ , by Lemma 5, $\sigma$ is a solution to $\Omega_{1}$ and $\sigma$ is a solution to $\Omega_{2}$ and $\sigma$ is a solution to $\{A<:V\}$ .

By the IH, $\sigma\Gamma;\emptyset\vdash|d_{1}|:\textsf{ref}~{}\sigma V$ .

By the IH, $\sigma\Gamma;\emptyset\vdash|d_{2}|:\sigma A$ .

Since $\sigma$ is a solution to $\{A<:V\}$ , $\vdash\sigma A<:\sigma V$ .

By TSubsump, $\sigma\Gamma;\emptyset\vdash|d_{2}|:\sigma V$ .

By TUpdt, $\sigma\Gamma;\emptyset\vdash|d_{1}|{:=}^{{\scaleobj{.8}{\lozenge}}}|d_{2}|:\textsf{int}$ .

**Case: **

IAdd:

[TABLE]

Since $\sigma$ is a solution to $\Omega_{1}\cup\Omega_{2}$ , by Lemma 5, $\sigma$ is a solution to $\Omega_{1}$ and $\sigma$ is a solution to $\Omega_{2}$ .

By the IH, $\sigma\Gamma;\emptyset\vdash|d_{1}|:\textsf{int}$ .

By the IH, $\sigma\Gamma;\emptyset\vdash|d_{2}|:\textsf{int}$ .

Therefore by TAdd, $\sigma\Gamma;\emptyset\vdash|d_{1}|~{}+~{}|d_{2}|:\textsf{int}$ .

**Case : **

IInt: Immediate by TInt.

∎

Lemma 0.

If $\Gamma;\Sigma\vdash e:T$ and for all $x\in\mathit{dom}(\Gamma)$ , $\Gamma^{\prime}(x)=\Gamma(x)$ , then $\Gamma^{\prime};\Sigma\vdash e:T$ .

Proof.

Induction on $\Gamma;\Sigma\vdash e:T$ . The only interesting cases are variables, where the correspondence between $\Gamma$ and $\Gamma^{\prime}$ ensure that the result is the same, and functions, where we can immediately show that for all $x\in\mathit{dom}(\Gamma,y:T)$ , $(\Gamma^{\prime},y:T)(x)=(\Gamma,y:T)(x)$ . ∎

Lemma 0.

If $\Gamma;\Sigma\vdash e:T$ and $\Sigma\vdash\rho:\Gamma$ , then $\emptyset;\Sigma\vdash\rho(e):T$ .

Proof.

By induction on $\Sigma\vdash\rho:\Gamma$ .

**Case : **

[TABLE]

Have that $\rho(e)=e$ .

Immediately $\emptyset;\Sigma\vdash e:T$ .

**Case : **

[TABLE]

Have $\Gamma,x:T;\Sigma\vdash e:T$ and $\emptyset,\Sigma\vdash v:T^{\prime}$ .

By Lemma 22, $\Gamma;\Sigma\vdash v:T^{\prime}$ .

By Lemma 15, $\Gamma;\Sigma\vdash e[x/v]:T$ .

By the IH, $\emptyset;\Sigma\vdash\rho(e[x/v]):T$ .

Have that $(\rho,x=v)(e)=\rho(e[x/v])$ .

∎

Lemma 0.

If $\Gamma;\Sigma\vdash v:T$ and $\Sigma\vdash\mu$ , then $\textit{hastype}(v,\lfloor T\rfloor)$ .

Proof.

By cases on $T$ .

**Case: **

$T=\textsf{int}$ : By Lemma 12, $v=n$ . Therefore $\textit{hastype}(n,\textsf{int})$ .

**Case: **

$T=T_{1}\to T_{2}$ : By Lemma 12, $v=\lambda x.~{}e$ . Therefore $\textit{hastype}(\lambda x.~{}e,{\to})$ .

**Case: **

$T=\textsf{ref}~{}T^{\prime}$ : By Lemma 12, $v=a$ . Therefore $\textit{hastype}(a,\textsf{ref})$ .

**Case: **

$T=\star$ : Immediate.

∎

Theorem 4.

Suppose $\Gamma\vdash d:A;\Omega$ and $\sigma$ is a solution to $\Omega$ and $\Sigma\vdash\rho:\sigma\Gamma$ and $\Sigma\vdash\mu$ and $\langle\rho(|d|),\mu\rangle\longrightarrow^{*}\langle v,\mu^{\prime}\rangle$ . If $\lfloor\sigma A\rfloor\preceq S$ , then $\langle v{\Downarrow}S,\mu^{\prime}\rangle\not\longrightarrow\mathtt{fail}$ .

Proof.

By Lemma 21, $\sigma\Gamma;\emptyset\vdash|d|:\sigma A$ .

By Lemma 13, $\sigma\Gamma;\Sigma\vdash|d|:\sigma$ .

By Lemma 23, $\emptyset;\Sigma\vdash\rho(|d|):\sigma A$ .

By Lemma 18, $\emptyset;\Sigma^{\prime}\vdash v:\sigma A$ and $\Sigma^{\prime}\vdash\mu^{\prime}$ .

By Lemma 24, $\textit{hastype}(v,\lfloor\sigma A\rfloor)$ .

Since $\lfloor\sigma A\rfloor\preceq S$ , either $S=\star$ or $S=\lfloor\sigma A\rfloor$ . In either case, $\textit{hastype}(v,\lfloor\sigma A\rfloor)$ .

Therefore ECheckFail does not apply, and no other step can be taken from $\langle v{\Downarrow}S,\mu^{\prime}\rangle$ to fail. ∎

B.5. Soundness of constraint solving

Figure 1 restates the definition for constraint set simplification from Figure 8.

Lemma 0.

If $T_{1}=T_{2}$ then $\vdash T_{1}<:T_{2}$ and $\vdash T_{2}<:T_{1}$ .

Proof.

Straightforward induction on $T_{1}$ . ∎

Lemma 0.

If $\sigma$ is a solution to $\Omega_{1}$ and $\sigma$ is a solution to $\Omega_{2}$ , then $\sigma$ is a solution to $\Omega_{1}\cup\Omega_{2}$ .

Proof.

Since $\sigma$ is a solution for every constraint in $\Omega_{1}$ and $\Omega_{2}$ , and for all $C\in\Omega_{1}\cup\Omega_{2}$ , $C\in\Omega_{1}$ or $C\in\Omega_{2}$ , so $\sigma$ is a solution for every constraint in $\Omega_{1}\cup\Omega_{2}$ so it is a solution to $\Omega_{1}\cup\Omega_{2}$ .

∎

Lemma 0.

If $\Omega\longrightarrow\Omega^{\prime}$ and $\sigma$ is a solution to $\Omega^{\prime}$ , then $\sigma$ is a solution to $\Omega$ .

Proof.

By cases on $\Omega\longrightarrow\Omega^{\prime}$ . Many cases are immediate using Lemmas 5 and 26.

**Case: **

1 $\Omega\cup\{V_{1}\to V_{2}<:\star\}\longrightarrow\Omega\cup\{\star<:V_{1},~{}V_{2}<:\star\}$ :

Immediate from subtyping definitions.

**Case: **

2 $\Omega\cup\{V_{1}\to V_{2}<:V_{3}\to V_{4}\}\longrightarrow\Omega\cup\{V_{3}<:V_{1},~{}V_{2}<:V_{4}\}$ :

Immediate from subtyping definitions.

**Case: **

3 $\Omega\cup\{\textsf{ref}~{}V<:\star\}\longrightarrow\Omega\cup\{V=\star\}$ :

Immediate from subtyping definitions and from Lemma 25.

**Case: **

4 $\Omega\cup\{\textsf{ref}~{}V_{1}<:\textsf{ref}~{}V_{2}\}\longrightarrow\Omega\cup\{V_{1}=V_{2}\}$ :

Immediate from subtyping definitions and from Lemma 25.

**Case: **

5 $\Omega\cup\{V<:V\}\longrightarrow\Omega$ :

Immediate since subtyping is reflexive.

**Case: **

6 $\Omega\cup\{\textsf{int}<:\star\}\longrightarrow\Omega$ :

Immediate from subtyping definitions.

**Case: **

7 $\Omega\cup\{V_{1}\to V_{2}=V_{3}\to V_{4}\}\longrightarrow\Omega\cup\{V_{1}=V_{3},V_{2}=V_{4}\}$ :

Immediate.

**Case: **

8 $\Omega\cup\{\textsf{ref}~{}V_{1}=\textsf{ref}~{}V_{2}\}\longrightarrow\Omega\cup\{V_{1}=V_{2}\}$ :

Immediate.

**Case: **

9 $\Omega\cup\{A=A\}\longrightarrow\Omega$ :

Immediate.

**Case: **

10 $\Omega\cup\{A=\alpha\}\longrightarrow\Omega\cup\{\alpha=A\}$ :

Immediate.

**Case: **

13 $\Omega\cup\{\alpha=A\}\longrightarrow\Omega[\alpha/A]\cup\{\alpha\triangleq A\}$ :

Since $\sigma$ is a solution to $\{\alpha\triangleq A\}$ , have that $\sigma\alpha=\sigma A$ .

Therefore for any type $A^{\prime}$ with $\alpha$ as a component, $\sigma A^{\prime}[\alpha/A]=\sigma A^{\prime}$ .

Therefore $\sigma$ is a solution to $\Omega$ , and thus a solution to $\Omega\cup\{\alpha=A\}$ .

**Case: **

17 $\Omega\cup\{(A{:}S)=A\}\longrightarrow\Omega$ :

Immediate.

**Case: **

18 $\Omega\cup\{\alpha:S,(\alpha{:}S)=A\}\longrightarrow\Omega\cup\{\alpha=A\}$ :

Have that $\sigma\alpha=\sigma A$ and $\lfloor\sigma\alpha\rfloor=S$ .

Therefore $(\alpha{:}S)=A$ is satisfied.

Rest is immediate.

**Case: **

22 $\Omega\cup\{\alpha:S_{1},(\alpha{:}S_{2})=A\}\longrightarrow\Omega\cup\{\alpha:S_{1}\}\cup\{\alpha^{\prime}=\star\mid\forall\alpha^{\prime}\in\mathit{parts}(A)\}$ :

Have that $S_{1}\neq S_{2}$ .

Have that $\lfloor\sigma\alpha\rfloor=S_{1}$ .

Therefore $\lfloor\sigma\alpha\rfloor\neq S_{2}$ .

Have that $\sigma\alpha^{\prime}=\star$ for all $\alpha^{\prime}\in\mathit{parts}(A)$ .

Therefore $(\alpha{:}S_{1})=A$ is satisfied.

Rest is immediate.

**Case: **

25 $\Omega\cup\{(\alpha{:}S)=A_{1},(\alpha{:}S)=A_{2}\}\longrightarrow\Omega\cup\{(\alpha{:}S)=A_{1},A_{1}=A_{2}\}$ :

First, suppose that $\sigma\alpha=\sigma A_{1}$ and $\lfloor\sigma\alpha\rfloor=S$ .

Since $\sigma A_{1}=\sigma A_{2}$ , $(\alpha{:}S)=A_{2}$ is satisfied.

Now suppose that $\lfloor\sigma\alpha\rfloor\neq S$ .

Then for all parts $\alpha_{1}$ of $A_{1}$ , $\sigma\alpha_{1}=\star$ .

Since $\sigma\alpha_{1}=\sigma\alpha_{2}$ , for all parts $\alpha_{2}$ of $A_{2}$ , $\sigma\alpha_{2}=\star$ .

Therefore $(\alpha{:}S)=A_{2}$ is satisfied.

Rest is immediate.

**Case: **

26 $\Omega\cup\{\alpha:S\}\longrightarrow\Omega\cup\{\alpha=A\}$ :

Since $\sigma\alpha=\sigma A$ and $\lfloor A\rfloor=S$ , $\lfloor\sigma\alpha\rfloor=S$ . Rest is immediate.

∎

Lemma 0.

If $\Omega=\{\alpha_{1}\triangleq T_{1},\ldots,\alpha_{n}\triangleq T_{n}\}$ , and for all $i,j\leq n$ , $\alpha_{i}\not\in T_{j}$ , then $\sigma=\alpha_{1}\mapsto T_{1},\ldots,\alpha_{n}\mapsto T_{n}$ is a solution to $\Omega$ .

Proof.

Since $\alpha_{i}\not\in\mathit{vars}(T_{j})$ for any $i,j$ , $\sigma\Omega=\{T_{1}\triangleq T_{1},\ldots,T_{n}\triangleq T_{n}\}$ . Therefore $\sigma$ is a solution to $\Omega$ . ∎

Theorem 3.

If $\Omega\Downarrow\sigma$ , then $\sigma$ is a solution to $\Omega$ .

Proof.

By induction on $\Omega\Downarrow\sigma$ .

**Base case.: **

By Lemma 28, $\sigma$ is a solution to $\Omega$ .

**Simplification case.: **

By the IH, $\sigma$ is a solution to $\Omega^{\prime\prime}$ , $\sigma$ is a solution to $\Omega^{\prime}$ .

By repeating Lemma 27, $\sigma$ is a solution to $\Omega$ .

**Solving case.: **

By the IH, $\sigma$ is a solution to $\Omega\cup\{\alpha:S\}$ .

By Lemma 5, $\sigma$ is a solution to $\Omega$ .

∎

Bibliography41

The reference list from the paper itself. Each links out to its DOI / PubMed record.

1(1)
2Ahmed et al . (2011) Amal Ahmed, Robert Bruce Findler, Jeremy G. Siek, and Philip Wadler. 2011. Blame for All. In POPL . 14.
3Aiken and Fähndrich (1995) Alexander Aiken and Manuel Fähndrich. 1995. Dynamic typing and subtype inference. In FPCA ’95: Proceedings of the seventh international conference on Functional programming languages and computer architecture . ACM Press, New York, NY, USA, 182–191.
4Aiken and Wimmers (1993) Alexander Aiken and Edward L. Wimmers. 1993. Type Inclusion Constraints and Type Inference. In Proceedings of the Conference on Functional Programming Languages and Computer Architecture (FPCA ’93) . ACM, New York, NY, USA, 31–41. https://doi.org/10.1145/165180.165188 · doi ↗
5Aiken et al . (1994) Alexander Aiken, Edward L. Wimmers, and T. K. Lakshman. 1994. Soft typing with conditional types. In POPL ’94: Proceedings of the 21st ACM SIGPLAN-SIGACT symposium on Principles of programming languages . ACM Press, New York, NY, USA, 163–173.
6Allende et al . (2013 a) Esteban Allende, Oscar Callaú, Johan Fabry, Éric Tanter, and Markus Denker. 2013 a. Gradual typing for Smalltalk. Science of Computer Programming (August 2013).
7Allende et al . (2014) Esteban Allende, Johan Fabry, Ronald Garcia, and Éric Tanter. 2014. Confined Gradual Typing. In Proceedings of the 2014 ACM International Conference on Object Oriented Programming Systems Languages & Applications (OOPSLA ’14) . ACM, New York, NY, USA, 251–270. https://doi.org/10.1145/2660193.2660222 · doi ↗
8Allende et al . (2013 b) Esteban Allende, Johan Fabry, and Éric Tanter. 2013 b. Cast Insertion Strategies for Gradually-typed Objects. In DLS .

TL;DR

Contribution

Findings

Abstract

Peer Reviews

Videos

Optimizing and Evaluating Transient Gradual Typing

Abstract.

1. Introduction

1.1. Strategies for Runtime Checks

1.2. Performance of Transient Gradual Typing

1.3. Reducing the Burden of Pervasive Checks

1.4. Transient Gradual Typing on a Tracing JIT

1.5. Contributions

2. Performance of Transient Gradual Typing

2.1. Experimental Setup

2.2. Results

2.3. Module-Based Configurations

2.4. Comparison to Guarded Gradual Typing

3. Optimizing Transient Gradual Typing

3.1. Overall approach

3.2. Constraint Generation with Check Constraints

Theorem 1.

3.2.1. Constraints from the open world

3.3. Computing Constraint Solutions

3.4. Check Removal

3.4.1. Soundness of constraint solving

Definition 0.

Theorem 3.

3.4.2. Correctness of check removal

Theorem 4.

4. Performance of Optimized Transient Gradual Typing

5. Performance on PyPy, a Tracing JIT

6. Related Work

Gradual type systems.

Performance analysis for gradual typing.

Type inference.

7. Conclusions

Appendix A Appendix: Semantics

Appendix B Appendix: Proofs

B.1. Soundness of λs⋆\lambda^{\star}_{s}λs⋆​

Lemma 0.

Proof.

Lemma 0.

Proof.

Lemma 0.

Proof.

Lemma 0.

Proof.

B.2. Soundness of λd⇓\lambda^{\Downarrow}_{d}λd⇓​

Lemma 0.

Proof.

Lemma 0.

Proof.

Lemma 0.

Proof.

Lemma 0.

Proof.

Lemma 0.

Proof.

Lemma 0.

Proof.

B.3. Soundness of λe→\lambda^{\to}_{e}λe→​

Lemma 0 (Inversion).

Proof.

Lemma 0 (Canonical forms).

Proof.

Lemma 0 (Heap weakening).

Proof.

Lemma 0 (Heap extension).

Proof.

Lemma 0 (Substitution).

Proof.

Lemma 0.

Proof.

Lemma 0 (Preservation).

Proof.

Lemma 0 (Multi-step preservation).

Proof.

Lemma 0 (Progress).

B.1. Soundness of $\lambda^{\star}_{s}$

B.2. Soundness of $\lambda^{\Downarrow}_{d}$

B.3. Soundness of $\lambda^{\to}_{e}$