Space-Efficient Gradual Typing in Coercion-Passing Style

TL;DR

This paper introduces a coercion-passing style approach for space-efficient gradual typing, providing a formal translation and implementation that prevents stack overflows with manageable performance overhead.

Contribution

It proposes a novel coercion-passing style technique for efficient gradual typing, including a formal translation and practical implementation in the Grift compiler.

Findings

Prevents stack overflows in gradually typed programs.

Execution can be up to 3 times slower with the new method.

Formal correctness of the translation is proven.

Abstract

Herman et al. pointed out that the insertion of run-time checks into a gradually typed program could hamper tail-call optimization and, as a result, worsen the space complexity of the program. To address the problem, they proposed a space-efficient coercion calculus, which was subsequently improved by Siek et al. The semantics of these calculi involves eager composition of run-time checks expressed by coercions to prevent the size of a term from growing. However, it relies also on a nonstandard reduction rule, which does not seem easy to implement. In fact, no compiler implementation of gradually typed languages fully supports the space-efficient semantics faithfully. In this paper, we study coercion-passing style, which Herman et al. have already mentioned, as a technique for straightforward space-efficient implementation of gradually typed languages. A program in coercion-passing style passes "the rest of the run-time checks" around---just like continuation-passing style (CPS), in which "the rest of the computation" is passed around---and (unlike CPS) composes coercions eagerly. We give a formal coercion-passing translation from $\lambda$S by Siek et al. to $\lambda$S$_1$, which is a new calculus of first-class coercions tailored for coercion-passing style, and prove correctness of the translation. We also implement our coercion-passing style transformation for the Grift compiler developed by Kuhlenschmidt et al. An experimental result shows stack overflow can be prevented properly at the cost of up to 3 times slower execution for most partially typed practical programs.

Equations

$$\mathsf{odd}4$$

$${⟼}^{\ast }(\mathsf{even}1)⟨\mathsf{bool}{\text{?}}^p⟩⟨\mathsf{bool}\text{!}⟩⟨\mathsf{bool}{\text{?}}^p⟩{⟼}^{\ast }(\mathsf{odd}0)⟨\mathsf{bool}\text{!}⟩⟨\mathsf{bool}{\text{?}}^p⟩⟨\mathsf{bool}\text{!}⟩⟨\mathsf{bool}{\text{?}}^p⟩$$

$${⟼}^{\ast }\mathsf{false}⟨\mathsf{bool}\text{!}⟩⟨\mathsf{bool}{\text{?}}^p⟩⟨\mathsf{bool}\text{!}⟩⟨\mathsf{bool}{\text{?}}^p⟩{⟼}^{\ast }\mathsf{false}$$

$$\begin{array}[]{lll}\lx@intercol\mathsf{odd}\,4\hfil\lx@intercol\\ &\mathbin{\longmapsto^{*}}&(\mathsf{even}\,3)\langle\mathsf{bool}\texttt{?}^{\mathit{p}}\rangle\\ &\longmapsto&(\mathsf{odd}\,(3-1))\langle\mathsf{bool}\texttt{!}\rangle\langle\mathsf{bool}\texttt{?}^{\mathit{p}}\rangle\\ &\longmapsto&(\mathsf{odd}\,(3-1))\langle\mathsf{bool}\texttt{!}\fatsemi\mathsf{bool}\texttt{?}^{\mathit{p}}\rangle\\ &=&(\mathsf{odd}\,(3-1))\langle\mathsf{id}_{\mathsf{bool}}\rangle\\ &\longmapsto&(\mathsf{odd}\,2)\langle\mathsf{id}_{\mathsf{bool}}\rangle\\ &\longmapsto&(\mathsf{even}\,(2-1))\langle\mathsf{bool}\texttt{?}^{\mathit{p}}\rangle\langle\mathsf{id}_{\mathsf{bool}}\rangle\\ &\longmapsto&(\mathsf{even}\,(2-1))\langle\mathsf{bool}\texttt{?}^{\mathit{p}}\fatsemi\mathsf{id}_{\mathsf{bool}}\rangle\\ &=&(\mathsf{even}\,(2-1))\langle\mathsf{bool}\texttt{?}^{\mathit{p}}\rangle\\ &\longmapsto&(\mathsf{even}\,1)\langle\mathsf{bool}\texttt{?}^{\mathit{p}}\rangle\\ &\longmapsto&\dots\end{array}\quad\begin{array}[]{lll}\lx@intercol\mathsf{oddk}\,(4,\mathsf{id}_{\mathsf{bool}})\hfil\lx@intercol\\ &\longmapsto&\mathsf{evenk}\,(4-1,\mathsf{bool}\texttt{?}^{\mathit{p}}\mathbin{;\!;}\mathsf{id}_{\mathsf{bool}})\\ &\longmapsto&\mathsf{evenk}\,(4-1,\mathsf{bool}\texttt{?}^{\mathit{p}})\\ &\longmapsto&\mathsf{evenk}\,(3,\mathsf{bool}\texttt{?}^{\mathit{p}})\\ &\longmapsto&\mathsf{oddk}\,(3-1,\mathsf{bool}\texttt{!}\mathbin{;\!;}\mathsf{bool}\texttt{?}^{\mathit{p}})\\ &\longmapsto&\mathsf{oddk}\,(3-1,\mathsf{id}_{\mathsf{bool}})\\ &\longmapsto&\mathsf{oddk}\,(2,\mathsf{id}_{\mathsf{bool}})\\ &\longmapsto&\mathsf{evenk}\,(2-1,\mathsf{bool}\texttt{?}^{\mathit{p}}\mathbin{;\!;}\mathsf{id}_{\mathsf{bool}})\\ &\longmapsto&\mathsf{evenk}\,(2-1,\mathsf{bool}\texttt{?}^{\mathit{p}})\\ &\longmapsto&\mathsf{evenk}\,(1,\mathsf{bool}\texttt{?}^{\mathit{p}})\\ &\longmapsto&\ldots\end{array}$$

$$(G{\text{?}}^p;{)}^{?}({\mathsf{id}}_{\iota }+(s_1\to s_2))(;G^{\prime }\text{!}{)}^{?}$$

$$\text{Variables}x,y\text{Constants}a,b\text{Operators}op\text{Blame labels}p$$

$$\iota$$

$$A,B,C$$

$$G,H$$

$$s,t$$

$$i$$

$$g,h$$

$$d$$

$$L,M,N$$

$$V,W$$

$$U$$

$$\Gamma$$

$$((G_1{\text{?}}^p;{)}^{?}({\mathsf{id}}_A+(s_1\to s_2));G_2\text{!})\text{fatsemi}(G_3{\text{?}}^{p^{\prime }};({\mathsf{id}}_A+(s_3\to s_4))(;G_4\text{!}{)}^{?})$$

$$\begin{array}[]{cll}(\mathsf{id}_{\mathsf{int}};\mathsf{int}\texttt{!})\rightarrow(\mathsf{int}\texttt{?}^{\mathit{p}};\mathsf{id}_{\mathsf{int}})&:\mathord{\star}\rightarrow\mathord{\star}&\rightsquigarrow\mathsf{int}\rightarrow\mathsf{int}\\ \bot^{\mathord{\star}\rightarrow\mathord{\star}\mathit{p}\mathsf{int}}&:\mathsf{int}\rightarrow\mathsf{bool}&\rightsquigarrow\mathsf{int}\end{array}$$

$${\mathsf{id}}_{\star }\text{fatsemi}t$$

$$(g;G\text{!})\text{fatsemi}{\mathsf{id}}_{\star }$$

$${\perp }^{GpH}\text{fatsemi}s$$

$$(\text{if G=H})$$

$$g\text{fatsemi}{\perp }^{GpH}$$

$${\mathsf{id}}_A\text{fatsemi}g$$

$$(s\to t)\text{fatsemi}(s^{\prime }\to t^{\prime })$$

$$\mathcal{E}$$

$$op(a,b)$$

$$(\lambda x.M)V$$

$$(U⟨⟨s\to t⟩⟩)V$$

$$M⟨s⟩⟨t⟩$$

$$U⟨⟨d⟩⟩⟨t⟩$$

$$({\mathsf{id}}_{\mathsf{bool}};\mathsf{bool}\text{!})\text{fatsemi}(\mathsf{bool}{\text{?}}^p;{\mathsf{id}}_{\mathsf{bool}})$$

$$({\mathsf{id}}_{\star \to \star };(\star \to \star )\text{!})\text{fatsemi}(\mathsf{int}{\text{?}}^p;{\mathsf{id}}_{\mathsf{int}})$$

$$((\iota {\text{?}}^p;{\mathsf{id}}_{\iota })\to ({\mathsf{id}}_{{\iota }^{\prime }};{\iota }^{\prime }\text{!}))\text{fatsemi}(({\mathsf{id}}_{\iota };\iota \text{!})\to {\mathsf{id}}_{\star })$$

$$={\mathsf{id}}_{\iota }\to ({\mathsf{id}}_{{\iota }^{\prime }};{\iota }^{\prime }\text{!})$$

$$(\iota {\text{?}}^p;{\mathsf{id}}_{\iota })\text{fatsemi}({\mathsf{id}}_{\iota };\iota \text{!})$$

$$({\mathsf{id}}_{\iota };\iota \text{!})\text{fatsemi}(\iota {\text{?}}^p;({\mathsf{id}}_{\iota };\iota \text{!}))$$

$${\mathcal{F}}_1$$

$${\mathcal{F}}_2$$

$${\mathcal{F}}_3$$

$$((U⟨\mathsf{int}\text{!}\to \mathsf{int}{\text{?}}^p⟩)3)⟨\mathsf{int}\text{!}⟩$$

$${⟼}^{\ast }(U(3⟨\mathsf{int}\text{!}⟩))⟨\mathsf{int}{\text{?}}^p⟩⟨\mathsf{int}\text{!}⟩$$

$$⟼(U(3⟨\mathsf{int}\text{!}⟩))⟨\mathsf{int}{\text{?}}^p;\mathsf{id};\mathsf{int}\text{!}⟩$$

$${⟼}^{\ast }(3⟨⟨\mathsf{int}\text{!}⟩⟩⟨\mathsf{int}{\text{?}}^p⟩+2)⟨\mathsf{int}\text{!}⟩⟨\mathsf{int}{\text{?}}^p;\mathsf{id};\mathsf{int}\text{!}⟩$$

$${⟼}^{\ast }(3⟨\mathsf{id}⟩+2)⟨\mathsf{int}\text{!}⟩$$

$${⟼}^{\ast }5⟨⟨\mathsf{int}\text{!}⟩⟩$$

Full text

\AtAppendix

Space-Efficient Gradual Typing in Coercion-Passing Style

Yuya Tsuda

  

Atsushi Igarashi

  

Tomoya Tabuchi

In this paper, we study coercion-passing style, which Herman et al. have already mentioned, as a technique for straightforward space-efficient implementation of gradually typed languages. A program in coercion-passing style passes “the rest of the run-time checks” around—just like continuation-passing style (CPS), in which “the rest of the computation” is passed around—and (unlike CPS) composes coercions eagerly. We give a formal coercion-passing translation from $\lambda\mathsf{S}$ by Siek et al. to $\lambda\mathsf{S_{1}}$, which is a new calculus of first-class coercions tailored for coercion-passing style, and prove correctness of the translation. We also implement our coercion-passing style transformation for the Grift compiler developed by Kuhlenschmidt et al. An experimental result shows stack overflow can be prevented properly at the cost of up to 3 times slower execution for most partially typed practical programs.

1 Introduction

1.1 Space-Efficiency Problem in Gradual Typing

Gradual typing (conf/scheme/SiekT06, ; DBLP:conf/oopsla/Tobin-HochstadtF06, ) is one of the linguistic approaches to integrating static and dynamic typing. Allowing programmers to mix statically typed and dynamically typed fragments in a single program, it advocates the “script to program” evolution DBLP:conf/oopsla/Tobin-HochstadtF06 . Namely, software development starts with simple, often dynamically typed scripts, which evolve to more robust, fully statically typed programs through intermediate stages of partially typed programs. To make this evolution work in practice, it is important that the performance of partially typed programs at intermediate stages is comparable to that of (the slower of) the two ends, that is, dynamically typed scripts and statically typed programs.

However, it has been pointed out that gradual typing suffers from serious efficiency problems from both theoretical and practical viewpoints (DBLP:conf/sfp/HermanTF07, ; DBLP:journals/lisp/HermanTF10, ; DBLP:conf/popl/TakikawaFGNVF16, ). In particular, Takikawa et al. DBLP:conf/popl/TakikawaFGNVF16 showed that even a state-of-the-art gradual typing implementation could show catastrophic slowdown for partially typed programs due to run-time checking to ensure safety. Worse, such slowdown is not easy to predict because it depends on implicit run-time checks inserted by the language implementation and it requires fairly deep knowledge about the underlying gradual type system to understand when and where run-time checks are inserted and how they behave. Since then, several pieces of work have investigated the performance issues DBLP:journals/pacmpl/BaumanBST17 ; DBLP:journals/pacmpl/MuehlboeckT17 ; DBLP:journals/pacmpl/RichardsAT17 ; DBLP:conf/popl/RastogiSFBV15 ; DBLP:conf/pldi/KuhlenschmidtAS19 ; DBLP:journals/pacmpl/FelteyGSFS18 .

Earlier work by Herman et al. DBLP:conf/sfp/HermanTF07 ; DBLP:journals/lisp/HermanTF10 pointed out a related problem. They showed that, when values are passed between a statically typed part and a dynamically typed part many times, delayed run-time checks may accumulate and make space complexity of a program worse than an unchecked semantics.

To make the discussion more concrete, consider the following mutually recursive functions (written in ML-like syntax):

⬇

let rec even (x : int) : $\mathord{\star}$ =

if x = 0 then true{\color[rgb]{0.4,0.4,0.4}\langle\mathsf{bool}\texttt{!}\rangle} else (odd (x - 1)){\color[rgb]{0.4,0.4,0.4}\langle\mathsf{bool}\texttt{!}\rangle}

and odd (x : int) : bool =

if x = 0 then false else (even (x - 1)){\color[rgb]{0.4,0.4,0.4}\langle\mathsf{bool}\texttt{?}^{\mathit{p}}\rangle}

Ignoring the gray part (in angle brackets), which will be explained shortly, this is a tail-recursive definition of functions to decide whether a given integer is even or odd, except that the return type of one of the functions is written $\mathord{\star}$, which is the dynamic type, which can be any tagged value. This definition expresses a situation where a statically typed and a dynamically typed function call each other.111In this sense, the argument of even should have been $\mathord{\star}$, too, but it would clutter the code after inserting run-time checks. The gray part represents inserted run-time checks, written using Henglein’s coercion syntax (DBLP:journals/scp/Henglein94, ): $\mathsf{bool}\texttt{!}$ is a coercion from $\mathsf{bool}$ to $\mathord{\star}$ and $\texttt{true}\langle\mathsf{bool}\texttt{!}\rangle$ means that (untagged) Boolean value $\mathsf{true}$ will be tagged with $\mathsf{bool}$ to make a value of the dynamic type; $\mathsf{bool}\texttt{?}^{\mathit{p}}$ is a coercion from $\mathord{\star}$ to $\mathsf{bool}$ and $\texttt{(even (x - 1))}\langle\mathsf{bool}\texttt{?}^{\mathit{p}}\rangle$ means that the value returned from recursive call even (x - 1) will be tested whether it is tagged with $\mathsf{bool}$—if so, the run-time check removes the tag and returns the untagged Boolean value, and, otherwise, it results in blame, which is an uncatchable exception (with label $\mathit{p}$ to indicate where the check has failed).

The crux of this example is that the insertion of run-time checks has broken tail recursion: due to $\langle\mathsf{bool}\texttt{!}\rangle$ and $\langle\mathsf{bool}\texttt{?}^{\mathit{p}}\rangle$, the recursive calls are not in tail positions any longer. So, according to the original semantics of coercions (DBLP:journals/scp/Henglein94, ), evaluation of $\mathsf{odd}\,4$ is as follows:

[TABLE]

Thus, the size of a term being evaluated is proportional to the argument $n$ at its longest, whereas unchecked semantics (without coercions) allows for tail-call optimization and constant-space execution. This is the space-efficiency problem of gradual typing.

1.2 Space-Efficient Gradual Typing

Herman et al. DBLP:conf/sfp/HermanTF07 ; DBLP:journals/lisp/HermanTF10 also presented a solution to this problem. In the evaluation sequence of $\mathsf{odd}\,n$ above, we could immediately “compress” nested coercion applications $\mathit{M}\langle\mathsf{bool}\texttt{!}\rangle\langle\mathsf{bool}\texttt{?}^{\mathit{p}}\rangle$ before computation of the target term $\mathit{M}$ ends, because $\langle\mathsf{bool}\texttt{!}\rangle\langle\mathsf{bool}\texttt{?}^{\mathit{p}}\rangle$—tagging immediately followed by untagging—is equivalent to the identity function. By doing so, we can maintain that the order of the size of a term in the middle of evaluation is constant. This idea is formalized in terms of a “space-efficient” extension of the coercion calculus (DBLP:journals/scp/Henglein94, ). Since then, a few space-efficient coercion/cast calculi have been proposed DBLP:conf/pldi/SiekTW15 ; DBLP:conf/popl/SiekW10 ; DBLP:conf/esop/SiekGT09 .

Among them, Siek et al. DBLP:conf/pldi/SiekTW15 have proposed a space-efficient coercion calculus $\lambda\mathsf{S}$. $\lambda\mathsf{S}$ is equipped with a composition function that compresses consecutive coercions in certain canonical forms. The coercion composition is achieved as a simple recursive function thanks to the canonical forms. We show evaluation of $\mathsf{odd}\,4$ according to the $\lambda\mathsf{S}$ semantics in the left of Figure 1.222Strictly speaking, $\mathsf{bool}\texttt{!}$ and $\mathsf{bool}\texttt{?}^{\mathit{p}}$ are abbreviations of $\mathsf{id}_{\mathsf{bool}};\mathsf{bool}\texttt{!}$ and $\mathsf{bool}\texttt{?}^{\mathit{p}};\mathsf{id}_{\mathsf{bool}}$, respectively, in $\lambda\mathsf{S}$.

Here, $\mathit{s}\fatsemi\mathit{t}$ is a meta-level operation that composes two coercions $\mathit{s},\mathit{t}$ (in canonical forms) and yields another canonical coercion that semantically corresponds to their sequential composition. This composition function enables us to prevent the size of a term from growing.

However, in order to ensure that nested coercion applications are always merged, the operational semantics of $\lambda\mathsf{S}$ relies on a nonstandard reduction rule and nonstandard evaluation contexts. Although it does not cause any theoretical problems, it does not seem easy to implement—in particular, its compilation method seems nontrivial. In fact, none of the existing compiler implementations that address the space-efficiency problem DBLP:conf/pldi/KuhlenschmidtAS19 ; DBLP:journals/pacmpl/FelteyGSFS18 solves the problem of growing coercions at tail positions (an exception is recent work by Castagna et al. conf/ifl/CastagnaDLS19 —See Section 6 for more comparison).

1.3 Our Work: Coercion-Passing Style

In this paper, we study coercion-passing style for space-efficient gradual typing. Just as continuation-passing style, in which “the rest of the computation” is passed around as first-class functions and every function call is at a tail position, a program in coercion-passing style passes “the rest of the run-time checks” around. Actually, the idea of coercion-passing style has already been listed as one of the possible implementation techniques by Herman et al. DBLP:conf/sfp/HermanTF07 ; DBLP:journals/lisp/HermanTF10 but it has been neither well studied nor formalized.

We use the even/odd example above to describe our approach to the problem. Here are the even/odd functions in coercion-passing style. (We omit type declarations for simplicity.)

⬇

let rec evenk (x, $\kappa$) =

if x = 0 then true$\langle\mathsf{bool}\texttt{!}\mathbin{;\!;}\kappa\rangle$ else oddk (x - 1, $\mathsf{bool}\texttt{!}\mathbin{;\!;}\kappa$)

and oddk (x, $\kappa$) =

if x = 0 then false$\langle\kappa\rangle$ else evenk (x - 1, $\mathsf{bool}\texttt{?}^{\mathit{p}}\mathbin{;\!;}\kappa$)

Additional parameters named $\kappa$ are for first-class coercions, which are supposed to be applied—as in false$\langle\kappa\rangle$—to values that are returned in the original function definition. We often call these coercions continuation coercions. Coercion applications such as true$\langle\mathsf{bool}\texttt{!}\rangle$ and (oddk (x - 1))$\langle\mathsf{bool}\texttt{!}\rangle$ at tail positions in the original program are translated to coercion compositions such as true$\langle\mathsf{bool}\texttt{!}\mathbin{;\!;}\kappa\rangle$ and oddk (x - 1, $\mathsf{bool}\texttt{!}\mathbin{;\!;}\kappa$), respectively. When $\kappa$ is bound to a concrete coercion, it will be composed with $\mathsf{bool}\texttt{!}$ before it is applied. Similarly to programs in CPS, function calls pass (composed) coercions.

With these functions in coercion-passing style, the evaluation of $\mathsf{oddk}\,(4,\mathsf{id}_{\mathsf{bool}})$ (where $\mathsf{id}_{\mathsf{bool}}$ is an identity coercion, which does nothing) proceeds as in the right of Figure 1. Since tagging followed by untagging (with the same tag) actually does nothing, $\mathsf{bool}\texttt{!}\mathbin{;\!;}\mathsf{bool}\texttt{?}^{\mathit{p}}$ composes to $\mathsf{id}_{\mathsf{bool}}$ by the (meta-level) coercion composition $\mathsf{bool}\texttt{!}\fatsemi\mathsf{bool}\texttt{?}^{\mathit{p}}$.

Similarly to the $\lambda\mathsf{S}$ semantics described above, coercion composition in the argument takes place before a recursive call, thus the size of coercions stays bounded by the constant order, overcoming the space efficiency problem. A nice property of our solution is that the evaluation is standard call-by-value.

One can view the extra parameter $\kappa$ as an accumulating parameter and continuation coercions as (delimited) continuations in defunctionalized forms Reynolds98HOSC . Unlike simple defunctionalization, however, special composition of two defunctionalized coercions is provided, preventing the sizes of composed coercions from growing.

Contributions

Since the operational semantics of $\lambda\mathsf{S}$ seems nontrivial to implement due to a nonstandard reduction rule, we investigate implementation of the space-efficient semantics via a translation into coercion-passing style. Our contributions in this paper are summarized as follows:

• •

In the context of the space-efficiency problem of gradual typing, we develop a new calculus $\lambda\mathsf{S_{1}}$ of space-efficient first-class coercions.

• •

We formalize a coercion-passing style translation from (a slight variant of) space-efficient coercion calculus $\lambda\mathsf{S}$ DBLP:conf/pldi/SiekTW15 to the new calculus $\lambda\mathsf{S_{1}}$.

• •

We prove correctness of the coercion-passing style translation via a simulation property.

• •

We implement the coercion-passing style translation on top of the Grift compiler DBLP:conf/pldi/KuhlenschmidtAS19 , and conduct some experiments to show that stack overflow is indeed avoided.

Outline

The rest of this paper is organized as follows. We review the space-efficient coercion calculus $\lambda\mathsf{S}$ DBLP:conf/pldi/SiekTW15 in Section 2. We introduce a new space-efficient coercion calculus with first-class coercions $\lambda\mathsf{S_{1}}$ in Section 3, formalize a translation into coercion-passing style as a translation from $\lambda\mathsf{S}$ to $\lambda\mathsf{S_{1}}$, and prove correctness of the translation in Section 4. We discuss our implementation of coercion-passing translation on top of the Grift compiler DBLP:conf/pldi/KuhlenschmidtAS19 and show an experimental result in Section 5. Finally, we discuss related work in Section 6 and conclude in Section 7. Proofs of the stated properties can be found in Appendix A.

2 Space-Efficient Coercion Calculus

In this section, we review the space-efficient coercion calculus $\lambda\mathsf{S}$ (DBLP:conf/pldi/SiekTW15, ), which is the source calculus of our translation. Our definition differs from the original in a few respects, as we will explain later. For simplicity, we do not include (mutually) recursive functions and conditional expressions in the formalization but it is straightforward to add them; in fact, our implementation includes them.

Main novelties of $\lambda\mathsf{S}$ over the original coercion calculus $\lambda\mathsf{C}$ (DBLP:journals/scp/Henglein94, ) are (1) space-efficient coercions, which are canonical forms of coercions, whose composition can be defined by a straightforward recursive function, and (2) operational semantics in which a sequence of coercion applications is collapsed eagerly—even before they are applied to a value DBLP:conf/sfp/HermanTF07 ; DBLP:journals/lisp/HermanTF10 ; DBLP:conf/esop/SiekGT09 .

Basic forms of coercions are inherited from $\lambda\mathsf{C}$ (DBLP:journals/scp/Henglein94, ), which provides (1) identity coercions $\mathsf{id}_{\mathit{A}}$ (where $\mathit{A}$ is a type), which do nothing; (2) injections $\mathit{G}\texttt{!}$, which add a type tag $\mathit{G}$ to a value to make a value of the dynamic type; (3) projections $\mathit{G}\texttt{?}^{\mathit{p}}$, which test whether a value of the dynamic type is tagged with $\mathit{G}$, remove the tag if the test succeeds, or raise blame labeled $\mathit{p}$ if it fails; (4) function coercions $\mathit{c_{{\mathrm{1}}}}\rightarrow\mathit{c_{{\mathrm{2}}}}$, which, when they are applied to a function, coerce an argument to the function by $\mathit{c_{{\mathrm{1}}}}$ and a value returned from the function by $\mathit{c_{{\mathrm{2}}}}$; and (5) sequential compositions $\mathit{c_{{\mathrm{1}}}};\mathit{c_{{\mathrm{2}}}}$, which apply $\mathit{c_{{\mathrm{1}}}}$ and $\mathit{c_{{\mathrm{2}}}}$ in this order. Space-efficient coercions restrict the way basic coercions are combined by sequential composition; they can be roughly expressed by the following regular expression:

[TABLE]

(where $\iota$ is a base type, $\mathit{s_{{\mathrm{1}}}}$ and $\mathit{s_{{\mathrm{2}}}}$ stand for space efficient coercions, $(\cdots)^{?}$ stands for an optional element, and $+$ for alternatives). As already mentioned, an advantage of this form is that (meta-level) sequential composition (denoted by $\mathit{s_{{\mathrm{1}}}}\fatsemi\mathit{s_{{\mathrm{2}}}}$) of two space-efficient coercions results in another space-efficient coercion (if the composition is well typed), in other words, space-efficient coercions are closed under $\mathit{s_{{\mathrm{1}}}}\fatsemi\mathit{s_{{\mathrm{2}}}}$. For example, the composition $((\mathit{G_{{\mathrm{1}}}}\texttt{?}^{\mathit{p}};)^{?}(\mathsf{id}_{\iota}+(\mathit{s_{{\mathrm{1}}}}\rightarrow\mathit{s_{{\mathrm{2}}}}));\mathit{G_{{\mathrm{2}}}}\texttt{!})\fatsemi(\mathit{G_{{\mathrm{3}}}}\texttt{?}^{\mathit{p^{\prime}}};(\mathsf{id}_{\iota}+(\mathit{s_{{\mathrm{3}}}}\rightarrow\mathit{s_{{\mathrm{4}}}}))(;\mathit{G_{{\mathrm{4}}}}\texttt{!})^{?})$ will be $((\mathit{G_{{\mathrm{1}}}}\texttt{?}^{\mathit{p}};)^{?}(\mathsf{id}_{\iota}+((\mathit{s_{{\mathrm{3}}}}\fatsemi\mathit{s_{{\mathrm{1}}}})\rightarrow(\mathit{s_{{\mathrm{2}}}}\fatsemi\mathit{s_{{\mathrm{4}}}})))(;\mathit{G_{{\mathrm{4}}}}\texttt{!})^{?})$ if $\mathit{G_{{\mathrm{2}}}}=\mathit{G_{{\mathrm{3}}}}$—that is, tagging with $\mathit{G_{{\mathrm{2}}}}$ is immediately followed by inspection whether $\mathit{G_{{\mathrm{2}}}}$ is present.333Here, we exclude ill-typed coercion compositions such as $(\mathit{s_{{\mathrm{1}}}}\rightarrow\mathit{s_{{\mathrm{2}}}})\fatsemi\mathsf{id}_{\iota}$. Notice that the resulting coercion conforms to the regular expression again. (The other case where $\mathit{G_{{\mathrm{2}}}}\neq\mathit{G_{{\mathrm{3}}}}$ means that the projection $\mathit{G_{{\mathrm{3}}}}\texttt{?}^{\mathit{p^{\prime}}}$ will fail; we will explain such failures later.)

The operational semantics includes the reduction rule $\mathcal{F}[\mathit{M}\langle\mathit{s}\rangle\langle\mathit{t}\rangle]\longrightarrow\mathcal{F}[\mathit{M}\langle\mathit{s}\fatsemi\mathit{t}\rangle]$ where $\mathcal{F}$ is an evaluation context that does not include nested coercion applications and whose innermost frame is not a coercion application. This rule intuitively means that two consecutive coercions at the outermost position will be composed even before $\mathit{M}$ is evaluated to a value. This eager composition avoids a long chain of coercion applications in an evaluation context.

2.1 Syntax

We show the syntax of $\lambda\mathsf{S}$ in Figure 2. The syntax of $\lambda\mathsf{S}$ extends that of the simply typed lambda calculus (written in gray) with the dynamic type and (space-efficient) coercions.

Types, ranged over by $\mathit{A},\mathit{B},\mathit{C}$, include the dynamic type $\mathord{\star}$, base types $\iota$, and function types $\mathit{A}\rightarrow\mathit{B}$. Base types $\iota$ include $\mathsf{int}$ (integer type) and $\mathsf{bool}$ (Boolean type) and so on. Ground types, ranged over by $\mathit{G},\mathit{H}$, include base types $\iota$ and the function type $\mathord{\star}\rightarrow\mathord{\star}$. They are used for type tags put on values of the dynamic type (DBLP:conf/esop/WadlerF09, ). Here, the ground type for functions is always $\mathord{\star}\rightarrow\mathord{\star}$, reflecting the fact that many dynamically typed languages do not include information on the argument and return types of the function in its type tag.

As we have already discussed, $\lambda\mathsf{S}$ restricts coercions to only canonical ones, namely space-efficient coercions $\mathit{s}$, whose grammar is defined via ground coercions $\mathit{g}$ and intermediate coercions $\mathit{i}$. Ground coercions correspond to the middle part of space-efficient coercions; unlike the original $\lambda\mathsf{S}$, ground coercions include identity coercions for any function types—such as $\mathsf{id}_{\iota\rightarrow\iota}$—and exclude “virtually identity” coercions such as $\mathsf{id}_{\iota}\rightarrow\mathsf{id}_{\iota}$. Although these two coercions are extensionally the same, they reduce in slightly different ways: applying $\mathsf{id}_{\iota\rightarrow\iota}$ to a function immediately returns the function, whereas applying $\mathsf{id}_{\iota}\rightarrow\mathsf{id}_{\iota}$ results in a wrapped function whose argument and return values are monitored by $\mathsf{id}_{\iota}$, which does nothing. Adopting $\mathsf{id}_{\mathit{A}}$ for any $\mathit{A}$ simplifies our proof that the coercion-passing translation preserves the semantics. An intermediate coercion adds an optional injection to a ground coercion. Coercions of the form $\bot^{\mathit{G}\mathit{p}\mathit{H}}$ trigger blame (labeled $\mathit{p}$) if applied to a value. They emerge from coercion composition

[TABLE]

where $\mathit{A}\neq\mathord{\star}$ and $\mathit{G_{{\mathrm{2}}}}\neq\mathit{G_{{\mathrm{3}}}}$, which means that the projection $\mathit{G_{{\mathrm{3}}}}\texttt{?}^{\mathit{p^{\prime}}}$ is bound to fail. The composition results in $(\mathit{G_{{\mathrm{1}}}}\texttt{?}^{\mathit{p}};)^{?}\bot^{\mathit{G_{{\mathrm{1}}}}\mathit{p^{\prime}}\mathit{G_{{\mathrm{3}}}}}$, which means that, unless the optional projection fails—blaming $\mathit{p}$—it fails with $\mathit{p^{\prime}}$. Finally, space-efficient coercions are obtained by adding optional projection to intermediate coercions. $\mathsf{id}_{\mathord{\star}}$ is a special coercion that does not conform to the regular expression above. Strictly speaking, an injection, say $\mathsf{int}\texttt{!}$, has to be written $\mathsf{id}_{\mathsf{int}};\mathsf{int}\texttt{!}$ and a projection, say $\mathsf{int}\texttt{?}^{\mathit{p}}$, has to be written $\mathsf{int}\texttt{?}^{\mathit{p}};\mathsf{id}_{\mathsf{int}}$. We often omit these identity coercions in examples.

Terms, ranged over by $\mathit{L},\mathit{M},\mathit{N}$, include values $\mathit{V}$, primitive binary operations $\mathit{op}(\mathit{M},\mathit{N})$, function applications $\mathit{M}\,\mathit{N}$, coercion applications $\mathit{M}\langle\mathit{s}\rangle$, and coercion failure $\mathsf{blame}\,\mathit{p}$. The term $\mathit{M}\langle\mathit{s}\rangle$ coerces the value of $\mathit{M}$ with coercion $\mathit{s}$ at run time. The term $\mathsf{blame}\,\mathit{p}$ denotes a run-time type error caused by the failure of a coercion (projection) with blame label $\mathit{p}$.

Values, ranged over by $\mathit{V},\mathit{W}$, include variables $\mathit{x}$, uncoerced values $\mathit{U}$, and coerced values $\mathit{U}\langle\!\langle\mathit{d}\rangle\!\rangle$. Uncoerced values, ranged over by $\mathit{U}$, include constants $\mathit{a}$ of base types and lambda abstractions $\lambda\mathit{x}.\,\mathit{M}$. Unlike $\lambda\mathsf{C}$, where values can involve nested coercion applications, there is at most one coercion in a value—nested coercions will be composed. Coerced values $\mathit{U}\langle\!\langle\mathit{d}\rangle\!\rangle$ have two forms: injected values $\mathit{U}\langle\!\langle\mathit{g};\mathit{G}\texttt{!}\rangle\!\rangle$ and wrapped functions $\mathit{U}\langle\!\langle\mathit{s}\rightarrow\mathit{t}\rangle\!\rangle$. The check of function coercion is delayed until wrapped functions are applied to a value (DBLP:journals/scp/Henglein94, ; DBLP:conf/icfp/FindlerF02, ; conf/scheme/SiekT06, ). We include variables as values for technical convenience in defining translations; for operational semantics, though, it is not necessary to do so because we consider evaluation of closed terms.

Unlike many other studies on coercion and blame calculi, we syntactically distinguish coerced values $\mathit{U}\langle\!\langle\mathit{d}\rangle\!\rangle$ from $\mathit{U}\langle\mathit{d}\rangle$ (similarly to Wadler and Findler DBLP:conf/esop/WadlerF09 ). This distinction plays an important role in our correctness proof; roughly speaking, without the distinction, $\mathit{U}\langle\mathit{d}\rangle\langle\mathit{t}\rangle$ would allow two different interpretations: an application of $\mathit{t}$ to a value $\mathit{U}\langle\mathit{d}\rangle$ or two applications of $\mathit{d}$ and $\mathit{t}$ to a value $\mathit{U}$, which would result in different translation results. We also note that variables $\mathit{x}$ are considered values, rather than uncoerced values, since they can be bound to coerced values at function calls. In other words, we ensure that values are closed under value substitution.

As usual, applications are left-associative and $\lambda$ extends as far to the right as possible. We do not commit to a particular choice of precedence between function applications and coercion applications; we will always use parentheses to disambiguate terms like $\mathit{M}\,\mathit{N}\langle\mathit{t}\rangle$. The term $\lambda\mathit{x}.\,\mathit{M}$ binds $\mathit{x}$ in $\mathit{M}$ as usual. The definitions of free variables and $\alpha$-equivalence of terms are standard, and thus we omit them. We identify $\alpha$-equivalent terms.

The metavariable $\Gamma$ ranges over type environments. A type environment is a sequence of pairs of a variable and its type.

2.2 Type System

We give the type system of $\lambda\mathsf{S}$, which consists of three judgments for type consistency $\mathit{A}\sim\mathit{B}$, well-formed coercions $\mathit{c}:\mathit{A}\rightsquigarrow\mathit{B}$, and typing $\Gamma\vdash_{\mathsf{S}}\mathit{M}:\mathit{A}$. We use $c$ to denote any kind of coercions. The inference rules (except for $\mathit{A}\sim\mathit{B}$) are shown in Figure 3. (We omit the subscript $\mathsf{S}$ on $\vdash$ in rules, as some of them are reused for $\lambda\mathsf{S_{1}}$.)

The type consistency relation $\mathit{A}\sim\mathit{B}$ is the least reflexive and symmetric and compatible relation that contains $\mathit{A}\sim\mathord{\star}$. As this is standard (conf/scheme/SiekT06, ), we omit inference rules here. (We put them in Appendix A.)

The relation $\mathit{c}:\mathit{A}\rightsquigarrow\mathit{B}$ means that coercion $\mathit{c}$, which ranges over all kinds of coercions, converts a value from type $\mathit{A}$ to type $\mathit{B}$. We often call $\mathit{A}$ and $\mathit{B}$ the source and target types of $\mathit{c}$, respectively. The rule (CT-Id) is for identity coercion $\mathsf{id}_{\mathit{A}}$. The rule (CT-Inj) is for injection $\mathit{G}\texttt{!}$, which converts type $\mathit{G}$ to type $\mathord{\star}$. The rule (CT-Proj) is for projection $\mathit{G}\texttt{?}^{\mathit{p}}$, which converts type $\mathord{\star}$ to type $\mathit{G}$. The rule (CT-Fun) is for function coercion $\mathit{c_{{\mathrm{1}}}}\rightarrow\mathit{c_{{\mathrm{2}}}}$. If its argument coercion $\mathit{c_{{\mathrm{1}}}}$ converts type $\mathit{A^{\prime}}$ to type $\mathit{A}$ and its return-value coercion $\mathit{c_{{\mathrm{2}}}}$ converts type $\mathit{B}$ to type $\mathit{B^{\prime}}$, then function coercion $\mathit{c_{{\mathrm{1}}}}\rightarrow\mathit{c_{{\mathrm{2}}}}$ converts type $\mathit{A}\rightarrow\mathit{B}$ to type $\mathit{A^{\prime}}\rightarrow\mathit{B^{\prime}}$. In other words, function coercions are contravariant in their argument coercions and covariant in return-value coercions. The rule (CT-Fail) is for failure coercion $\bot^{\mathit{G}\mathit{p}\mathit{H}}$. Here, the source type is not necessarily $\mathit{G}$ but can be any nondynamic type $\mathit{A}$ consistent with $\mathit{G}$ because the source type of a failure coercion may change during coercion composition. For example, the following judgments are derivable:

[TABLE]

Proposition 2.1 below, which is about the source and target types of intermediate coercions and ground coercions, is useful to understand the syntactic structure of space-efficient coercions. In particular, it states that neither the source nor target type of ground coercions $\mathit{g}$ is the type $\mathord{\star}$.

Proposition 2.1** (name=Source and Target Types,restate=propSrcTgt).**

If $\mathit{i}:\mathit{A}\rightsquigarrow\mathit{B}$ then $\mathit{A}\neq\mathord{\star}$. 2. 2.

If $\mathit{g}:\mathit{A}\rightsquigarrow\mathit{B}$, then $\mathit{A}\neq\mathord{\star}$ and $\mathit{B}\neq\mathord{\star}$ and $\mathit{A}\sim\mathit{G}$ and $\mathit{G}\sim\mathit{B}$ for some unique $\mathit{G}$.

The judgment $\Gamma\vdash_{\mathsf{S}}\mathit{M}:\mathit{A}$ means that the $\lambda\mathsf{S}$-term $\mathit{M}$ is given type $\mathit{A}$ under type environment $\Gamma$. When clear from the context, we sometimes write $\vdash$ for $\vdash_{\mathsf{S}}$ with the subscript $\mathsf{S}$ omitted. We adopt similar conventions for other relations (such as $\longmapsto_{\mathsf{S}}$) introduced later.

The rules (T-Const), (T-Op), (T-Var), (T-Abs), and (T-App) are standard. Here, $\mathit{ty}(\mathit{a})$ maps constant $\mathit{a}$ to a base type $\iota$, and $\mathit{ty}(\mathit{op})$ maps binary operator $\mathit{op}$ to a (first-order) function type $\iota_{{\mathrm{1}}}\rightarrow\iota_{{\mathrm{2}}}\rightarrow\iota$. The rule (T-Crc) states that if $\mathit{M}$ is given type $\mathit{A}$ and space-efficient coercion $\mathit{s}$ converts type $\mathit{A}$ to $\mathit{B}$, then coercion application $\mathit{M}\langle\mathit{s}\rangle$ is given type $\mathit{B}$. The rule (T-CrcV) is similar to (T-Crc), but for coerced values $\mathit{U}\langle\!\langle\mathit{d}\rangle\!\rangle$. The rule (T-Blame) allows $\mathsf{blame}\,\mathit{p}$ to have an arbitrary type $\mathit{A}$. Here, type environments are always empty $\emptyset$ in (T-CrcV) and (T-Blame). It is valid because the terms $\mathit{U}\langle\!\langle\mathit{d}\rangle\!\rangle$ and $\mathsf{blame}\,\mathit{p}$ arise only during evaluation, which runs a closed term. In other words, these terms are not written by programmers in the surface language, and also they do not appear as the result of coercion insertion.

2.3 Operational Semantics

2.3.1 Coercion Composition

The coercion composition $\mathit{s}\fatsemi\mathit{t}$ is a recursive function that takes two space-efficient coercions and computes another space-efficient coercion corresponding to their sequential composition. We show the coercion composition rules in Figure 4. The function is defined in such a way that the form of the first coercion determines which rule to apply.

The rules (CC-IdDynL) and (CC-ProjL) are applied if the first coercion is not an intermediate coercion. The rules (CC-InjId), (CC-Collapse), (CC-Conflict), and (CC-FailL) are applied if the first one is a (nonground) intermediate coercion, in which case another intermediate coercion is yielded. The rules (CC-Collapse) and (CC-Conflict) deal with cases where an injection and a projection meet and perform tag checks. If type tags do not match, a failure coercion arises.

Failure coercions are necessary for eager coercion composition to preserve the behavior of $\lambda\mathsf{C}$. The term $\mathit{M}\langle\mathit{G}\texttt{!}\rangle\langle\mathit{H}\texttt{?}^{\mathit{p}}\rangle$ (if $\mathit{G}\neq\mathit{H}$) in $\lambda\mathsf{C}$ evaluates to $\mathsf{blame}\,\mathit{p}$—only after $\mathit{M}$ evaluates to a value. By contrast, the two coercions $\mathit{G}\texttt{!}$ and $\mathit{H}\texttt{?}^{\mathit{p}}$ in the term $\mathit{M}\langle\mathsf{id}_{\mathit{G}};\mathit{G}\texttt{!}\rangle\langle\mathit{H}\texttt{?}^{\mathit{p}};\mathsf{id}_{\mathit{H}}\rangle$ are eagerly composed in $\lambda\mathsf{S}$. Raising $\mathsf{blame}\,\mathit{p}$ immediately would not match the semantics of $\lambda\mathsf{C}$ because $\mathit{M}$ may evaluate to another blame or even diverge, in which case $\mathit{p}$ is not blamed. Thus, $\bot^{\mathit{G}\mathit{p}\mathit{H}}$ must raise $\mathsf{blame}\,\mathit{p}$ only after $\mathit{M}$ evaluates to a value.

The rules (CC-FailR) and (CC-InjR) are applied if a ground coercion and an intermediate coercion are composed to another intermediate coercion. The rules (CC-FailL) and (CC-FailR) represent the propagation of a failure to the context, somewhat similarly to exceptions. The rule (CC-InjR) represents associativity of sequential compositions but $\fatsemi$ is propagated to the inside.

The rules (CC-IdL), (CC-IdR), and (CC-Fun) are applied if two ground coercions are composed to another ground coercion. They are straightforward except that $\mathsf{id}_{\mathit{A}}\rightarrow\mathsf{id}_{\mathit{B}}$ has to be normalized to $\mathsf{id}_{\mathit{A}\rightarrow\mathit{B}}$ (CC-Fun).

We present a few examples of coercion composition below:

[TABLE]

These examples involve situations where an injection meets a projection by (CC-Collapse) or (CC-Conflict). The third example is by (CC-Fun).

[TABLE]

As the fourth example shows, a projection followed by an injection does not collapse since the projection might fail. Such a coercion is simplified when it is preceded by another injection (the fifth example).

The following lemma states that composition is defined for two well-formed coercions with matching target and source types.

Lemma 2.2** (restate=lemCmpWelldef,name=).**

If $\mathit{s}:\mathit{A}\rightsquigarrow\mathit{B}$ and $\mathit{t}:\mathit{B}\rightsquigarrow\mathit{C}$, then $(\mathit{s}\fatsemi\mathit{t}):\mathit{A}\rightsquigarrow\mathit{C}$.

2.3.2 Evaluation

We give a small-step operational semantics to $\lambda\mathsf{S}$ consisting of two relations on closed terms: the reduction relation $\mathit{M}\longrightarrow_{\mathsf{S}}\mathit{N}$ for basic computation, and the evaluation relation $\mathit{M}\mathbin{\longmapsto_{\mathsf{S}}}\mathit{N}$ for computing subterms and raising errors.

We show the reduction rules and the evaluation rules of $\lambda\mathsf{S}$ in Figure 5. The reduction/evaluation rules are labeled either e or c. The label e is for essential computation, and the label c is for coercion applications. As we see later, this distinction is important in our correctness proof. We write $\longrightarrow_{\mathsf{S}}$ for $\mathbin{\accentset{\mathsf{e}}{\longrightarrow}_{\mathsf{S}}}\cup\mathbin{\accentset{\mathsf{c}}{\longrightarrow}_{\mathsf{S}}}$, and $\longmapsto_{\mathsf{S}}$ for $\accentset{\mathsf{e}}{\longmapsto}_{\mathsf{S}}\cup\accentset{\mathsf{c}}{\longmapsto}_{\mathsf{S}}$. We sometimes call $\accentset{\mathsf{e}}{\longmapsto}_{\mathsf{S}}$ and $\accentset{\mathsf{c}}{\longmapsto}_{\mathsf{S}}$ e-evaluation and c-evaluation, respectively.

The rule (R-Op) applies to primitive operations. Here, $\delta$ is a (partial) function that takes an operator $\mathit{op}$ and two constants $\mathit{a_{{\mathrm{1}}}},\mathit{a_{{\mathrm{2}}}}$, and returns the resulting constant of the primitive operation. We assume that if $\mathit{ty}(\mathit{op})=\iota_{{\mathrm{1}}}\rightarrow\iota_{{\mathrm{2}}}\rightarrow\iota$ and $\mathit{ty}(\mathit{a_{{\mathrm{1}}}})=\iota_{{\mathrm{1}}}$ and $\mathit{ty}(\mathit{a_{{\mathrm{2}}}})=\iota_{{\mathrm{2}}}$, then $\delta\,(\mathit{op},\mathit{a_{{\mathrm{1}}}},\mathit{a_{{\mathrm{2}}}})=\mathit{a}$ and $\mathit{ty}(\mathit{a})=\iota$ for some constant $\mathit{a}$.

The rule (R-Beta) performs the standard call-by-value $\beta$-reduction. We write $\mathit{M}[\mathit{x}:=\mathit{V}]$ for capture-avoiding substitution of $\mathit{V}$ for free occurrences of $\mathit{x}$ in $\mathit{M}$. The definition of substitution is standard and thus omitted.

The rule (R-Wrap) applies to applications of wrapped function $\mathit{U}\langle\!\langle\mathit{s}\rightarrow\mathit{t}\rangle\!\rangle$ to value $\mathit{V}$. In this case, we first apply coercion $\mathit{s}$ on the argument to $\mathit{V}$, and get $\mathit{V}\langle\mathit{s}\rangle$. We next apply function $\mathit{U}$ to $\mathit{V}\langle\mathit{s}\rangle$, and get $\mathit{U}\,(\mathit{V}\langle\mathit{s}\rangle)$. We then apply coercion $\mathit{t}$ on the returned value, hence $(\mathit{U}\,(\mathit{V}\langle\mathit{s}\rangle))\langle\mathit{t}\rangle$.

The rule (R-Id) represents that identity coercion $\mathsf{id}_{\mathit{A}}$ returns the input value $\mathit{U}$ as it is. The rule (R-Fail) applies to applications of failure coercion $\bot^{\mathit{G}\mathit{p}\mathit{H}}$ to uncoerced value $\mathit{U}$, which reduces to $\mathsf{blame}\,\mathit{p}$. The rule (R-Crc) applies to applications $\mathit{U}\langle\mathit{d}\rangle$ of delayed coercion $\mathit{d}$ to uncoerced value $\mathit{U}$, which reduces to a coerced value $\mathit{U}\langle\!\langle\mathit{d}\rangle\!\rangle$.

The rules (R-MergeC) and (R-MergeV) apply to two consecutive coercion applications, and the two coercions are merged by the composition operation. These rules are key to space efficiency. Thanks to (R-MergeV), we can assume that there is at most one coercion in a value. Since $\mathit{d}\fatsemi\mathit{t}$ may or may not be a delayed coercion, the right-hand side has to be $\mathit{U}\langle\mathit{d}\fatsemi\mathit{t}\rangle$, rather than $\mathit{U}\langle\!\langle\mathit{d}\fatsemi\mathit{t}\rangle\!\rangle$. The outermost nested coercion applications are merged by (R-MergeC).

Now, we explain evaluation contexts, ranged over by $\mathcal{E}$, shown in the top of Figure 5. Following Siek et al. DBLP:conf/pldi/SiekTW15 , we define them in the so-called “inside-out” style DBLP:conf/lfp/FelleisenWFD88 ; DBLP:journals/tcs/DanvyN01 . Evaluation contexts represent that function calls in $\lambda\mathsf{S}$ are call-by-value and that primitive operations and function applications are evaluated from left to right. The grammar is mutually recursive with $\mathcal{F}$, which stands for evaluation contexts whose innermost frames are not a coercion application, whereas $\mathcal{E}$ may contain a coercion application as the innermost frame.444$\mathcal{F}[\square\,\langle\mathit{s}\rangle]$ (instead of $\mathcal{F}[\square\,\langle\mathit{f}\rangle]$) in the definition of $\mathcal{E}$ fixes a problem in Siek et al. DBLP:conf/pldi/SiekTW15 that an identity coercion applied to a nonvalue gets stuck (personal communication). Careful inspection will reveal that both $\mathcal{E}$ and $\mathcal{F}$ contain no consecutive coercion applications. As usual, we write $\mathcal{E}[\mathit{M}]$ for the term obtained by replacing the hole in $\mathcal{E}$ with $\mathit{M}$, similarly for $\mathcal{F}[\mathit{M}]$. (We omit their definitions.)

We present a few examples of evaluation contexts below:

[TABLE]

We then come back to evaluation rules: The rules (E-CtxE) and (E-CtxC) enable us to evaluate the subterm in an evaluation context. Here, (E-CtxC) requires that computation of coercion applications is only performed under contexts $\mathcal{F}$—otherwise, the innermost frame may be a coercion application, in which case (R-MergeC) has to be applied first. For example, $\mathit{U}\langle\mathit{d}\rangle\langle\mathit{t}\rangle$ reduces to $\mathit{U}\langle\mathit{d}\fatsemi\mathit{t}\rangle$ rather than $\mathit{U}\langle\!\langle\mathit{d}\rangle\!\rangle\langle\mathit{t}\rangle$. The rule (E-Abort) halts the evaluation of a program if it raises blame.

Example 2.3**.**

Let $\mathit{U}$ be $\lambda\mathit{x}.\,(\mathit{x}\langle\mathsf{int}\texttt{?}^{\mathit{p}}\rangle+2)\langle\mathsf{int}\texttt{!}\rangle$. Term $((\mathit{U}\langle\mathsf{int}\texttt{!}\rightarrow\mathsf{int}\texttt{?}^{\mathit{p}}\rangle)\,3)\langle\mathsf{int}\texttt{!}\rangle$ evaluates to $5\langle\!\langle\mathsf{int}\texttt{!}\rangle\!\rangle$ as follows:

[TABLE]

2.4 Properties

We state a few important properties of $\lambda\mathsf{S}$, including determinacy of the evaluation relation and type safety via progress and preservation (WrightFelleisenIC94, ). We write $\mathbin{\longmapsto_{\mathsf{S}}^{*}}$ for the reflexive and transitive closure of $\longmapsto_{\mathsf{S}}$, and $\mathbin{\longmapsto_{\mathsf{S}}^{+}}$ for the transitive closure of $\longmapsto_{\mathsf{S}}$. We say that $\lambda\mathsf{S}$-term $\mathit{M}$ diverges, denoted by $\mathit{M}\,\mathord{\Uparrow_{\mathsf{S}}}$, if there exists an infinite evaluation sequence from $\mathit{M}$.

Proofs of the stated properties are in Appendix A.

Lemma 2.4** (name=Determinacy,restate=lemDeterminacyS).**

If $\mathit{M}\mathbin{\longmapsto_{\mathsf{S}}}\mathit{N}$ and $\mathit{M}\mathbin{\longmapsto_{\mathsf{S}}}\mathit{N^{\prime}}$, then $\mathit{N}=\mathit{N^{\prime}}$.

Theorem 2.5** (name=Progress,restate=thmProgressS).**

If $\emptyset\vdash_{\mathsf{S}}\mathit{M}:\mathit{A}$, then one of the following holds: (1) $\mathit{M}\mathbin{\longmapsto_{\mathsf{S}}}\mathit{M^{\prime}}$ for some $\mathit{M^{\prime}}$; (2) $\mathit{M}=\mathit{V}$ for some $\mathit{V}$; or (3) $\mathit{M}=\mathsf{blame}\,\mathit{p}$ for some $\mathit{p}$.

Theorem 2.6** (name=Preservation,restate=thmPreservationS).**

If $\emptyset\vdash_{\mathsf{S}}\mathit{M}:\mathit{A}$ and $\mathit{M}\mathbin{\longmapsto_{\mathsf{S}}}\mathit{N}$, then $\emptyset\vdash_{\mathsf{S}}\mathit{N}:\mathit{A}$.

Corollary 2.7** (name=Type Safety,restate=corSafetyS).**

If $\emptyset\vdash_{\mathsf{S}}\mathit{M}:\mathit{A}$, then one of the following holds: (1) $\mathit{M}\mathbin{\longmapsto_{\mathsf{S}}^{*}}\mathit{V}$ and $\emptyset\vdash_{\mathsf{S}}\mathit{V}:\mathit{A}$ for some $\mathit{V}$; (2) $\mathit{M}\mathbin{\longmapsto_{\mathsf{S}}^{*}}\mathsf{blame}\,\mathit{p}$ for some $\mathit{p}$; or (3) $\mathit{M}\,\mathord{\Uparrow_{\mathsf{S}}}$.

3 Space-Efficient First-Class Coercion Calculus

In this section, we introduce $\lambda\mathsf{S_{1}}$, a new space-efficient coercion calculus with first-class coercions; $\lambda\mathsf{S_{1}}$ serves as the target calculus of the translation into coercion-passing style. The design of $\lambda\mathsf{S_{1}}$ is tailored to coercion-passing style and, as a result, first-class coercions are not as general as one might expect: for example, coercions for coercions are restricted to identity coercions (e.g., $\mathsf{id}_{\iota\rightsquigarrow\iota}$).

Since coercions are first-class in $\lambda\mathsf{S_{1}}$, the use of (space-efficient) coercions $\mathit{s}$ is not limited to coercion applications $\mathit{M}\langle\mathit{s}\rangle$; they can be passed to a function as an argument, for example. We equip $\lambda\mathsf{S}$ with the infix (object-level) operator $\mathit{M}\mathbin{;\!;}\mathit{N}$ to compute the composition of two coercions: if $\mathit{M}$ and $\mathit{N}$ evaluate to coercions $\mathit{s}$ and $\mathit{t}$, respectively, then $\mathit{M}\mathbin{;\!;}\mathit{N}$ reduces to their composition $\mathit{s}\fatsemi\mathit{t}$, which is another space-efficient coercion. The type of (first-class) coercions from $\mathit{A}$ to $\mathit{B}$ is written $\mathit{A}\rightsquigarrow\mathit{B}$.555In $\lambda\mathsf{S}$, $\rightsquigarrow$ is the symbol used in the three-place judgment form $\mathit{c}:\mathit{A}\rightsquigarrow\mathit{B}$, whereas $\rightsquigarrow$ is also a type constructor in $\lambda\mathsf{S_{1}}$.

In $\lambda\mathsf{S_{1}}$, every function abstraction takes two arguments, one of which is a parameter for a continuation coercion to be applied to the value returned from this abstraction. For example, $\lambda\mathit{x}.\,1$ in $\lambda\mathsf{S}$ corresponds to $\lambda(\mathit{x},\kappa).\,1\langle\kappa\rangle$ in $\lambda\mathsf{S_{1}}$—here, $\kappa$ is a coercion parameter. Correspondingly, a function application takes the form $\mathit{M}\,(\mathit{N},\mathit{L})$, which calls function $\mathit{M}$ with an argument pair $(\mathit{N},\mathit{L})$, in which $\mathit{L}$ is a coercion argument, which is applied to the value returned from $\mathit{M}$. For example, $(\mathit{f}\,3)\langle\mathit{s}\rangle$ in $\lambda\mathsf{S}$ corresponds to $\mathit{f}\,(3,\mathit{s})$ in $\lambda\mathsf{S_{1}}$; $(\mathit{f}\,3)$ (without a coercion application) corresponds to $\mathit{f}\,(3,\mathsf{id})$.

The type of a function abstraction in $\lambda\mathsf{S_{1}}$ is written $\mathit{A}\Rightarrow\mathit{B}$, which means that the type of the first argument is the type $\mathit{A}$ and the source type of the second coercion argument is $\mathit{B}$. An abstraction is polymorphic over the target type of the coercion argument; so, if a function of type $\mathit{A}\Rightarrow\mathit{B}$ is applied to a pair of $\mathit{A}$ and $\mathit{B}\rightsquigarrow\mathit{C}$, then the type of the application will be $\mathit{C}$. Polymorphism is useful—and in fact required—for coercion-passing translation to work because coercions with different target types may be passed to calls to the same function in $\lambda\mathsf{S}$. Intuitively, $\mathit{A}\Rightarrow\mathit{B}$ means $\forall\mathit{X}.(\mathit{A}\times(\mathit{B}\rightsquigarrow\mathit{X}))\rightarrow\mathit{X}$ but we do not introduce $\forall$-types explicitly because our use of $\forall$ is limited to the target-type polymorphism. However, we do have to introduce type variables for typing function abstractions.

Following the change to function types, function coercions in $\lambda\mathsf{S_{1}}$ take the form $\mathit{s}\Rightarrow\mathit{t}$. Roughly speaking, its meaning is the same: it coerces an input to a function by $\mathit{s}$ and coerces an output by $\mathit{t}$. However, due to the coercion passing semantics, there is slight change in how $\mathit{t}$ is used at a function call. Consider $\mathit{f}\langle\!\langle\mathit{s}\Rightarrow\mathit{t}\rangle\!\rangle$, i.e., coercion-passing function $\mathit{f}$ wrapped by coercion $\mathit{s}\Rightarrow\mathit{t}$. If the wrapped function is applied to $(\mathit{V},\mathit{t^{\prime}})$, $\mathit{V}$ is coerced by $\mathit{s}$ before passing to $\mathit{f}$ as in $\lambda\mathsf{S}$; instead of coercing the return value by $\mathit{t}$, however, $\mathit{t}$ is prepended to $\mathit{t^{\prime}}$ and passed to $\mathit{f}$ (together with the coerced $\mathit{V}$) so that the return value is coerced by $\mathit{t}$ and then $\mathit{t^{\prime}}$. In the reduction rule, prepending $\mathit{t}$ to $\mathit{t^{\prime}}$ is represented by composition $\mathit{t}\mathbin{;\!;}\mathit{t^{\prime}}$.

3.1 Syntax

We show the syntax of $\lambda\mathsf{S_{1}}$ in Figure 6. We reuse the same metavariables from $\lambda\mathsf{S}$. We also use $\kappa$ for variables, and $\mathit{K}$ for values.

We replace $\mathit{A}\rightarrow\mathit{B}$ with $\mathit{A}\Rightarrow\mathit{B}$ and add $\mathit{A}\rightsquigarrow\mathit{B}$ and type variables to types. The syntax for ground types and space-efficient, intermediate, ground, and delayed coercions is the same except that $\rightarrow$ is replaced with $\Rightarrow$, similarly to types. As we have mentioned, we replace abstractions and applications with two-argument versions. We also add let-expressions (although they could be introduced as derived forms) and coercion composition $\mathit{M}\mathbin{;\!;}\mathit{N}$. The syntax for coercion applications is now $\mathit{M}\langle\mathit{N}\rangle$, where $\mathit{N}$ is a general term (of type $\mathit{A}\rightsquigarrow\mathit{B}$). Uncoerced values now include space-efficient coercions.

The term $\lambda(\mathit{x},\kappa).\,\mathit{M}$ binds $\mathit{x}$ and $\kappa$ in $\mathit{M}$, and the term $\mathsf{let}\,\mathit{x}=\mathit{M}\,\mathsf{in}\,\mathit{N}$ binds $\mathit{x}$ in $\mathit{N}$. The definitions of free variables and $\alpha$-equivalence of terms are standard, and thus we omit them. We identify $\alpha$-equivalent terms.

The definition of type environments, ranged over by $\Gamma$, is the same as $\lambda\mathsf{S}$.

3.2 Type System

Figure 7 shows the main typing rules of $\lambda\mathsf{S_{1}}$, which are a straightforward adaption from $\lambda\mathsf{S}$.

The relation $\mathit{c}:\mathit{A}\rightsquigarrow\mathit{B}$ is mostly the same as that of $\lambda\mathsf{S}$. We replace the rule (CT-Fun) as shown. As in $\lambda\mathsf{S}$, function coercions are contravariant in their argument coercions and covariant in their return-value coercions.

The judgment $\Gamma\vdash_{\mathsf{S_{1}}}\mathit{M}:\mathit{A}$ means that term $\mathit{M}$ of $\lambda\mathsf{S_{1}}$ has type $\mathit{A}$ under type environment $\Gamma$. The rules (T-Const), (T-Op), (T-Var), and (T-Blame) are the same as $\lambda\mathsf{S}$, and so we omit them. The rule (T-Let) is standard.

The rules (T-Abs) and (T-App) look involved but the intuition that $\mathit{A}\Rightarrow\mathit{B}$ corresponds to $\forall\mathit{X}.\,(\mathit{A}\times(\mathit{B}\rightsquigarrow\mathit{X}))\rightarrow\mathit{X}$ should help to understand them. The rule (T-Abs) assigns type $\mathit{A}\Rightarrow\mathit{B}$ to an abstraction $\lambda(\mathit{x},\kappa).\,\mathit{M}$ if the body is well typed under the assumption that $\mathit{x}$ is of type $\mathit{A}$ and $\kappa$ is of type $\mathit{B}\rightsquigarrow\mathit{X}$ for fresh $\mathit{X}$. The type variable $\mathit{X}$ must not appear in $\Gamma,\mathit{A},\mathit{B}$ so that the target type can be polymorphic at call sites. The rule (T-App) for applications is already explained.

The rule (T-Crcn) assigns type $\mathit{A}\rightsquigarrow\mathit{B}$ to space-efficient coercion $\mathit{s}$ if it converts a value from type $\mathit{A}$ to type $\mathit{B}$. The rules (T-Crc) and (T-CrcV) are similar to the corresponding rules of $\lambda\mathsf{S}$, but adjusted to first-class coercions.

3.3 Operational Semantics

The composition function $\mathit{s}\fatsemi\mathit{t}$ is mostly the same as that of $\lambda\mathsf{S}$. We only replace (CC-Fun) as shown in Figure 8.

Similarly to $\lambda\mathsf{S}$, we give a small-step operational semantics to $\lambda\mathsf{S_{1}}$ consisting of two relations on closed terms: the reduction relation $\mathit{M}\longrightarrow_{\mathsf{S_{1}}}\mathit{N}$ and the evaluation relation $\mathit{M}\mathbin{\longmapsto_{\mathsf{S_{1}}}}\mathit{N}$. We show the reduction/evaluation rules of $\lambda\mathsf{S_{1}}$ in Figure 8. As in $\lambda\mathsf{S}$, they are labeled either e or c. We write $\longrightarrow_{\mathsf{S_{1}}}$ for $\mathbin{\accentset{\mathsf{e}}{\longrightarrow}_{\mathsf{S_{1}}}}\cup\mathbin{\accentset{\mathsf{c}}{\longrightarrow}_{\mathsf{S_{1}}}}$, and $\longmapsto_{\mathsf{S_{1}}}$ for $\accentset{\mathsf{e}}{\longmapsto}_{\mathsf{S_{1}}}\cup\accentset{\mathsf{c}}{\longmapsto}_{\mathsf{S_{1}}}$.

The rules (R-Op) and (R-Beta) are standard. Note that (R-Beta) is adjusted for pair arguments. We write $\mathit{M}[\mathit{x}:=\mathit{V},\kappa:=\mathit{K}]$ for capture-avoiding simultaneous substitution of $\mathit{V}$ and $\mathit{K}$ for $\mathit{x}$ and $\kappa$, respectively, in $\mathit{M}$.

The rule (R-Wrap) applies to applications of wrapped function $\mathit{U}\langle\!\langle\mathit{s}\Rightarrow\mathit{t}\rangle\!\rangle$ to value $\mathit{V}$. Since coercion $\mathit{s}$ is for function arguments, it is applied to $\mathit{V}$, as in $\lambda\mathsf{S}$. Additionally, we compose coercion $\mathit{t}$ on the return value with continuation coercion $\mathit{W}$. Thus, $\mathit{V}\langle\mathit{s}\rangle$ and $\mathit{t}\mathbin{;\!;}\mathit{W}$ are passed to function $\mathit{U}$. Note that we use a let expression to evaluate the second argument $\mathit{t}\mathbin{;\!;}\mathit{W}$ before $\mathit{V}\langle\mathit{s}\rangle$. It is a necessary adjustment for the semantics of $\lambda\mathsf{S}$ and $\lambda\mathsf{S_{1}}$ to match.

The rule (R-Let) is standard; it is labeled as c because we use let-expressions only for coercion compositions. The rule (R-Cmp) applies to coercion compositions $\mathit{s}\mathbin{;\!;}\mathit{t}$, which is evaluated by meta-level coercion composition function $\mathit{s}\fatsemi\mathit{t}$. The rules (R-Id), (R-Fail), (R-Crc), and (R-MergeV) are the same as $\lambda\mathsf{S}$.

Evaluation contexts, ranged over by $\mathcal{E}$, are defined also in Figure 8. In contrast to $\lambda\mathsf{S}$, evaluation contexts are standard in $\lambda\mathsf{S_{1}}$. The definition represents that function calls in $\lambda\mathsf{S_{1}}$ are call-by-value, and primitive operations, function applications, coercion compositions, and coercion applications are all evaluated from left to right.

We then come back to evaluation rules: The evaluation rules (E-Ctx) and (E-Abort) are the same as $\lambda\mathsf{S}$. (However, evaluation contexts in (E-Ctx) are more straightforward in $\lambda\mathsf{S_{1}}$.)

Finally, we should emphasize that we no longer need (R-MergeC) in $\lambda\mathsf{S_{1}}$. So, $\lambda\mathsf{S_{1}}$ is an ordinary call-by-value language and its semantics should be easy to implement.

Example 3.1**.**

Let $\mathit{U}$ be $\lambda(\mathit{x},\kappa).\,\mathsf{let}\,\kappa^{\prime}=\mathsf{int}\texttt{!}\mathbin{;\!;}\kappa\,\mathsf{in}\,(\mathit{x}\langle\mathsf{int}\texttt{?}^{\mathit{p}}\rangle+2)\langle\kappa^{\prime}\rangle$, which corresponds to the $\lambda\mathsf{S}$-term $\lambda\mathit{x}.\,(\mathit{x}\langle\mathsf{int}\texttt{?}^{\mathit{p}}\rangle+2)\langle\mathsf{int}\texttt{!}\rangle$ in Example 2.3. In fact, we will obtain this term as a result of our coercion-passing translation defined in the next section. The term $(\mathit{U}\langle\mathsf{int}\texttt{!}\Rightarrow\mathsf{int}\texttt{?}^{\mathit{p}}\rangle)\,(3,\mathsf{int}\texttt{!})$ evaluates to $5\langle\!\langle\mathsf{int}\texttt{!}\rangle\!\rangle$ as follows:

[TABLE]

It is easy to see that the steps by (R-MergeC) in Example 2.3 are simulated by (R-Cmp) followed by (R-Let).

3.4 Properties

We state a few properties of $\lambda\mathsf{S_{1}}$ below. Their proofs are in Appendix A.

Lemma 3.2** (name=Determinacy,restate=lemDeterminacySx).**

If $\mathit{M}\mathbin{\longmapsto_{\mathsf{S_{1}}}}\mathit{N}$ and $\mathit{M}\mathbin{\longmapsto_{\mathsf{S_{1}}}}\mathit{N^{\prime}}$, then $\mathit{N}=\mathit{N^{\prime}}$.

Theorem 3.3** (name=Progress,restate=thmProgressSx).**

If $\emptyset\vdash_{\mathsf{S_{1}}}\mathit{M}:\mathit{A}$, then one of the following holds: (1) $\mathit{M}\mathbin{\longmapsto_{\mathsf{S_{1}}}}\mathit{M^{\prime}}$ for some $\mathit{M^{\prime}}$; (2) $\mathit{M}=\mathit{V}$ for some $\mathit{V}$; or (3) $\mathit{M}=\mathsf{blame}\,\mathit{p}$ for some $\mathit{p}$.

Theorem 3.4** (name=Preservation,restate=thmPreservationSx).**

If $\emptyset\vdash_{\mathsf{S_{1}}}\mathit{M}:\mathit{A}$ and $\mathit{M}\mathbin{\longmapsto_{\mathsf{S_{1}}}}\mathit{N}$, then $\emptyset\vdash_{\mathsf{S_{1}}}\mathit{N}:\mathit{A}$.

Corollary 3.5** (name=Type Safety,restate=corSafetySx).**

If $\emptyset\vdash_{\mathsf{S_{1}}}\mathit{M}:\mathit{A}$, then one of the following holds: (1) $\mathit{M}\mathbin{\longmapsto_{\mathsf{S_{1}}}^{*}}\mathit{V}$ and $\emptyset\vdash_{\mathsf{S_{1}}}\mathit{V}:\mathit{A}$ for some $\mathit{V}$; (2) $\mathit{M}\mathbin{\longmapsto_{\mathsf{S_{1}}}^{*}}\mathsf{blame}\,\mathit{p}$ for some $\mathit{p}$; or (3) $\mathit{M}\,\mathord{\Uparrow_{\mathsf{S_{1}}}}$.

4 Translation into Coercion-Passing Style

In this section, we formalize a translation into coercion-passing style as a translation from $\lambda\mathsf{S}$ to $\lambda\mathsf{S_{1}}$ and state its correctness. As its name suggests, this translation is similar to transformations into continuation-passing style (CPS transformations) for the call-by-value $\lambda$-calculus (DBLP:journals/tcs/Plotkin75, ).

4.1 Definition of Translation

We give the translation into coercion-passing style by the translation rules presented in Figure 9. In order to distinguish metavariables of $\lambda\mathsf{S}$ and $\lambda\mathsf{S_{1}}$, we often use blue for the source calculus $\lambda\mathsf{S}$. When we need static type information in translation rules, we write $\mathit{M}^{\mathit{A}}$ to indicate that term $\mathit{M}$ has type $\mathit{A}$. Thus, strictly speaking, the translation is defined for type derivations in $\lambda\mathsf{S}$.

Translations for types $\Psi(\mathit{A})$ and coercions $\Psi(\mathit{s})$ are very straightforward, thanks to the special type/coercion constructor $\Rightarrow$: they just recursively replace $\rightarrow$ with $\Rightarrow$.

Value translation $\Psi(\mathit{V})$ and term translation $\mathscr{K}\llbracket\mathit{M}\rrbracket\mathit{K}$ are defined in a mutually recursive manner. In $\mathscr{K}\llbracket\mathit{M}\rrbracket\mathit{K}$, $\mathit{M}$ is a $\lambda\mathsf{S}$-term whereas $\mathit{K}$ is a $\lambda\mathsf{S_{1}}$-term, which is either a variable or a $\lambda\mathsf{S_{1}}$-coercion. $\mathscr{K}\llbracket\mathit{M}\rrbracket\mathit{K}$ returns a $\lambda\mathsf{S_{1}}$-term—in coercion-passing style—that applies $\mathit{K}$ to the value of $\mathit{M}$.

Value translation $\Psi(\mathit{V})$ is straightforward: every function $\lambda\mathit{x}.\,\mathit{M}$ is translated to a $\lambda\mathsf{S_{1}}$-abstraction that takes as the second argument $\kappa$ a coercion which is to be applied to the return value. So, the body is translated by term translation $\mathscr{K}\llbracket\mathit{M}\rrbracket\kappa$.

We now describe the translation for terms. We write $\mathscr{K}\llbracket\mathit{M}\rrbracket\mathit{K}$ for the translation of $\lambda\mathsf{S}$-term $\mathit{M}$ with continuation coercion $\mathit{K}$. We first explain the basic transformation scheme given by the recursive function $\mathscr{K}^{\prime}$ defined by the following simpler rules:

[TABLE]

(We put a prime on $\mathscr{K}$ to distinguish with the final version.)

The rule (Tr*′*-Val) applies to values $\mathit{V}$, where we apply coercion $\mathit{K}$ to the result of value translation $\Psi(\mathit{V})$.

The rule (Tr*′*-Op) applies to primitive operations $\mathit{op}(\mathit{M},\mathit{N})$. We translate the arguments $\mathit{M}$ and $\mathit{N}$ with identity continuation coercions by $\mathscr{K}^{\prime}\llbracket\mathit{M}\rrbracket\mathsf{id}$ and $\mathscr{K}^{\prime}\llbracket\mathit{N}\rrbracket\mathsf{id}$ and pass them to the primitive operation. The given continuation coercion $\mathit{K}$ is applied to the result. Translating subexpressions with $\mathsf{id}$ is one of the main differences from CPS transformation. While continuations in continuation-passing style capture the whole rest of computation, continuation coercions in coercion-passing style capture only the coercion applied right after the current computation. Since neither $\mathit{M}$ nor $\mathit{N}$ is surrounded by a coercion, they are translated with identity coercions of appropriate types. (Cases where a subexpression itself is a coercion application will be discussed shortly.) Careful readers may notice at this point that left-to-right evaluation of arguments is enforced by the semantics (or the definition of evaluation contexts) of $\lambda\mathsf{S}$, not by the translation. In other words, the correctness of the translation relies on the fact that $\lambda\mathsf{S}$ evaluation is left-to-right and call-by-value. This is another point that is different from CPS transformation, which dismisses the distinction of call-by-name and call-by-value.

The rule (Tr*′*-App) applies to function applications $\mathit{M}\,\mathit{N}$. We translate function $\mathit{M}$ and argument $\mathit{N}$ with identity continuation coercions just like the case for primitive operations. We then pass the continuation coercion $\mathit{K}$ as the second argument to function $\mathscr{K}^{\prime}\llbracket\mathit{M}\rrbracket\mathsf{id}$.

The rule (Tr*′*-Crc) applies to coercion applications $\mathit{M}\langle\mathit{s}\rangle$. We can think of the sequential composition of $\Psi(\mathit{s})$ and $\mathit{K}$ as the continuation coercion for $\mathit{M}$. Thus, we first compute the composition $\Psi(\mathit{s})\mathbin{;\!;}\mathit{K}$, bind its result to $\kappa$, and translate $\mathit{M}$ with continuation $\kappa$. The let-expression is necessary to compose $\Psi(\mathit{s})$ and $\mathit{K}$ before evaluating $\mathscr{K}^{\prime}\llbracket\mathit{M}\rrbracket\kappa$. In general, it is not necessarily the case that $\mathscr{K}^{\prime}\llbracket\mathit{M}\rrbracket\mathit{K}$ evaluates $\mathit{K}$ first, so if we set $\mathscr{K}^{\prime}\llbracket\mathit{M}\langle\mathit{s}\rangle\rrbracket\mathit{K}=(\mathscr{K}^{\prime}\llbracket\mathit{M}\rrbracket(\Psi(\mathit{s})\mathbin{;\!;}\mathit{K}))$, then the order of computation would change by the translation and correctness of translation would be harder to show.

Lastly, the rule (Tr*′*-Blame) means that continuation $\mathit{K}$ is discarded for $\mathsf{blame}\,\mathit{p}$.

The translation $\mathscr{K}^{\prime}$ seems acceptable but, just as naïve CPS transformation leaves administrative redexes, it leaves many applications of $\mathsf{id}$, which we call administrative coercions. We expect $\mathit{M}$ and $\mathscr{K}^{\prime}\llbracket\mathit{M}\rrbracket\mathit{K}$ to “behave similarly” but administrative redexes make it hard to show such semantic correspondence. Therefore, we will optimize the translation so that administrative coercions are eliminated, similarly to CPS transformations that eliminate administrative redexes DBLP:journals/tcs/Plotkin75 ; DBLP:books/cu/Appel1992 ; DBLP:conf/mfps/Wand91 ; DBLP:journals/lisp/SabryF93 ; DBLP:journals/tcs/DanvyN03 ; DBLP:journals/mscs/DanvyF92 ; DBLP:journals/toplas/SabryW97 .

The bottom of Figure 9 shows the optimized translation rules. The idea to eliminate administrative coercions is close to the colon translation by Plotkin DBLP:journals/tcs/Plotkin75 : we avoid translating values with administrative coercions. So, we introduce an auxiliary translation function $\mathscr{C}\llbracket\mathit{M}\rrbracket$, which, if $\mathit{M}$ is a value $\mathit{V}$, returns $\Psi(\mathit{V})$—without a coercion application—and, if $\mathit{M}$ is a coercion application $\mathit{N}\langle\mathit{s}\rangle$, returns $\mathscr{K}\llbracket\mathit{N}\rrbracket\Psi(\mathit{s})$—with the trivial composition $\Psi(\mathit{s})\fatsemi\mathsf{id}$ optimized away—and returns $\mathscr{K}\llbracket\mathit{M}\rrbracket\mathsf{id}$ otherwise. Translation rules for primitive operations and function applications are adapted so that they use $\mathscr{C}\llbracket\mathit{M}\rrbracket$ to translate subexpressions.

In other words, $\mathscr{C}\llbracket\mathit{M}\rrbracket$ helps us precisely distinguish between $\mathsf{id}$ introduced by the translation and $\mathsf{id}$ that was present in the original term. Whenever we introduce $\mathsf{id}$ as an initial coercion for the translation, we first apply $\mathscr{C}\llbracket\mathit{M}\rrbracket$ and then apply $\mathscr{K}\llbracket\mathit{M}\rrbracket\mathsf{id}$ only if necessary. We note that $\mathscr{K}\llbracket\mathit{M}\rrbracket\mathsf{id}\mathbin{\longmapsto_{\mathsf{S_{1}}}}\mathscr{C}\llbracket\mathit{M}\rrbracket$ holds. (Lemma A.56)

We present a few examples of the translation below:

[TABLE]

The following example shows the translation of the $\lambda\mathsf{S}$-term in Example 2.3 will be the $\lambda\mathsf{S_{1}}$-term in Example 3.1.

Example 4.1**.**

Let $\mathit{U}$ be a $\lambda\mathsf{S}$-term $\lambda\mathit{x}.\,(\mathit{x}\langle\mathsf{int}\texttt{?}^{\mathit{p}}\rangle+2)\langle\mathsf{int}\texttt{!}\rangle$.

[TABLE]

4.2 Correctness of Translation

Having defined the translation, we now state its correctness properties with auxiliary lemmas. (Their proofs are in Appendix A.)

To begin with, the translation preserves typing. Here, we write $\Psi(\Gamma)$ for the type environment satisfying: $(\mathit{x}:\mathit{A})\in\Gamma$ if and only if $(\mathit{x}:\Psi(\mathit{A}))\in\Psi(\Gamma)$.

Theorem 4.2** (name=Translation Preserves Typing,restate=thmTransTyping).**

If $\Gamma\vdash_{\mathsf{S}}\mathit{M}:\mathit{A}$ and $\mathit{s}:\mathit{A}\rightsquigarrow\mathit{B}$ , then $\Psi(\Gamma)\vdash_{\mathsf{S_{1}}}(\mathscr{K}\llbracket\mathit{M}\rrbracket\Psi(\mathit{s})):\Psi(\mathit{B})$. 2. 2.

If $\Gamma\vdash_{\mathsf{S}}\mathit{V}:\mathit{A}$, then $\Psi(\Gamma)\vdash_{\mathsf{S_{1}}}\Psi(\mathit{V}):\Psi(\mathit{A})$.

As for the preservation of semantics, we will prove the following theorem that states the semantics is preserved by the translation:

Theorem 4.3** (name=Translation Preserves Semantics,restate=thmTransSem).**

If $\emptyset\vdash_{\mathsf{S}}\mathit{M}:\iota$, then (1) $\mathit{M}\mathbin{\longmapsto_{\mathsf{S}}^{*}}\mathit{a}$ iff $\mathscr{C}\llbracket\mathit{M}\rrbracket\mathbin{\longmapsto_{\mathsf{S_{1}}}^{*}}\mathit{a}$; (2) $\mathit{M}\mathbin{\longmapsto_{\mathsf{S}}^{*}}\mathsf{blame}\,\mathit{p}$ iff $\mathscr{C}\llbracket\mathit{M}\rrbracket\mathbin{\longmapsto_{\mathsf{S_{1}}}^{*}}\mathsf{blame}\,\mathit{p}$; and (3) $\mathit{M}\,\mathord{\Uparrow_{\mathsf{S}}}$ iff $\mathscr{C}\llbracket\mathit{M}\rrbracket\,\mathord{\Uparrow_{\mathsf{S_{1}}}}$.

To prove this theorem, it suffices to show the left-to-right direction (Theorem 4.4 below) for each item because the other direction follows from Theorem 4.4 together with other properties: for example, if $\emptyset\vdash_{\mathsf{S}}\mathit{M}:\iota$ and $\mathscr{C}\llbracket\mathit{M}\rrbracket\,\mathord{\Uparrow_{\mathsf{S_{1}}}}$, then $\mathit{M}$ can neither get stuck (by type soundness of $\lambda\mathsf{S}$) nor terminate (as it contradicts the left-to-right direction and the fact that $\longmapsto_{\mathsf{S_{1}}}$ is deterministic).

Theorem 4.4** (name=Translation Soundness,restate=thmTransSoundness).**

Suppose $\Gamma\vdash_{\mathsf{S}}\mathit{M}:\mathit{A}$. (1) If $\mathit{M}\mathbin{\longmapsto_{\mathsf{S}}^{*}}\mathit{V}$, then $\mathscr{C}\llbracket\mathit{M}\rrbracket\mathbin{\longmapsto_{\mathsf{S_{1}}}^{*}}\Psi(\mathit{V})$; (2) if $\mathit{M}\mathbin{\longmapsto_{\mathsf{S}}^{*}}\mathsf{blame}\,\mathit{p}$, then $\mathscr{C}\llbracket\mathit{M}\rrbracket\mathbin{\longmapsto_{\mathsf{S_{1}}}^{*}}\mathsf{blame}\,\mathit{p}$; and (3) if $\mathit{M}\,\mathord{\Uparrow_{\mathsf{S}}}$, then $\mathscr{C}\llbracket\mathit{M}\rrbracket\,\mathord{\Uparrow_{\mathsf{S_{1}}}}$.

A standard proof strategy would be to show that single-step evaluation in the source language is simulated by multi-step evaluation in the target language. In fact, we prove the following lemma:

Lemma 4.5** (name=Simulation,restate=lemTransEval).**

If $\mathit{M}\mathbin{\accentset{\mathsf{e}}{\longmapsto}_{\mathsf{S}}}\mathit{N}$, then $\mathscr{C}\llbracket\mathit{M}\rrbracket\mathbin{\accentset{\mathsf{e}}{\longmapsto}_{\mathsf{S_{1}}}\accentset{\mathsf{c}}{\longmapsto}_{\mathsf{S_{1}}}^{*}}\mathscr{C}\llbracket\mathit{N}\rrbracket$. 2. 2.

If $\mathit{M}\mathbin{\accentset{\mathsf{c}}{\longmapsto}_{\mathsf{S}}}\mathit{N}$, then $\mathscr{C}\llbracket\mathit{M}\rrbracket\mathbin{\accentset{\mathsf{c}}{\longmapsto}_{\mathsf{S_{1}}}^{+}}\mathscr{C}\llbracket\mathit{N}\rrbracket$.

[TABLE]

The straightforward simulation property below follows from Lemma 4.5.

Lemma 4.6** (restate=lemSimulation,name=).**

If $\mathit{M}\mathbin{\longmapsto_{\mathsf{S}}}\mathit{N}$, then $\mathscr{C}\llbracket\mathit{M}\rrbracket\mathbin{\longmapsto_{\mathsf{S_{1}}}^{+}}\mathscr{C}\llbracket\mathit{N}\rrbracket$.

As is the case for simulation proofs for CPS translation DBLP:journals/tcs/Plotkin75 ; DBLP:books/cu/Appel1992 ; DBLP:conf/mfps/Wand91 ; DBLP:journals/lisp/SabryF93 ; DBLP:journals/tcs/DanvyN03 ; DBLP:journals/mscs/DanvyF92 ; DBLP:journals/toplas/SabryW97 , the simulation property666If we had been interested only in the property that translation preserves term equivalence, we could have simplified the technical development by, say, removing the distinction between $\mathit{U}\langle\mathit{s}\rangle$ and $\mathit{U}\langle\!\langle\mathit{s}\rangle\!\rangle$. However, simulation is crucial for showing that divergence is preserved by the translation. is quite subtle. We discuss this subtlety below.

First, it is important that the translation removes administrative identity coercions by distinguishing values and nonvalues in $\mathscr{C}\llbracket\mathit{M}\rrbracket$. For example, $(\lambda\mathit{x}.\,\mathit{x})\,5\mathbin{\accentset{\mathsf{e}}{\longmapsto}}5$ holds in $\lambda\mathsf{S}$, but the translation $\mathscr{K}^{\prime}\llbracket(\lambda\mathit{x}.\,\mathit{x})\,5\rrbracket\mathit{K}$ without removing administrative redexes would yield $((\lambda(\mathit{x},\kappa).\,\mathit{x}\langle\kappa\rangle)\langle\mathsf{id}\rangle)\,(5\langle\mathsf{id}\rangle,\mathit{K})$, which performs c-evaluation before calling the function. We avoid such a situation. More formally, we prove the following lemma, which means the redex in the source is also the redex in the target.

Lemma 4.7** (restate=lemTransCtx,name=).**

For any $\mathcal{F}$, there exists $\mathcal{E}^{\prime}$ such that for any $\mathit{M}$, $\mathscr{C}\llbracket\mathcal{F}[\mathit{M}]\rrbracket=\mathcal{E}^{\prime}[\mathscr{C}\llbracket\mathit{M}\rrbracket]$. 2. 2.

For any $\mathcal{F}$ and $\mathit{s}$, there exists $\mathcal{E}^{\prime}$ such that for any $\mathit{M}$, $\mathscr{C}\llbracket\mathcal{F}[\mathit{M}\langle\mathit{s}\rangle]\rrbracket=\mathcal{E}^{\prime}[\mathscr{K}\llbracket\mathit{M}\rrbracket\Psi(\mathit{s})]$.

To prove this lemma, the rule (TrC-Crc) also plays an important role: for example, if we removed (TrC-Crc), $\mathscr{K}\llbracket(1+1)\langle\mathsf{int}\texttt{!}\rangle\rrbracket\mathsf{id}$ would translate to $\mathsf{let}\,\kappa=\mathsf{int}\texttt{!}\mathbin{;\!;}\mathsf{id}\,\mathsf{in}\,(1+1)\langle\kappa\rangle$, which performs c-evaluation before adding 1 and 1, which is the first thing the original term $(1+1)\langle\mathsf{int}\texttt{!}\rangle$ will do.

Second, optimizing too many (identity) coercions can break simulation. We should only remove administrative identity coercions, and keep identity coercions that were present in the original term. Consider $\mathit{M}\stackrel{{\scriptstyle\textrm{\tiny def}}}{{=}}(((\lambda\mathit{x}.\,\mathit{M_{{\mathrm{1}}}})\langle\!\langle\mathsf{id}_{\iota}\rightarrow\iota\texttt{!}\rangle\!\rangle)\,\mathit{a})\langle\iota\texttt{?}^{\mathit{p}}\rangle$ and $\mathit{N}\stackrel{{\scriptstyle\textrm{\tiny def}}}{{=}}((\lambda\mathit{x}.\,\mathit{M_{{\mathrm{1}}}})\,(\mathit{a}\langle\mathsf{id}_{\iota}\rangle))\langle\iota\texttt{!}\rangle\langle\iota\texttt{?}^{\mathit{p}}\rangle$, for which $\mathit{M}\mathbin{\longmapsto_{\mathsf{S}}}\mathit{N}$ holds by (R-Wrap). Then,

[TABLE]

At one point, we defined the translation (let’s call it $\mathscr{K}^{\prime\prime}$) so that applications of identity coercions would be removed as much as possible, namely,

[TABLE]

(notice that $\langle\mathsf{id}_{\iota}\rangle$ on $\mathit{a}$ is removed). Although $\mathscr{K}^{\prime\prime}\llbracket\mathit{M}\rrbracket\mathsf{id}$ and $\mathscr{K}^{\prime\prime}\llbracket\mathit{N}\rrbracket\mathsf{id}$ reduced to the same term, we did not quite have $\mathscr{K}^{\prime\prime}\llbracket\mathit{M}\rrbracket\mathsf{id}\mathbin{\longmapsto^{+}}\mathscr{K}^{\prime\prime}\llbracket\mathit{N}\rrbracket\mathsf{id}$ as we had desired.

Third, the distinction between $\mathit{U}\langle\mathit{s}\rangle$ and $\mathit{U}\langle\!\langle\mathit{s}\rangle\!\rangle$ is crucial for ensuring that substitution commutes with the translation:

Lemma 4.8** (name=Substitution,restate=lemSubstTrans).**

If $\kappa\notin\mathit{FV}(\mathit{M})\cup\mathit{FV}(\mathit{V})$, then $(\mathscr{K}\llbracket\mathit{M}\rrbracket\kappa)[\mathit{x}:=\Psi(\mathit{V}),\kappa:=\mathit{K}]=\mathscr{K}\llbracket\mathit{M}[\mathit{x}:=\mathit{V}]\rrbracket\mathit{K}$.

Roughly speaking, if we identified a value $\mathit{U}\langle\!\langle\mathit{s}\rangle\!\rangle$ and an application $\mathit{U}\langle\mathit{s}\rangle$ of $\mathit{s}$ to an uncoerced value $\mathit{U}$, then the term $\mathit{U}\langle\mathit{s}\rangle\langle\mathit{t}\rangle$ would allow two interpretations: an application of $\mathit{t}$ to a value $\mathit{U}\langle\mathit{s}\rangle$ and applications of $\mathit{s}$ and $\mathit{t}$ to $\mathit{U}$ and committing to either interpretation would break Lemma 4.8.

5 Implementation and Evaluation

5.1 Implementation

We have implemented the coercion-passing translation described in Section 4 and the semantics of $\lambda\mathsf{S_{1}}$ for Grift (DBLP:conf/pldi/KuhlenschmidtAS19, )777The semantics of coercions in Grift is so-called D DBLP:conf/esop/SiekGT09 , which is slightly different from that of $\lambda\mathsf{S_{1}}$, which is UD. Since the main difference is in the coercion composition, our technique can be applied to Grift., an experimental compiler for gradually typed languages. GTLC+, the language that the Grift compiler implements, supports integers, floating-point numbers, Booleans, higher-order functions, local binding by let, (mutually) recursive definitions by letrec, conditional expressions, iterations, sequencing, mutable references, and vectors (mutable arrays).

The Grift compiler compiles a GTLC+ program into the C language where coercions are represented as values of a struct type, and operations such as coercion application and coercion composition are C functions. The compiler supports different run-time check schemes, those based on type-based casts conf/scheme/SiekT06 and space-efficient coercions DBLP:conf/pldi/SiekTW15 . Note that, although meta-level composition $\mathit{s_{{\mathrm{1}}}}\fatsemi\mathit{s_{{\mathrm{2}}}}$ is implemented, only nested coercions on values are composed; in other words, (R-MergeC) was not implemented. Thus, implicit run-time checks may break tail calls and seemingly tail-recursive functions may cause stack overflow.

We modify the compiler phases for run-time checking based on the space-efficient coercions. After typechecking a user program, the compiler inserts type-based casts to the program and converts type-based casts to space-efficient coercions, following the translation from blame calculus $\lambda\mathsf{B}$ to $\lambda\mathsf{S}$ DBLP:conf/pldi/SiekTW15 . Our implementation performs the coercion-passing translation after the translation into $\lambda\mathsf{S}$. It is straightforward to extend the translation scheme to language features that are not present in $\lambda\mathsf{S}$. For example, here is translation for conditional expressions:

[TABLE]

Since coercions are represented as structs, we did not have to do anything special to make coercions first-class. We modify another compiler phase that generates operations on coercions such as $\mathit{M}\mathbin{;\!;}\mathit{N}$ and (R-Wrap). The current implementation, which generates C code and uses clang888https://clang.llvm.org/ for compilation to machine code, relies on the C compiler to perform tail-call optimizations. We have found the original compiler’s handling of recursive types hampers tail-call optimizations,999The C function to compose coercions takes a pointer to a stack-allocated object as an argument and writes into the object when recursive coercions are composed. Although those stack-allocated objects never escape and tail-call optimization is safe, the C compiler is not powerful enough to see it. so our implementation does not deal with recursive types. We leave their implementation for future work.

5.2 Even and Odd Functions

We first inspected the tail-recursive even–odd functions in GTLC+:

⬇

(letrec ([even (lambda ([n : $\mathit{A_{{\mathrm{1}}}}$]) : $\mathit{A_{{\mathrm{3}}}}$

       (if (= 0 n) #t (odd (- n 1))))]

      [odd (lambda ([n : $\mathit{A_{{\mathrm{2}}}}$]) : $\mathit{A_{{\mathrm{4}}}}$

       (if (= 0 n) #f (even (- n 1))))])

(odd $\mathit{n}$))

where $\mathit{A_{{\mathrm{1}}}}$ and $\mathit{A_{{\mathrm{2}}}}$ are either Int or Dyn, and $\mathit{A_{{\mathrm{3}}}}$ and $\mathit{A_{{\mathrm{4}}}}$ are either Bool or Dyn. We run this program with the original and modified compilers for all combinations of $\mathit{A_{{\mathrm{1}}}},\mathit{A_{{\mathrm{2}}}},\mathit{A_{{\mathrm{3}}}}$, and $\mathit{A_{{\mathrm{4}}}}$. We call the program compiled by the original compiler Base, the program compiled by the modified compiler CrcPS.

We have confirmed that, as $\mathit{n}$ increases, 12 of 16 configurations of Base cause stack overflow.101010The size of the run-time stack is 8 MB. In the four configurations that survived, both $\mathit{A_{{\mathrm{3}}}}$ and $\mathit{A_{{\mathrm{4}}}}$ are set to Bool. CrcPS never causes stack overflow for any configuration.

Although we expected that Base would crash if $\mathit{A_{{\mathrm{3}}}}$ and $\mathit{A_{{\mathrm{4}}}}$ are different, it is our surprise that Base causes stack overflow even when $\mathit{A_{{\mathrm{3}}}}=\mathit{A_{{\mathrm{4}}}}=\texttt{Dyn}$. We have found that it is due to the typing rule of Grift for conditional expressions. In Grift, if one of the branches is given a static type, say Bool, and the other is Dyn, the whole if-expression is given the static type and the compiler put a cast from Dyn on the branch of type Dyn. If both $\mathit{A_{{\mathrm{3}}}}$ and $\mathit{A_{{\mathrm{4}}}}$ are Dyn, the recursive calls in the two else-branches will involve casts $\mathsf{bool}\texttt{?}^{\mathit{p}}$ from Dyn to Bool because the two then-branches are Boolean constants and the if-expressions are given type Bool. However, since the return types are declared to be Dyn, the whole if-expressions are cast back to Dyn, inserting injections $\mathsf{bool}\texttt{!}$. Thus, every recursive call involves a projection immediately followed by an injection, as shown below, eventually causing stack overflow.

⬇

(letrec ([even (lambda ([n : Dyn]) : Dyn

       (if (= 0 n$\langle\mathsf{int}\texttt{?}^{\mathit{p_{{\mathrm{1}}}}}\rangle$) #t

           (odd (- n$\langle\mathsf{int}\texttt{?}^{\mathit{p_{{\mathrm{2}}}}}\rangle$ 1))$\langle\mathsf{bool}\texttt{?}^{\mathit{p_{{\mathrm{3}}}}}\rangle$)$\langle\mathsf{bool}\texttt{!}\rangle$)]

      [odd (lambda ([n : Dyn) : Dyn

       (if (= 0 n$\langle\mathsf{int}\texttt{?}^{\mathit{p_{{\mathrm{4}}}}}\rangle$) #f

           (even (- n$\langle\mathsf{int}\texttt{?}^{\mathit{p_{{\mathrm{5}}}}}\rangle$ 1))$\langle\mathsf{bool}\texttt{?}^{\mathit{p_{{\mathrm{6}}}}}\rangle$)$\langle\mathsf{bool}\texttt{!}\rangle$))])

(odd $\mathit{n}$))

5.3 Evaluation

We have conducted some experiments to measure the overhead of the coercion-passing style translation. The benchmark programs we have used are taken from Kuhlenschmidt et al. DBLP:conf/pldi/KuhlenschmidtAS19 111111https://github.com/Gradual-Typing/benchmarks; we excluded the sieve program because of the use of recursive types. We also include the even/odd program only for reference, which is relatively small compared to other programs.

We compare the running time of a benchmark program between Base and CrcPS. To take many partially typed configurations for each benchmark program into account, we focus on the so-called fine-grained approach, where everywhere a type is required is given either the dynamic type Dyn or an appropriate static type.121212The other approach is called coarse-grained, where functions in each module are all statically or all dynamically typed.

In the fine-grained approach, the number of configurations is $2^{n}$ where $n$ is the number of type annotations. When this number is very large, we consider uniformly sampled configurations. We use the sampling algorithm131313https://github.com/Gradual-Typing/Dynamizer from (DBLP:conf/pldi/KuhlenschmidtAS19, ).

We describe the (sampled) number of partially typed configurations and main language features used for each benchmark program below. (Each benchmark program has one additional type annotation for the return type of the 0-ary main function.) For more detailed description of benchmark programs, we refer readers to Kuhlenschmidt et al. DBLP:conf/pldi/KuhlenschmidtAS19 .

[TABLE]

Our benchmark method is as follows: For each partially typed configuration of a benchmark program, we measure its running time by taking the average of 5 runs for Base and CrcPS, and compute the ratio of CrcPS to Base. We use a machine with a 8-core 3.6 GHz Intel Core i7-7700 and 16 GB memory, and run the benchmark programs within a Docker container (Docker version 19.03.5) which runs Arch Linux. The generated C code is compiled by clang version 9.0.0 with -O3 so that tail-call optimization is applied. The size of the run-time stack is set as unlimited.

Figure 10 shows the result in box plots. (Detailed plots for each benchmark are shown in Appendix B.) It shows that, except for tak (and even–odd), practical programs in CrcPS run up to three times as slow as Base, for most configurations. It is natural because coercion-passing style translation adds an extra coercion argument to each function. In fact, tak and even–odd, which have a lot of function calls, have large overhead compared with other programs. In even–odd, CrcPS performs many coercion composition operations (and one coercion application) while Base performs many coercion applications (without any coercion composition).141414An application of a projection coercion to an injected value is always computed by coercion composition in CrcPS, while the implementation of Base is slightly optimized for first-order types.

Thus, the difference between Base and CrcPS for even–odd is partially due to the difference of the cost of coercion application and coercion composition.

The benchmark programs other than tak and even–odd mainly concern vectors and iterations over them. Vector operations are treated in the translation as primitive operations, which we consider do not have much overhead by the translation. In fact, our translation implementation optimizes the rule (Tr-Op) when its continuation is $\mathsf{id}$: $\mathscr{K}\llbracket\mathit{op}(\mathit{M},\mathit{N})\rrbracket\mathsf{id}=\mathit{op}(\mathscr{C}\llbracket\mathit{M}\rrbracket,\mathscr{C}\llbracket\mathit{N}\rrbracket)$ without an application of an identity coercion.

There are several configurations in which CrcPS is faster than Base but we have not figured out why this is the case.

6 Related Work

6.1 Space-Efficient Coercion/Cast Calculi

As we have already mentioned, it is fairly well known that coercions DBLP:journals/scp/Henglein94 and casts DBLP:conf/esop/WadlerF09 hamper tail-call optimization and make the space complexity of the execution of a program worse than the execution under an unchecked semantics. We discuss below a few pieces of work DBLP:conf/sfp/HermanTF07 ; DBLP:journals/lisp/HermanTF10 ; DBLP:conf/esop/SiekGT09 ; DBLP:conf/popl/SiekW10 ; DBLP:conf/icfp/Garcia13 ; DBLP:conf/pldi/SiekTW15 addressing the problem.

To the best of our knowledge, Herman et al. DBLP:conf/sfp/HermanTF07 ; DBLP:journals/lisp/HermanTF10 were the first to observe the space-efficiency problem of inserted dynamic checks. They developed a variant of Henglein’s coercion calculus with semantics such that a sequence of coercion applications is eagerly composed to reduce the size of coercions. However, they identified two coercions $(\mathit{c_{{\mathrm{1}}}};\mathit{c_{{\mathrm{2}}}});\mathit{c_{{\mathrm{3}}}}$ and $\mathit{c_{{\mathrm{1}}}};(\mathit{c_{{\mathrm{2}}}};\mathit{c_{{\mathrm{3}}}})$ (note that $\mathit{c_{{\mathrm{1}}}};\mathit{c_{{\mathrm{2}}}}$ is not a meta-level operator but only a formal composition constructor); thus, an algorithm for computing coercion composition was not very clear. They did not take blame tracking DBLP:conf/icfp/FindlerF02 into account, either.

Later, Siek et al. DBLP:conf/esop/SiekGT09 extended Herman et al. DBLP:conf/sfp/HermanTF07 ; DBLP:journals/lisp/HermanTF10 with a few different blame tracking strategies. The issue of identifying $(\mathit{c_{{\mathrm{1}}}};\mathit{c_{{\mathrm{2}}}});\mathit{c_{{\mathrm{3}}}}$ and $\mathit{c_{{\mathrm{1}}}};(\mathit{c_{{\mathrm{2}}}};\mathit{c_{{\mathrm{3}}}})$ remained. According to their terminology, our work, which follows previous work DBLP:conf/pldi/SiekTW15 , adopts the UD semantics, which allows only $\mathord{\star}\rightarrow\mathord{\star}$ as a tag to functional values, as opposed to the D semantics, which allows any function types to be used as a tag.

Siek and Wadler DBLP:conf/popl/SiekW10 introduced threesomes to a blame calculus as another solution to the space-efficiency problem. Threesome casts have a third type (called a mediating type) in addition to the source and target types; a threesome cast is considered a downcast from the source type to the mediating, followed by an upcast from the mediating type to the target. Threesome casts allow a simple recursive algorithm to compose two threesome casts but blame tracking is rather complicated.

Garcia DBLP:conf/icfp/Garcia13 gave a translation from coercion calculi to threesome calculi and show that the two solutions to the space-efficiency problem are equivalent in some sense. He introduced supercoercions and a recursive algorithm to compute composition of supercoercions but they were complex, too.

Siek et al. DBLP:conf/pldi/SiekTW15 proposed yet another space-efficient coercion calculus $\lambda\mathsf{S}$, in which they succeeded in developing a simple recursive algorithm for coercion composition by restricting coercions to be in certain canonical forms—what they call space-efficient coercions. They also gave a translation from blame calculus $\lambda\mathsf{B}$ to $\lambda\mathsf{S}$ (via Henglein’s coercion calculus $\lambda\mathsf{C}$) and showed that the translation is fully abstract. As we have discussed already, our $\lambda\mathsf{S}$ has introduced syntax that distinguishes an application $\mathit{U}\langle\mathit{s}\rangle$ of a coercion to (uncoerced) values from $\mathit{U}\langle\!\langle\mathit{d}\rangle\!\rangle$ for a value wrapped by a delayed coercion. Such distinction, which can be seen in some blame calculi DBLP:conf/esop/WadlerF09 , is not just an aesthetic choice but crucial for proving correctness of the translation.

All the above-mentioned calculi adopt a nonstandard reduction rule to compose coercions or casts even before the subject evaluates to a value, together with a nonstandard form of evaluation contexts, and as a result it has not been clear how to implement them efficiently. Herman et al. DBLP:conf/sfp/HermanTF07 ; DBLP:journals/lisp/HermanTF10 sketched a few possible implementation strategies, including coercion passing, but details were not discussed. Siek and Garcia DBLP:conf/icfp/SiekG12 showed an interpreter which performs coercion composition at tail calls. Although not showing correctness of the interpreter, their interpreter would give a hint to direct low-level implementation of space-efficient coercions. Our work addresses the problem of the nonstandard semantics in a different way—by translating a program into coercion-passing style. The difference, however, may not be so large as it may appear at first: in Siek and Garcia DBLP:conf/icfp/SiekG12 , a state of the abstract machine includes an evaluation context, which contains the information on a coercion to be applied to a return value and such a coercion roughly corresponds to our continuation coercions. More detailed analysis of the relationship between the two implementation schemes is left for future work.

Kuhlenschmidt et al. DBLP:conf/pldi/KuhlenschmidtAS19 built an experimental compiler Grift for gradual typing with structural types. It supports run-time checking with the space-efficient coercions of $\lambda\mathsf{S}$ but does not support composition of coercions at tail positions. We have implemented our coercion-passing translation for the Grift compiler.

Greenberg DBLP:conf/popl/Greenberg15 has studied the same space-efficiency problem in the context of manifest contract calculi DBLP:journals/toplas/KnowlesF10 ; DBLP:conf/popl/GreenbergPW10 ; DBLP:journals/jfp/GreenbergPW12 and proposed a few semantics for composing casts that involve contract checking. Feltey et al. DBLP:journals/pacmpl/FelteyGSFS18 recently implemented Greenberg’s eidetic contracts on top of Typed Racket DBLP:conf/popl/Tobin-HochstadtF08 but, similarly to Kuhlenschmidt et al. DBLP:conf/pldi/KuhlenschmidtAS19 , composition is limited to a sequence of contracts applied to values.

There is other recent work for making gradual typing efficient DBLP:journals/pacmpl/BaumanBST17 ; DBLP:journals/pacmpl/MuehlboeckT17 ; DBLP:journals/pacmpl/RichardsAT17 ; DBLP:conf/popl/RastogiSFBV15 but as far as we know, none of them addresses the problem caused by run-time checking applied to tail positions. Additionally, Castagna et al. conf/ifl/CastagnaDLS19 implemented a virtual machine for space-efficient gradual typing in presence of set-theoretic types, but without blame tracking. They address the problem caused by casts applied to tail positions by an approach similar to the one in the interpreter by Siek and Garcia DBLP:conf/icfp/SiekG12 . They implemented their virtual machine and evaluated their implementation by benchmarks such as the even–odd functions.

6.2 Continuation-Passing Style

Our coercion-passing style translation is inspired by continuation-passing style translation, first formalized by Plotkin DBLP:journals/tcs/Plotkin75 . However, coercions represent only a part of the rest of computation and are, in this sense, closer to delimited continuations DBLP:conf/lfp/DanvyF90 . Roughly speaking, translating a subexpression with $\mathsf{id}$ corresponds to the reset operation DBLP:conf/lfp/DanvyF90 to delimit continuations. Unlike (delimited) continuations, which are usually expressed by first-class functions, coercions have compact representations and compactness can be preserved by composition.

Wallach and Felten DBLP:conf/sp/WallachF98 proposed security-passing style to implement Java stack inspection JVMspec . The idea is indeed similar to ours: each function is augmented by an additional argument to pass information on run-time security checking.

In CPS, it is crucial to eliminate administrative redexes to achieve a simulation property DBLP:journals/tcs/Plotkin75 ; DBLP:books/cu/Appel1992 ; DBLP:conf/mfps/Wand91 ; DBLP:journals/lisp/SabryF93 ; DBLP:journals/tcs/DanvyN03 ; DBLP:journals/mscs/DanvyF92 ; DBLP:journals/toplas/SabryW97 , which says that a reduction in the source is simulated by a sequence of (one-directional) reductions in the translation. Simulation is usually achieved by applying different translations to an application $\mathit{M}\,\mathit{N}$, depending on whether $\mathit{M}$ and $\mathit{N}$ are values or not. In addition to such value/nonvalue distinction, our coercion-passing style translation also relies on whether subterms are coercion applications or not.

Continuation-passing style eliminates the difference between call-by-name and call-by-value but our coercion-passing style translation works only under the call-by-value semantics of the target language because coercions have to be eagerly composed. It would be interesting to investigate call-by-name for either the source or the target language, or both.

6.3 First-Class Coercions

The idea of first-class coercions is also found in Cretin and Rémy DBLP:conf/popl/CretinR12 . Their language $\mathrm{F}_{\iota}$ is equipped with abstraction over coercions. However, their coercions are not for gradual typing but for parametric polymorphism and subtyping polymorphism.

7 Conclusion

We have developed a new coercion calculus $\lambda\mathsf{S_{1}}$ with first-class coercions as a target language of coercion-passing style translation from $\lambda\mathsf{S}$, an existing space-efficient coercion calculus. We have proved the translation preserves both typing and semantics. To achieve a simulation property, it is important to reduce administrative coercions, just as in CPS transformations. Our coercion-passing style translation solves the difficulty in implementing the semantics of $\lambda\mathsf{S}$ in a faithful manner and, with the help of first-class coercions, makes it possible to implement in a compiler for a call-by-value language. We have modified an existing compiler for a gradually typed language and conducted some experiments. We have confirmed that our implementation successfully overcomes stack overflow caused by coercions at tail positions, which Kuhlenschmidt at al. DBLP:conf/pldi/KuhlenschmidtAS19 did not support. Our experiment has shown that for practical programs (without heavy use of function calls), the coercion-passing style translation causes slowdown up to 3 times for most partially typed configurations.

Aside from completing the implementation by adding recursive types, which the original Grift compiler supports, more efficient implementation is an obvious direction of future work. Our coercion-passing style translation introduces several identity coercions and optimizing operations on coercions will be necessary.

From a theoretical point of view, it would be interesting to extend the technique to gradual typing in the presence of parametric polymorphism DBLP:conf/popl/AhmedFSW11 ; DBLP:journals/pacmpl/AhmedJSW17 ; DBLP:journals/pacmpl/IgarashiSI17 ; DBLP:conf/esop/XieBO18 ; DBLP:journals/pacmpl/ToroLT19 , for which a polymorphic coercion calculus has to be studied first—Luo DBLP:journals/mscs/Luo08 and Kießling and Luo DBLP:conf/types/KiesslingL03 , who study coercive subtyping in polymorphic settings, may be relevant. The present design of $\lambda\mathsf{S_{1}}$ is geared towards coercion-passing style. For example, in $\lambda\mathsf{S_{1}}$, trivial (namely identity) coercions for coercion types $\mathit{A}\rightsquigarrow\mathit{B}$ are allowed; passing coercions to dynamically typed code is prohibited; variables cannot appear as an argument to coercion constructors, like $\mathit{x}\Rightarrow\mathit{s}$. It may be interesting to study more general first-class coercions without such restrictions.

Appendix A Proofs

A.1 Properties of $\lambda\mathsf{S}$

\propSrcTgt

Proof A.1**.**

(1) By case analysis on $\mathit{i}$ with (2). (2) By case analysis on $\mathit{g}$.

Proposition A.2**.**

Coercion composition $\mathit{s}\fatsemi\mathit{t}$ is terminating.

Proof A.3**.**

The sum of sizes of two arguments gets smaller at each recursive call of $\fatsemi$.

\lemCmpWelldef

Proof A.4**.**

We prove the following four items simultaneously by straightforward induction:

• •

If $\mathit{s}:\mathit{A}\rightsquigarrow\mathit{B}$ and $\mathit{t}:\mathit{B}\rightsquigarrow\mathit{C}$, then $(\mathit{s}\fatsemi\mathit{t}):\mathit{A}\rightsquigarrow\mathit{C}$.

• •

If $\mathit{i}:\mathit{A}\rightsquigarrow\mathit{B}$ and $\mathit{t}:\mathit{B}\rightsquigarrow\mathit{C}$, then there exists $\mathit{i^{\prime}}$ such that $\mathit{i^{\prime}}=\mathit{i}\fatsemi\mathit{t}$ and $\mathit{i^{\prime}}:\mathit{A}\rightsquigarrow\mathit{C}$.

• •

If $\mathit{g}:\mathit{A}\rightsquigarrow\mathit{B}$ and $\mathit{i}:\mathit{B}\rightsquigarrow\mathit{C}$, then there exists $\mathit{i^{\prime}}$ such that $\mathit{i^{\prime}}=\mathit{g}\fatsemi\mathit{i}$ and $\mathit{i^{\prime}}:\mathit{A}\rightsquigarrow\mathit{C}$.

• •

If $\mathit{g_{{\mathrm{1}}}}:\mathit{A}\rightsquigarrow\mathit{B}$ and $\mathit{g_{{\mathrm{2}}}}:\mathit{B}\rightsquigarrow\mathit{C}$, then there exists $\mathit{g_{{\mathrm{3}}}}$ such that $\mathit{g_{{\mathrm{3}}}}=\mathit{g_{{\mathrm{1}}}}\fatsemi\mathit{g_{{\mathrm{2}}}}$ and $\mathit{g_{{\mathrm{3}}}}:\mathit{A}\rightsquigarrow\mathit{C}$.

Lemma A.5**.**

$\accentset{\mathsf{c}}{\longmapsto}_{\mathsf{S}}$* is terminating.*

Proof A.6**.**

Consider a metric $f(M)=4(k+l)+2m+n$ of a term $\mathit{M}$ where:

• •

$k$* is the sum of the sizes of coercions in $\langle\cdot\rangle$ in $\mathit{M}$*

• •

$l$* is the sum of the sizes of coercions in $\langle\!\langle\cdot\rangle\!\rangle$ in $\mathit{M}$*

• •

$m$* is the number of $\langle\cdot\rangle$*

• •

$n$* is the number of $\langle\!\langle\cdot\rangle\!\rangle$ in $\mathit{M}$*

It is easy to show that if $\mathit{M}\mathbin{\accentset{\mathsf{c}}{\longmapsto}_{\mathsf{S}}}\mathit{N}$ then $f(M)>f(N)$.

Lemma A.7** (Unique Decomposition).**

If $\emptyset\vdash_{\mathsf{S}}\mathit{M}:\mathit{A}$, then one of the following holds.

There uniquely exist a redex $\mathit{M_{{\mathrm{1}}}}$ and an evaluation context $\mathcal{E}$ such that $\mathit{M}=\mathcal{E}[\mathit{M_{{\mathrm{1}}}}]$. 2. 2.

$\mathit{M}=\mathit{V}$* for some $\mathit{V}$.* 3. 3.

$\mathit{M}=\mathsf{blame}\,\mathit{p}$* for some $\mathit{p}$.*

Proof A.8**.**

By induction on the derivation of $\emptyset\vdash_{\mathsf{S}}\mathit{M}:\mathit{A}$ with case analysis on the rule applied last.

\lemDeterminacyS

Proof A.9**.**

By Lemma A.7.

We state type safety for $\lambda\mathsf{S}$ with auxiliary lemmas.

Lemma A.10** (Canonical Forms).**

If $\emptyset\vdash_{\mathsf{S}}\mathit{V}:\mathit{A}$, then one of the following holds.

$\mathit{V}=\mathit{a}$* and $\mathit{A}=\iota$ for some $\mathit{a},\iota$.* 2. 2.

$\mathit{V}=\lambda\mathit{x}.\,\mathit{M}$* and $\mathit{A}=\mathit{A_{{\mathrm{1}}}}\rightarrow\mathit{A_{{\mathrm{2}}}}$ for some $\mathit{x},\mathit{M},\mathit{A_{{\mathrm{1}}}},\mathit{A_{{\mathrm{2}}}}$.* 3. 3.

$\mathit{V}=\mathit{U}\langle\!\langle\mathit{s}\rightarrow\mathit{t}\rangle\!\rangle$* and $\mathit{A}=\mathit{A_{{\mathrm{1}}}}\rightarrow\mathit{A_{{\mathrm{2}}}}$ for some $\mathit{U},\mathit{s},\mathit{t},\mathit{A_{{\mathrm{1}}}},\mathit{A_{{\mathrm{2}}}}$.* 4. 4.

$\mathit{V}=\mathit{U}\langle\!\langle\mathit{g};\mathit{G}\texttt{!}\rangle\!\rangle$* and $\mathit{A}=\mathord{\star}$ for some $\mathit{U},\mathit{g},\mathit{G}$.*

\thmProgressS

Proof A.11**.**

By Lemma A.7.

Lemma A.12** (Preservation of Types under Substitution).**

If $\Gamma,\mathit{x}:\mathit{A}\vdash_{\mathsf{S}}\mathit{M}:\mathit{B}$ and $\Gamma\vdash_{\mathsf{S}}\mathit{V}:\mathit{A}$, then $\Gamma\vdash_{\mathsf{S}}\mathit{M}[\mathit{x}:=\mathit{V}]:\mathit{B}$.

Lemma A.13** (Preservation for Reduction).**

If $\emptyset\vdash_{\mathsf{S}}\mathit{M}:\mathit{A}$ and $\mathit{M}\longrightarrow_{\mathsf{S}}\mathit{N}$, then $\emptyset\vdash_{\mathsf{S}}\mathit{N}:\mathit{A}$.

Proof A.14**.**

By case analysis on the reduction rule applied to $\mathit{M}\longrightarrow_{\mathsf{S}}\mathit{N}$. (Similar to Lemma A.31.)

\thmPreservationS

Proof A.15**.**

By case analysis on the evaluation rule applied to $\mathit{M}\mathbin{\longmapsto_{\mathsf{S}}}\mathit{N}$. (Similar to Theorem 3.4.)

\corSafetyS

Proof A.16**.**

By Theorem 2.5 and Theorem 2.6.

A.2 Properties of $\lambda\mathsf{S_{1}}$

The properties for $\lambda\mathsf{S}$-coercions still hold in $\lambda\mathsf{S_{1}}$. We do not repeat all of them.

Lemma A.17**.**

If $\mathit{s}:\mathit{A}\rightsquigarrow\mathit{B}$ and $\mathit{t}:\mathit{B}\rightsquigarrow\mathit{C}$, $(\mathit{s}\fatsemi\mathit{t}):\mathit{A}\rightsquigarrow\mathit{C}$.

Proof A.18**.**

Similar to Lemma 2.2.

We explicitly state a few lemmas on evaluation contexts.

The following lemma ensures that the composition of evaluation contexts is also an evaluation context. Here, we note that

[TABLE]

where $\mathit{L}$ is a term that may contain at most one hole $\square$. For example,

[TABLE]

Lemma A.19** (Composition of Contexts).**

For any evaluation contexts $\mathcal{E}_{{\mathrm{1}}},\mathcal{E}_{{\mathrm{2}}}$ of $\lambda\mathsf{S_{1}}$, there exists an evaluation context $\mathcal{E}$ such that $\mathcal{E}_{{\mathrm{1}}}[\mathcal{E}_{{\mathrm{2}}}]=\mathcal{E}$.

Proof A.20**.**

By induction on $\mathcal{E}_{{\mathrm{2}}}$. We only show one case.

Case $\mathcal{E}_{{\mathrm{2}}}=\mathcal{E}^{\prime}_{{\mathrm{2}}}[\square\,(\mathit{M},\mathit{N})]$ :

[TABLE]

By the IH, we have $\mathcal{E}_{{\mathrm{1}}}[\mathcal{E}^{\prime}_{{\mathrm{2}}}]=\mathcal{E}^{\prime}$ for some $\mathcal{E}^{\prime}$. Then, $\mathcal{E}_{{\mathrm{1}}}[\mathcal{E}_{{\mathrm{2}}}]=\mathcal{E}^{\prime}[\square\,(\mathit{M},\mathit{N})]$ is an evaluation context.

The following lemma is useful in Lemma 4.5.

Lemma A.21**.**

Assume $\mathit{N}\neq\mathsf{blame}\,\mathit{p}$ and $\mathcal{X}\in\{\mathsf{e},\mathsf{c}\}$. If $\mathit{M}\mathbin{\accentset{\mathcal{X}}{\longmapsto}_{\mathsf{S_{1}}}}\mathit{N}$, then $\mathcal{E}[\mathit{M}]\mathbin{\accentset{\mathcal{X}}{\longmapsto}_{\mathsf{S_{1}}}}\mathcal{E}[\mathit{N}]$.

Proof A.22**.**

By case analysis on the evaluation rule applied to $\mathit{M}\mathbin{\accentset{\mathcal{X}}{\longmapsto}_{\mathsf{S_{1}}}}\mathit{N}$.

Case (E-Ctx) :

We are given

[TABLE]

for some $\mathcal{E},\mathit{M_{{\mathrm{1}}}},\mathit{N_{{\mathrm{1}}}}$. By Lemma A.19, we have $\mathcal{E}[\mathcal{E}_{{\mathrm{1}}}]=\mathcal{E}^{\prime}$ for some $\mathcal{E}^{\prime}$.

[TABLE]

By (E-Ctx) with evaluation context $\mathcal{E}[\mathcal{E}_{{\mathrm{1}}}]=\mathcal{E}^{\prime}$, we have $\mathcal{E}[\mathit{M}]\mathbin{\accentset{\mathcal{X}}{\longmapsto}}\mathcal{E}[\mathit{N}]$.

Case (E-Abort) :

Cannot happen (since $\mathit{N}\neq\mathsf{blame}\,\mathit{p}$).

We note that the following property (for any natural number $\mathit{n}$) follows from Lemma A.21. (By $\mathit{N}\neq\mathsf{blame}\,\mathit{p}$, we can assume no use of (E-Abort) in the derivation of $\mathit{M}\mathbin{\accentset{\mathcal{X}}{\longmapsto}_{\mathsf{S_{1}}}^{\mathit{n}}}\mathit{N}$.)

Assume $\mathit{N}\neq\mathsf{blame}\,\mathit{p}$ and $\mathcal{X}\in\{\mathsf{e},\mathsf{c}\}$. If $\mathit{M}\mathbin{\accentset{\mathcal{X}}{\longmapsto}_{\mathsf{S_{1}}}^{\mathit{n}}}\mathit{N}$, then $\mathcal{E}[\mathit{M}]\mathbin{\accentset{\mathcal{X}}{\longmapsto}_{\mathsf{S_{1}}}^{\mathit{n}}}\mathcal{E}[\mathit{N}]$.

Lemma A.23** (Unique Decomposition).**

If $\emptyset\vdash_{\mathsf{S_{1}}}\mathit{M}:\mathit{A}$, then one of the following holds.

There uniquely exist a redex $\mathit{M_{{\mathrm{1}}}}$ and an evaluation context $\mathcal{E}$ such that $\mathit{M}=\mathcal{E}[\mathit{M_{{\mathrm{1}}}}]$. 2. 2.

$\mathit{M}=\mathit{V}$* for some $\mathit{V}$.* 3. 3.

$\mathit{M}=\mathsf{blame}\,\mathit{p}$* for some $\mathit{p}$.*

Proof A.24**.**

*Similarly for Theorem 3.3.151515It would be a bit more involved so as to show the uniqueness. We avoid involvedness to write them down. (Theorem 3.3 would follow Lemma A.23.) *

\lemDeterminacySx

Proof A.25**.**

By Lemma A.23.

We state type safety for $\lambda\mathsf{S_{1}}$ with auxiliary lemmas. We omit inversion lemmas for the typing judgments.

Lemma A.26** (Canonical Forms).**

If $\emptyset\vdash_{\mathsf{S_{1}}}\mathit{V}:\mathit{A}$, then one of the following holds.

$\mathit{V}=\mathit{a}$* and $\mathit{A}=\iota$ for some $\mathit{a},\iota$.* 2. 2.

$\mathit{V}=\lambda(\mathit{x},\kappa).\,\mathit{M}$* and $\mathit{A}=\mathit{A_{{\mathrm{1}}}}\Rightarrow\mathit{A_{{\mathrm{2}}}}$ for some $\mathit{x},\kappa,\mathit{M},\mathit{A_{{\mathrm{1}}}},\mathit{A_{{\mathrm{2}}}}$.* 3. 3.

$\mathit{V}=\mathit{U}\langle\!\langle\mathit{s}\Rightarrow\mathit{t}\rangle\!\rangle$* and $\mathit{A}=\mathit{A_{{\mathrm{1}}}}\Rightarrow\mathit{A_{{\mathrm{2}}}}$ for some $\mathit{U},\mathit{s},\mathit{t},\mathit{A_{{\mathrm{1}}}},\mathit{A_{{\mathrm{2}}}}$.* 4. 4.

$\mathit{V}=\mathit{U}\langle\!\langle\mathit{g};\mathit{G}\texttt{!}\rangle\!\rangle$* and $\mathit{A}=\mathord{\star}$ for some $\mathit{U},\mathit{g},\mathit{G}$.* 5. 5.

$\mathit{V}=\mathit{s}$* and $\mathit{A}=\mathit{A_{{\mathrm{1}}}}\rightsquigarrow\mathit{A_{{\mathrm{2}}}}$ for some $\mathit{s},\mathit{A_{{\mathrm{1}}}},\mathit{A_{{\mathrm{2}}}}$.*

Proof A.27**.**

By case analysis on the typing rule applied to $\emptyset\vdash_{\mathsf{S_{1}}}\mathit{V}:\mathit{A}$.

In the proof of the following theorem, we only write down case (T-Op) in detail and write “Similar.” for the other cases.

\thmProgressSx

Proof A.28**.**

By induction on the derivation of $\emptyset\vdash_{\mathsf{S_{1}}}\mathit{M}:\mathit{A}$ with case analysis on the rule applied last.

Case (T-Var) :

Cannot happen.

Case (T-Const) :

Immediate. ($\mathit{M}=\mathit{a}$* is a value.)*

Case (T-Abs) :

Immediate. ($\mathit{M}=\lambda(\mathit{x},\kappa).\,\mathit{M_{{\mathrm{1}}}}$* is a value.)*

Case (T-Op) :

We are given

[TABLE]

for some $\mathit{N_{{\mathrm{1}}}},\mathit{N_{{\mathrm{2}}}},\iota_{{\mathrm{1}}},\iota_{{\mathrm{2}}}$. We have the IHs for $\emptyset\vdash\mathit{N_{{\mathrm{1}}}}:\iota_{{\mathrm{1}}}$ and $\emptyset\vdash\mathit{N_{{\mathrm{2}}}}:\iota_{{\mathrm{2}}}$. We proceed by case analysis on $\mathit{N_{{\mathrm{1}}}},\mathit{N_{{\mathrm{2}}}}$.

Subcase $\mathit{N_{{\mathrm{1}}}}\mathbin{\longmapsto}\mathit{N^{\prime}_{{\mathrm{1}}}}$ :

By case analysis on the evaluation rule applied to $\mathit{N_{{\mathrm{1}}}}$.

Subsubcase (E-Ctx) :

We are given

[TABLE]

for some $\mathcal{E}_{{\mathrm{1}}},\mathit{N_{{\mathrm{11}}}},\mathit{N^{\prime}_{{\mathrm{11}}}}$. Take $\mathcal{E}=(\mathit{op}(\square,\mathit{N_{{\mathrm{2}}}}))[\mathcal{E}_{{\mathrm{1}}}]$ by Lemma A.19.

[TABLE]

By (E-Ctx) with $\mathcal{E}=(\mathit{op}(\square,\mathit{N_{{\mathrm{2}}}}))[\mathcal{E}_{{\mathrm{1}}}]$, we have $\mathit{op}(\mathit{N_{{\mathrm{1}}}},\mathit{N_{{\mathrm{2}}}})\mathbin{\longmapsto}\mathit{op}(\mathit{N^{\prime}_{{\mathrm{1}}}},\mathit{N_{{\mathrm{2}}}})$. Take $\mathit{M^{\prime}}=\mathit{op}(\mathit{N^{\prime}_{{\mathrm{1}}}},\mathit{N_{{\mathrm{2}}}})$.

Subsubcase (E-Abort) :

We are given

[TABLE]

for some $\mathcal{E}_{{\mathrm{1}}},\mathit{p}$. By Lemma A.19, we have

[TABLE]

By (E-Abort) with $\mathcal{E}=(\mathit{op}(\square,\mathit{N_{{\mathrm{2}}}}))[\mathcal{E}_{{\mathrm{1}}}]$, we have $\mathit{op}(\mathit{N_{{\mathrm{1}}}},\mathit{N_{{\mathrm{2}}}})\mathbin{\longmapsto}\mathsf{blame}\,\mathit{p}$. Take $\mathit{M^{\prime}}=\mathsf{blame}\,\mathit{p}$.

Subcase $\mathit{N_{{\mathrm{1}}}}=\mathsf{blame}\,\mathit{p}$ :

Take $\mathit{M^{\prime}}=\mathsf{blame}\,\mathit{p}$. By (E-Abort) with $\mathcal{E}=\mathit{op}(\square,\mathit{N_{{\mathrm{2}}}})$, we have $\mathit{op}(\mathsf{blame}\,\mathit{p},\mathit{N_{{\mathrm{2}}}})\mathbin{\longmapsto}\mathsf{blame}\,\mathit{p}$; i.e., $\mathit{M}\mathbin{\longmapsto}\mathit{M^{\prime}}$.

Subcase $\mathit{N_{{\mathrm{1}}}}=\mathit{V_{{\mathrm{1}}}}$ and $\mathit{N_{{\mathrm{2}}}}\mathbin{\longmapsto}\mathit{N^{\prime}_{{\mathrm{2}}}}$ :

By case analysis on the evaluation rule applied to $\mathit{N_{{\mathrm{2}}}}$.

Subsubcase (E-Ctx) :

Similarly, take $\mathit{M^{\prime}}=\mathit{op}(\mathit{V_{{\mathrm{1}}}},\mathit{N^{\prime}_{{\mathrm{2}}}})$.

Subsubcase (E-Abort) :

Similarly, take $\mathit{M^{\prime}}=\mathsf{blame}\,\mathit{p}$.

Subcase $\mathit{N_{{\mathrm{1}}}}=\mathit{V_{{\mathrm{1}}}}$ and $\mathit{N_{{\mathrm{2}}}}=\mathsf{blame}\,\mathit{p}$ :

Take $\mathit{M^{\prime}}=\mathsf{blame}\,\mathit{p}$. By (E-Abort) with $\mathcal{E}=\mathit{op}(\mathit{V_{{\mathrm{1}}}},\,\square\,)$, $\mathit{op}(\mathit{V_{{\mathrm{1}}}},\mathsf{blame}\,\mathit{p})\mathbin{\longmapsto}\mathsf{blame}\,\mathit{p}$; i.e., $\mathit{M}\mathbin{\longmapsto}\mathit{M^{\prime}}$.

Subcase $\mathit{N_{{\mathrm{1}}}}=\mathit{V_{{\mathrm{1}}}}$ and $\mathit{N_{{\mathrm{2}}}}=\mathit{V_{{\mathrm{2}}}}$ :

By $\emptyset\vdash\mathit{V_{{\mathrm{1}}}}:\iota_{{\mathrm{1}}}$ and $\emptyset\vdash\mathit{V_{{\mathrm{2}}}}:\iota_{{\mathrm{2}}}$ and Lemma A.26, we have $\mathit{V_{{\mathrm{1}}}}=\mathit{a_{{\mathrm{1}}}}$ and $\mathit{V_{{\mathrm{2}}}}=\mathit{a_{{\mathrm{2}}}}$ for some $\mathit{a_{{\mathrm{1}}}},\mathit{a_{{\mathrm{2}}}}$. Then, (R-Op) finishes.

Case (T-App) :

We are given

[TABLE]

for some $\mathit{N_{{\mathrm{1}}}},\mathit{N_{{\mathrm{2}}}},\mathit{N_{{\mathrm{3}}}},\mathit{A_{{\mathrm{2}}}},\mathit{B}$. We have the IHs for three typing derivations. We proceed by case analysis on $\mathit{N_{{\mathrm{1}}}},\mathit{N_{{\mathrm{2}}}},\mathit{N_{{\mathrm{3}}}}$.

Subcase $\mathit{N_{{\mathrm{1}}}}=\mathit{V_{{\mathrm{1}}}}$ and $\mathit{N_{{\mathrm{2}}}}=\mathit{V_{{\mathrm{2}}}}$ and $\mathit{N_{{\mathrm{3}}}}=\mathit{V_{{\mathrm{3}}}}$ :

By $\emptyset\vdash\mathit{V_{{\mathrm{1}}}}:\mathit{A_{{\mathrm{2}}}}\Rightarrow\mathit{A}$ and Lemma A.26, we have either

[TABLE]

Then, (R-Beta) or (R-Wrap) finishes the case.

Otherwise:

Similar.

Case (T-Let) :

We are given

[TABLE]

for some $\mathit{N_{{\mathrm{1}}}},\mathit{N_{{\mathrm{2}}}},\mathit{x},\mathit{A_{{\mathrm{1}}}}$. We use the IH with $\emptyset\vdash\mathit{N_{{\mathrm{1}}}}:\mathit{A_{{\mathrm{1}}}}$. We proceed by case analysis on $\mathit{N_{{\mathrm{1}}}}$.

Subcase $\mathit{N_{{\mathrm{1}}}}=\mathit{V_{{\mathrm{1}}}}$ :

Take $\mathit{M^{\prime}}=\mathit{N_{{\mathrm{2}}}}[\mathit{x}:=\mathit{V_{{\mathrm{1}}}}]$ by (R-Let).

Subcase $\mathit{N_{{\mathrm{1}}}}\mathbin{\longmapsto}\mathit{N^{\prime}_{{\mathrm{1}}}}$ :

Similar.

Subcase $\mathit{N_{{\mathrm{1}}}}=\mathsf{blame}\,\mathit{p}$ :

Similar.

Case (T-Cmp) :

We are given

[TABLE]

for some $\mathit{N_{{\mathrm{1}}}},\mathit{N_{{\mathrm{2}}}},\mathit{A_{{\mathrm{1}}}},\mathit{A_{{\mathrm{2}}}},\mathit{B}$. We have the IHs for $\emptyset\vdash\mathit{N_{{\mathrm{1}}}}:\mathit{A_{{\mathrm{1}}}}\rightsquigarrow\mathit{B}$ and $\emptyset\vdash\mathit{N_{{\mathrm{2}}}}:\mathit{B}\rightsquigarrow\mathit{A_{{\mathrm{2}}}}$. We proceed by case analysis on $\mathit{N_{{\mathrm{1}}}},\mathit{N_{{\mathrm{2}}}}$.

Subcase $\mathit{N_{{\mathrm{1}}}}=\mathit{V_{{\mathrm{1}}}}$ and $\mathit{N_{{\mathrm{2}}}}=\mathit{V_{{\mathrm{2}}}}$ :

By $\emptyset\vdash\mathit{V_{{\mathrm{1}}}}:\mathit{A_{{\mathrm{1}}}}\rightsquigarrow\mathit{B}$ and $\emptyset\vdash\mathit{V_{{\mathrm{2}}}}:\mathit{B}\rightsquigarrow\mathit{A_{{\mathrm{2}}}}$ and Lemma A.26, we have $\mathit{V_{{\mathrm{1}}}}=\mathit{s_{{\mathrm{1}}}}$ and $\mathit{V_{{\mathrm{2}}}}=\mathit{s_{{\mathrm{2}}}}$ for some $\mathit{s_{{\mathrm{1}}}},\mathit{s_{{\mathrm{2}}}}$. Take $\mathit{M^{\prime}}=\mathit{s}\fatsemi\mathit{t}$ by (R-Op). (Here, $\mathit{s}\fatsemi\mathit{t}$ is defined by Lemma 2.2.)

Otherwise:

Similar.

Case (T-Crc) :

We are given

[TABLE]

for some $\mathit{N_{{\mathrm{1}}}},\mathit{N_{{\mathrm{2}}}},\mathit{A_{{\mathrm{1}}}}$. We have the IHs for $\emptyset\vdash\mathit{N_{{\mathrm{1}}}}:\mathit{A_{{\mathrm{1}}}}$ and $\emptyset\vdash\mathit{N_{{\mathrm{2}}}}:\mathit{A_{{\mathrm{1}}}}\rightsquigarrow\mathit{A}$. We proceed by case analysis on $\mathit{N_{{\mathrm{1}}}},\mathit{N_{{\mathrm{2}}}}$.

Subcase $\mathit{N_{{\mathrm{1}}}}=\mathit{V_{{\mathrm{1}}}}$ and $\mathit{N_{{\mathrm{2}}}}=\mathit{V_{{\mathrm{2}}}}$ :

By $\emptyset\vdash\mathit{N_{{\mathrm{2}}}}:\mathit{A_{{\mathrm{1}}}}\rightsquigarrow\mathit{A}$ and Lemma A.26, we have $\mathit{N_{{\mathrm{2}}}}=\mathit{t}$ for some $\mathit{t}$. We proceed by case analysis on closed value $\mathit{V_{{\mathrm{1}}}}$.

Subcase $\mathit{N_{{\mathrm{1}}}}=\mathit{U}$ :

By $\emptyset\vdash\mathit{U}:\mathit{A_{{\mathrm{1}}}}$, we have $\mathit{A_{{\mathrm{1}}}}\neq\mathord{\star}$. As the source type of $\mathit{t}$ is nondynamic, we have either $\mathit{t}=\mathsf{id},\bot^{\mathit{G}\mathit{p}\mathit{H}},\mathit{d}$. Then, (R-Id) or (R-Fail) or (R-Crc) finishes the case. (Note: it might be the case that $\mathit{U}=\mathit{s}$ for some $\mathit{s}$; e.g., $\mathsf{id}_{\iota}\langle\mathsf{id}_{\iota\rightsquigarrow\iota}\rangle\mathbin{\longmapsto}\mathsf{id}_{\iota}$.)

Subcase $\mathit{N_{{\mathrm{1}}}}=\mathit{U}\langle\!\langle\mathit{d}\rangle\!\rangle$ :

Take $\mathit{M^{\prime}}=\mathit{U}\langle\mathit{d}\mathbin{;\!;}\mathit{t}\rangle$ by (R-MergeV).

Otherwise:

Similar.

Case (T-CrcV) :

Immediate. ($\mathit{M}=\mathit{U}\langle\!\langle\mathit{V}\rangle\!\rangle$* is a value.)*

Case (T-Crcn) :

Immediate. ($\mathit{M}=\mathit{s}$* is a value.)*

Case (T-Blame) :

Immediate. ($\mathit{M}=\mathsf{blame}\,\mathit{p}$)

Lemma A.29** (Preservation of Types under Substitution).**

If $\Gamma,\mathit{x}:\mathit{A}\vdash_{\mathsf{S_{1}}}\mathit{M}:\mathit{B}$ and $\Gamma\vdash_{\mathsf{S_{1}}}\mathit{V}:\mathit{A}$, then $\Gamma\vdash_{\mathsf{S_{1}}}\mathit{M}[\mathit{x}:=\mathit{V}]:\mathit{B}$.

Proof A.30**.**

By straightforward induction on the derivation of $\Gamma,\mathit{x}:\mathit{A}\vdash_{\mathsf{S_{1}}}\mathit{M}:\mathit{B}$ with case analysis on the rule applied last.

Lemma A.31** (Preservation for Reduction).**

If $\emptyset\vdash_{\mathsf{S_{1}}}\mathit{M}:\mathit{A}$ and $\mathit{M}\longrightarrow_{\mathsf{S_{1}}}\mathit{N}$, then $\emptyset\vdash_{\mathsf{S_{1}}}\mathit{N}:\mathit{A}$.

Proof A.32**.**

By case analysis on the reduction rule applied to $\mathit{M}\longrightarrow_{\mathsf{S_{1}}}\mathit{N}$.

Case (R-Op) :

We are given

[TABLE]

for some $\mathit{a_{{\mathrm{1}}}},\mathit{a_{{\mathrm{2}}}},\mathit{a}$. By inversion on $\emptyset\vdash\mathit{op}(\mathit{a_{{\mathrm{1}}}},\mathit{a_{{\mathrm{2}}}}):\mathit{A}$,

[TABLE]

for some $\iota_{{\mathrm{1}}},\iota_{{\mathrm{2}}},\iota$. Assumptions on $\delta$ (called $\delta$-typability) ensure that

[TABLE]

for some constant $\mathit{a}$. By (T-Const), we have $\emptyset\vdash\mathit{a}:\iota$.

Case (R-Beta) :

We are given

[TABLE]

for some $\mathit{x},\kappa,\mathit{M_{{\mathrm{1}}}},\mathit{V},\mathit{W}$. By inversion on $\emptyset\vdash(\lambda(\mathit{x},\kappa).\,\mathit{M_{{\mathrm{1}}}})\,(\mathit{V},\mathit{W}):\mathit{A}$,

[TABLE]

for some $\mathit{A_{{\mathrm{1}}}},\mathit{A_{{\mathrm{2}}}}$. By inversion on the left judgment,

[TABLE]

for some $\mathit{X}$. Thus, we have

[TABLE]

(by type substitution of $\mathit{A}$ for $\mathit{X}$). By Lemma A.29 (twice), $\emptyset\vdash\mathit{M_{{\mathrm{1}}}}[\mathit{x}:=\mathit{V},\kappa:=\mathit{W}]:\mathit{A}$ follows.

Case (R-Wrap) :

We are given

[TABLE]

for some $\mathit{U},\mathit{s},\mathit{t},\mathit{V},\mathit{W},\kappa$. By inversion on $\emptyset\vdash(\mathit{U}\langle\!\langle\mathit{s}\rightarrow\mathit{t}\rangle\!\rangle)\,(\mathit{V},\mathit{W}):\mathit{A}$,

[TABLE]

for some $\mathit{A_{{\mathrm{1}}}},\mathit{A_{{\mathrm{2}}}}$. By inversion on the left judgment,

[TABLE]

for some $\mathit{A^{\prime}}$. By inversion on the right judgment,

[TABLE]

for some $\mathit{A^{\prime}_{{\mathrm{1}}}},\mathit{A^{\prime}_{{\mathrm{2}}}}$. By (T-Crc) and (T-Cmp), we have

[TABLE]

Then, (T-Let) and (T-App) finish this case.

Case (R-Let) :

We are given

[TABLE]

for some $\mathit{x},\mathit{V},\mathit{M_{{\mathrm{1}}}}$. By inversion on $\emptyset\vdash\mathsf{let}\,\mathit{x}=\mathit{V}\,\mathsf{in}\,\mathit{M_{{\mathrm{1}}}}:\mathit{A}$,

[TABLE]

for some $\mathit{A_{{\mathrm{1}}}}$. By Lemma A.29, $\emptyset\vdash\mathit{M_{{\mathrm{1}}}}[\mathit{x}:=\mathit{V}]:\mathit{A}$ follows.

Case (R-Cmp) :

We are given

[TABLE]

for some $\mathit{s},\mathit{t}$. By inversion on $\emptyset\vdash\mathit{s}\mathbin{;\!;}\mathit{t}:\mathit{A}$,

[TABLE]

for some $\mathit{A_{{\mathrm{1}}}},\mathit{A_{{\mathrm{2}}}},\mathit{B}$. By Lemma A.17, we have $\emptyset\vdash(\mathit{s}\fatsemi\mathit{t}):\mathit{A_{{\mathrm{1}}}}\rightsquigarrow\mathit{A_{{\mathrm{2}}}}$.

Case (R-Id) :

We are given

[TABLE]

for some $\mathit{U},\mathit{A}$. By inversion on $\emptyset\vdash\mathit{U}\langle\mathsf{id}_{\mathit{A}}\rangle:\mathit{A}$,

[TABLE]

for some $\mathit{A^{\prime}}$. By $\mathit{A^{\prime}}=\mathit{A}$, we have $\emptyset\vdash\mathit{U}:\mathit{A}$.

Case (R-Fail) :

By (T-Blame).

Case (R-Crc) :

By (T-CrcV).

Case (R-MergeV) :

We are given

[TABLE]

for some $\mathit{U},\mathit{d},\mathit{t}$. By inversion on $\emptyset\vdash\mathit{U}\langle\!\langle\mathit{d}\rangle\!\rangle\langle\mathit{t}\rangle:\mathit{A}$,

[TABLE]

for some $\mathit{A^{\prime}}$. By inversion on the left judgment,

[TABLE]

for some $\mathit{A^{\prime\prime}}$. By (T-Cmp), $\emptyset\vdash(\mathit{d}\mathbin{;\!;}\mathit{t}):\mathit{A^{\prime\prime}}\rightsquigarrow\mathit{A}$. By (T-Crc), $\emptyset\vdash\mathit{U}\langle\mathit{d}\mathbin{;\!;}\mathit{t}\rangle:\mathit{A}$.

\thmPreservationSx

Proof A.33**.**

By case analysis on the evaluation rule applied to $\mathit{M}\mathbin{\longmapsto_{\mathsf{S_{1}}}}\mathit{N}$.

Case (E-Ctx) :

We are given

[TABLE]

for some $\mathcal{E},\mathit{M_{{\mathrm{1}}}},\mathit{N_{{\mathrm{1}}}}$. We have derivation $\mathcal{D}$ of $\emptyset\vdash\mathcal{E}[\mathit{M_{{\mathrm{1}}}}]:\mathit{A}$. In derivation $\mathcal{D}$, there exists subderivation $\mathcal{D}_{1}$ of $\emptyset\vdash\mathit{M_{{\mathrm{1}}}}:\mathit{A_{{\mathrm{1}}}}$ for some $\mathit{A_{{\mathrm{1}}}}$. By $\mathit{M_{{\mathrm{1}}}}\longrightarrow\mathit{N_{{\mathrm{1}}}}$ and Lemma A.31, we have derivation $\mathcal{D}_{2}$ of $\emptyset\vdash\mathit{N_{{\mathrm{1}}}}:\mathit{A_{{\mathrm{1}}}}$. Thus, we can form derivation of $\emptyset\vdash\mathcal{E}[\mathit{N_{{\mathrm{1}}}}]:\mathit{A}$ by substituting $\mathcal{D}_{2}$ for $\mathcal{D}_{1}$ in $\mathcal{D}$. We have $\emptyset\vdash\mathit{N}:\mathit{A}$. (More precisely, by induction on $\mathcal{E}$.)

Case (E-Abort) :

We are given

[TABLE]

for some $\mathcal{E},\mathit{p}$. By (T-Blame), $\emptyset\vdash\mathsf{blame}\,\mathit{p}:\mathit{A}$.

\corSafetySx

Proof A.34**.**

By Theorem 3.3 and Theorem 3.4.

A.3 Translation Preserves Typing

Lemma A.35**.**

If $\mathit{s}:\mathit{A}\rightsquigarrow\mathit{B}$ in $\lambda\mathsf{S}$, then $\emptyset\vdash_{\mathsf{S_{1}}}\Psi(\mathit{s}):\Psi(\mathit{A})\rightsquigarrow\Psi(\mathit{B})$.

Proof A.36**.**

By case analysis on $\mathit{s}$.

\thmTransTyping

Proof A.37**.**

Simultaneously proved by induction on the derivation of $\Gamma\vdash_{\mathsf{S}}\mathit{M}:\mathit{A}$ and $\Gamma\vdash_{\mathsf{S}}\mathit{V}:\mathit{A}$.

A.4 Translation Preserves Semantics

Lemma A.38** (Composition).**

If $\mathit{s}\fatsemi\mathit{t}=\mathit{s^{\prime}}$ in $\lambda\mathsf{S}$, then $\Psi(\mathit{s})\fatsemi\Psi(\mathit{t})=\Psi(\mathit{s^{\prime}})$.

Proof A.39**.**

By induction on the derivation of $\mathit{s}\fatsemi\mathit{t}=\mathit{s^{\prime}}$.

Lemma A.40**.**

If $\mathit{s}:\mathit{A}\rightsquigarrow\mathit{B}$ and $\mathsf{id}:\Psi(\mathit{B})\rightsquigarrow\Psi(\mathit{B})$, then $\Psi(\mathit{s})\fatsemi\mathsf{id}=\Psi(\mathit{s})$.

Proof A.41**.**

Easy case analysis on $\mathit{s}$.

Lemma A.42**.**

$\Psi(\mathit{U})$* is an uncoerced value and $\Psi(\mathit{V})$ is a value.*

Proof A.43**.**

Easy.

Lemma A.44**.**

If $\emptyset\vdash_{\mathsf{S}}\Psi(\mathit{V}):\mathit{A}$ and $\mathsf{id}:\mathit{A}\rightsquigarrow\mathit{A}$, then $\Psi(\mathit{V})\langle\mathsf{id}\rangle\mathbin{\accentset{\mathsf{c}}{\longmapsto}_{\mathsf{S_{1}}}^{*}}\Psi(\mathit{V})$.

Proof A.45**.**

By case analysis on $\mathit{V}$. (Note that $\mathit{V}$ is closed.)

Case $\mathit{V}=\mathit{x}$ :

Cannot happen.

Case $\mathit{V}=\mathit{U}$ :

By (R-Id).

Case $\mathit{V}=\mathit{U}\langle\!\langle\mathit{d}\rangle\!\rangle$ :

[TABLE]

A.4.1 Substitution

The definition of substitution is standard. Here are selected cases from its definition:

[TABLE]

Lemma A.46**.**

$\mathit{FV}(\mathscr{K}\llbracket\mathit{M}\rrbracket\mathit{K})=\mathit{FV}(\mathit{M})\,\cup\,\mathit{FV}(\mathit{K})$**

Proof A.47**.**

By induction on the derivation of $\mathscr{K}\llbracket\mathit{M}\rrbracket\mathit{K}$.

Lemma A.48** (Substitution for a non-continuation variable).**

$\mathscr{C}\llbracket\mathit{M}\rrbracket[\mathit{x}:=\Psi(\mathit{V})]=\mathscr{C}\llbracket\mathit{M}[\mathit{x}:=\mathit{V}]\rrbracket$** 2. 2.

If $\mathit{x}\notin\mathit{FV}(\mathit{K})$, then $(\mathscr{K}\llbracket\mathit{M}\rrbracket\mathit{K})[\mathit{x}:=\Psi(\mathit{V})]=\mathscr{K}\llbracket\mathit{M}[\mathit{x}:=\mathit{V}]\rrbracket\mathit{K}$.

Proof A.49**.**

The two items are simultaneously proved by induction on the derivations of $\mathscr{C}\llbracket\mathit{M}\rrbracket$ and $\mathscr{K}\llbracket\mathit{M}\rrbracket\mathit{K}$.

(1) By case analysis on the form of $\mathit{M}$. We first consider the cases where $\mathit{M}$ is a value: $\mathit{M}=\mathit{W}$. We must show $\Psi(\mathit{W})[\mathit{x}:=\Psi(\mathit{V})]=\Psi(\mathit{W}[\mathit{x}:=\mathit{V}])$. (Note that $\mathit{W}[\mathit{x}:=\mathit{V}]$ is a value.)

Case $\mathit{W}=\mathit{x}$ :

[TABLE]

Case $\mathit{W}=\mathit{y}\neq x$ :

[TABLE]

Case $\mathit{W}=\mathit{a}$ :

[TABLE]

Case $\mathit{W}=\lambda\mathit{y}.\,\mathit{N}$ :

We can assume $\mathit{y}\neq\mathit{x}$.

[TABLE]

Then,

[TABLE]

By the IH, $(\mathscr{K}\llbracket\mathit{N}\rrbracket\kappa)[\mathit{x}:=\Psi(\mathit{V})]=\mathscr{K}\llbracket\mathit{N}[\mathit{x}:=\mathit{V}]\rrbracket\kappa$, which finishes this case.

Case $\mathit{W}=\mathit{U}\langle\!\langle\mathit{d}\rangle\!\rangle$ :

[TABLE]

Since $\mathit{U}[\mathit{x}:=\mathit{V}]$ is an uncoerced value,

[TABLE]

By the IH, $\Psi(\mathit{U})[\mathit{x}:=\Psi(\mathit{V})]=\Psi(\mathit{U}[\mathit{x}:=\mathit{V}])$, which finishes this subcase.

We then consider the cases where $\mathit{M}$ is not a value.

Case $\mathit{M}=\mathit{N}\langle\mathit{s}\rangle$ :

[TABLE]

Then,

[TABLE]

We have $\mathit{x}\notin\mathit{FV}(\Psi(\mathit{s}))=\emptyset$. By the IH, $(\mathscr{K}\llbracket\mathit{N}\rrbracket\Psi(\mathit{s}))[\mathit{x}:=\Psi(\mathit{V})]=\mathscr{K}\llbracket\mathit{N}[\mathit{x}:=\mathit{V}]\rrbracket\Psi(\mathit{s})$, which finishes this case.

Otherwise:

Since $\mathit{M}$ is neither a value nor a coercion application,

[TABLE]

Since $\mathit{M}[\mathit{x}:=\mathit{V}]$ is neither a value nor a coercion application,

[TABLE]

We have $\mathit{x}\notin\mathit{FV}(\mathsf{id})=\emptyset$. By the IH, $(\mathscr{K}\llbracket\mathit{M}\rrbracket\mathsf{id})[\mathit{x}:=\Psi(\mathit{V})]=\mathscr{K}\llbracket\mathit{M}[\mathit{x}:=\mathit{V}]\rrbracket\mathsf{id}$, which finishes this case.

(2) By case analysis on the form of $\mathit{M}$.

Case $\mathit{M}=\mathit{W}$ :

We have

[TABLE]

Since $\mathit{W}[\mathit{x}:=\mathit{V}]$ is a value,

[TABLE]

By the IH, $\Psi(\mathit{W})[\mathit{x}:=\Psi(\mathit{V})]=\Psi(\mathit{W}[\mathit{x}:=\mathit{V}])$, which finishes this case.

Case $\mathit{M}=\mathit{op}(\mathit{N_{{\mathrm{1}}}},\mathit{N_{{\mathrm{2}}}})$ :

By $\mathit{x}\notin\mathit{FV}(\mathit{K})$,

[TABLE]

Then,

[TABLE]

By the IHs,

[TABLE]

which finish this case.

Case $\mathit{M}=\mathit{N_{{\mathrm{1}}}}\,\mathit{N_{{\mathrm{2}}}}$ :

By $\mathit{x}\notin\mathit{FV}(\mathit{K})$,

[TABLE]

Then,

[TABLE]

By the IHs,

[TABLE]

which finish this case.

Case $\mathit{M}=\mathit{N}\langle\mathit{s}\rangle$ :

By $\mathit{x}\notin\mathit{FV}(\mathit{K})$ and $\mathit{x}\notin\mathit{FV}(\Psi(\mathit{s}))=\emptyset$,

[TABLE]

Then,

[TABLE]

Here, we can assume $\kappa\neq\mathit{x}$. So, $\mathit{x}\notin\mathit{FV}(\kappa)$. By the IH, $(\mathscr{K}\llbracket\mathit{N}\rrbracket\kappa)[\mathit{x}:=\Psi(\mathit{V})]=\mathscr{K}\llbracket\mathit{N}[\mathit{x}:=\mathit{V}]\rrbracket\kappa$, which finishes this case.

Case $\mathit{M}=\mathsf{blame}\,\mathit{p}$ :

[TABLE]

Lemma A.50** (Substitution for a continuation variable).**

If $\kappa\notin\mathit{FV}(\mathit{M})$, then $(\mathscr{K}\llbracket\mathit{M}\rrbracket\kappa)[\kappa:=\mathit{K}]=\mathscr{K}\llbracket\mathit{M}\rrbracket\mathit{K}$.

Proof A.51**.**

By case analysis on the structure of $\mathit{M}$.

Case $\mathit{M}=\mathit{V}$ :

[TABLE]

Case $\mathit{M}=\mathit{op}(\mathit{N_{{\mathrm{1}}}},\mathit{N_{{\mathrm{2}}}})$ :

Since $\kappa\notin\mathit{FV}(\mathit{M})$, we have $\kappa\notin\mathit{FV}(\mathit{N_{{\mathrm{1}}}})$ and $\kappa\notin\mathit{FV}(\mathit{N_{{\mathrm{2}}}})$.

[TABLE]

Case $\mathit{M}=\mathit{N_{{\mathrm{1}}}}\,\mathit{N_{{\mathrm{2}}}}$ :

Since $\kappa\notin\mathit{FV}(\mathit{M})$, we have $\kappa\notin\mathit{FV}(\mathit{N_{{\mathrm{1}}}})$ and $\kappa\notin\mathit{FV}(\mathit{N_{{\mathrm{2}}}})$.

[TABLE]

Case $\mathit{M}=\mathit{N}\langle\mathit{s}\rangle$ :

[TABLE]

The third equality is by $(\mathscr{K}\llbracket\mathit{N}\rrbracket\kappa^{\prime})[\kappa:=\mathit{K}]=\mathscr{K}\llbracket\mathit{N}\rrbracket\kappa^{\prime}$, which is shown as below: We can assume $\kappa^{\prime}\neq\kappa$. Since $\kappa\notin\mathit{FV}(\mathit{M})$, we have $\kappa\notin\mathit{FV}(\mathit{N})$. By Lemma A.46,

[TABLE]

Thus, $(\mathscr{K}\llbracket\mathit{N}\rrbracket\kappa^{\prime})[\kappa:=\mathit{K}]=\mathscr{K}\llbracket\mathit{N}\rrbracket\kappa^{\prime}$.

Case $\mathit{M}=\mathsf{blame}\,\mathit{p}$ :

[TABLE]

\lemSubstTrans

Proof A.52**.**

We have $\kappa\notin\mathit{FV}(\mathit{M}[\mathit{x}:=\mathit{V}])$.

[TABLE]

A.4.2 Evaluation Contexts

We can rewrite the syntax of evaluation contexts in $\lambda\mathsf{S}$ as below:

[TABLE]

In the following lemma, the first item concerns the case $\mathcal{E}=\mathcal{F}$, and the second concerns the case $\mathcal{E}=\mathcal{F}[\square\,\langle\mathit{s}\rangle]$. Note that $(\mathcal{F}[\square\,\langle\mathit{s}\rangle])[\mathit{M}]=\mathcal{F}[\mathit{M}\langle\mathit{s}\rangle]$.

\lemTransCtx

Proof A.53**.**

Two items are simultaneously proved by induction on the structure of $\mathcal{F}$.

(1) By case analysis on the structure of $\mathcal{F}$.

Case $\mathcal{F}=\square$ :

By $\square[\mathit{M}]=\mathit{M}$, we must show $\mathscr{C}\llbracket\mathit{M}\rrbracket=\mathcal{E}^{\prime}[\mathscr{C}\llbracket\mathit{M}\rrbracket]$. Take $\mathcal{E}^{\prime}=\square$.

Case $\mathcal{F}=\mathcal{F}_{{\mathrm{1}}}[\mathit{op}(\square,\mathit{N})]$ :

By the IH (item 1), there exists $\mathcal{E}^{\prime}_{{\mathrm{1}}}$ such that $\mathscr{C}\llbracket\mathcal{F}_{{\mathrm{1}}}[\mathit{L}]\rrbracket=\mathcal{E}^{\prime}_{{\mathrm{1}}}[\mathscr{C}\llbracket\mathit{L}\rrbracket]$ for any $\mathit{L}$. We have

[TABLE]

and so

[TABLE]

(Note that $\mathit{op}(\mathit{M},\mathit{N})$ is neither a value nor a coercion application.) Take $\mathcal{E}^{\prime}=\mathcal{E}^{\prime}_{{\mathrm{1}}}[\mathit{op}(\,\square\,,\mathscr{C}\llbracket\mathit{N}\rrbracket)\langle\mathsf{id}\rangle]$; then we have $\mathcal{E}^{\prime}[\mathscr{C}\llbracket\mathit{M}\rrbracket]=\mathscr{C}\llbracket\mathcal{F}[\mathit{M}]\rrbracket$.

Case $\mathcal{F}=\mathcal{F}_{{\mathrm{1}}}[\mathit{op}(\,\square\,,\mathit{N})\langle\mathit{t}\rangle]$ :

By the IH (item 2), there exists $\mathcal{E}^{\prime}_{{\mathrm{1}}}$ such that $\mathscr{C}\llbracket\mathcal{F}_{{\mathrm{1}}}[\mathit{L}\langle\mathit{t}\rangle]\rrbracket=\mathcal{E}^{\prime}_{{\mathrm{1}}}[\mathscr{K}\llbracket\mathit{L}\rrbracket\Psi(\mathit{t})]$ for any $\mathit{L}$. We have

[TABLE]

and so

[TABLE]

Take $\mathcal{E}^{\prime}=\mathcal{E}^{\prime}_{{\mathrm{1}}}[\mathit{op}(\,\square\,,\mathscr{C}\llbracket\mathit{N}\rrbracket)\langle\Psi(\mathit{t})\rangle]$; then we have $\mathcal{E}^{\prime}[\mathscr{C}\llbracket\mathit{M}\rrbracket]=\mathscr{C}\llbracket\mathcal{F}[\mathit{M}]\rrbracket$.

Case $\mathcal{F}=\mathcal{F}_{{\mathrm{1}}}[\mathit{op}(\mathit{V},\,\square\,)]$ :

*Similar. *

Case $\mathcal{F}=\mathcal{F}_{{\mathrm{1}}}[\mathit{op}(\mathit{V},\,\square\,)\langle\mathit{t}\rangle]$ :

Similar.

Case $\mathcal{F}=\mathcal{F}_{{\mathrm{1}}}[\square\,\mathit{N}]$ :

By the IH (item 1), there exists $\mathcal{E}^{\prime}_{{\mathrm{1}}}$ such that $\mathscr{C}\llbracket\mathcal{F}_{{\mathrm{1}}}[\mathit{L}]\rrbracket=\mathcal{E}^{\prime}_{{\mathrm{1}}}[\mathscr{C}\llbracket\mathit{L}\rrbracket]$ for any $\mathit{L}$. We have

[TABLE]

and so

[TABLE]

Take $\mathcal{E}^{\prime}=\mathcal{E}^{\prime}_{{\mathrm{1}}}[\square\,(\mathscr{C}\llbracket\mathit{N}\rrbracket,\mathsf{id})]$; then we have $\mathcal{E}^{\prime}[\mathscr{C}\llbracket\mathit{M}\rrbracket]=\mathscr{C}\llbracket\mathcal{F}[\mathit{M}]\rrbracket$.

Case $\mathcal{F}=\mathcal{F}_{{\mathrm{1}}}[(\,\square\,\mathit{N})\langle\mathit{t}\rangle]$ :

By the IH (item 2), there exists $\mathcal{E}^{\prime}_{{\mathrm{1}}}$ such that $\mathscr{C}\llbracket\mathcal{F}_{{\mathrm{1}}}[\mathit{L}\langle\mathit{t}\rangle]\rrbracket=\mathcal{E}^{\prime}_{{\mathrm{1}}}[\mathscr{K}\llbracket\mathit{L}\rrbracket\Psi(\mathit{t})]$ for any $\mathit{L}$. We have

[TABLE]

and so

[TABLE]

Take $\mathcal{E}^{\prime}=\mathcal{E}^{\prime}_{{\mathrm{1}}}[\square\,(\mathscr{C}\llbracket\mathit{N}\rrbracket,\Psi(\mathit{t}))]$; then we have $\mathcal{E}^{\prime}[\mathscr{C}\llbracket\mathit{M}\rrbracket]=\mathscr{C}\llbracket\mathcal{F}[\mathit{M}]\rrbracket$.

Case $\mathcal{F}=\mathcal{F}_{{\mathrm{1}}}[\mathit{V}\,\square]$ :

Similar.

Case $\mathcal{F}=\mathcal{F}_{{\mathrm{1}}}[(\mathit{V}\,\square\,)\langle\mathit{t}\rangle]$ :

Similar.

(2) By case analysis on the structure of $\mathcal{F}$.

Case $\mathcal{F}=\square$ :

By $\square[\mathit{M}\langle\mathit{s}\rangle]=\mathit{M}\langle\mathit{s}\rangle$, we must show $\mathscr{C}\llbracket\mathit{M}\langle\mathit{s}\rangle\rrbracket=\mathcal{E}^{\prime}[\mathscr{K}\llbracket\mathit{M}\rrbracket\Psi(\mathit{s})]$. We now have $\mathscr{C}\llbracket\mathit{M}\langle\mathit{s}\rangle\rrbracket=\mathscr{K}\llbracket\mathit{M}\rrbracket\Psi(\mathit{s})$. Take $\mathcal{E}^{\prime}=\square$.

Case $\mathcal{F}=\mathcal{F}_{{\mathrm{1}}}[\mathit{op}(\square,\mathit{N})]$ :

By the IH (item 1), there exists $\mathcal{E}^{\prime}_{{\mathrm{1}}}$ such that $\mathscr{C}\llbracket\mathcal{F}_{{\mathrm{1}}}[\mathit{L}]\rrbracket=\mathcal{E}^{\prime}_{{\mathrm{1}}}[\mathscr{C}\llbracket\mathit{L}\rrbracket]$ for any $\mathit{L}$. We have

[TABLE]

and so

[TABLE]

Take $\mathcal{E}^{\prime}=\mathcal{E}^{\prime}_{{\mathrm{1}}}[\mathit{op}(\,\square\,,\mathscr{C}\llbracket\mathit{N}\rrbracket)\langle\mathsf{id}\rangle]$; then we have $\mathcal{E}^{\prime}[\mathscr{K}\llbracket\mathit{M}\rrbracket\Psi(\mathit{s})]=\mathscr{C}\llbracket\mathcal{F}[\mathit{M}\langle\mathit{s}\rangle]\rrbracket$.

Case $\mathcal{F}=\mathcal{F}_{{\mathrm{1}}}[\mathit{op}(\,\square\,,\mathit{N})\langle\mathit{t}\rangle]$ :

By the IH (item 2), there exists $\mathcal{E}^{\prime}_{{\mathrm{1}}}$ such that $\mathscr{C}\llbracket\mathcal{F}_{{\mathrm{1}}}[\mathit{L}\langle\mathit{t}\rangle]\rrbracket=\mathcal{E}^{\prime}_{{\mathrm{1}}}[\mathscr{K}\llbracket\mathit{L}\rrbracket\Psi(\mathit{t})]$ for any $\mathit{L}$. We have

[TABLE]

and so

[TABLE]

Take $\mathcal{E}^{\prime}=\mathcal{E}^{\prime}_{{\mathrm{1}}}[\mathit{op}(\,\square\,,\mathscr{C}\llbracket\mathit{N}\rrbracket)\langle\Psi(\mathit{t})\rangle]$; then we have $\mathcal{E}^{\prime}[\mathscr{K}\llbracket\mathit{M}\rrbracket\Psi(\mathit{s})]=\mathscr{C}\llbracket\mathcal{F}[\mathit{M}\langle\mathit{s}\rangle]\rrbracket$.

Case $\mathcal{F}=\mathcal{F}_{{\mathrm{1}}}[\mathit{op}(\mathit{V},\,\square\,)]$ :

*Similar. *

Case $\mathcal{F}=\mathcal{F}_{{\mathrm{1}}}[\mathit{op}(\mathit{V},\,\square\,)\langle\mathit{t}\rangle]$ :

Similar.

Case $\mathcal{F}=\mathcal{F}_{{\mathrm{1}}}[\square\,\mathit{N}]$ :

By the IH (item 1), there exists $\mathcal{E}^{\prime}_{{\mathrm{1}}}$ such that $\mathscr{C}\llbracket\mathcal{F}_{{\mathrm{1}}}[\mathit{L}]\rrbracket=\mathcal{E}^{\prime}_{{\mathrm{1}}}[\mathscr{C}\llbracket\mathit{L}\rrbracket]$ for any $\mathit{L}$. We have

[TABLE]

and so

[TABLE]

Take $\mathcal{E}^{\prime}=\mathcal{E}^{\prime}_{{\mathrm{1}}}[\square\,(\mathscr{C}\llbracket\mathit{N}\rrbracket,\mathsf{id})]$; then we have $\mathcal{E}^{\prime}[\mathscr{K}\llbracket\mathit{M}\rrbracket\Psi(\mathit{s})]=\mathscr{C}\llbracket\mathcal{F}[\mathit{M}\langle\mathit{s}\rangle]\rrbracket$.

Case $\mathcal{F}=\mathcal{F}_{{\mathrm{1}}}[(\,\square\,\mathit{N})\langle\mathit{t}\rangle]$ :

By the IH (item 2), there exists $\mathcal{E}^{\prime}_{{\mathrm{1}}}$ such that $\mathscr{C}\llbracket\mathcal{F}_{{\mathrm{1}}}[\mathit{L}\langle\mathit{t}\rangle]\rrbracket=\mathcal{E}^{\prime}_{{\mathrm{1}}}[\mathscr{K}\llbracket\mathit{L}\rrbracket\Psi(\mathit{t})]$ for any $\mathit{L}$. We have

[TABLE]

and so

[TABLE]

Take $\mathcal{E}^{\prime}=\mathcal{E}^{\prime}_{{\mathrm{1}}}[\square\,(\mathscr{C}\llbracket\mathit{N}\rrbracket,\Psi(\mathit{t}))]$; then we have $\mathcal{E}^{\prime}[\mathscr{K}\llbracket\mathit{M}\rrbracket\Psi(\mathit{s})]=\mathscr{C}\llbracket\mathcal{F}[\mathit{M}\langle\mathit{s}\rangle]\rrbracket$.

Case $\mathcal{F}=\mathcal{F}_{{\mathrm{1}}}[\mathit{V}\,\square]$ :

Similar.

Case $\mathcal{F}=\mathcal{F}_{{\mathrm{1}}}[(\mathit{V}\,\square\,)\langle\mathit{t}\rangle]$ :

Similar.

A.4.3 Main Theorem

As usual, $\mathbin{\accentset{\mathsf{e}}{\longmapsto}_{\mathsf{S_{1}}}\accentset{\mathsf{c}}{\longmapsto}_{\mathsf{S_{1}}}^{*}}$ denotes the relational composition.

Lemma A.54** (Simulation for Reduction).**

If $\mathit{M}\mathbin{\accentset{\mathsf{e}}{\longrightarrow}_{\mathsf{S}}}\mathit{N}$ , then $\mathscr{K}\llbracket\mathit{M}\rrbracket\mathit{K}\mathbin{\accentset{\mathsf{e}}{\longmapsto}_{\mathsf{S_{1}}}\accentset{\mathsf{c}}{\longmapsto}_{\mathsf{S_{1}}}^{*}}\mathscr{K}\llbracket\mathit{N}\rrbracket\mathit{K}$. 2. 2.

If $\mathit{M}\mathbin{\accentset{\mathsf{c}}{\longrightarrow}_{\mathsf{S}}}\mathit{N}$, then $\mathscr{C}\llbracket\mathit{M}\rrbracket\mathbin{\accentset{\mathsf{c}}{\longmapsto}_{\mathsf{S_{1}}}^{+}}\mathscr{C}\llbracket\mathit{N}\rrbracket$.

Proof A.55**.**

(1) By case analysis on the reduction rule applied to $\mathit{M}\mathbin{\accentset{\mathsf{e}}{\longrightarrow}_{\mathsf{S}}}\mathit{N}$.

Case (R-Op) :

We are given

[TABLE]

for some $\mathit{op},\mathit{a_{{\mathrm{1}}}},\mathit{a_{{\mathrm{2}}}},\mathit{a}$. We assume $\mathit{ty}(\mathit{a_{{\mathrm{1}}}})=\iota_{{\mathrm{1}}}$ and $\mathit{ty}(\mathit{a_{{\mathrm{2}}}})=\iota_{{\mathrm{2}}}$.

[TABLE]

Case (R-Beta) :

We are given

[TABLE]

for some $\mathit{x},\mathit{M_{{\mathrm{1}}}},\mathit{V}$. Here,

[TABLE]

Case (R-Wrap) :

We are given

[TABLE]

for some $\mathit{U},\mathit{s},\mathit{t},\mathit{V}$.

[TABLE]

Then,

[TABLE]

Thus, $\mathscr{K}\llbracket(\mathit{U}\langle\!\langle\mathit{s}\rightarrow\mathit{t}\rangle\!\rangle)\,\mathit{V}\rrbracket\mathit{K}\accentset{\mathsf{e}}{\longmapsto}\mathscr{K}\llbracket(\mathit{U}\,(\mathit{V}\langle\mathit{s}\rangle))\langle\mathit{t}\rangle\rrbracket\mathit{K}$.

(2) By case analysis on the reduction rule applied to $\mathit{M}\mathbin{\accentset{\mathsf{c}}{\longrightarrow}_{\mathsf{S}}}\mathit{N}$.

Case (R-Id) :

We are given

[TABLE]

for some $\mathit{U}$. Here,

[TABLE]

Case (R-Fail) :

We are given

[TABLE]

for some $\mathit{U},\mathit{p},\mathit{G},\mathit{H}$. Here,

[TABLE]

Thus, $\mathscr{C}\llbracket\mathit{U}\langle\bot^{\mathit{G}\mathit{p}\mathit{H}}\rangle\rrbracket\mathbin{\accentset{\mathsf{c}}{\longmapsto}}\mathscr{C}\llbracket\mathsf{blame}\,\mathit{p}\rrbracket$.

Case (R-Crc) :

We are given

[TABLE]

for some $\mathit{d}$. Note that $\Psi(\mathit{d})$ is also a delayed coercion.

[TABLE]

Thus, $\mathscr{C}\llbracket\mathit{U}\langle\mathit{d}\rangle\rrbracket\mathbin{\accentset{\mathsf{c}}{\longmapsto}}\mathscr{C}\llbracket\mathit{U}\langle\!\langle\mathit{d}\rangle\!\rangle\rrbracket$.

Case (R-MergeC) :

We are given

[TABLE]

for some $\mathit{M_{{\mathrm{1}}}},\mathit{s},\mathit{t},\mathit{s^{\prime}}$. Here, $\Psi(\mathit{s})\fatsemi\Psi(\mathit{t})=\Psi(\mathit{s^{\prime}})$ by Lemma A.38.

[TABLE]

Thus, $\mathscr{C}\llbracket\mathit{M_{{\mathrm{1}}}}\langle\mathit{s}\rangle\langle\mathit{t}\rangle\rrbracket\mathbin{\accentset{\mathsf{c}}{\longmapsto}^{+}}\mathscr{C}\llbracket\mathit{M_{{\mathrm{1}}}}\langle\mathit{s^{\prime}}\rangle\rrbracket$.

Case (R-MergeV) :

We are given

[TABLE]

for some $\mathit{U},\mathit{d},\mathit{t},\mathit{s^{\prime}}$. Here, $\Psi(\mathit{d})\fatsemi\Psi(\mathit{t})=\Psi(\mathit{s^{\prime}})$ by Lemma A.38.

[TABLE]

Thus, $\mathscr{C}\llbracket\mathit{U}\langle\!\langle\mathit{d}\rangle\!\rangle\langle\mathit{t}\rangle\rrbracket\mathbin{\accentset{\mathsf{c}}{\longmapsto}^{+}}\mathscr{C}\llbracket\mathit{U}\langle\mathit{s^{\prime}}\rangle\rrbracket$.

Lemma A.56**.**

$\mathscr{K}\llbracket\mathit{M}\rrbracket\mathsf{id}\mathbin{\accentset{\mathsf{c}}{\longmapsto}_{\mathsf{S_{1}}}^{*}}\mathscr{C}\llbracket\mathit{M}\rrbracket$**

Proof A.57**.**

By case analysis on the form of $\mathit{M}$.

Case $\mathit{M}=\mathit{V}$ :

[TABLE]

Case $\mathit{M}=\mathit{N}\langle\mathit{s}\rangle$ :

[TABLE]

Otherwise:

Since $\mathit{M}$ is neither a value nor a coercion application, $\mathscr{K}\llbracket\mathit{M}\rrbracket\mathsf{id}=\mathscr{C}\llbracket\mathit{M}\rrbracket$.

\lemTransEval

Proof A.58**.**

(1) By case analysis on the evaluation rule applied to $\mathit{M}\mathbin{\accentset{\mathsf{e}}{\longmapsto}_{\mathsf{S}}}\mathit{N}$.

Case (E-CtxE) with $\mathcal{E}=\mathcal{F}$ :

We are given

[TABLE]

for some $\mathit{M_{{\mathrm{1}}}},\mathit{N_{{\mathrm{1}}}}$. By Lemma 4.7 (1), there exists $\mathcal{E}^{\prime}$ such that $\mathscr{C}\llbracket\mathcal{F}[\mathit{L}]\rrbracket=\mathcal{E}^{\prime}[\mathscr{C}\llbracket\mathit{L}\rrbracket]$ for any $\mathit{L}$. So,

[TABLE]

Since $\mathit{M_{{\mathrm{1}}}}$ is e-reducible, $\mathit{M_{{\mathrm{1}}}}$ is neither a value nor a coercion application. (Note that a coercion application may be a c-redex, but not an e-redex.) So, we have $\mathscr{C}\llbracket\mathit{M_{{\mathrm{1}}}}\rrbracket=\mathscr{K}\llbracket\mathit{M_{{\mathrm{1}}}}\rrbracket\mathsf{id}$. Next, by $\mathit{M_{{\mathrm{1}}}}\mathbin{\accentset{\mathsf{e}}{\longrightarrow}_{\mathsf{S}}}\mathit{N_{{\mathrm{1}}}}$ and Lemma A.54 (1) with $\mathit{K}=\mathsf{id}$,

[TABLE]

Then, $\mathscr{K}\llbracket\mathit{N_{{\mathrm{1}}}}\rrbracket\mathsf{id}\mathbin{\accentset{\mathsf{c}}{\longmapsto}_{\mathsf{S_{1}}}^{*}}\mathscr{C}\llbracket\mathit{N_{{\mathrm{1}}}}\rrbracket$ by Lemma 4.5. Therefore,

[TABLE]

By $\mathscr{C}\llbracket\mathit{M_{{\mathrm{1}}}}\rrbracket\mathbin{\accentset{\mathsf{e}}{\longmapsto}_{\mathsf{S_{1}}}\accentset{\mathsf{c}}{\longmapsto}_{\mathsf{S_{1}}}^{*}}\mathscr{C}\llbracket\mathit{N_{{\mathrm{1}}}}\rrbracket$ and Lemma A.21,

[TABLE]

Thus, by eq. (1), $\mathscr{C}\llbracket\mathcal{F}[\mathit{M_{{\mathrm{1}}}}]\rrbracket\mathbin{\accentset{\mathsf{e}}{\longmapsto}_{\mathsf{S_{1}}}\accentset{\mathsf{c}}{\longmapsto}_{\mathsf{S_{1}}}^{*}}\mathscr{C}\llbracket\mathcal{F}[\mathit{N_{{\mathrm{1}}}}]\rrbracket$.

Case (E-CtxE) with $\mathcal{E}=\mathcal{F}[\square\,\langle\mathit{t}\rangle]$ :

We are given

[TABLE]

for some $\mathit{M_{{\mathrm{1}}}},\mathit{N_{{\mathrm{1}}}}$. By Lemma 4.7 (2), there exist $\mathcal{E}^{\prime}$ such that $\mathscr{C}\llbracket\mathcal{F}[\mathit{L}\langle\mathit{t}\rangle]\rrbracket=\mathcal{E}^{\prime}[\mathscr{K}\llbracket\mathit{L}\rrbracket\Psi(\mathit{t})]$ for any $\mathit{L}$. So,

[TABLE]

By $\mathit{M_{{\mathrm{1}}}}\mathbin{\accentset{\mathsf{e}}{\longrightarrow}_{\mathsf{S}}}\mathit{N_{{\mathrm{1}}}}$ and Lemma A.54 (1) with $\mathit{K}=\Psi(\mathit{t})$,

[TABLE]

By Lemma A.21,

[TABLE]

Thus, by eq. (2), $\mathscr{C}\llbracket\mathcal{F}[\mathit{M_{{\mathrm{1}}}}\langle\mathit{t}\rangle]\rrbracket\mathbin{\accentset{\mathsf{e}}{\longmapsto}_{\mathsf{S_{1}}}\accentset{\mathsf{c}}{\longmapsto}_{\mathsf{S_{1}}}^{*}}\mathscr{C}\llbracket\mathcal{F}[\mathit{N_{{\mathrm{1}}}}\langle\mathit{t}\rangle]\rrbracket$.

Case (E-Abort) with $\mathcal{E}=\mathcal{F}$ :

We are given

[TABLE]

for some $\mathit{p}$. By Lemma 4.7 (1), there exists $\mathcal{E}^{\prime}$ such that $\mathscr{C}\llbracket\mathcal{F}[\mathit{L}]\rrbracket=\mathcal{E}^{\prime}[\mathscr{C}\llbracket\mathit{L}\rrbracket]$ for any $\mathit{L}$. So,

[TABLE]

By $\mathscr{C}\llbracket\mathsf{blame}\,\mathit{p}\rrbracket=\mathscr{K}\llbracket\mathsf{blame}\,\mathit{p}\rrbracket\mathsf{id}=\mathsf{blame}\,\mathit{p}$,

[TABLE]

Thus, $\mathscr{C}\llbracket\mathcal{F}[\mathsf{blame}\,\mathit{p}]\rrbracket\mathbin{\accentset{\mathsf{e}}{\longmapsto}_{\mathsf{S_{1}}}}\mathscr{C}\llbracket\mathsf{blame}\,\mathit{p}\rrbracket$.

Case (E-Abort) with $\mathcal{E}=\mathcal{F}[\square\,\langle\mathit{t}\rangle]$ :

We are given

[TABLE]

for some $\mathit{p}$. By Lemma 4.7 (2), there exist $\mathcal{E}^{\prime}$ such that $\mathscr{C}\llbracket\mathcal{F}[\mathit{L}\langle\mathit{t}\rangle]\rrbracket=\mathcal{E}^{\prime}[\mathscr{K}\llbracket\mathit{L}\rrbracket\Psi(\mathit{t})]$ for any $\mathit{L}$. So,

[TABLE]

By $\mathscr{K}\llbracket\mathsf{blame}\,\mathit{p}\rrbracket\Psi(\mathit{t})=\mathsf{blame}\,\mathit{p}$ and $\mathscr{C}\llbracket\mathsf{blame}\,\mathit{p}\rrbracket=\mathsf{blame}\,\mathit{p}$,

[TABLE]

Thus, $\mathscr{C}\llbracket(\mathcal{F}[\square\,\langle\mathit{t}\rangle])[\mathsf{blame}\,\mathit{p}]\rrbracket\mathbin{\accentset{\mathsf{e}}{\longmapsto}_{\mathsf{S_{1}}}}\mathscr{C}\llbracket\mathsf{blame}\,\mathit{p}\rrbracket$.

(2) By case analysis on the evaluation rule applied to $\mathit{M}\mathbin{\accentset{\mathsf{c}}{\longmapsto}_{\mathsf{S}}}\mathit{N}$.

Case (E-CtxC) :

We are given

[TABLE]

for some $\mathcal{F},\mathit{M_{{\mathrm{1}}}},\mathit{N_{{\mathrm{1}}}}$. By Lemma 4.7 (1), there exists $\mathcal{E}^{\prime}$ such that $\mathscr{C}\llbracket\mathcal{F}[\mathit{L}]\rrbracket=\mathcal{E}^{\prime}[\mathscr{C}\llbracket\mathit{L}\rrbracket]$ for any $\mathit{L}$. So,

[TABLE]

By $\mathit{M_{{\mathrm{1}}}}\mathbin{\accentset{\mathsf{c}}{\longrightarrow}_{\mathsf{S}}}\mathit{N_{{\mathrm{1}}}}$ and Lemma A.54 (2),

[TABLE]

By Lemma A.21, $\mathcal{E}^{\prime}[\mathscr{C}\llbracket\mathit{M_{{\mathrm{1}}}}\rrbracket]\mathbin{\accentset{\mathsf{c}}{\longmapsto}_{\mathsf{S_{1}}}^{+}}\mathcal{E}^{\prime}[\mathscr{C}\llbracket\mathit{N_{{\mathrm{1}}}}\rrbracket]$. Thus, by eq. (3), $\mathscr{C}\llbracket\mathcal{F}[\mathit{M_{{\mathrm{1}}}}]\rrbracket\mathbin{\accentset{\mathsf{c}}{\longmapsto}_{\mathsf{S_{1}}}^{+}}\mathscr{C}\llbracket\mathcal{F}[\mathit{N_{{\mathrm{1}}}}]\rrbracket$.

\lemSimulation

[TABLE]

Proof A.59**.**

Immediate by Lemma 4.5.

\thmTransSoundness

Proof A.60**.**

By repeated use of Lemma 4.6. We also use $\mathscr{C}\llbracket\mathit{V}\rrbracket=\Psi(\mathit{V})$ and $\mathscr{C}\llbracket\mathsf{blame}\,\mathit{p}\rrbracket=\mathscr{K}\llbracket\mathsf{blame}\,\mathit{p}\rrbracket\mathsf{id}=\mathsf{blame}\,\mathit{p}$.

\thmTransSem

Proof A.61**.**

The left-to-right direction follows Theorem 4.4. (Note that $\Psi(\mathit{a})=\mathit{a}$.)

We prove the right-to-left direction of (1). We are given $\mathscr{K}\llbracket\mathit{M}\rrbracket\mathsf{id}_{\iota}\mathbin{\longmapsto_{\mathsf{S_{1}}}^{*}}\mathit{a}$. By $\emptyset\vdash_{\mathsf{S}}\mathit{M}:\iota$ and Corollary 2.7, either of the following holds:

[TABLE]

• •

If $\mathit{M}\mathbin{\longmapsto_{\mathsf{S}}^{*}}\mathsf{blame}\,\mathit{p}$, then by Theorem 4.4, $\mathscr{K}\llbracket\mathit{M}\rrbracket\mathsf{id}_{\iota}\mathbin{\longmapsto_{\mathsf{S_{1}}}^{*}}\mathsf{blame}\,\mathit{p}$. It contradicts $\mathscr{K}\llbracket\mathit{M}\rrbracket\mathsf{id}_{\iota}\mathbin{\longmapsto_{\mathsf{S_{1}}}^{*}}\mathit{a}$ by Lemma 3.2.

• •

If $\mathit{M}\,\mathord{\Uparrow_{\mathsf{S}}}$, then by Theorem 4.4, $\mathscr{K}\llbracket\mathit{M}\rrbracket\mathsf{id}\,\mathord{\Uparrow_{\mathsf{S_{1}}}}$. It contradicts $\mathscr{K}\llbracket\mathit{M}\rrbracket\mathsf{id}_{\iota}\mathbin{\longmapsto_{\mathsf{S_{1}}}^{*}}\mathit{a}$ by Lemma 3.2.

Thus, $\mathit{M}\mathbin{\longmapsto_{\mathsf{S}}^{*}}\mathit{a}$.

The right-to-left directions of (2) and (3) are similar.

Appendix B Detailed Benchmark Results

Figure 12 shows the scatter plots of the running time ratios for each benchmark program, generated by the same experiment as Figure 10. The x-axis indicates how much of type annotations in the benchmark program are given static type.