A framework for numeric analysis of array operations

Abstract

Automatic discovery of relationships among values of array elements is a challenging problem due to the unbounded nature of arrays. We present a framework for analyzing array operations that is capable of capturing numeric properties of array elements.In particular, the analysis is able to establish that all array elements are initialized by an array-initialization loop, as well as to discover numeric constraints on the values of initialized elements.The analysis is based on the combination of canonical abstraction and summarizing numeric domains. We describe a prototype implementation of the analysis and discuss our experience with applying the prototype to several examples, including the verification of correctness of an insertion-sort procedure.

Fluid Updates: Beyond Strong vs. Weak Updates

“…This yields 1 ≤ i 2 ≤ 4, indicating that the target's index must lie in the range [1,4]. To formalize this intuition, we define an operation φ 1 ↓ I φ 2 , which yields the result of restricting constraint φ 1 to only those values of the index variables I that are consistent with φ 2 .…”

“…For instance, if a loop increments i by 1 until i ≥ size, then it is easy to determine that N = size − i 0 , assuming the loop executes at least once. 4 Finally, we generalize the effect set as follows:…”

“…We believe these experiments demonstrate that Compass reasons precisely and efficiently about array contents despite being fully automatic. As a comparison, while Compass takes 0.01 seconds to verify the full correctness of copy, the approach described in [4] reports a running time of 338.1 seconds, and the counterexample-guided abstraction refinement based approach described in [17] takes 3.65 seconds. Furthermore, our technique is naturally able to verify the correctness of programs that manipulate non-contiguous array elements (e.g., copy odd), as well as programs that require reasoning about arrays inside other arrays (e.g., alloc nonfixed size).…”

“…Gopan et al propose a 3-valued logic based framework to discover relationships about values of array elements [4]. This technique isolates individual elements to perform strong updates and places elements that share a common property into a partition (usually a contiguous range), and relevant partitions are heuristically inferred.…”

“…In existing work on pointer and shape analysis, there is a fundamental distinction between two kinds of updates to memory locations: weak updates and strong updates [1][2][3][4]. A strong update overwrites the old content of an abstract memory location l with a new value, whereas a weak update adds new values to the existing set of values associated with l. Whenever safe, it is preferable to apply strong updates to achieve better precision.…”