Linearizability is the commonly accepted notion of correctness for concurrent data structures. It requires that any execution of the data structure is justified by a linearization -a linear order on operations satisfying the data structure's sequential specification. Proving linearizability is often challenging because an operation's position in the linearization order may depend on future operations. This makes it very difficult to incrementally construct the linearization in a proof. We propose a new proof method that can handle data structures with such futuredependent linearizations. Our key idea is to incrementally construct not a single linear order of operations, but a partial order that describes multiple linearizations satisfying the sequential specification. This allows decisions about the ordering of operations to be delayed, mirroring the behaviour of data structure implementations. We formalise our method as a program logic based on rely-guarantee reasoning, and demonstrate its effectiveness by verifying several challenging data structures: the Herlihy-Wing queue, the TS queue and the Optimistic set. arXiv:1701.05463v4 [cs.PL] 6 Jul 2017 14 Val dequeue() { 15 Val ret := NULL; 16 EventID CAND; 17 do { 18 TS start ts := newTimestamp(); 19 PoolID pid, cand pid := NULL; 20 TS ts, cand ts := ; 21 ThreadID cand tid; 22 * D , , H }. We say that a data structure (D, s 0 ) is linearizable with respect to a set of sequential histories H if H(D, s 0 ) H (Definition 2).
LogicWe now formalise our proof method as a Hoare logic based on rely-guarantee [13]. We make this choice to keep presentation simple; our method is general and can be combined with more advanced methods for reasoning about concurrency [22,1,20].