A semantics for procedure local heaps and its abstractions

Abstract

The goal of this work is to develop compile-time algorithms for automatically verifying properties of imperative programs that manipulate dynamically allocated storage. The paper presents an analysis method that uses a characterization of a procedure's behavior in which parts of the heap not relevant to the procedure are ignored. The paper has two main parts: The first part introduces a non-standard concrete semantics, LSL, in which called procedures are only passed parts of the heap. In this semantics, objects are treated specially when they separate the "local heap" that can be mutated by a procedure from the rest of the heap, which-from the viewpoint of that procedure-is non-accessible and immutable. The second part concerns abstract interpretation of LSL and develops a new static-analysis algorithm using canonical abstraction.

Effectively-Propositional Reasoning about Reachability in Linked Data Structures

“…Formula (8) is in AF R . In terms of [21], this means that we assume that the procedure is cutpoint free. We can also generate an AF R summary for a program with fixed number of cutpoints, as is done in Section 5.…”

Using Disjoint Reachability for Parallelization

“…We expose only the callee reachable portion of the caller's heap when analyzing a callee method, similar to previous work [17,18] but with extensions to accommodate reachability properties. A summary of the transform follows: i) Compute the portion of the heap that is reachable from the callee.…”

Refinement-Based Verification for Possibly-Cyclic Lists

“…[13] // if y and h are non-NULL, [14] // this will create a cycle [15] if (y != NULL) y->n = h; [16] Two examples of our methodology are depicted in Fig. 11.…”

“…The slight modification shown on the right nondeterministically constructs a (cyclic or acyclic) linked list pointed to by x. This is achieved by setting y to point to the last list node on line [8], nondeterministically setting h to point to some list node (or NULL) on line [10], and setting y->n to point to h on line [16] if y is non-NULL (possibly completing a cycle). If h is NULL, the DSC constructs an acyclic list.…”

“…To make this possible, we need to find a way to infer properties of heap configurations from properties of components of those configurations. The concept of local heaps introduced by Rinetzky et al is relevant in this line of research [16].…”