Abstract Local Reasoning for Concurrent Libraries: Mind the Gap

Abstract

16.06.15 KB. Ok to add published verison, OA paper© 2014 The Authors.We study abstract local reasoning for concurrent libraries. There are two main approaches: provide a specification of a library by abstracting from concrete reasoning about an implementation; or provide a direct abstract library specification, justified by refining to an implementation. Both approaches have a significant gap in their reasoning, due to a mismatch between the abstract connectivity of the abstract data structures and the concrete connectivity of the concrete heap representations. We demonstrate this gap using structural separation logic (SSL) for specifying a concurrent tree library and concurrent abstract predicates (CAP) for reasoning about a concrete tree implementation. The gap between the abstract and concrete connectivity emerges as a mismatch between the SSL tree predicates and CAP heap predicates. This gap is closed by an interface function I which links the abstract and concrete connectivity. In the accompanying technical report, we generalise our SSL reasoning and results to arbitrary concurrent data libraries

Local Reasoning for the POSIX File System

“…We give a natural axiomatic specification of the sequential POSIX file system using SSL; the general theory is in [25,12]. We verify safety properties for a client software installer, demonstrating integrated reasoning for the file system and the heap.…”

“…Concurrent abstract predicates [7,24,23] work well for reasoning abstractly about simple concurrent data structures. However, they do not extend to complex data structures since the implementation details leak into the abstraction [12].…”

“…Here, we demonstrate SSL by reasoning about POSIX. In [25,12], we provide the general theory which relies substantially on ideas from the views framework [6] 2 . SSL combines fine-grained local reasoning about e.g.…”

DOM: Specification and Client Reasoning

“…For example, n.getElementsByTagName(s) returns a NodeList (using depth-first, left-to-right search) containing the identifiers of the elements named s underneath the tree rooted at n. Given the DOM tree of Fig. 1a, when n=4 and s="img", then r = n.getElementsByTagName(s) yields r= [3,8,2]. However, since NodeLists are live, if node 8 is later removed from the document, then r= [3,2].…”

“…We present a faithful axiomatic specification of a key fragment of the DOM and verify substantial client programs, using structural separation logic (SSL) introduced in [25,8]. SSL provides fine-grained reasoning about complex data structures.…”