Automatic Verification of Iterated Separating Conjunctions Using Symbolic Execution

Abstract

In permission logics such as separation logic, the iterated separating conjunction is a quantifier denoting access permission to an unbounded set of heap locations. In contrast to recursive predicates, iterated separating conjunctions do not prescribe a structure on the locations they range over, and so do not restrict how to traverse and modify these locations. This flexibility is important for the verification of random-access data structures such as arrays and data structures that can be traversed in multiple ways such as graphs. Despite its usefulness, no automatic program verifier natively supports iterated separating conjunctions; they are especially difficult to incorporate into symbolic execution engines, the prevalent technique for building verifiers for these logics.In this paper, we present the first symbolic execution technique to support general iterated separating conjunctions. We propose a novel representation of symbolic heaps and flexible support for logical specifications that quantify over heap locations. Our technique exhibits predictable and fast performance despite employing quantifiers at the SMT level, by carefully controlling quantifier instantiations. It is compatible with other features of permission logics such as fractional permissions, recursive predicates, and abstraction functions. Our technique is implemented as an extension of the Viper verification infrastructure.

Automatic Reasoning on Recursive Data-Structures with Sharing

“…Furthermore, the postcondition on its own does not imply the final graph is completely marked. The crucial point here is that the proof in [24] does not prove the same thing as we do. As an aside, that proof is not about local reasoning; it does not use framing at all.…”

“…Remark: There is a recently published proof [24] that considers a similar graph marking algorithm. By supporting the construct of iterated separating conjunction [31], they managed to "verify challenging examples such as graph-marking algorithms that so far were beyond the scope of automated verifiers based on permission logics [such as SL and IDFs]".…”

Verifying the Correctness and Amortized Complexity of a Union-Find Implementation in Separation Logic with Time Credits

“…The Union-Find case study exploits this power in several ways: we find that (say) reasoning about a complex potential function ( §6) or working with iterated separating conjunctions ( §7) is not significantly more difficult in Coq than on paper. In contrast, supporting iterated separating conjunctions in an automated program verifier is possible but challenging (Müller et al, 2016). The interactive approach to program verification has been explored in several projects, including Ynot (Nanevski et al, 2007(Nanevski et al, , 2008aChlipala et al, 2009), Bedrock (Chlipala, 2013), and CFML (Charguéraud, 2010(Charguéraud, , 2013.…”

Permission Inference for Array Programs

“…We assume that for any inhale or exhale statements, the permission expression p denotes a non-negative fraction. For simplicity, we restrict inhale and exhale statements to a single array location, but the extension to unboundedly-many locations from the same array is straightforward [37].…”