Byte-Precise Verification of Low-Level List Manipulation

Empirical software metrics for benchmarking of verification tools

“…[10,19]), give evidence for the relevance of our features for selecting verification tools: They mention language constructs, which-depending on whether they are fully, partially, or not modeled by a tool-constitute its strengths or weaknesses. We give a short survey of such language constructs in Table 1 and relate them to our features.…”

“…As an approach to software verification, portfolio solving brings interesting advantages: Extracted from the competition report [2] and tool papers [10,19] To choose the software metrics describing our benchmarks, we consider the zoo of techniques discussed above along with their target domains, our intuition as programmers, as well as the tool developer reports in their competition contributions. Table 1 exemplarily summarizes these reports for tools CBMC, Predator, CPAchecker and SMACK: the first column gives obstacles the tools' authors identified, the following columns show whether the feature is supported by respective tool, and the last column references the corresponding metrics, which we introduce in Sect.…”

From Low-Level Pointers to High-Level Containers

“…We further demonstrate that our method can simplify verification of pointer programs by separating the issue of shape analysis from that of verification of data-related properties. Namely, we first obtain shape invariants from a specialised shape analyser (Predator [7] in our case), use it within our method to transform the given pointer program into a container program, and then use a tool that specialises in verification of data-related properties of container programs (for which we use the J2BP tool [14,15]). …”

“…We say that the former objects are transformed into the latter ones, and we call the relationship a transformation relation. A transformation relation is normally not output by shape analysers, however, tools such as Predator [7] (based on SMGs), Slayer [1] (based on separation logic), or Forester [8] (based on automata) actually work with it at least implicitly when applying abstract transformers. We only need them to output it.…”

“…1(a) with lines annotated by the shape invariant in the round boxes on their right. The invariant is expressed in the form of so-called symbolic memory graphs (SMGs), the abstract domain of the shape analyser Predator [7], simplified to a bare minimum sufficient for exposing main concepts of our method. The basic abstract objects of SMGs are shown as the black circles in the figure.…”