Compositional Verification of Heap-Manipulating Programs Through Property-Guided Learning

Abstract

Analyzing and verifying heap-manipulating programs automatically is challenging. A key for fighting the complexity is to develop compositional methods. For instance, many existing verifiers for heap-manipulating programs require user-provided specification for each function in the program in order to decompose the verification problem. The requirement, however, often hinders the users from applying such tools. To overcome the issue, we propose to automatically learn heap-related program invariants in a property-guided way for each function call. The invariants are learned based on the memory graphs observed during test execution and improved through memory graph mutation. We implemented a prototype of our approach and integrated it with two existing program verifiers. The experimental results show that our approach enhances existing verifiers effectively in automatically verifying complex heap-manipulating programs with multiple function calls.

Learning Data Structure Shapes from Memory Graphs

“…In contrast, Locust [9], Slearner [30], and SLING [23] conduct a dynamic analysis supported by predefined shape predicates. Locust interprets the prediction of a separation logic formula as a classification problem on a fixed grammar, and uses symbolic execution in combination with a program verifier to generate positive and negative memory graphs in a refinement loop.…”