ConSORT: Context- and Flow-Sensitive Ownership Refinement Types for Imperative Programs

Toman, John; Siqi, Ren; Suenaga, Kohei; Igarashi, Atsushi; Kobayashi, Naoki

doi:10.1007/978-3-030-44914-8_25

“…Specifically, Liquid type inference [Rondon et al 2008;Vazou et al 2015Vazou et al , 2013Vazou et al , 2014] performs a context-insensitive analysis over a monomial predicate abstraction domain of type refinements. Similarly, Zhu and Jagannathan [2013] propose a 1-context sensitive analysis with predicate abstraction, augmented with an additional counterexample-guided refinement loop, an idea that has also inspired recent techniques for analyzing pointer programs [Toman et al 2020]. Our work generalizes these algorithms to arbitrary abstract domains of type refinements (including domains of infinite height) and provides parametric and constructive soundness and completeness results for the obtained type systems.…”

Section: Related Workmentioning

confidence: 98%

Data flow refinement type inference

Pavlinovic

¹

,

Su

²

,

Wies

³

2021

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

Refinement types enable lightweight verification of functional programs. Algorithms for statically inferring refinement types typically work by reduction to solving systems of constrained Horn clauses extracted from typing derivations. An example is Liquid type inference, which solves the extracted constraints using predicate abstraction. However, the reduction to constraint solving in itself already signifies an abstraction of the program semantics that affects the precision of the overall static analysis. To better understand this issue, we study the type inference problem in its entirety through the lens of abstract interpretation. We propose a new refinement type system that is parametric with the choice of the abstract domain of type refinements as well as the degree to which it tracks context-sensitive control flow information. We then derive an accompanying parametric inference algorithm as an abstract interpretation of a novel data flow semantics of functional programs. We further show that the type system is sound and complete with respect to the constructed abstract semantics. Our theoretical development reveals the key abstraction steps inherent in refinement type inference algorithms. The trade-off between precision and efficiency of these abstraction steps is controlled by the parameters of the type system. Existing refinement type systems and their respective inference algorithms, such as Liquid types, are captured by concrete parameter instantiations. We have implemented our framework in a prototype tool and evaluated it for a range of new parameter instantiations (e.g., using octagons and polyhedra for expressing type refinements). The tool compares favorably against other existing tools. Our evaluation indicates that our approach can be used to systematically construct new refinement type inference algorithms that are both robust and precise.

show abstract

“…Specifically, Liquid type inference [Rondon et al 2008;Vazou et al 2015Vazou et al , 2013Vazou et al , 2014] performs a context-insensitive analysis over a monomial predicate abstraction domain of type refinements. Similarly, Zhu and Jagannathan [2013] propose a 1-context sensitive analysis with predicate abstraction, augmented with an additional counterexample-guided refinement loop, an idea that has also inspired recent techniques for analyzing pointer programs [Toman et al 2020]. Our work generalizes these algorithms to arbitrary abstract domains of type refinements (including domains of infinite height) and provides parametric and constructive soundness and completeness proofs for the obtained type systems.…”

Section: Related Workmentioning

confidence: 99%

Data Flow Refinement Type Inference

Pavlinovic¹,

Su²,

Wies³

2020

Preprint

0

View full text Add to dashboard Cite

Refinement types enable lightweight verification of functional programs. Algorithms for statically inferring refinement types typically work by reduction to solving systems of constrained Horn clauses extracted from typing derivations. An example is Liquid type inference, which solves the extracted constraints using predicate abstraction. However, the reduction to constraint solving in itself already signifies an abstraction of the program semantics that affects the precision of the overall static analysis. To better understand this issue, we study the type inference problem in its entirety through the lens of abstract interpretation. We propose a new refinement type system that is parametric with the choice of the abstract domain of type refinements as well as the degree to which it tracks context-sensitive control flow information. We then derive an accompanying parametric inference algorithm as an abstract interpretation of a novel data flow semantics of functional programs. We further show that the type system is sound and complete with respect to the constructed abstract semantics. Our theoretical development reveals the key abstraction steps inherent in refinement type inference algorithms. The trade-off between precision and efficiency of these abstraction steps is controlled by the parameters of the type system. Existing refinement type systems and their respective inference algorithms, such as Liquid types, are captured by concrete parameter instantiations. We have implemented our framework in a prototype tool and evaluated it for a range of new parameter instantiations (e.g., using octagons and polyhedra for expressing type refinements). The tool compares favorably against other existing tools. Our evaluation indicates that our approach can be used to systematically construct new refinement type inference algorithms that are both robust and precise. CCS Concepts: • Theory of computation → Program analysis; Type theory.

show abstract

“…Our approach is able to prove the correctness of both the untrusted and the trusted code within the same pipeline. Toman et al [2020] introduce the ConSORT system, which shows how ownership types can be used to allow refinement types to work with mutable objects. Like our work, this is an application of refinement types to imperative languages which reduces the number of false positives reported by type checkers.…”

Section: Related Workmentioning

confidence: 99%

Scalability and precision by combining expressive type systems and deductive verification

Lanzinger¹,

Weigl²,

Ulbrich³

et al. 2021

Proc. ACM Program. Lang.

4

0

View full text Add to dashboard Cite

Type systems and modern type checkers can be used very successfully to obtain formal correctness guarantees with little specification overhead. However, type systems in practical scenarios have to trade precision for decidability and scalability. Tools for deductive verification, on the other hand, can prove general properties in more cases than a typical type checker can, but they do not scale well. We present a method to complement the scalability of expressive type systems with the precision of deductive program verification approaches. This is achieved by translating the type uses whose correctness the type checker cannot prove into assertions in a specification language, which can be dealt with by a deductive verification tool. Type uses whose correctness the type checker can prove are instead turned into assumptions to aid the verification tool in finding a proof.Our novel approach is introduced both conceptually for a simple imperative language, and practically by a concrete implementation for the Java programming language. The usefulness and power of our approach has been evaluated by discharging known false positives from a real-world program and by a small case study.

show abstract

ConSORT: Context- and Flow-Sensitive Ownership Refinement Types for Imperative Programs

Cited by 16 publications

References 72 publications

Data flow refinement type inference

Data flow refinement type inference

Data Flow Refinement Type Inference

Scalability and precision by combining expressive type systems and deductive verification

Contact Info

Product

Resources

About