Hierarchical Shape Abstraction of Dynamic Structures in Static Blocks

Sotin, Pascal; Rival, Xavier

doi:10.1007/978-3-642-35182-2_10

Cited by 11 publications

(17 citation statements)

References 26 publications

(50 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…More complex properties like reachability of locations in the heap and shape of the data structures could also be proved with static analysis methods based on shape analysis, e.g., [4,6,10,32]. These automatic techniques have been applied to linked lists coded in arrays [34]. These methods concern limited properties and may be used in the early stages of the library development to infer internal invariant properties.…”

Section: Related Workmentioning

confidence: 99%

A Verified Implementation of the Bounded List Container

Cauderlier

Sighireanu

2018

Tools and Algorithms for the Construction and Analysis of Systems

View full text Add to dashboard Cite

Abstract. This paper contributes to the trend of providing fully verified container libraries. We consider an implementation of the bounded doubly linked list container which manages the list in a fixed size, heap allocated array. The container provides constant time methods to update the list by adding, deleting, and changing elements, as well as cursors for list traversal and access to elements. The library is implemented in C, but we wrote the code and its specification by imitating the ones provided by GNAT for the standard library of Ada 2012. The proof of functional correctness is done using VeriFast, which provides an auto-active verification environment for Separation Logic extended with algebraic data types. The specifications proved entail the contracts of the Ada library and include new features. The verification method we used employs a precise algebraic model of the data structure and we show that it facilitates the verification and captures entirely the library contracts. This case study may be of interest for other verification platforms, thus we highlight the intricate points of its proof.

show abstract

Section: Related Workmentioning

confidence: 99%

A Verified Implementation of the Bounded List Container

Cauderlier

Sighireanu

2018

Tools and Algorithms for the Construction and Analysis of Systems

View full text Add to dashboard Cite

show abstract

“…We propose new abstract transformers which do not require user annotations like in [21]. Another hierarchical analysis of shape and numeric properties has been proposed in [25]. They consider the analysis of linked data structures coded in arrays and track the shape of these data structures and not the shape of the free set.…”

Section: Related Work and Conclusionmentioning

confidence: 99%

“…These challenges have been addressed partially by several works in the last ten years [5,23,25]. Efficient numerical analyses has been designed to track address alignment and bit-fields [23].…”

Section: Introductionmentioning

confidence: 99%

“…However, some properties of the heap and free-list can not be tracked, e.g., the absence of memory leaks or ordering of start addresses of free-chunks. Although the analysis in [25] does not concern DMA, it is the first to propose a hierarchical abstraction of the memory to track properties of linked data structures stored in static memory regions. However, this analysis can not track properties like address sorting of the high level data structures (here the free-list) stored in the memory region.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Hierarchical Shape Abstraction for Analysis of Free List Memory Allocators

Fang

Sighireanu

2017

Logic-Based Program Synthesis and Transformation

View full text Add to dashboard Cite

We propose a hierarchical abstract domain for the analysis of free-list memory allocators that tracks shape and numerical properties about both the heap and the free lists. Our domain is based on Separation Logic extended with predicates that capture the pointer arithmetics constraints for the heap-list and the shape of the free-list. These predicates are combined using a hierarchical composition operator to specify the overlapping of the heap-list by the free-list. In addition to expressiveness, this operator leads to a compositional and compact representation of abstract values and simplifies the implementation of the abstract domain. The shape constraints are combined with numerical constraints over integer arrays to track properties about the allocation policies (best-fit, first-fit, etc). Such properties are out of the scope of the existing analyzers. We implemented this domain and we show its effectiveness on several implementations of free-list allocators.

show abstract

“…This combinator does not rely on separation and provides a different form of separation of concerns than our separating combinator: in [22], sub-domains express a collection of properties of the same structure whereas the separating conjunction operator combines domains representing distinct structures. Moreover, we introduced a hierarchical memory abstraction to abstract structures allocated inside other structures [21]; in that work the whole memory is abstracted in the main domain, and a sub-domain describes nested structures. These combinators are implemented as ML functors in the MemCAD analyzer and can be used together (although assessing such compositions is beyond the scope of this paper).…”

Section: Related Workmentioning

confidence: 99%

An Abstract Domain Combinator for Separately Conjoining Memory Abstractions

2014

Self Cite

View full text Add to dashboard Cite

Abstract. The breadth and depth of heap properties that can be inferred by the union of today's shape analyses is quite astounding. Yet, achieving scalability while supporting a wide range of complex data structures in a generic way remains a long-standing challenge. In this paper, we propose a way to side-step this issue by defining a generic abstract domain combinator for combining memory abstractions on disjoint regions. In essence, our abstract domain construction is to the separating conjunction in separation logic as the reduced product construction is to classical, non-separating conjunction. This approach eases the design of the analysis as memory abstract domains can be re-used by applying our separating conjunction domain combinator. And more importantly, this combinator enables an analysis designer to easily create a combined domain that applies computationally-expensive abstract domains only where it is required.

show abstract

Hierarchical Shape Abstraction of Dynamic Structures in Static Blocks

Cited by 11 publications

References 26 publications

A Verified Implementation of the Bounded List Container

A Verified Implementation of the Bounded List Container

Hierarchical Shape Abstraction for Analysis of Free List Memory Allocators

An Abstract Domain Combinator for Separately Conjoining Memory Abstractions

Contact Info

Product

Resources

About