Low-level liquid types

Abstract

We present Low-Level Liquid Types, a refinement type system for C based on Liquid Types. Low-Level Liquid Types combine refinement types with three key elements to automate verification of critical safety properties of low-level programs: First, by associating refinement types with individual heap locations and precisely tracking the locations referenced by pointers, our system is able to reason about complex invariants of in-memory data structures and sophisticated uses of pointer arithmetic. Second, by adding constructs which allow strong updates to the types of heap locations, even in the presence of aliasing, our system is able to verify properties of in-memory data structures in spite of temporary invariant violations. By using this strong update mechanism, our system is able to verify the correct initialization of newly-allocated regions of memory. Third, by using the abstract interpretation framework of Liquid Types, we are able to use refinement type inference to automatically verify important safety properties without imposing an onerous annotation burden. We have implemented our approach in CSOLVE, a tool for Low-Level Liquid Type inference for C programs. We demonstrate through several examples that CSOLVE is able to precisely infer complex invariants required to verify important safety properties, like the absence of array bounds violations and null-dereferences, with a minimal annotation overhead.

Rely-guarantee references for refinement types over aliased mutable data

“…Examples include DML [47], ATS [9], and X10's constrained types [36]. The refinement language is often also restricted to some theory that can be effectively decided by an SMT solver, as in Liquid Types [41]. RGREF allows refinements to depend on mutable heap data, and does not artificially restrict the properties that can be verified (at the cost of requiring manual guidance for proofs).…”

Rely-guarantee references for refinement types over aliased mutable data

“…This means that a series of writes that individually violate a guarantee but in aggregate satisfy it are disallowed. This is a common challenge for verification techniques [3,5,41], and we expect related work to inspire sufficient solutions.…”

Deterministic parallelism via liquid effects

“…In the preceding, we gave explicit loop invariants and heap effects where necessary. Later in this paper, we explain how we use Liquid Type inference [28] to reduce the annotation burden on the programmer by automatically inferring the loop invariants and heap effects given above.…”

“…Most of the expression forms for expressing sequential computation are standard or covered extensively in previous work [28]; the expression forms for parallel computation are new to this work.…”

“…The mechanism is similar to freeze/thaw and adopt/focus [34,10]. These rules are treated in previous work [28]; we now discuss how these rules handle effects and briefly recap their handling of strong updates.…”