Modular Verification of Procedure Equivalence in the Presence of Memory Allocation

Abstract

For most high level languages, two procedures are equivalent if they transform a pair of isomorphic stores to isomorphic stores. However, tools for modular checking of such equivalence impose a stronger check where isomorphism is strengthened to equality of stores. This results in the inability to prove many interesting program pairs with recursion and dynamic memory allocation. In this work, we present RIE, a methodology to modularly establish equivalence of procedures in the presence of memory allocation, cyclic data structures and recursion. Our technique addresses the need for finding witnesses to isomorphism with angelic allocation, supports reasoning about equivalent procedures calls when the stores are only locally isomorphic, and reasoning about changes in the order of procedure calls. We have implemented RIE by encoding it in the Boogie program verifier. We describe the encoding and prove its soundness.

Synthesizing replacement classes

“…Contextual Equivalence. The equivalence of two expressions under all contexts can be proved using contextual equivalence [Koutavas and Wand 2006a,b;Lahiri et al 2012;Sangiorgi et al 2011;Pierce 2004, 2005;Wand et al 2018;Wood et al 2017]. A set of techniques [Koutavas and Wand 2006a,b;Pierce 2004, 2005] establish a bisimulation invariant to prove the equivalence of two lambda calculus programs.…”

“…Wang et al propose techniques for verifying the equivalence of database applications. Wood et al [Wood et al 2017] propose an approach for verifying the equivalence of methods that may contain memory allocations, cyclic data structures and recursion. In contrast to these approaches where equivalence of two programs is veri ed, we synthesize a class that is equivalent to an original class by establishing inter-class equivalence predicates.…”

Verified three-way program merge

“…Cross-version program analysis. Prior work on comparing closely related programs versions include regression verification that checks semantic equivalence using uninterpreted function abstraction of equivalent callees [Felsing et al 2014;Godlin and Strichman 2008;Lahiri et al 2012], mutual summaries Wood et al 2017], relational invariant inference to prove differential properties and verification modulo versions [Logozzo et al 2014]. Other approaches include static analysis for abstract differencing [Jackson and Ladd 1994;Partush and Yahav 2014], symbolic execution for verifying assertion-equivalence [Ramos and Engler 2011] and differential symbolic execution to summarize differences [Person et al 2008].…”

Verifying equivalence of database-driven applications

“…Unlike translation validation where the two programs are expressed at different levels of abstraction and transformations are intra-procedural, regression verification deals with two programs across a refactoring, feature addition or bug-fix with changes possibly spread across procedures. Approaches range from the use of differential symbolic execution [Person et al 2008] for loop-free and recursion-free programs, techniques based on uninterpreted functions to deal with mutual recursion [Godlin and Strichman 2009;Lahiri et al 2012], use of mutual summaries for checking heap-manipulating programs Wood et al 2017], to the use of standard invariant inference for inferring intermediate relational invariants [Felsing et al 2014;]. Because the invariants and assertions relate program variables, the resulting verification conditions are expressible in first-order theories supported by SMT solvers.…”