Predator Shape Analysis Tool Suite

Holík, Lukáš; Kotoun, Michal; Peringer, Petr; Šoková, Veronika; Trtík, Marek; Vojnar, Tomáš

doi:10.1007/978-3-319-49052-6_13

Cited by 12 publications

(4 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Testification approaches [28,29,39,43,52,74,81] often sequentially combine a verification and a validation approach and prioritize or only report confirmed proofs and alarms. Sequential portfolio approaches [44,61] run distinct, independent analyses in sequence while parallel portfolio approaches [91,12,57,65,66,96] execute various, independent analyses in parallel. Parallel white-box combinations [7,9,37,38,54,56,59,79] run different approaches in parallel, which exchange information for the purpose of collaboration.…”

Section: Related Workmentioning

confidence: 99%

Parallel Program Analysis via Range Splitting

Haltermann

Jakobs

Richter

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Ranged symbolic execution has been proposed as a way of scaling symbolic execution by splitting the task of path exploration onto several workers running in parallel. The split is conducted along path ranges which – simply speaking – describe sets of paths. Workers can then explore path ranges in parallel.In this paper, we propose ranged analysis as the generalization of ranged symbolic execution to arbitrary program analyses. This allows us to not only parallelize a single analysis, but also run different analyses on different ranges of a program in parallel. Besides this generalization, we also provide a novel range splitting strategy operating along loop bounds, complementing the existing random strategy of the original proposal. We implemented ranged analysis within the tool CPAchecker and evaluated it on programs from the SV-COMP benchmark. The evaluation in particular shows the superiority of loop bounds splitting over random splitting. We furthermore find that compositions of ranged analyses can solve analysis tasks that none of the constituent analysis alone can solve.

show abstract

Section: Related Workmentioning

confidence: 99%

Parallel Program Analysis via Range Splitting

Haltermann

Jakobs

Richter

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Cooperative Verification. Several verification tools apply different analyses using no cooperation [1,2,38,49,54,64,65,76] or select a suitable analysis from a set of analyses [2,14,50,83,96]. Further approaches split the verification effort among different analyses [20,23,26,29,40,41,46,47,52,54,[89][90][91].…”

Section: Related Workmentioning

confidence: 99%

Scalable Typestate Analysis for Low-Latency Environments

Arslanagić

Subotić²,

Pérez

2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed. The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use. The publisher, the authors, and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the editors give a warranty, expressed or implied, with respect to the material contained herein or for any errors or omissions that may have been made. The publisher remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

show abstract

“…There are a number of related tools that can check pointer programs for memory safety. For example: a combination of ccured [Necula et al 2002] and blast [Henzinger et al 2003] due to Beyer et al [2005], invader [Yang et al 2008], xisa [Laviron et al 2010], slayer [Berdine et al 2011], infer [Calcagno and Distefano 2011], forester [Holík et al 2013], predator [Dudka et al 2013;Holík et al 2016], and aprove [Ströder et al 2017]. These tools can only handle sequential code.…”

Section: Related Workmentioning

confidence: 99%

Pointer life cycle types for lock-free data structures with memory reclamation

Meyer

Wolff

2019

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

We consider the verification of lock-free data structures that manually manage their memory with the help of a safe memory reclamation (SMR) algorithm. Our first contribution is a type system that checks whether a program properly manages its memory. If the type check succeeds, it is safe to ignore the SMR algorithm and consider the program under garbage collection. Intuitively, our types track the protection of pointers as guaranteed by the SMR algorithm. There are two design decisions. The type system does not track any shape information, which makes it extremely lightweight. Instead, we rely on invariant annotations that postulate a protection by the SMR. To this end, we introduce angels, ghost variables with an angelic semantics. Moreover, the SMR algorithm is not hard-coded but a parameter of the type system definition. To achieve this, we rely on a recent specification language for SMR algorithms. Our second contribution is to automate the type inference and the invariant check. For the type inference, we show a quadratic-time algorithm. For the invariant check, we give a source-to-source translation that links our programs to off-the-shelf verification tools. It compiles away the angelic semantics. This allows us to infer appropriate annotations automatically in a guess-and-check manner. To demonstrate the effectiveness of our type-based verification approach, we check linearizability for various list and set implementations from the literature with both hazard pointers and epoch-based memory reclamation. For many of the examples, this is the first time they are verified automatically. For the ones where there is a competitor, we obtain a speed-up of up to two orders of magnitude.Proving lock-free data structures linearizable has received a lot of attention (cf. Section 10). Doherty et al. [2004], for instance, give a mechanized proof of a practical lock-free queue. Such proofs require plenty of manual work and take a considerable amount of time. Moreover, they require an understanding of the proof method and the data structure under consideration. To overcome this drawback, we are interested in automated verification. The cave tool by Vafeiadis [2010a,b], for example, is able to establish linearizability for singly-linked data structures fully automatically.The problem with automated verification for lock-free data structures is its limited applicability. Most techniques are restricted to implementations that assume a garbage collector (GC). This assumption, however, does not apply to all programming languages. Take C/C++ as an example. It does not provide an automatic garbage collector that is running in the background. Instead, it is the programmer's obligation to avoid memory leaks by reclaiming memory that is no longer in use (using delete). In lock-free data structures, this task is much harder than it may seem at first glance. The root of the problem is that threads typically traverse the data structure without synchronization. Hence, there may be threads holding pointers to records that have alread...

show abstract

Predator Shape Analysis Tool Suite

Cited by 12 publications

References 11 publications

Parallel Program Analysis via Range Splitting

Parallel Program Analysis via Range Splitting

Scalable Typestate Analysis for Low-Latency Environments

Pointer life cycle types for lock-free data structures with memory reclamation

Contact Info

Product

Resources

About