RustHorn: CHC-Based Verification for Rust Programs

Matsushita, Yusuke; Tsukada, Takeshi; Kobayashi, Naoki

doi:10.1007/978-3-030-44914-8_18

Cited by 25 publications

(10 citation statements)

References 52 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…While we are mainly interested in solving CHCs encoding imperative programs, to show the robustness of our approach, we evaluate Racer on CHC benchmarks obtained from two sources. The first group, called Rust-bench, contains 87 CHCs encoding safety of imperative Rust programs from [Matsushita et al 2020]. The second group, called Leon-bench, contains 64 CHCs encoding safety of ADT manipulating functional programs [De Angelis et al 2020].…”

Section: Implementation and Evaluationmentioning

confidence: 99%

Solving constrained Horn clauses modulo algebraic data types and recursive functions

Shoham

Gurfinkel

2022

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

This work addresses the problem of verifying imperative programs that manipulate data structures, e.g., Rust programs. Data structures are usually modeled by Algebraic Data Types (ADTs) in verification conditions. Inductive invariants of such programs often require recursively defined functions (RDFs) to represent abstractions of data structures. From the logic perspective, this reduces to solving Constrained Horn Clauses (CHCs) modulo both ADT and RDF. The underlying logic with RDFs is undecidable. Thus, even verifying a candidate inductive invariant is undecidable. Similarly, IC3-based algorithms for solving CHCs lose their progress guarantee: they may not find counterexamples when the program is unsafe. We propose a novel IC3-inspired algorithm Racer for solving CHCs modulo ADT and RDF (i.e., automatically synthesizing inductive invariants, as opposed to only verifying them as is done in deductive verification). Racer ensures progress despite the undecidability of the underlying theory, and is guaranteed to terminate with a counterexample for unsafe programs. It works with a general class of RDFs over ADTs called catamorphisms. The key idea is to represent catamorphisms as both CHCs, via relationification , and RDFs, using novel abstractions . Encoding catamorphisms as CHCs allows learning inductive properties of catamorphisms, as well as preserving unsatisfiabilty of the original CHCs despite the use of RDF abstractions, whereas encoding catamorphisms as RDFs allows unfolding the recursive definition, and relying on it in solutions. Abstractions ensure that the underlying theory remains decidable. We implement our approach in Z3 and show that it works well in practice.

show abstract

Section: Implementation and Evaluationmentioning

confidence: 99%

Solving constrained Horn clauses modulo algebraic data types and recursive functions

Shoham

Gurfinkel

2022

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

show abstract

“…RustHorn [Matsushita et al 2020] uses the ownership information of Rust types to translate Rust code to constrained Horn clauses. Heapster supports a more general class of source programs at the cost of more user input, but uses the same idea of using ownership information to extract simpler representations of source programs.…”

Section: Related Workmentioning

confidence: 99%

A type system for extracting functional specifications from memory-safe imperative programs

Westbrook

Carmer

et al. 2021

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

Verifying imperative programs is hard. A key difficulty is that the specification of what an imperative program does is often intertwined with details about pointers and imperative state. Although there are a number of powerful separation logics that allow the details of imperative state to be captured and managed, these details are complicated and reasoning about them requires significant time and expertise. In this paper, we take a different approach: a memory-safe type system that, as part of type-checking, extracts functional specifications from imperative programs. This disentangles imperative state, which is handled by the type system, from functional specifications, which can be verified without reference to pointers. A key difficulty is that sometimes memory safety depends crucially on the functional specification of a program; e.g., an array index is only memory-safe if the index is in bounds. To handle this case, our specification extraction inserts dynamic checks into the specification. Verification then requires the additional proof that none of these checks fail. However, these checks are in a purely functional language, and so this proof also requires no reasoning about pointers.

show abstract

“…Many authors have explored the use of linear type systems to reason in contexts with aliased mutable references [18,19,52], and in particular with the goal of supporting strong updates [1]. A closely related approach is RustHorn by Matsushita et al [40]. Much like ConSORT, RustHorn uses CHC and linear aliasing information for the sound and-unlike ConSORT-complete verification of programs with aliasing and mutability.…”

Section: Related Workmentioning

confidence: 99%

ConSORT: Context- and Flow-Sensitive Ownership Refinement Types for Imperative Programs

Toman

Siqi

Suenaga

et al. 2020

Programming Languages and Systems

Self Cite

View full text Add to dashboard Cite

We present ConSORT, a type system for safety verification in the presence of mutability and aliasing. Mutability requires strong updates to model changing invariants during program execution, but aliasing between pointers makes it difficult to determine which invariants must be updated in response to mutation. Our type system addresses this difficulty with a novel combination of refinement types and fractional ownership types. Fractional ownership types provide flow-sensitive and precise aliasing information for reference variables. ConSORT interprets this ownership information to soundly handle strong updates of potentially aliased references. We have proved ConSORT sound and implemented a prototype, fully automated inference tool. We evaluated our tool and found it verifies non-trivial programs including data structure implementations.

show abstract

RustHorn: CHC-Based Verification for Rust Programs

Cited by 25 publications

References 52 publications

Solving constrained Horn clauses modulo algebraic data types and recursive functions

Solving constrained Horn clauses modulo algebraic data types and recursive functions

A type system for extracting functional specifications from memory-safe imperative programs

ConSORT: Context- and Flow-Sensitive Ownership Refinement Types for Imperative Programs

Contact Info

Product

Resources

About