Shape Analysis of Single-Parent Heaps

Balaban, Ittai; Pnueli, Amir; Zuck, Lenore D.

doi:10.1007/978-3-540-69738-1_7

Cited by 15 publications

(8 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…These logics are usually FOLs with restricted quantifiers, and usually are decided using SMT solvers. The logics Lisbq [22] and CSL [9,10] offer such reasoning with restricted reachability predicates and quantification; see also the logics in [1,7,30,[33][34][35]. Strand is a relatively expressive logic that can handle some data-structure properties (like BSTs) and admits decidable fragments [25,26], but is again not expressive enough for more complex properties of inductive datastructures.…”

Section: Related Workmentioning

confidence: 99%

Natural proofs for structure, data, and separation

Qiu

Garg

Ștefănescu

et al. 2013

Proceedings of the 34th ACM SIGPLAN Conference on Programming Language Design and Implementation

View full text Add to dashboard Cite

We propose natural proofs for reasoning with programs that manipulate data-structures against specifications that describe the structure of the heap, the data stored within it, and separation and framing of sub-structures. Natural proofs are a subclass of proofs that are amenable to completely automated reasoning, that provide sound but incomplete procedures, and that capture common reasoning tactics in program verification. We develop a dialect of separation logic over heaps, called Dryad, with recursive definitions that avoids explicit quantification. We develop ways to reason with heaplets using classical logic over the theory of sets, and develop natural proofs for reasoning using proof tactics involving disciplined unfoldings and formula abstractions. Natural proofs are encoded into decidable theories of first-order logic so as to be discharged using SMT solvers.We also implement the technique and show that a large class of more than 100 correct programs that manipulate data-structures are amenable to full functional correctness using the proposed natural proof method. These programs are drawn from a variety of sources including standard data-structures, the Schorr-Waite algorithm for garbage collection, a large number of low-level C routines from the Glib library and OpenBSD library, the Linux kernel, and routines from a secure verified OS-browser project. Our work is the first that we know of that can handle such a wide range of full functional verification properties of heaps automatically, given pre/post and loop invariant annotations. We believe that this work paves the way for deductive verification technology to be used by programmers who do not (and need not) understand the internals of the underlying logic solvers, significantly increasing their applicability in building reliable systems.

show abstract

Section: Related Workmentioning

confidence: 99%

Natural proofs for structure, data, and separation

Qiu

Garg

Ștefănescu

et al. 2013

Proceedings of the 34th ACM SIGPLAN Conference on Programming Language Design and Implementation

View full text Add to dashboard Cite

show abstract

“…The primary inspiration for our solution came from the efficient SMT-based techniques for reasoning about list structures [13], as well as the idea of viewing singleparent heaps as duals of lists [1]. However, there are several differences from this immediate inspiration.…”

Section: Introductionmentioning

confidence: 99%

“…However, there are several differences from this immediate inspiration. For integration with other decision procedures, as well as for modular reasoning with preconditions and postconditions, it was essential to obtain a logic and not only a finite-model property for the analysis of systems as in [1]. Furthermore, the need to support imperative updates on trees led to technical challenges that are very different than those of [13].…”

Section: Introductionmentioning

confidence: 99%

An Efficient Decision Procedure for Imperative Tree Data Structures

Wies

Muñiz

Kunčak

2011

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. We present a new decidable logic called TREX for expressing constraints about imperative tree data structures. In particular, TREX supports a transitive closure operator that can express reachability constraints, which often appear in data structure invariants. We show that our logic is closed under weakest precondition computation, which enables its use for automated software verification. We further show that satisfiability of formulas in TREX is decidable in NP. The low complexity makes it an attractive alternative to more expensive logics such as monadic second-order logic (MSOL) over trees, which have been traditionally used for reasoning about tree data structures.

show abstract

“…On the other hand, the approach is only as viable as the strength of the quantifier instantiation heuristics. Balaban et al [2] use a poral tem ) small model theorem to derive a decision procedure. A different line of work is based on automata-based decision procedures.…”

Section: Introductionmentioning

confidence: 99%

Linear Functional Fixed-points

Bjørner

Hendrix

2009

Computer Aided Verification

View full text Add to dashboard Cite

We introduce a logic of functional fixed-points. It is suitable for analyzing heap-manipulating programs and can encode several logics used for program verification with different ways of expressing reachability. While full fixed-point logic remains undecidable, several subsets admit decision procedures. In particular, for the logic of linear functional fixed-points, we develop an abstraction refinement integration of the SMT solver Z3 and a satisfiability checker for propositional lineartime temporal logic. The integration refines the temporal abstraction by generating safety formulas until the temporal abstraction is unsatisfiable or a model for it is also a model for the functional fixed-point formula. Contributions. This paper analyzes several different fixed-point logic fragments to identify expressive logics that still have good decidability and complexity results. On the practical side, we outline an integration procedure between propositional temporal logic checking and theory solvers.-We formulate a logic called the Equational Linear Functional Fixed Point Logic (or FFP(E) for short). FFP(E) encodes several fixed point logics presented in recent literature on program verification.-We establish that FFP(E) is PSPACE-complete modulo background theories that are in PSPACE by using a reduction from FFP(E) into propositional linear-time temporal logic. We show that two different extensions are NEXPTIME-hard and undecidable, respectively.

show abstract

Shape Analysis of Single-Parent Heaps

Cited by 15 publications

References 17 publications

Natural proofs for structure, data, and separation

Natural proofs for structure, data, and separation

An Efficient Decision Procedure for Imperative Tree Data Structures

Linear Functional Fixed-points

Contact Info

Product

Resources

About