Verification of heap manipulating programs with ordered data by extended forest automata

Abstract

We present a general framework for verifying programs with complex dynamic linked data structures whose correctness depends on ordering relations between stored data values. The underlying formalism of our framework is that of forest automata (FA), which has previously been developed for verification of heap-manipulating programs. We extend FA with constraints between data elements associated with nodes of the heaps represented by FA, and we present extended versions of all operations needed for using the extended FA in a fully-automated verification approach, based on abstract interpretation. We have implemented our approach as an extension of the Forester tool and successfully applied it This paper is an extended version of a paper published in the proceedings of ATVA'13.

Graph-Based Shape Analysis Beyond Context-Freeness

“…(H, K well-formed, premise) 16 For details confer Rozenberg, Salomaa: "Handbook of Formal Languages", Vol. 1,1997 ⇒ K ⇒ C .…”

“…We consider one execution sequence in detail. The individual execution 1 We often draw multiple black circles, but they all correspond to the same location. Step (1).…”

“…The individual execution 1 We often draw multiple black circles, but they all correspond to the same location. Step (1). Starting with the leftmost IHC in Figure 3, we first execute a binary search (Figure 1, l. 9).…”

“…Applicability to red-black trees is demonstrated in an example, but not covered by experiments. In [1], forest automata are extended by constraints between data elements associated with nodes of the heaps. The authors conjecture that their method generalizes to handle lengths of branches in a tree, which are needed to express balancedness properties.…”

“…For shape analyses to be effective, they need to track detailed information about the heap configurations arising during computations. Although recent shape analyses have become quite potent [1,5,7,13,20], discovering abstractions that go beyond structural shape properties remains far from fully solved. For example, this is the case when considering balancedness properties of data structures, such as the AVL property: A full binary tree is an AVL tree if and only if for each of its inner nodes, the difference between the heights of its two subtrees is −1, 0, or 1.…”