What’s Decidable About Program Verification Modulo Axioms?

Mathur, Umang; Madhusudan, P.; Viswanathan, Mahesh

doi:10.1007/978-3-030-45237-7_10

Cited by 8 publications

(3 citation statements)

References 47 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Recent work [10] has shown that verifying programs using uninterpreted abstractions can be extremely effective in practice for proving programs correct. Also, recent work by Mathur et al [40] explores ways to add axioms (such as commutativity of functions, axioms regarding partial orders, etc.) and yet preserve decidability of verification.…”

Section: Discussionmentioning

confidence: 99%

Decidable Synthesis of Programs with Uninterpreted Functions

Krogmeier

Mathur

Murali

et al. 2020

Computer Aided Verification

Self Cite

View full text Add to dashboard Cite

We identify a decidable synthesis problem for a class of programs of unbounded size with conditionals and iteration that work over infinite data domains. The programs in our class use uninterpreted functions and relations, and abide by a restriction called coherence that was recently identified to yield decidable verification. We formulate a powerful grammar-restricted (syntax-guided) synthesis problem for coherent uninterpreted programs, and we show the problem to be decidable, identify its precise complexity, and also study several variants of the problem.

show abstract

Section: Discussionmentioning

confidence: 99%

Decidable Synthesis of Programs with Uninterpreted Functions

Krogmeier

Mathur

Murali

et al. 2020

Computer Aided Verification

Self Cite

View full text Add to dashboard Cite

show abstract

“…The verification of uninterpreted programs is undecidable in general; for the subclass of coherent uninterpreted programs, however, it is decidable [15]. The verification problem of uninterpreted programs has been extended with theories, i.e., with axioms over the functions and predicates [16]. Adding axioms to coherent uninterpreted programs preserves decidability for some axioms, e.g., idempotence, while it yields undecidability for others, e.g., associativity.…”

Section: Related Workmentioning

confidence: 99%

Temporal Stream Logic modulo Theories (Full Version)

Finkbeiner¹,

Heim²,

Passing³

2021

Preprint

View full text Add to dashboard Cite

Temporal Stream Logic (TSL) is a temporal logic that extends LTL with updates and predicates over arbitrary function terms. This allows for specifying data-intensive systems for which LTL is not expressive enough. In TSL, functions and predicates are uninterpreted. In this paper, we investigate the satisfiability problem of TSL both with respect to the standard underlying theory of uninterpreted functions and with respect to other theories such as Presburger arithmetic. We present an algorithm for checking the satisfiability of a TSL formula in the theory of uninterpreted functions and evaluate it on different benchmarks: It scales well and is able to validate assumptions in a real-world system design. The algorithm is not guaranteed to terminate. In fact, we show that TSL satisfiability is highly undecidable in the theories of uninterpreted functions, equality, and Presburger arithmetic, proving that no complete algorithm exists. However, we identify three fragments of TSL for which the satisfiability problem is (semi-)decidable in the theory of uninterpreted functions.

show abstract

“…This work stems from the recent decidability result on uninterpreted coherent programs [Mathur et al 2019a], which has also been extended to incorporate reasoning modulo theories including associativity and commutativity of functions over the data domain and ordering relations on the data domain [Mathur et al 2019b]. In our work we use automata-theoretic techniques that, over the data domain, reason about equality and function computation over the data elements.…”

Section: Related Workmentioning

confidence: 99%

Deciding memory safety for single-pass heap-manipulating programs

Mathur

Murali

Krogmeier

et al. 2019

Proc. ACM Program. Lang.

Self Cite

View full text Add to dashboard Cite

We investigate the decidability of automatic program verification for programs that manipulate heaps, and in particular, decision procedures for proving memory safety for them. We extend recent work that identified a decidable subclass of uninterpreted programs to a class of alias-aware programs that can update maps. We apply this theory to develop verification algorithms for memory safetyÐ determining if a heap-manipulating program that allocates and frees memory locations and manipulates heap pointers does not dereference an unallocated memory location. We show that this problem is decidable when the initial allocated heap forms a forest data-structure and when programs are streaming-coherent, which intuitively restricts programs to make a single pass over a data-structure. Our experimental evaluation on a set of library routines that manipulate forest data-structures shows that common single-pass algorithms on data-structures often fall in the decidable class, and that our decision procedure is efficient in verifying them.Deciding Memory Safety for Single-Pass Heap-Manipulating Programs 35:3 must either be the case that x is different from z in any data-model/heap or it must be the case that x is equal to z in all data-models/heaps.We show that alias-awareness is a panacea for our problems. For alias-aware programs (programs whose executions are all alias-aware), we show we can associate terms with variables after a computation that updates maps, and further show that the notion of coherence extends naturally to programs that update maps. We then show that for coherent alias-aware programs, the verification problem becomes decidable. These results constitute the first main contribution of the paper. Application to Verifying Memory SafetyWe then study the application of our framework to verifying memory safety. Our key observation is that for programs that manipulate forest data-structures (data-structures consisting of disjoint tree-like structures), programs are naturally alias-aware. Intuitively, when traversing forest datastructures, aliasing information is implicitly present. For instance, if x points to a location of a forest data-structure, we know that the location pointed to by x, the one pointed to by the left child x·left, and the one pointed to by the right child x·right are all different.In this paper, we define memory safety as follows. A heap-manipulating program starts with a set of allocated heap locations. During its execution, it dereferences pointers on heap locations, and allocates and frees locations. A program is memory safe if it never dereferences a location that is not in the allocated set. The above definition of memory safety captures the usual categories of memory safety errors such as null-pointer dereferences, use after free, use of uninitialized memory, illegal freeing of memory, etc. [Hicks 2014]. However, in this paper, we do not consider allocation of contiguous blocks of arbitrary size of memory (and hence do not handle arrays and buffer overflows of arrays in languages like ...

show abstract

What’s Decidable About Program Verification Modulo Axioms?

Cited by 8 publications

References 47 publications

Decidable Synthesis of Programs with Uninterpreted Functions

Decidable Synthesis of Programs with Uninterpreted Functions

Temporal Stream Logic modulo Theories (Full Version)

Deciding memory safety for single-pass heap-manipulating programs

Contact Info

Product

Resources

About