A Relational Shape Abstract Domain

Abstract

Abstract. Static analyses aim at inferring semantic properties of programs. While many analyses compute an over-approximation of reachable states, some analyses compute a description of the input-output relations of programs. In the case of numeric programs, several analyses have been proposed that utilize relational numerical abstract domains to describe relations. On the other hand, designing abstractions for relations over memory states and taking shapes into account is challenging. In this paper, we propose a set of novel logical connectives to describe such relations, which are inspired by separation logic. This logic can express that certain memory areas are unchanged, freshly allocated, or freed, or that only part of the memory was modified. Using these connectives, we build an abstract domain and design a static analysis that over-approximates relations over memory states containing inductive structures. We implement this analysis and report on the analysis of a basic library of list manipulating functions.

Stable relations and abstract interpretation of higher-order programs

“…The same rule for the denotation of functions also fosters the development of a modular analysis, where the body of a function is analysed only once at its definition site. Function summaries have indeed lead to the successful design of a variety of static analyses including shape analysis [Das 2000;Illous et al 2017], numerical analysis [Farzan and Kincaid 2015;Jeannet et al 2004;Kincaid et al 2017], and correlation analysis [Andreescu et al 2019]. The correlation abstract domain represents typed relations between values of algebraic datatypes.…”

Interprocedural Shape Analysis Using Separation Logic-Based Transformer Summaries

“…Unlike state analyses, transformation analyses compute abstractions of the input-output relation of a program fragment. As an example, given the above abstract pre-condition, the analysis of [17] infers relations as shown in Figure 2(a). This graphical view states that the procedure append keeps both summary predicates unchanged and only modifies the middle list element so as to append the two lists.…”

“…The analysis of assignments and loops follows from [17]. It may require finite disjunctions of transformations although we do not formalize this aspect since it is orthogonal to the goal of this paper.…”

“…To solve this issue, a first approach is to modify the semantics of separation logic connectors to pairs of states [34]. A more radical solution is to construct novel logical connectors over state transformation relations that are inspired by separation logic [17]. These transformations can describe the effect of a program and express facts such as "memory region A is left untouched whereas a single element is inserted into the list stored inside memory region B and the rest of that list is not modified".…”

“…These transformations can describe the effect of a program and express facts such as "memory region A is left untouched whereas a single element is inserted into the list stored inside memory region B and the rest of that list is not modified". The analysis of [17] is designed as a forward abstract interpretation which produces abstract transformation relations. Therefore, it can describe tranfsormations precisely using separation logic predicates and without accumulating tables of input and output abstract states.…”