Automating Separation Logic with Trees and Data

Abstract

Separation logic (SL) is a widely used formalism for verifying heap manipulating programs. Existing SL solvers focus on decidable fragments for list-like structures. More complex data structures such as trees are typically unsupported in implementations, or handled by incomplete heuristics. While complete decision procedures for reasoning about trees have been proposed, these procedures suffer from high complexity, or make global assumptions about the heap that contradict the separation logic philosophy of local reasoning. In this paper, we present a fragment of classical first-order logic for local reasoning about tree-like data structures. The logic is decidable in NP and the decision procedure allows for combinations with other decidable first-order theories for reasoning about data. Such extensions are essential for proving functional correctness properties. We have implemented our decision procedure and, building on earlier work on translating SL proof obligations into classical logic, integrated it into an SL-based verification tool. We successfully used the tool to verify functional correctness of tree-based data structure implementations. Contributions. In this paper, we give a positive answer to this question. Our solution builds on our earlier work on reducing entailment checking in separation logic to satisfiability checking in classical first-order logic [32]. Our main technical contribution therefore lies in the identification of a fragment of first-order logic that (1) supports reasoning about mutable tree data structures; (2) is sufficiently expressive to serve as AE Supported in part by NSF grant CCS-1320583. AEAE Supported by DARPA (Grant FA8650-11-C-7192).

A fully verified container library

“…Separation logic tools such as VeriFast may require a heavier annotation burden that includes low-level directives to "bundle/open" and "unbundle/close" abstract predicate definitions in crucial parts of a proof. To provide automation at a higher level, Piskac et al [PWZ14] combine separation logic with decidable first-order fragments to verify programs in a C-like fragment with native support for specification constructs. They demonstrate their GRASShoper verifier on flat linked datastructure examples; it currently cannot handle nested structures or arrays.…”

A Verified Implementation of the Bounded List Container

“…At the intermediate level of automation, functional verification tools have been used to tackle the verification of specific data structures (e.g., Dafny [33], GRASShoper [26], VeriFast [15], or Why3 [36]) but we are not aware of any experiment on bounded lists.…”

Satisfiability Modulo Heap-Based Programs

“…Although these proposals can decide the formula of that fragment in polynomial time, it is not easy to extend them to a fragment with general inductive predicates (i.e., the fragment SLPA). Decision procedures in [34,36,35] and [33] support decidable fragments of separation logic with inter-reachable data structures using SMT. Our proposal extends these procedures to those fragments with general inductively-defined predicates.…”