Bi-Abduction with Pure Properties for Specification Inference

Abstract. In this work, we present a semi-decision procedure for a fragment of separation logic with user-defined predicates and Presburger arithmetic. To check the satisfiability of a formula, our procedure iteratively unfolds the formula and examines the derived disjuncts. In each iteration, it searches for a proof of either satisfiability or unsatisfiability. Our procedure is further enhanced with automatically inferred invariants as well as detection of cyclic proof. We also identify a syntactically restricted fragment of the logic for which our procedure is terminating and thus complete. This decidable fragment is relatively expressive as it can capture a range of sophisticated data structures with non-trivial pure properties, such as size, sortedness and near-balanced. We have implemented the proposed solver and a new system for verifying heap-based programs. We have evaluated our system on benchmark programs from a software verification competition.

show abstract

“…As such, the soundness of this lemma immediately follows from the soundness of second-order abduction [28,45].…”

Section: Sound Invariant Inferencementioning

confidence: 91%

“…Inferring Predicate Invariant Our invariant inference is based on the principle of secondorder abduction [28,45]. Given the predicate P defined by m branches as P(t) ≡ m i=1 ∆ i , we assume a sound invariant of P as an unknown (second-order ) variable I(t).…”

Section: Sound Invariant Inferencementioning

confidence: 99%

Satisfiability Modulo Heap-Based Programs

Sun

Chin

2016

Computer Aided Verification

Self Cite

View full text Add to dashboard Cite

show abstract

“…Additionally, bi-abduction has been applied to different forms of program reasoning, including: automatic verification of concurrent systems [Calcagno et al 2009a]; inference of pure information about weakly-specified data structures, such as size, sum or height [Trinh et al 2013]; and automatic synthesis of higher-order predicates for polymorphic data structures [Le et al 2014].…”

Section: Related Workmentioning

confidence: 99%

JaVerT 2.0: compositional symbolic execution for JavaScript

Santos

Maksimovic

Sampaio

et al. 2019

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

We propose a novel, unified approach to the development of compositional symbolic execution tools, bridging the gap between classical symbolic execution and compositional program reasoning based on separation logic. Using this approach, we build JaVerT 2.0, a symbolic analysis tool for JavaScript that follows the language semantics without simplifications. JaVerT 2.0 supports whole-program symbolic testing, verification, and, for the first time, automatic compositional testing based on bi-abduction. The meta-theory underpinning JaVerT 2.0 is developed modularly, streamlining the proofs and informing the implementation. Our explicit treatment of symbolic execution errors allows us to give meaningful feedback to the developer during wholeprogram symbolic testing and guides the inference of resource of the bi-abductive execution. We evaluate the performance of JaVerT 2.0 on a number of JavaScript data-structure libraries, demonstrating: the scalability of our whole-program symbolic testing; an improvement over the state-of-the-art in JavaScript verification; and the feasibility of automatic compositional testing for JavaScript.

show abstract

“…As the disjunction of the bounded formulas is an under-approximation, the closure computed is an under-approximated base. To compute an over-approximation, we adopt the approach in [30]. In particular, first we transform the system of arithmetic inductive predicates into a system of constrained Horn clauses.…”

Section: Correctnessmentioning

confidence: 99%

A Decidable Fragment in Separation Logic with Inductive Predicates and Arithmetic

Tatsuta

Sun

et al. 2017

Computer Aided Verification

Self Cite

View full text Add to dashboard Cite

Abstract. We consider the satisfiability problem for a fragment of separation logic including inductive predicates with shape and arithmetic properties. We show that the fragment is decidable if the arithmetic properties can be represented as semilinear sets. Our decision procedure is based on a novel algorithm to infer a finite representation for each inductive predicate which precisely characterises its satisfiability. Our analysis shows that the proposed algorithm runs in exponential time in the worst case. We have implemented our decision procedure and integrated it into an existing verification system. Our experiment on benchmarks shows that our procedure helps to verify the benchmarks effectively.

show abstract

Bi-Abduction with Pure Properties for Specification Inference

Cited by 13 publications

References 27 publications

Satisfiability Modulo Heap-Based Programs

Satisfiability Modulo Heap-Based Programs

JaVerT 2.0: compositional symbolic execution for JavaScript

A Decidable Fragment in Separation Logic with Inductive Predicates and Arithmetic

Contact Info

Product

Resources

About