FixBag: A Fixpoint Calculator for Quantified Bag Constraints

Abstract

interpretation techniques have played a major role in advancing the state-of-the-art in program analysis. Traditionally, stand-alone tools for these techniques have been developed for the numerical domains which may be sufficient for lower levels of program correctness. To analyze a wider range of programs, we have developed a tool to compute symbolic fixpoints for quantified bag domain. This domain is useful for programs that deal with collections of values. Our tool is able to derive both loop invariants and method pre/post conditions via fixpoint analysis of recursive bag constraints. To support better precision, we have allowed disjunctive formulae to be inferred, where appropriate. As a stand-alone tool, we have tested it on a range of small but challenging examples with acceptable precision and performance.

Automatically refining partial specifications for heap-manipulating programs

“…Secondly, instead of a direct fixpoint computation in the combined abstract domain (with shape, numerical and bag information), a "pure" constraint abstraction (without heap shape information) is derived from the generated constraint abstraction. This pure constraint abstraction is then solved by fixpoint solvers in pure (numerical and bag) domains, such as [9,10,11].…”

“…It first finds the "centre" node in the list (root), where the difference between numbers of nodes to the left and to the right of the centre node is at most one (lines 5-10), as Fig 3 (a) shows. It then applies the algorithm recursively on both list segments to the left and to the right of the centre node, and regards the centre node as the tree's root, whose left and right children are the resulting subtrees' roots from the recursive calls (lines [11][12][13][14][15][16][17], as in Fig 3 (b) and (c). As the data structures of doubly-linked list and binary tree are homomorphic (line 0), the algorithm reuses the nodes in the input instead of creating a new tree, making itself in-place.…”

“…The termination of fixpoint solver has been proved [10,11]. The non-termination problem of abduction may be caused by infinite number of unrolling in rule (R2), or infinitely recursive application of rule (R3).…”

QUICr: A Reusable Library for Parametric Abstraction of Sets and Numbers

“…Therefore, when verifying programs, it is vital to support containers as well as scalar values. In the decision procedures community, this is widely recognized with support for arrays, sets, and maps [1][2][3], but when invariant generation is concerned, such as in abstract interpretation [4], only arrays have been carefully considered [5][6][7][8][9][10][11], leaving other containers rarely explored [12][13][14]. Given that there is a plethora of abstract domains for reasoning about scalars [15,16], it is necessary to build abstract domains that not only reason about containers, but also interact efficiently and precisely with existing domains for scalars.…”

QUIC Graphs: Relational Invariant Generation for Containers

“…On the flip side, the pure container-as-a-whole approach would track relations directly between X and Y without characterizing their contents. Some existing containersas-a-whole approaches incorporate some fixed content reasoning (e.g., [23]). In this paper, we present a tight integration of these two approaches with domains for reasoning about scalar variables and their relations to the set elements.…”