Fluid Updates: Beyond Strong vs. Weak Updates

Abstract

Abstract. We describe a symbolic heap abstraction that unifies reasoning about arrays, pointers, and scalars, and we define a fluid update operation on this symbolic heap that relaxes the dichotomy between strong and weak updates. Our technique is fully automatic, does not suffer from the kind of state-space explosion problem partition-based approaches are prone to, and can naturally express properties that hold for non-contiguous array elements. We demonstrate the effectiveness of this technique by evaluating it on challenging array benchmarks and by automatically verifying buffer accesses and dereferences in five Unix Coreutils applications with no annotations or false alarms.

From Invariant Checking to Invariant Inference Using Randomized Search

“…We evaluate the randomized search algorithms on the benchmarks of [15] in Table 3. The VCs for these benchmarks were obtained from the repository of the competition on software verification.…”

“…1 We have omitted benchmarks with bugs from the original benchmark set; these bugs are triggered during data generation. The second column shows the time taken to analyze these benchmarks using the fluid updates abstraction in [15]. Using a specialized abstract domain leads to a very efficient analysis, but the scope of the analysis is limited to array manipulating programs that have invariants given by Eqn.…”

“…We now define a search space of invariants to simulate the fluid updates abstraction for reasoning about arrays [15]. If x 1 , .…”

Desynchronized Multi-State Abstractions for Open Programs in Dynamic Languages

“…Instead, they use uninterpreted functions to map a elements of a key/attribute type to a natural number that is the array index containing the value. The value arrays are then represented and manipulated using fluid updates [9]. Uninterpreted functions: There are several analyses [3,13] that use uninterpreted functions to combine multiple abstract domains.…”

Small Formulas for Large Programs: On-Line Constraint Simplification in Scalable Static Analysis

“…Hence, Mistral's interface is designed to be useful for program analysis systems that incrementally construct formulas from existing formulas and make many intermediary satisfiability or validity queries. Examples of such systems include, but are not limited to, [10,16,[7][8][9]17]. …”