Full functional verification of linked data structures

Abstract

We present the first verification of full functional correctness for a range of linked data structure implementations, including mutable lists, trees, graphs, and hash tables. Specifically, we present the use of the Jahob verification system to verify formal specifications, written in classical higher-order logic, that completely capture the desired behavior of the Java data structure implementations (with the exception of properties involving execution time and/or memory consumption). Given that the desired correctness properties include intractable constructs such as quantifiers, transitive closure, and lambda abstraction, it is a challenge to successfully prove the generated verification conditions.Our Jahob verification system uses integrated reasoning to split each verification condition into a conjunction of simpler subformulas, then apply a diverse collection of specialized decision procedures, first-order theorem provers, and, in the worst case, interactive theorem provers to prove each subformula. Techniques such as replacing complex subformulas with stronger but simpler alternatives, exploiting structure inherently present in the verification conditions, and, when necessary, inserting verified lemmas and proof hints into the imperative source code make it possible to seamlessly integrate all of the specialized decision procedures and theorem provers into a single powerful integrated reasoning system. By appropriately applying multiple proof techniques to discharge different subformulas, this reasoning system can effectively prove the complex and challenging verification conditions that arise in this context.

Specifying linked data structures in JML for combining formal verification and testing

“…The previously defined query contains comes in handy to reduce the size of the specification. During a verification attempt, when applying the method contract rule, 8 the contains query (likewise isSorted) is replaced by its contract. This contract is defined using reach as the only query.…”

“…Specification using HOL or separation logic Zee et al [8] verify full functional correctness of linked data structure implementations, including mutable lists, trees, graphs, and hash tables. The correctness properties include intractable constructs such as quantifiers and transitive closure.…”

Verification of heap manipulating programs with ordered data by extended forest automata

“…Another work that targets verification of programs with dynamic linked data structures, including properties depending on the data stored in them, is [30]. It generates verification conditions in an undecidable fragment of higher-order logic and discharges them using decision procedures, first-order theorem proving, and interactive theorem proving.…”

Scalable data structure detection and classification for C/C++ binaries

“…Shape analysis (Ghiya and Hendren 1996;Sagiv et al 1999;Kuncak et al 2006;Bogudlov et al 2007;Zee et al 2008) is a static analysis technique that discovers and verifies properties of linked, dynamically allocated data structures. It is typically used at compile time to find software bugs or to verify high-level correctness properties of programs.…”