Fully Automated Shape Analysis Based on Forest Automata

Abstract

Forest automata (FA) have recently been proposed as a tool for shape analysis of complex heap structures. FA encode sets of tree decompositions of heap graphs in the form of tuples of tree automata. In order to allow for representing complex heap graphs, the notion of FA allowed one to provide user-defined FA (called boxes) that encode repetitive graph patterns of shape graphs to be used as alphabet symbols of other, higher-level FA. In this paper, we propose a novel technique of automatically learning the FA to be used as boxes that avoids the need of providing them manually. Further, we propose a significant improvement of the automata abstraction used in the analysis. The result is an efficient, fullyautomated analysis that can handle even as complex data structures as skip lists, with the performance comparable to state-of-the-art fully-automated tools based on separation logic, which, however, specialise in dealing with linked lists only.

Shape Analysis via Second-Order Bi-Abduction

“…With respect to fully automatic analyses, there are [5], [16] and the Forester system [18]. Although very expressive in terms of the inferred shape classes, the analysis proposed by Guo et al [16] relies on a heavy formalism and depends wholly on the shape construction patterns being present in the code.…”

“…However, their proposal is currently limited to a simple imperative language without methods. A completely different approach is presented in the Forrester system [18] where a fully automated shape synthesis is described in terms of graph transformations over forest automata. Their approach is based on learning techniques that can discover suitable forest automata by incrementally constructing shape abstractions called boxes.…”

Verification of heap manipulating programs with ordered data by extended forest automata

“…In the case of skip lists, our analysis is the first fully-automated shape analysis which is able to handle skip lists. Our previous fully-automated shape analysis, which did not handle ordering relations, could also handle skip lists automatically [17], but only after modifying the code in such a way that the preservation of the shape invariant does not depend on ordering relations. This paper is an extension of the work originally published in [3].…”

“…Sets of heap graphs can then be represented by tuples of tree automata (TA). A fully-automated shape analysis framework based on FAs, employing the framework of abstract regular tree model checking (ARTMC) [8], has been implemented in the Forester tool [17]. This approach has been shown to handle a wide variety of different dynamically allocated data structures with a performance that compares favourably to other state-of-the-art fully-automated tools.…”

Reducing Nondeterministic Tree Automata by Adding Transitions

“…They have many applications in model checking [3,7], term rewriting [11] and related areas of formal software verification, e.g., shape analysis [13]. Several software packages for manipulating tree automata have been developed, e.g., Timbuk [4], Autowrite [11] and libvata [16] (on which other verification tools, like Forester [17], are based).…”