On the Complexity of Pointer Arithmetic in Separation Logic

Abstract

We investigate the complexity consequences of adding pointer arithmetic to separation logic. Specifically, we study extensions of the points-to fragment of symbolic-heap separation logic with various forms of Presburger arithmetic constraints. Most significantly, we find that, even in the minimal case when we allow only conjunctions of simple "difference constraints" x ′ ≤ x ± k (where k is an integer), polynomial-time decidability is already impossible: satisfiability becomes NP-complete, while quantifier-free entailment becomes coNP-complete and quantified entailment becomes Π P 2 -complete (Π P 2 is the second class in the polynomial-time hierarchy) In fact we prove that the upper bound is the same, Π P 2 , even for the full pointer arithmetic but with a fixed pointer offset, where we allow any Boolean combinations of the elementary formulas (x ′ = x + k0), (x ′ ≤ x + k0), and (x ′ < x + k0), and, in addition to the points-to formulas, we allow spatial formulas of the arrays the length of which is ≤ k0 and lists which length is ≤ k0, etc, where k0 is a fixed integer. However, if we allow a significantly more expressive form of pointer arithmetic -namely arbitrary Boolean combinations of elementary formulas over arbitrary pointer sums -then the complexity increase is relatively modest for satisfiability and quantifier-free entailment: they are still NPcomplete and coNP-complete respectively, and the complexity appears to increase drastically for quantified entailments, which becomes Π EXP 1 complete.

Exploiting Pointer Analysis in Memory Models for Deductive Verification

“…Partitioning analysis: Based on the base-offset pointer analysis above, we define in Section 5.3 a new analysis that computes for each pointer expression an abstract location that collects a finite set of slices of symbolic blocks, i.e., the abstraction is a partial mapping from program's variables to sets of intervals representing offsets in the block. With this analysis, the abstract location computed for outArr+i (at line 39 of sort4, call in Figure 3 (b)) is more precise, i.e., {df → { [5,7], [0, 0]}}, and it allows to prove the post-condition for sort4. Notice that the analysis computes a finite set of slices in symbolic blocks whose concretizations (sets of locations) are pairwise disjoint.…”

“…. , df· [7]}. Given a cell-path c, we denote by r(c) the range of offsets (in bytes) that correspond to the path and which is computed using ABI.…”

“…For C programs with pointers, DV has been boosted by the usage of Separation Logic [29], which leads to compact proofs due to the local reasoning allowed by the separating conjunction operator. However, for programs with low-level operations on pointers (e.g., pointer arithmetics and casting), this approach is actually limited by the theoretical results on the fragment of separation logic employed [7] and on the availability of solvers. Therefore, this class of programs is most commonly dealt using classic approaches based on memory modelsà la Burstall-Bornat [9,6], which may be adapted to be sound in presence of low-level operations [31] and dynamic allocation [36].…”

Internal Calculi for Separation Logics

“…Since the birth of separation logics, there has been a lot of interest in the study of decidability and computational complexity issues, see e.g. [3,10,11,7,15,31], and comparatively a bit less attention to the design of proof systems, and even less with the puristic approach that consists in discarding any external feature such as nominals or labels in the calculi. The well-known advantages of such an approach include an exhaustive understanding of the expressive power of the logic and discarding the use of any external artifact referring to semantical objects.…”