Predicate Abstraction for Linked Data Structures

Bakst, Alexander; Jhala, Ranjit

doi:10.1007/978-3-662-49122-5_3

Cited by 8 publications

(12 citation statements)

References 50 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Type Systems for Verification. Liquid Types [Rondon et al 2008] equip types with logical qualifiers prescribing value properties; their extension to Alias Refinement Types [Bakst and Jhala 2016] applies to mutable heap data structures. Type checking is decidable, and loop invariants can be inferred.…”

Section: Related Workmentioning

confidence: 99%

Leveraging rust types for modular specification and verification

Astrauskas

Müller

Poli

et al. 2019

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

Rust's type system ensures memory safety: well-typed Rust programs are guaranteed to not exhibit problems such as dangling pointers, data races, and unexpected side effects through aliased references. Ensuring correctness properties beyond memory safety, for instance, the guaranteed absence of assertion failures or more-general functional correctness, requires static program verification. For traditional system programming languages, formal verification is notoriously difficult and requires complex specifications and logics to reason about pointers, aliasing, and side effects on mutable state. This complexity is a major obstacle to the morewidespread verification of system software. In this paper, we present a novel verification technique that leverages Rust's type system to greatly simplify the specification and verification of system software written in Rust. We analyse information from the Rust compiler and synthesise a corresponding core proof for the program in a flavour of separation logic tailored to automation. To verify correctness properties beyond memory safety, users can annotate Rust programs with specifications at the abstraction level of Rust expressions; our technique weaves them into the core proof to verify modularly whether these specifications hold. Crucially, our proofs are constructed and checked automatically without exposing the underlying formal logic, allowing users to work exclusively at the level of abstraction of the programming language. As such, our work enables a new kind of verification tool, with the potential to impact a wide audience and allow the Rust community to benefit from state-of-the-art verification techniques. We have implemented our techniques for a subset of Rust; our evaluation on several thousand functions from widely-used Rust crates demonstrates its effectiveness.

show abstract

Section: Related Workmentioning

confidence: 99%

Leveraging rust types for modular specification and verification

Astrauskas

Müller

Poli

et al. 2019

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

show abstract

“…Separation logic [10] is an extension of Hoare-Floyd logic that allows reasoning about pointers. In general, it is difficult to integrate into automated deductive verification: in particular, it is not directly supported by SMT provers, although some recent attempts try to have it mended [11,12].…”

Section: Related Workmentioning

confidence: 99%

Verification of Programs with Pointers in SPARK

Jaloyan

Dross

Maalej

et al. 2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

“…• Properties expressing that some pairs of elements in a segment of an array satisfy a binary relation. 2 -for example,…”

Section: Array Refinementsmentioning

confidence: 99%

“…The last property holds after partition in quicksort, with p being the resulting pivot position. 2 Ternary or bigger relations are less frequent, and they make the inference process too expensive.…”

Section: Array Refinementsmentioning

confidence: 99%

“…For instance, a programmer can specify a subset of binary trees in which the left (respectively, right) child of a node contains a value lower (respectively, greater) than the value in that node, thus obtaining a specification of binary search trees. Although this work is carried out in the context of functional languages, liquid types have also been successfully applied to imperative languages, such as TypeScript [38], JavaScript [6], and C-like languages [2,28].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Extending Liquid Types to Arrays

Montenegro

Nieva

Peña

et al. 2020

ACM Trans. Comput. Logic

View full text Add to dashboard Cite

A liquid type is an ordinary Hindley-Milner type annotated with a logical predicate that states the properties satisfied by the elements of that type. Liquid types are a powerful tool for program verification, as programmers can use them to specify pre-and post conditions of their programs, whereas the predicates of intermediate variables and auxiliary functions are inferred automatically. Type inference is feasible in this context, as the logical predicates within liquid types are constrained to a quantifier-free logic to maintain decidability. In this article, we extend liquid types by allowing them to contain quantified properties on arrays so that they can be used to infer invariants on array-related programs (e.g., implementations of sorting algorithms). Although quantified logic is, in general, undecidable, we restrict properties on arrays to a decidable subset introduced by Bradley et al. We describe in detail the extended type system, the verification condition generator, and the iterative weakening algorithm for inferring invariants. After proving the correctness and completeness of these two algorithms, we apply them to find invariants on a set of algorithms involving array manipulations.

show abstract

Predicate Abstraction for Linked Data Structures

Cited by 8 publications

References 50 publications

Leveraging rust types for modular specification and verification

Leveraging rust types for modular specification and verification

Verification of Programs with Pointers in SPARK

Extending Liquid Types to Arrays

Contact Info

Product

Resources

About