Proofs as Relational Invariants of Synthesized Execution Grammars

Abstract

The automatic verification of programs that maintain unbounded low-level data structures is a critical and open problem. Analyzers and verifiers developed in previous work can synthesize invariants that only describe data structures of heavily restricted forms, or require an analyst to provide predicates over program data and structure that are used in a synthesized proof of correctness.In this work, we introduce a novel automatic safety verifier of programs that maintain low-level data structures, named Lttp. Lttp synthesizes proofs of program safety represented as a grammar of a given program's control paths, annotated with invariants that relate program state at distinct points within its path of execution. Lttp synthesizes such proofs completely automatically, using a novel inductive-synthesis algorithm.We have implemented Lttp as a verifier for JVM bytecode and applied it to verify the safety of a collection of verification benchmarks. Our results demonstrate that Lttp can be applied to automatically verify the safety of programs that are beyond the scope of previously-developed verifiers. INTRODUCTIONAutomatically verifying that a given program satisfies a desired safety property is a fundamental problems of program verification. Recent work has seen the development of powerful program verifiers that operate automatically [9,[22][23][24][25]38]. Such verifiers can often determine if practical programs satisfy properties concerning their control flow and facts over a bounded collection of data values [5].However, verifying the safety of programs that maintain unbounded low-level data structures remains an open problem. A significant body of previous work has developed shape analyzers [17,26] that, given a program P, synthesize invariants of the reachable heaps of P represented in a particular shape domain, such as three-valued logical structures [35,41,45] or separation-logic formulas [12,15,42,53]; the invariants synthesized by such analyzers can potentially imply facts about program states that establish that P is safe. Another body of work has developed automatic program