Propositional Reasoning about Safety and Termination of Heap-Manipulating Programs

Abstract

Abstract. This paper shows that it is possible to reason about the safety and termination of programs handling potentially cyclic, singlylinked lists using propositional reasoning even when the safety invariants and termination arguments depend on constraints over the lengths of lists. For this purpose, we propose the theory SLH of singly-linked lists with length, which is able to capture non-trivial interactions between shape and arithmetic. When using the theory of bit-vector arithmetic as a background, SLH is efficiently decidable via a reduction to SAT. We show the utility of SLH for software verification by using it to express safety invariants and termination arguments for programs manipulating potentially cyclic, singly-linked lists with unrestricted, unspecified sharing. We also provide an implementation of the decision procedure and use it to check safety and termination proofs for several heap-manipulating programs.

The Effects of Adding Reachability Predicates in Propositional Separation Logic

“…We now show that the sets of test formulae Test(q, α) are sufficient to capture the expressive power of SL( * , reach + ) (as shown below, Theorem 4.10) and deduce the small heap property of this logic (Theorem 4.11). We introduce an indistinguishability relation ≈ q α between memory states based on test formulae, see analogous relations in [14,16,25]. , then the two memory states cannot be distinguished by formulae whose syntactic resources are bounded in some way by q and α (details will follow, see the definition for msize(φ)).…”

“…This means that there is a memory state It is now possible to establish a small heap property of SL( * , reach + ) by inheriting it from the small heap property for Boolean combinations of test formulae, which is analogous to the small model property for other theories of singly linked lists, see e.g. [14,31]. Indeed, following Lemma 4.7, now it is straightforward to derive an upper bound on the size of a small model satisfying a formula in SL( * , reach + ).…”

“…14. SL( * , − * ) augmented with built-in formulae of the form n(x) = n(y), n(x) → n(y) and alloc −1 (x) admits an undecidable satisfiability problem.…”

“…14 can be refined a bit further by noting in which context the reachability predicates ls and reach are used in the formulae. This allows us to get the result below.…”

The Effects of Adding Reachability Predicates in Quantifier-Free Separation Logic

“…Besides, allowing quantifications is another direction to extend the symbolic heap fragment: in [4], an extension of the symbolic heap fragment with quantification over locations and over arithmetic variables for list lengths is introduced and several fragments are shown decidable (the whole extension is undecidable). Such an extension combines shape and arithmetic specifications (see also [14] for a theory of singly-linked lists with length combining such features) and the decidability results are obtained by using so-called symbolic shape graphs that are finite representations of sets of heaps. In the current paper, we consider only shape analysis (since herein, the heaps are restricted to a single record field) but the separating implication is admitted.…”