Shape Analysis for Composite Data Structures

Abstract

We propose a shape analysis that adapts to some of the complex composite data structures found in industrial systems-level programs. Examples of such data structures include "cyclic doubly-linked lists of acyclic singly-linked lists", "singly-linked lists of cyclic doublylinked lists with back-pointers to head nodes", etc. The analysis introduces the use of generic higher-order inductive predicates describing spatial relationships together with a method of synthesizing new parameterized spatial predicates which can be used in combination with the higher-order predicates. In order to evaluate the proposed approach for realistic programs we have performed experiments on examples drawn from device drivers: the analysis proved safety of the data structure manipulation of several routines belonging to an IEEE 1394 (firewire) driver, and also found several previously unknown memory safety bugs.

Automatically refining partial specifications for heap-manipulating programs

“…It first finds the "centre" node in the list (root), where the difference between numbers of nodes to the left and to the right of the centre node is at most one (lines 5-10), as Fig 3 (a) shows. It then applies the algorithm recursively on both list segments to the left and to the right of the centre node, and regards the centre node as the tree's root, whose left and right children are the resulting subtrees' roots from the recursive calls (lines [11][12][13][14][15][16][17], as in Fig 3 (b) and (c). As the data structures of doubly-linked list and binary tree are homomorphic (line 0), the algorithm reuses the nodes in the input instead of creating a new tree, making itself in-place.…”

“…Gotsman et al [16] proposed an interprocedural shape analysis for the SLAyer tool. Berdine et al [17] extended the local shape analysis [4] to handle higher-order list predicate so that more complicated real-world data structures can be analysed. Yang et al [5] proposed a novel abstraction operation which significantly improves the scalability of the analysis.…”

Statically Inferring Complex Heap, Array, and Numeric Invariants

“…The system is publicly available online [18]. (3) Along with the work of Berdine et al [2], our work addresses the most complex data-structure invariants considered in the shape-analysis literature. The problems addressed in the two papers are complementary: Berdine et al handle complex structural invariants for nests of linked structures (such as "cyclic doubly linked lists of acyclic singly linked lists"), whereas our work handles complex mixed-domain invariants for data structures with both linkage and numeric constraints, such as the structure depicted in Fig.…”

Tractable Reasoning in a Fragment of Separation Logic

“…The tool demonstrated that SL could be used to automatically verify memory safety of linked list and tree manipulating programs. Based on the success of Smallfoot, this approach has been extended to allow automatic inference of specifications of systems code [1,4], to reason about object-oriented programs [7,12], and even to reason about non-blocking concurrent programs [3]. But fundamentally all these tools are based on the same style of syntactic proof theory.…”