SLING: using dynamic analysis to infer program invariants in separation logic

Abstract

We introduce a new dynamic analysis technique to discover invariants in separation logic for heap-manipulating programs. First, we use a debugger to obtain rich program execution traces at locations of interest on sample inputs. These traces consist of heap and stack information of variables that point to dynamically allocated data structures. Next, we iteratively analyze separate memory regions related to each pointer variable and search for a formula over predefined heap predicates in separation logic to model these regions. Finally, we combine the computed formulae into an invariant that describes the shape of explored memory regions.We present SLING, a tool that implements these ideas to automatically generate invariants in separation logic at arbitrary locations in C programs, e.g., program pre and postconditions and loop invariants. Preliminary results on existing benchmarks show that SLING can efficiently generate correct and useful invariants for programs that manipulate a wide variety of complex data structures.

Compositional Verification of Heap-Manipulating Programs Through Property-Guided Learning

“…The experimental results show that our tool enhances the capability of existing program verifiers to verify nontrivial heap-based programs. In the future, we might apply our tool to more verifiers and more test subjects as well as compare our tool with other tools, e.g., Predator [13], Forester [21,22], S2 [26], and SLING [30].…”

“…The closest to our work is approach for invariant inference using dynamic analysis with separation logic abstraction [30]. Similar to our work, it generates invariant based on user-defined predicates (i.e., features in our work).…”

Automated Repair of Heap-Manipulating Programs Using Deductive Synthesis

“…Furthermore, we aim to ease the requirement of providing program specifications from users. To do that, we could either leverage static analyzers that do not require program specifications, e.g., Infer [2,3], or incorporate specification inference techniques, such as [24,27], to automatically infer program specifications. Finally, as discussed in Sect.…”

Synthesizing contracts correct modulo a test generator

“…In this work, our approach uses a testing oracle instead of a verifier for practical reasons (see also discussion regarding verification oracles in Section 3). There have been various approaches to mining specifications based on automata learning [Alur et al 2005;Ammons et al 2002;Henzinger et al 2005;Whaley et al 2002;Xie et al 2006] or dynamic and symbolic analysis [Astorga et al 2018;Csallner et al 2008;DeFreez et al 2019;Le et al 2019]. The predicate synthesis aspect of our work is similar to the PIE approach [Padhi et al 2016] that proposes feature expression synthesis in order to learn preconditions as well as loop invariants, but not strong/tight contracts.…”