Statically Inferring Complex Heap, Array, and Numeric Invariants

Abstract

Abstract. We describe Deskcheck, a parametric static analyzer that is able to establish properties of programs that manipulate dynamically allocated memory, arrays, and integers. Deskcheck can verify quantified invariants over mixed abstract domains, e.g., heap and numeric domains. These domains need only minor extensions to work with our domain combination framework.The technique used for managing the communication between domains is reminiscent of the Nelson-Oppen technique for combining decision procedures, in that the two domains share a common predicate language to exchange shared facts. However, whereas the Nelson-Oppen technique is limited to a common predicate language of shared equalities, the technique described in this paper uses a common predicate language in which shared facts can be quantified predicates expressed in first-order logic with transitive closure. We explain how we used Deskcheck to establish memory safety of the thttpd web server's cache data structure, which uses linked lists, a hash table, and reference counting in a single composite data structure. Our work addresses some of the most complex data-structure invariants considered in the shape-analysis literature.

FESA: Fold- and Expand-Based Shape Analysis

“…This would also raise the question of how relational numeric invariants between a summary and its ghost node can be inferred, for instance, to deduce that a list is sorted [12,8]. Future work will address these challenges.…”

“…Indeed, it can infer invariants that distinguish lists from trees from graphs. In contrast to other analyses [7,12], no extra effort is needed to make our analysis robust with respect to variations of these basic data structures (position of pointer fields, use of sentinel nodes instead of NULL values or the use of back pointers).…”

A Method for Symbolic Computation of Abstract Operations

“…As in Nelson-Oppen, communication between domains in their framework is solely via equalities. McCloskey et al [27] presented a framework for communication between abstract domains that goes beyond shared equalities: their technique uses a common predicate language in which shared facts can be quantified predicates expressed in first-order logic with transitive closure.…”

TVAL+ : TVLA and Value Analyses Together

“…McCloskey et al [21] introduced a general way of integrating various analyses represented in FOLTC, combining different theories in a generic way. Their work allows the flow of information between all analyses concerned.…”

“…For this reason, several recent approaches have combined heap and value abstractions. In this context, some heap analyses (e.g., TVLA) were extended with information about numerical values [21], or ad-hoc heap analyses were combined with some existing numerical domains [3].…”