Structuring the synthesis of heap-manipulating programs

Abstract

This paper describes a deductive approach to synthesizing imperative programs with pointers from declarative specifications expressed in Separation Logic. Our synthesis algorithm takes as input a pair of assertions-a preand a postcondition-which describe two states of the symbolic heap, and derives a program that transforms one state into the other, guided by the shape of the heap. The program synthesis algorithm rests on the novel framework of Synthetic Separation Logic (SSL), which generalises the classical notion of heap entailment P ⊢ Q to incorporate a possibility of transforming a heap satisfying an assertion P into a heap satisfying an assertion Q. A synthesized program represents a proof term for a transforming entailment statement P Q, and the synthesis procedure corresponds to a proof search. The derived programs are, thus, correct by construction, in the sense that they satisfy the ascribed pre/postconditions, and are accompanied by complete proof derivations, which can be checked independently.We have implemented a proof search engine for SSL in a form the program synthesizer called S SL . For efficiency, the engine exploits properties of SSL rules, such as invertibility and commutativity of rule applications on separate heaps, to prune the space of derivations it has to consider. We explain and showcase the use of SSL on characteristic examples, describe the design of S SL , and report on our experience of using it to synthesize a series of benchmark programs manipulating heap-based linked data structures. Nadia Polikarpova and Ilya Sergeythe proof search is guided by a goal in ordinary logics. In this work, we make this connection explicit and employ it for efficiently synthesizing imperative programs from SL pre-and postconditions.Structuring the Synthesis of Heap-Manipulating Programs :3 (reads as "the assertion P transforms into Q via a program c"), which unifies SL entailment P ⊢ Q and verification {P} c {Q}, with the former expressible as P Q| skip.The central practical contribution is the design and implementation of S SL -a deductive synthesizer for heap-manipulating programs, based on SSL. S SL takes as its input a library of inductive predicates, a (typically empty) list of auxiliary function specifications, and an SL specification of the function to be synthesized. It returns a-possibly recursive, but loop-free-program (in a minimalistic C-like language), which provably satisfies the given specification.Our evaluation shows that S SL can synthesize all structurally-recursive benchmarks from previous work on heap-based synthesis (Qiu and Solar-Lezama 2017), without any sketches and in most cases much faster. To the best of our knowledge, it is also the first synthesizer to automatically discover the implementations of copying linked lists and trees, and flattening a tree to a list.The essence of S SL 's synthesis algorithm is a backtracking search in the space of SSL derivations. Even though the structural constraints (i.e., the shape of the heap) embodied in the synthesis rules already pru...

Proof-Carrying Plans: a Resource Logic for AI Planning

“…If we look closer at the domain description of Figure 2, we will notice that it uses an inequality constraint x that is not declared as a domain predicate. We will follow the resource logics tradition [5,40] and separate state descriptions from constraints on states. That is, we further refine domain descriptions to have the syntax ϕ; {Pre} {Post} | action, where ϕ defines constraints on states.…”

SecCSL: Security Concurrent Separation Logic

“…Separation logic has proved to be a remarkably powerful vehicle for reasoning about programs, weak memory concurrency [47], program synthesis [42], and many other domains. With SecCSL, we hope that in future the same possibilities might be opened to verified information flow security.…”

Concise Read-Only Specifications for Better Synthesis of Programs with Pointers

“…Following this idea, it has been recently observed [34] that the synthesis of correct-by-construction imperative heap-manipulating programs (in a language similar to C) can be implemented as a proof search in a version of Separation Logic (SL)-a program logic designed for modular verification of programs with pointers [32,37]. SL-based deductive program synthesis based on Synthetic Separation Logic (SSL) [34] requires the programmer to provide a Hoare-style specification for a program of interest. For instance, given the predicate ls(x, S), which denotes a symbolic heap corresponding to a linked list starting at a pointer x, ending with null, and containing elements from the set S, one can specify the behaviour of the procedure for copying a linked list as follows: The precondition of specification (1), defining the shape of the initial heap, is illustrated by the figure above.…”

“…Provided the definition of the heap predicate ls and the specification (1), the SuS-Lik tool, an implementation of the SSLbased synthesis [34], will produce the program depicted in Fig. 1.…”

“…Practical Contributions. Our first practical contribution is ROBoSuSLik-an enhancement of the SuSLik synthesis tool [34] with support for read-only borrows, which required us to modify less than 100 lines of the original code. Our second practical contribution is the extensive evaluation of synthesis with read-only permissions, on a standard benchmark suite of specifications for heapmanipulating programs.…”