Using dynamic analysis to generate disjunctive invariants

Abstract

Program invariants are important for defect detection, program verification, and program repair. However, existing techniques have limited support for important classes of invariants such as disjunctions, which express the semantics of conditional statements. We propose a method for generating disjunctive invariants over numerical domains, which are inexpressible using classical convex polyhedra. Using dynamic analysis and reformulating the problem in nonstandard "max-plus" and "min-plus" algebras, our method constructs hulls over program trace points. Critically, we introduce and infer a weak class of such invariants that balances expressive power against the computational cost of generating nonconvex shapes in high dimensions.Existing dynamic inference techniques often generate spurious invariants that fit some program traces but do not generalize. With the insight that generating dynamic invariants is easy, we propose to verify these invariants statically using k-inductive SMT theorem proving which allows us to validate invariants that are not classically inductive.Results on difficult kernels involving nonlinear arithmetic and abstract arrays suggest that this hybrid approach efficiently generates and proves correct program invariants.

SLING: using dynamic analysis to infer program invariants in separation logic

“…We also do not consider general disjunctive invariants or numerical relations (e.g., only check equivalences among memory addresses and do not consider other relationships such as the address of x is greater than that of y). Existing numerical invariant studies [38,39] have shown that dynamic analysis often produces many spurious invariants involving disjunctions and general inequalities.…”

Minimal Assumptions Refinement for Realizable Specifications

“…Notice that our problem of finding minimal refinements is a relaxation of this NPhard problem, as we are not interested in minimizing the number of subsets; rather, our notion of minimality corresponds to that of non-redundancy in [4]. Redundancy and minimization in logical formulae have been studied extensively, in work such as [18,19,26,30]. The notion of redundancy we present here is substantially different.…”

Automatically learning shape specifications

“…Compared to earlier sampling-based approaches [49,60,65,66] which learn invariants using existing abstract interpretation transformers, our primary focus is a new specification inference technique inspired by recent advances in data-driven program analysis. These data-driven approaches can be classified into two broad categories: (1) Tools such as Daikon [12] and [18,21,42,53,70] infer invariants by summarizing properties from test data, but the structure of the constructed invariants is limited to a bounded number of disjunctions, making them unlikely to discover patterns between relations like in-order or forward-order, because it is not clear how syntax-derived templates could capture the semantics of ordering relations implicit in the construction of data structures; (2) Other tools learn unrestricted invariants but either require user-annotated post-conditions [15,16,36,51,54,69] (in order to rule out program states not seen in normal executions) or noncommutativity conditions [17] to drive the collection of "bad samples". The quality of synthesized invariants in these systems is limited by the precision and availability of such conditions.…”

“…Notably, existing data-driven learning techniques are ineffective in discovering such specifications. Template-based mining techniques [12,42,53] require us to provide the Boolean skeleton of these specifications a priori, which we often do not know. Classification-based learning techniques [15,16,51,54,69] search for specifications that rule out so-called bad program states that represent violations of programmer-supplied assertions, usually annotated as postconditions in source programs.…”