Verifying event-driven programs using ramified frame properties

Abstract

Interactive programs, such as GUIs or spreadsheets, often maintain dependency information over dynamically-created networks of objects. That is, each imperative object tracks not only the objects its own invariant depends on, but also all of the objects which depend upon it, in order to notify them when it changes.These bidirectional linkages pose a serious challenge to verification, because their correctness relies upon a global invariant over the object graph.We show how to modularly verify programs written using dynamically-generated bidirectional dependency information. The critical idea is to distinguish between the footprint of a command, and the state whose invariants depends upon the footprint. To do so, we define an application-specific semantics of updates, and introduce the concept of a ramification operator to explain how local changes can alter our knowledge of the rest of the heap. We illustrate the applicability of this style of proof with a case study from functional reactive programming, and formally justify reasoning about an extremely imperative implementation as if it were pure.

The ramifications of sharing in data structures

“…More recently, Mehnert et al and Krishnaswami et al have used some form of ramification to verify respectively implementations of snapshottable trees [MSBS12] and programs that follow the subjectobserver pattern [KBA10], both of which involved unspecified sharing. Their ramifications are restricted to ad-hoc "ramification operators" tailored for each example, and the logic itself is domainspecific and done modulo a predicate on the global heap.…”

Superficially substructural types

“…Early models of logically (but not physically) separable resources like fractional permissions [7,10] and trees [9] treat those resources as primitive, either baking them into the operational semantics or, in simple cases, relying on a fixed interpretation into an underlying heap. To handle higher-level notions of separation, Krishnaswami et al [23] embedded "domain-specific separation logics" into higher-order separation logic, and DinsdaleYoung, Gardner, and Wheelhouse named the general phenomenon "fictional disjointness" and justified its support of local reasoning by employing data refinement and axiomatic semantics [14].…”

Modular reasoning for deterministic parallelism

“…CSL has been extended to deal with dynamically-allocated locks [11,14,15] and re-entrant locks [12]. Others have extended separation logic or similar logics with primitive channels [13,1,24,18], and event driven programs [17].…”