ABSTRACT
Separation logic with recursively defined predicates allows for concise yet precise description of the shapes of data structures. However, most uses of separation logic for program analysis rely on pre-defined recursive predicates, limiting the class of programs analyzable to those that manipulate only a priori data structures. This paper describes a general algorithm based on inductive program synthesis that automatically infers recursive shape invariants, yielding a shape analysis based on separation logic that can be applied to any program.
A key strength of separation logic is that it facilitates, via explicit expression of structural separation, local reasoning about heap where the effects of altering one part of a data structure are analyzed in isolation from the rest. The interaction between local reasoning and the global invariants given by recursive predicates is a difficult area, especially in the presence of complex internal sharing in the data structures. Existing approaches, using logic rules specifically designed for the list predicate to unfold and fold linked-lists, again require a priori knowledge about the shapes of the data structures and do not easily generalize to more complex data structures. We introduce a notion of "truncation points" in a recursive predicate, which gives rise to generic algorithms for unfolding and folding arbitrary data structures.
- D. R. Chase, M. Wegman, and F. K. Zadeck, "Analysis of pointers and structures," in Proceedings of the ACM SIGPLAN '90 Conference on Programming Language Design and Implementation, pp. 296--310, June 1990. Google Scholar
Digital Library
- N. D. Jones and S. S. Muchnick, "Flow analysis and optimization of Lisp-like structures," in Program Flow Analysis: Theory and Applications (S. S. Muchnick and N. D. Jones, eds.), pp. 102--131, Englewood Cliffs, NJ: Prentice-Hall, 1981.Google Scholar
- J. Reynolds, "Separation logic: A logic for shared mutable data structures," in Proceedings of the 7th Annual IEEE Symposium on Logic in Computer Science, July 2002. Google Scholar
Digital Library
- D. Distefano, P. W. O'Hearn, and H. Yang, "A local shape analysis based on separation logic," in Lecture Notes in Computer Science, vol. 3920, pp. 287--302, Springer-Verlag, 2006. Google Scholar
Digital Library
- S. Magill, A. Nanevski, E. Clarke, and P. Lee, "Inferring invariants in separation logic for imperative list-processing programs," in Workshop on Semantics, Program Analysis, and Computing Environments for Memory Management (SPACE), January 2006.Google Scholar
- O. Lee, H. Yang, and K. Yi, "Automatic verification of pointer programs using grammar-based shape analysis," in Prceedings of the 2005 European Symposium on Programming (ESOP), 2005.Google Scholar
- P. Summers, "A methodology for Lisp program construction from examples," Journal ACM, vol. 24(1), pp. 162--175, 1977. Google Scholar
Digital Library
- U. Schmid, Inductive synthesis of functional programs. Berlin, Germany: Springer-Verlag, 2003. Google Scholar
Digital Library
- A. Møller and Schwartzbach, "The pointer assertion logic engine," in Proceedings of the ACM SIGPLAN 2001 Conference on Programming Language Design and Implementation, pp. 221--231, 2001. Google Scholar
Digital Library
- A. Gotsman, J. Berdine, and B. Cook, "Interprocedural shape analysis with separated heap abstractions," in Proceedings of the 13th International Static Analysis Symposium (SAS), August 2006. Google Scholar
Digital Library
- N. Rinetzky, J., Bauer, T. Reps, M. Sagiv, and R. Wilhelm, "A semantics for procedure local heaps and its abstractions," in Proceedings of the 32nd ACM Symposium on Principles of Programming Languages, pp. 296--309, January 2005. Google Scholar
Digital Library
- B. Guo, M. J. Bridges, S. Triantafyllis, G. Ottoni, E. Raman, and D. I. August, "Practical and accurate low-level pointer analysis," in Proceedings of the 3rd International Symposium on Code Generation and Optimization, March 2005. Google Scholar
Digital Library
- J. Berdine, C. Calcagno, and P. W. O'Hearn, "Symbolic execution with separation logic," in Lecture Notes in Computer Science, vol. 3780, pp. 52--68, Springer-Verlag, 2005. Google Scholar
Digital Library
- P. W. O'Hearn, H. Yang, and J. Reynolds, "Separation and information hiding," in Proceedings of the 31st ACM symposium on Principles of Programming Languages, pp. 268--280, January 2004. Google Scholar
Digital Library
- J. Berdine, C. Calcagno, and P. W. O'Hearn, "A decidable fragment of separation logic," in Lecture Notes in Computer Science, vol. 3328, pp. 97--109, Springer-Verlag, 2004. Google Scholar
Digital Library
- G. Tan and A. W. Appel, "A compositional logic for control flow," in Lecture Notes in Computer Science, vol. 3855, pp. 80--94, Springer-Verlag, 2006. Google Scholar
Digital Library
- B. Steensgaard, "Points-to analysis by type inference in programs with structures and unions," in Lecture Notes in Computer Science, 1060, pp. 136--150, Springer-Verlag, 1996. Google Scholar
Digital Library
- N. Rinetzky, M. Sagiv, and E. Yahav, "Interprocedural shape analysis for cutpoint-free programs," Tech. Rep. 26, Tel Aviv University, November 2004.Google Scholar
- C. Calcagno, D. Distefano, P. W. O'Hearn, and H. Yang, "Beyong reachability: Shape abstraction in the presence of pointer arithmeetic," in Lecture Notes in Computer Science, vol. 4134, pp. 182--203, Springer-Verlag, 2006. Google Scholar
Digital Library
- A. Loginov, T. Reps, and M. Sagiv, "Abstraction refinement via inductive learning," in Proceedings of the 17th International Conference on Computer Aided Verification, pp. 519--533, 2005. Google Scholar
Digital Library
Index Terms
Shape analysis with inductive recursion synthesis
Recommendations
Relational inductive shape analysis
POPL '08Shape analyses are concerned with precise abstractions of the heap to capture detailed structural properties. To do so, they need to build and decompose summaries of disjoint memory regions. Unfortunately, many data structure invariants require ...
Shape analysis with inductive recursion synthesis
Proceedings of the 2007 PLDI conferenceSeparation logic with recursively defined predicates allows for concise yet precise description of the shapes of data structures. However, most uses of separation logic for program analysis rely on pre-defined recursive predicates, limiting the class of ...







Comments