7,145 research outputs found
Completeness for a First-order Abstract Separation Logic
Existing work on theorem proving for the assertion language of separation
logic (SL) either focuses on abstract semantics which are not readily available
in most applications of program verification, or on concrete models for which
completeness is not possible. An important element in concrete SL is the
points-to predicate which denotes a singleton heap. SL with the points-to
predicate has been shown to be non-recursively enumerable. In this paper, we
develop a first-order SL, called FOASL, with an abstracted version of the
points-to predicate. We prove that FOASL is sound and complete with respect to
an abstract semantics, of which the standard SL semantics is an instance. We
also show that some reasoning principles involving the points-to predicate can
be approximated as FOASL theories, thus allowing our logic to be used for
reasoning about concrete program verification problems. We give some example
theories that are sound with respect to different variants of separation logics
from the literature, including those that are incompatible with Reynolds's
semantics. In the experiment we demonstrate our FOASL based theorem prover
which is able to handle a large fragment of separation logic with heap
semantics as well as non-standard semantics.Comment: This is an extended version of the APLAS 2016 paper with the same
titl
Spatial Interpolants
We propose Splinter, a new technique for proving properties of
heap-manipulating programs that marries (1) a new separation logic-based
analysis for heap reasoning with (2) an interpolation-based technique for
refining heap-shape invariants with data invariants. Splinter is property
directed, precise, and produces counterexample traces when a property does not
hold. Using the novel notion of spatial interpolants modulo theories, Splinter
can infer complex invariants over general recursive predicates, e.g., of the
form all elements in a linked list are even or a binary tree is sorted.
Furthermore, we treat interpolation as a black box, which gives us the freedom
to encode data manipulation in any suitable theory for a given program (e.g.,
bit vectors, arrays, or linear arithmetic), so that our technique immediately
benefits from any future advances in SMT solving and interpolation.Comment: Short version published in ESOP 201
Matching Logic
This paper presents matching logic, a first-order logic (FOL) variant for
specifying and reasoning about structure by means of patterns and pattern
matching. Its sentences, the patterns, are constructed using variables,
symbols, connectives and quantifiers, but no difference is made between
function and predicate symbols. In models, a pattern evaluates into a power-set
domain (the set of values that match it), in contrast to FOL where functions
and predicates map into a regular domain. Matching logic uniformly generalizes
several logical frameworks important for program analysis, such as:
propositional logic, algebraic specification, FOL with equality, modal logic,
and separation logic. Patterns can specify separation requirements at any level
in any program configuration, not only in the heaps or stores, without any
special logical constructs for that: the very nature of pattern matching is
that if two structures are matched as part of a pattern, then they can only be
spatially separated. Like FOL, matching logic can also be translated into pure
predicate logic with equality, at the same time admitting its own sound and
complete proof system. A practical aspect of matching logic is that FOL
reasoning with equality remains sound, so off-the-shelf provers and SMT solvers
can be used for matching logic reasoning. Matching logic is particularly
well-suited for reasoning about programs in programming languages that have an
operational semantics, but it is not limited to this
Synthesizing Short-Circuiting Validation of Data Structure Invariants
This paper presents incremental verification-validation, a novel approach for
checking rich data structure invariants expressed as separation logic
assertions. Incremental verification-validation combines static verification of
separation properties with efficient, short-circuiting dynamic validation of
arbitrarily rich data constraints. A data structure invariant checker is an
inductive predicate in separation logic with an executable interpretation; a
short-circuiting checker is an invariant checker that stops checking whenever
it detects at run time that an assertion for some sub-structure has been fully
proven statically. At a high level, our approach does two things: it statically
proves the separation properties of data structure invariants using a static
shape analysis in a standard way but then leverages this proof in a novel
manner to synthesize short-circuiting dynamic validation of the data
properties. As a consequence, we enable dynamic validation to make up for
imprecision in sound static analysis while simultaneously leveraging the static
verification to make the remaining dynamic validation efficient. We show
empirically that short-circuiting can yield asymptotic improvements in dynamic
validation, with low overhead over no validation, even in cases where static
verification is incomplete
- …