18,204 research outputs found
Heap Abstractions for Static Analysis
Heap data is potentially unbounded and seemingly arbitrary. As a consequence,
unlike stack and static memory, heap memory cannot be abstracted directly in
terms of a fixed set of source variable names appearing in the program being
analysed. This makes it an interesting topic of study and there is an abundance
of literature employing heap abstractions. Although most studies have addressed
similar concerns, their formulations and formalisms often seem dissimilar and
some times even unrelated. Thus, the insights gained in one description of heap
abstraction may not directly carry over to some other description. This survey
is a result of our quest for a unifying theme in the existing descriptions of
heap abstractions. In particular, our interest lies in the abstractions and not
in the algorithms that construct them.
In our search of a unified theme, we view a heap abstraction as consisting of
two features: a heap model to represent the heap memory and a summarization
technique for bounding the heap representation. We classify the models as
storeless, store based, and hybrid. We describe various summarization
techniques based on k-limiting, allocation sites, patterns, variables, other
generic instrumentation predicates, and higher-order logics. This approach
allows us to compare the insights of a large number of seemingly dissimilar
heap abstractions and also paves way for creating new abstractions by
mix-and-match of models and summarization techniques.Comment: 49 pages, 20 figure
Quadratic Word Equations with Length Constraints, Counter Systems, and Presburger Arithmetic with Divisibility
Word equations are a crucial element in the theoretical foundation of
constraint solving over strings, which have received a lot of attention in
recent years. A word equation relates two words over string variables and
constants. Its solution amounts to a function mapping variables to constant
strings that equate the left and right hand sides of the equation. While the
problem of solving word equations is decidable, the decidability of the problem
of solving a word equation with a length constraint (i.e., a constraint
relating the lengths of words in the word equation) has remained a
long-standing open problem. In this paper, we focus on the subclass of
quadratic word equations, i.e., in which each variable occurs at most twice. We
first show that the length abstractions of solutions to quadratic word
equations are in general not Presburger-definable. We then describe a class of
counter systems with Presburger transition relations which capture the length
abstraction of a quadratic word equation with regular constraints. We provide
an encoding of the effect of a simple loop of the counter systems in the theory
of existential Presburger Arithmetic with divisibility (PAD). Since PAD is
decidable, we get a decision procedure for quadratic words equations with
length constraints for which the associated counter system is \emph{flat}
(i.e., all nodes belong to at most one cycle). We show a decidability result
(in fact, also an NP algorithm with a PAD oracle) for a recently proposed
NP-complete fragment of word equations called regular-oriented word equations,
together with length constraints. Decidability holds when the constraints are
additionally extended with regular constraints with a 1-weak control structure.Comment: 18 page
Using Graph Transformations and Graph Abstractions for Software Verification
In this paper we describe our intended approach for the verification of software written in imperative programming languages. We base our approach on model checking of graph transition systems, where each state is a graph and the transitions are specified by graph transformation rules. We believe that graph transformation is a very suitable technique to model the execution semantics of languages with dynamic memory allocation. Furthermore, such representation allows us to investigate the use of graph abstractions, which can mitigate the combinatorial explosion inherent to model checking. In addition to presenting our planned approach, we reason about its feasibility, and, by providing a brief comparison to other existing methods, we highlight the benefits and drawbacks that are expected
- …