2 research outputs found
Shape Neutral Analysis of Graph-based Data-structures
Malformed data-structures can lead to runtime errors such as arbitrary memory
access or corruption. Despite this, reasoning over data-structure properties
for low-level heap manipulating programs remains challenging. In this paper we
present a constraint-based program analysis that checks data-structure
integrity, w.r.t. given target data-structure properties, as the heap is
manipulated by the program. Our approach is to automatically generate a solver
for properties using the type definitions from the target program. The
generated solver is implemented using a Constraint Handling Rules (CHR)
extension of built-in heap, integer and equality solvers. A key property of our
program analysis is that the target data-structure properties are shape
neutral, i.e., the analysis does not check for properties relating to a given
data-structure graph shape, such as doubly-linked-lists versus trees.
Nevertheless, the analysis can detect errors in a wide range of data-structure
manipulating programs, including those that use lists, trees, DAGs, graphs,
etc. We present an implementation that uses the Satisfiability Modulo
Constraint Handling Rules (SMCHR) system. Experimental results show that our
approach works well for real-world C programs.Comment: Paper presented at the 34nd International Conference on Logic
Programming (ICLP 2018), Oxford, UK, July 14 to July 17, 201
Proceedings of the Twenty-Third International Joint Conference on Artificial Intelligence Satisfiability Modulo Constraint Handling Rules (Extended Abstract) β
Satisfiability Modulo Constraint Handling Rules (SMCHR) is the integration of the Constraint Handling Rules (CHRs) solver programming language into a Satisfiability Modulo Theories (SMT) solver framework. Constraint solvers are implemented in CHR as a set of high-level rules that specify the simplification (rewriting) and constraint propagation behavior. The traditional CHR execution algorithm manipulates a global store representing a flat conjunction of constraints. This paper introduces SMCHR: a tight integration of CHR with a modern Boolean Satisfiability (SAT) solver. Unlike CHR, SMCHR can handle (quantifier-free) formulae with an arbitrary propositional structure. SM-CHR is essentially a Satisfiability Modulo Theories (SMT) solver where the theory T is implemented in CHR.