Static Analysis

Volume 6337 of the series Lecture Notes in Computer Science pp 71-99

Statically Inferring Complex Heap, Array, and Numeric Invariants

  • Bill McCloskeyAffiliated withLancaster UniversityUniversity of California
  • , Thomas RepsAffiliated withLancaster UniversityCarnegie Mellon UniversityUniversity of WisconsinGrammaTech, Inc.
  • , Mooly SagivAffiliated withCarnegie Mellon UniversityTel-Aviv UniversityStanford University

* Final gross prices may vary according to local VAT.

Get Access


We describe Deskcheck, a parametric static analyzer that is able to establish properties of programs that manipulate dynamically allocated memory, arrays, and integers. Deskcheck can verify quantified invariants over mixed abstract domains, e.g., heap and numeric domains. These domains need only minor extensions to work with our domain combination framework.

The technique used for managing the communication between domains is reminiscent of the Nelson-Oppen technique for combining decision procedures, in that the two domains share a common predicate language to exchange shared facts. However, whereas the Nelson-Oppen technique is limited to a common predicate language of shared equalities, the technique described in this paper uses a common predicate language in which shared facts can be quantified predicates expressed in first-order logic with transitive closure.

We explain how we used Deskcheck to establish memory safety of the thttpd web server’s cache data structure, which uses linked lists, a hash table, and reference counting in a single composite data structure. Our work addresses some of the most complex data-structure invariants considered in the shape-analysis literature.