Skip to main content
SpringerLink
Log in

A Product of Shape and Sequence Abstractions

  • Conference paper
  • First Online:
Static Analysis (SAS 2023)

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 14284))

Included in the following conference series:

Abstract

Traditional separation logic-based shape analyses utilize inductive summarizing predicates so as to capture general properties of the layout of data-structures, to verify accurate manipulations of, e.g., various forms of lists or trees. However, they also usually abstract away contents properties, so that they may only verify memory safety and invariance of data-structure shapes. In this paper, we introduce a novel abstract domain to describe sequences of values of unbounded size, and track constraints on their length and on extremal values contained in them. We define a reduced product of such a sequence abstraction together with an existing shape abstraction so as to infer both shape and contents properties of data-structures. We report on the implementation of the sequence domain, its integration into a static analyzer for C code, and we evaluate its ability to verify partial functional correctness properties for list and tree algorithms.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 69.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 89.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Artifact for “A Product of Shape and Sequence Abstractions”. Zenodo (2023). https://doi.org/10.5281/zenodo.8186871

  2. Amadini, R.: A survey on string constraint solving. ACM Comput. Surv. 55, 1–38 (2021)

    Article  Google Scholar 

  3. Arceri, V., Mastroeni, I.: An automata-based abstract semantics for string manipulation languages. In: VPT@Programming (2019)

    Google Scholar 

  4. Arceri, V., Olliaro, M., Cortesi, A., Ferrara, P.: Relational string abstract domains. In: Finkbeiner, B., Wies, T. (eds.) VMCAI 2022. LNCS, vol. 13182, pp. 20–42. Springer, Cham (2022). https://doi.org/10.1007/978-3-030-94583-1_2

    Chapter  Google Scholar 

  5. Assaf, M., Naumann, D.A., Signoles, J., Totel, E., Tronel, F.: Hypercollecting semantics and its application to static analysis of information flow. In: POPL (2017)

    Google Scholar 

  6. Berzish, M., Ganesh, V., Zheng, Y.: Z3str3: a string solver with theory-aware heuristics. In: FMCAD (2017)

    Google Scholar 

  7. Blanchet, B., et al.: A static analyzer for large safety-critical software. In: PLDI (2003)

    Google Scholar 

  8. Bouajjani, A., Drăgoi, C., Enea, C., Rezine, A., Sighireanu, M.: Invariant synthesis for programs manipulating lists with unbounded data. In: Touili, T., Cook, B., Jackson, P. (eds.) CAV 2010. LNCS, vol. 6174, pp. 72–88. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-14295-6_8

    Chapter  Google Scholar 

  9. Bouajjani, A., Drăgoi, C., Enea, C., Sighireanu, M.: Abstract domains for automated reasoning about list-manipulating programs with infinite data. In: Kuncak, V., Rybalchenko, A. (eds.) VMCAI 2012. LNCS, vol. 7148, pp. 1–22. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-27940-9_1

    Chapter  Google Scholar 

  10. Bouajjani, A., Drăgoi, C., Enea, C., Sighireanu, M.: Accurate invariant checking for programs manipulating lists and arrays with infinite data. In: Chakraborty, S., Mukund, M. (eds.) ATVA 2012. LNCS, pp. 167–182. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-33386-6_14

    Chapter  Google Scholar 

  11. Bouajjani, A., Drăgoi, C., Enea, C., Sighireanu, M.: On inter-procedural analysis of programs with lists and data. In: PLDI (2011)

    Google Scholar 

  12. Calcagno, C., Distefano, D., O’Hearn, P.W., Yang, H.: Footprint analysis: a shape analysis that discovers preconditions. In: Nielson, H.R., Filé, G. (eds.) SAS 2007. LNCS, vol. 4634, pp. 402–418. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-74061-2_25

    Chapter  Google Scholar 

  13. Calcagno, C., Distefano, D., O’Hearn, P., Yang, H.: Compositional shape analysis by means of bi-abduction. In: POPL (2009)

    Google Scholar 

  14. Chang, B.Y.E., Rival, X.: Relational inductive shape analysis. In: POPL. ACM (2008)

    Google Scholar 

  15. Chang, B.E., Dragoi, C., Manevich, R., Rinetzky, N., Rival, X.: Shape analysis. FNT (1–2) (2020)

    Google Scholar 

  16. Charguéraud, A.: Characteristic formulae for the verification of imperative programs. In: ICFP (2011)

    Google Scholar 

  17. Cousot, P., Cousot, R.: Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints. In: POPL. ACM (1977)

    Google Scholar 

  18. Cousot, P., Cousot, R.: Systematic design of program analysis frameworks. In: POPL (1979)

    Google Scholar 

  19. Cousot, P., Cousot, R., Logozzo, F.: A parametric segmentation functor for fully automatic and scalable array content analysis. In: POPL (2011)

    Google Scholar 

  20. Cousot, P., Halbwachs, N.: Automatic discovery of linear restraints among variables of a program. In: POPL (1978)

    Google Scholar 

  21. Cox, A., Chang, B.-Y.E., Rival, X.: Automatic analysis of open objects in dynamic language programs. In: Müller-Olm, M., Seidl, H. (eds.) SAS 2014. LNCS, vol. 8723, pp. 134–150. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-10936-7_9

    Chapter  Google Scholar 

  22. Curry, C., Le, Q.L.: Bi-abduction for shapes with ordered data (2020). arXiv https://arxiv.org/abs/2006.10439

  23. Darnis, N.: The generic data-structure library (2004). https://directory.fsf.org/wiki/GDSL

  24. Distefano, D., Fähndrich, M., Logozzo, F., O’Hearn, P.: Scaling static analyses at Facebook. CACM 62, 62–70 (2019)

    Article  Google Scholar 

  25. Dor, N., Rodeh, M., Sagiv, S.: CSSV: towards a realistic tool for statically detecting all buffer overflows in C. In: PLDI (2003)

    Google Scholar 

  26. Ferrara, P., Burato, E., Spoto, F.: Security analysis of the OWASP benchmark with Julia. In: ITASEC (2017)

    Google Scholar 

  27. Fiedor, T., Holík, L., Rogalewicz, A., Sinn, M., Vojnar, T., Zuleger, F.: From shapes to amortized complexity. In: Dillig, I., Palsberg, J. (eds.) VMCAI 2018. LNCS, vol. 10747, pp. 205–225. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-73721-8_10

    Chapter  Google Scholar 

  28. Gopan, D., Reps, T.W., Sagiv, S.: A framework for numeric analysis of array operations. In: POPL (2005)

    Google Scholar 

  29. Gulwani, S., McCloskey, B., Tiwari, A.: Lifting abstract interpreters to quantified logical domains. In: POPL (2008)

    Google Scholar 

  30. Halbwachs, N., Péron, M.: Discovering properties about arrays in simple programs. In: PLDI (2008)

    Google Scholar 

  31. Holík, L., Lengál, O., Rogalewicz, A., Šimáček, J., Vojnar, T.: Fully automated shape analysis based on forest automata. In: Sharygina, N., Veith, H. (eds.) CAV 2013. LNCS, vol. 8044, pp. 740–755. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-39799-8_52

    Chapter  Google Scholar 

  32. Holík, L., Peringer, P., Rogalewicz, A., Šoková, V., Vojnar, T., Zuleger, F.: Low-level bi-abduction. In: ECOOP (2022)

    Google Scholar 

  33. A. Inc.: The freertos kernel (2022). https://github.com/FreeRTOS

  34. Iosif, R., Rogalewicz, A., Vojnar, T.: Deciding entailments in inductive separation logic with tree automata. In: Cassez, F., Raskin, J.-F. (eds.) ATVA 2014. LNCS, vol. 8837, pp. 201–218. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-11936-6_15

    Chapter  Google Scholar 

  35. Jeannet, B., Miné, A.: Apron: a library of numerical abstract domains for static analysis. In: Bouajjani, A., Maler, O. (eds.) CAV 2009. LNCS, vol. 5643, pp. 661–667. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-02658-4_52

    Chapter  Google Scholar 

  36. Kiezun, A., Ganesh, V., Artzi, S., Guo, P.J., Hooimeijer, P., Ernst, M.D.: HAMPI: a solver for word equations over strings, regular expressions, and context-free grammars. ACM Trans. Softw. Eng. Methodol. 21, 1–28 (2013)

    Article  Google Scholar 

  37. Le, Q.L., Gherghina, C., Qin, S., Chin, W.-N.: Shape analysis via second-order bi-abduction. In: Biere, A., Bloem, R. (eds.) CAV 2014. LNCS, vol. 8559, pp. 52–68. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-08867-9_4

    Chapter  Google Scholar 

  38. Li, H., Berenger, F., Chang, B.Y.E., Rival, X.: Semantic-directed clumping of disjunctive abstract states. In: POPL (2017)

    Google Scholar 

  39. Li, H., Rival, X., Chang, B.-Y.E.: Shape analysis for unstructured sharing. In: Blazy, S., Jensen, T. (eds.) SAS 2015. LNCS, vol. 9291, pp. 90–108. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-48288-9_6

    Chapter  Google Scholar 

  40. Liang, T., Reynolds, A., Tinelli, C., Barrett, C., Deters, M.: A DPLL(T) theory solver for a theory of strings and regular expressions. In: Biere, A., Bloem, R. (eds.) CAV 2014. LNCS, vol. 8559, pp. 646–662. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-08867-9_43

    Chapter  Google Scholar 

  41. Liu, J., Chen, L., Rival, X.: Automatic verification of embedded system code manipulating dynamic structures stored in contiguous regions. IEEE Trans. Comput. Aided Des. Integr. Circuits Syst. 37, 2311–2322 (2018)

    Article  Google Scholar 

  42. Loginov, A., Reps, T., Sagiv, M.: Automated verification of the Deutsch-Schorr-Waite tree-traversal algorithm. In: Yi, K. (ed.) SAS 2006. LNCS, vol. 4134, pp. 261–279. Springer, Heidelberg (2006). https://doi.org/10.1007/11823230_17

    Chapter  Google Scholar 

  43. Magill, S., Tsai, M.H., Lee, P., Tsay, Y.K.: Automatic numeric abstractions for heap-manipulating programs. In: POPL (2010)

    Google Scholar 

  44. Makanin, G.S.: The problem of solvability of equations in a free semigroup. Math. USSR-Sbornik 32(4) (1977)

    Google Scholar 

  45. Midtgaard, J., Nielson, F., Nielson, H.R.: A parametric abstract domain for lattice-valued regular expressions. In: Rival, X. (ed.) SAS 2016. LNCS, vol. 9837, pp. 338–360. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-53413-7_17

    Chapter  Google Scholar 

  46. Miné, A.: The octagon abstract domain. HOSC 19, 31–100 (2006). https://doi.org/10.1007/s10990-006-8609-1

    Article  Google Scholar 

  47. Negrini, L., Arceri, V., Ferrara, P., Cortesi, A.: Twinning automata and regular expressions for string static analysis. In: Henglein, F., Shoham, S., Vizel, Y. (eds.) VMCAI 2021. LNCS, vol. 12597, pp. 267–290. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-67067-2_13

    Chapter  Google Scholar 

  48. O’Hearn, P.W.: Resources, concurrency and local reasoning. In: Gardner, P., Yoshida, N. (eds.) CONCUR 2004. LNCS, vol. 3170, pp. 49–67. Springer, Heidelberg (2004). https://doi.org/10.1007/978-3-540-28644-8_4

    Chapter  Google Scholar 

  49. Quine, W.V.: Concatenation as a basis for arithmetic. J. Symb. Logic 11(4) (1946). https://doi.org/10.2307/2268308

  50. Reynolds, J.: Separation logic: a logic for shared mutable data structures. In: LICS (2002)

    Google Scholar 

  51. Sagiv, M., Reps, T., Whilhelm, R.: Solving shape-analysis problems in languages with destructive updating. TOPLAS 20, 1–50 (1998)

    Article  Google Scholar 

  52. Singh, G., Püschel, M., Vechev, M.T.: Fast polyhedra abstract domain. In: POPL (2017)

    Google Scholar 

  53. Ta, Q.-T., Le, T.C., Khoo, S.-C., Chin, W.-N.: Automated mutual explicit induction proof in separation logic. In: Fitzgerald, J., Heitmeyer, C., Gnesi, S., Philippou, A. (eds.) FM 2016. LNCS, vol. 9995, pp. 659–676. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-48989-6_40

    Chapter  Google Scholar 

  54. Torvalds, L.: The Linux kernel (2022). https://git.kernel.org

  55. Urban, C.: The abstract domain of segmented ranking functions. In: Logozzo, F., Fähndrich, M. (eds.) SAS 2013. LNCS, vol. 7935, pp. 43–62. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-38856-9_5

    Chapter  Google Scholar 

  56. Vafeiadis, V.: Shape-value abstraction for verifying linearizability. In: Jones, N.D., Müller-Olm, M. (eds.) VMCAI 2009. LNCS, vol. 5403, pp. 335–348. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-93900-9_27

    Chapter  Google Scholar 

  57. Vafeiadis, V., Parkinson, M.: A marriage of rely/guarantee and separation logic. In: Caires, L., Vasconcelos, V.T. (eds.) CONCUR 2007. LNCS, vol. 4703, pp. 256–271. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-74407-8_18

    Chapter  Google Scholar 

Download references

Acknowledgment

The authors want to thank Thierry Martinez for his work on libraries used by the MemCAD analyzer. This work was supported by the VeriAMOS ANR-18-CE25-0010 French ANR project.

Author information

Authors and Affiliations

  1. INRIA Paris/CNRS/École Normale Supérieure/PSL Research University, Paris, France

    Josselin Giet & Xavier Rival

  2. IMDEA Software Institute, Madrid, Spain

    Félix Ridoux

  3. Univ Rennes, 35000, Rennes, France

    Félix Ridoux

Authors
  1. Josselin Giet
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Félix Ridoux
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Xavier Rival
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Josselin Giet .

Editor information

Editors and Affiliations

  1. U. Politécnica de Madrid (UPM) and IMDEA Software Institute, Pozuelo de Alarcón, Madrid, Spain

    Manuel V. Hermenegildo

  2. U. Politécnica de Madrid (UPM) and IMDEA Software Institute, Pozuelo de Alarcon, Spain

    José F. Morales

Rights and permissions

Reprints and permissions

Copyright information

© 2023 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Giet, J., Ridoux, F., Rival, X. (2023). A Product of Shape and Sequence Abstractions. In: Hermenegildo, M.V., Morales, J.F. (eds) Static Analysis. SAS 2023. Lecture Notes in Computer Science, vol 14284. Springer, Cham. https://doi.org/10.1007/978-3-031-44245-2_15

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-44245-2_15

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-44244-5

  • Online ISBN: 978-3-031-44245-2

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation