Skip to main content
SpringerLink
Log in
Book cover

International Conference on Software Engineering and Formal Methods

SEFM 2018: Software Engineering and Formal Methods pp 271–286Cite as

Graph-Based Shape Analysis Beyond Context-Freeness

  • Conference paper
  • First Online:

Part of the book series: Lecture Notes in Computer Science ((LNTCS,volume 10886))

Abstract

We develop a shape analysis for reasoning about relational properties of data structures. Both the concrete and the abstract domain are represented by hypergraphs. The analysis is parameterized by user-supplied indexed graph grammars to guide concretization and abstraction. This novel extension of context-free graph grammars is powerful enough to model complex data structures such as balanced binary trees with parent pointers, while preserving most desirable properties of context-free graph grammars.

One strength of our analysis is that no artifacts apart from grammars are required from the user; it thus offers a high degree of automation. We implemented our analysis and successfully applied it to various programs manipulating AVL trees, (doubly-linked) lists, and combinations of both.

Matheja, C.—Supported by Deutsche Forschungsgemeinschaft (DFG) Grant NO 401/2-1.

This is a preview of subscription content, log in via an institution.

Chapter
USD   29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD   39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD   54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Learn about institutional subscriptions

Notes

  1. 1.

    We often draw multiple black circles, but they all correspond to the same location.

  2. 2.

    Again, note that we consider a single execution path in this example. The full analysis also explores the cases in which X is substituted by \(z\) and \(sz\).

  3. 3.

    External nodes are needed to define the semantics of nonterminal edges.

  4. 4.

    I.e., \(v_{\mathtt {null}}= \textit{ext}(1)\) and for each \(e \in E\) with \(\textit{lab}(e) \in N\), we have \(\textit{att}(e)(1) = v_{\mathtt {null}}\).

  5. 5.

    \(f \upharpoonright M\) denotes the restriction of function f to domain M and . Moreover, function \(\textit{mod} = \{ \textit{ext}_{K}(k) \mapsto \textit{att}_{H}(e)(k) ~|~ 1 \le k \le |\textit{ext}_{K}| \} \cup \{ v \mapsto v ~|~ v \in V\setminus \textit{ext}_{K} \}\) is lifted to sequences of nodes by pointwise application.

  6. 6.

    \(H\left[ \nu \mapsto \rho \right] = (V_{H},E_{H},\textit{att}_{H},\textit{lab}_{H},\textit{ind},\textit{ext}_{H})\) with \(\textit{ind}= \{ \textit{ind}_{H}(e)\left[ \nu \mapsto \rho \right] ~|~ e \in E_{H} \}\).

  7. 7.

    denotes sequential composition of f and g, i.e. .

  8. 8.

    https://github.com/moves-rwth/attestor-examples/releases/tag/v0.3.5-SEFM2018. Also confer the extended version [4].

References

  1. Abdulla, P.A., Holík, L., Jonsson, B., Lengál, O., Trinh, C.Q., Vojnar, T.: Verification of heap manipulating programs with ordered data by extended forest automata. Acta Inf. 53(4), 357–385 (2016)

    Article  MathSciNet  Google Scholar 

  2. Aho, A.V.: Indexed grammars - an extension of context-free grammars. J. ACM 15(4), 647–671 (1968)

    Article  MathSciNet  Google Scholar 

  3. Arndt, H., Jansen, C., Katoen, J.P., Matheja, C., Noll, T.: Let this graph be your witness! an attestor for verifying Java pointer programs. In: CAV (2018, to appear)

    Google Scholar 

  4. Arndt, H., Jansen, C., Matheja, C., Noll, T.: Heap abstraction beyond context-freeness. CoRR abs/1705.03754 (2017). http://arxiv.org/abs/1705.03754

  5. Bar-Hillel, Y., Perles, M., Shamir, E.: On formal properties of simple phrase structure grammars. Sprachtypologie und Universalienforschung 14, 143–172 (1961)

    MathSciNet  MATH  Google Scholar 

  6. Calcagno, C., Distefano, D., O’Hearn, P.W., Yang, H.: Compositional shape analysis by means of bi-abduction. J. ACM 58(6), 26:1–26:66 (2011)

    Article  MathSciNet  Google Scholar 

  7. Chang, B.E., Rival, X.: Relational inductive shape analysis. In: POPL 2008, pp. 247–260. ACM (2008)

    Google Scholar 

  8. Chang, B.E., Rival, X.: Modular construction of shape-numeric analyzers. EPTCS 129, 161–185 (2013)

    Article  MathSciNet  Google Scholar 

  9. Chang, B.-Y.E., Rival, X., Necula, G.C.: Shape analysis with structural invariant checkers. In: Nielson, H.R., Filé, G. (eds.) SAS 2007. LNCS, vol. 4634, pp. 384–401. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-74061-2_24

    Chapter  Google Scholar 

  10. Chin, W., David, C., Nguyen, H.H., Qin, S.: Automated verification of shape, size and bag properties via user-defined predicates in separation logic. Sci. Comput. Program. 77(9), 1006–1036 (2012)

    Article  Google Scholar 

  11. Cousot, P., Cousot, R.: Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints. In: POPL 1977, pp. 238–252. ACM (1977)

    Google Scholar 

  12. Cousot, P., Cousot, R.: Abstract interpretation frameworks. J. Log. Comput. 2(4), 511–547 (1992)

    Article  MathSciNet  Google Scholar 

  13. Ferrara, P., Fuchs, R., Juhasz, U.: TVAL+ : TVLA and value analyses together. In: Eleftherakis, G., Hinchey, M., Holcombe, M. (eds.) SEFM 2012. LNCS, vol. 7504, pp. 63–77. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-33826-7_5

    Chapter  Google Scholar 

  14. Habel, A.: Hyperedge Replacement: Grammars and Languages. LNCS, vol. 643. Springer, Heidelberg (1992). https://doi.org/10.1007/BFb0013875

    Book  MATH  Google Scholar 

  15. Heinen, J., Jansen, C., Katoen, J., Noll, T.: Juggrnaut: using graph grammars for abstracting unbounded heap structures. Form. Method. Syst. Des. 47(2), 159–203 (2015)

    Article  Google Scholar 

  16. Jansen, C., Göbe, F., Noll, T.: Generating Inductive predicates for symbolic execution of pointer-manipulating programs. In: Giese, H., König, B. (eds.) ICGT 2014. LNCS, vol. 8571, pp. 65–80. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-09108-2_5

    Chapter  Google Scholar 

  17. Jansen, C., Heinen, J., Katoen, J.-P., Noll, T.: A local Greibach normal form for hyperedge replacement grammars. In: Dediu, A.-H., Inenaga, S., Martín-Vide, C. (eds.) LATA 2011. LNCS, vol. 6638, pp. 323–335. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-21254-3_25

    Chapter  Google Scholar 

  18. Jansen, C., Katelaan, J., Matheja, C., Noll, T., Zuleger, F.: Unified reasoning about robustness properties of symbolic-heap separation logic. In: Yang, H. (ed.) ESOP 2017. LNCS, vol. 10201, pp. 611–638. Springer, Heidelberg (2017). https://doi.org/10.1007/978-3-662-54434-1_23

    Chapter  Google Scholar 

  19. Plump, D.: Checking graph-transformation systems for confluence. In: ECEASST, vol. 26 (2010)

    Google Scholar 

  20. Reps, T.W., Sagiv, M., Wilhelm, R.: Shape analysis and applications. In: Srikant, Y.N., Shankar, P. (eds.) The Compiler Design Handbook, 2nd edn. CRC Press, Boca Raton (2007)

    Google Scholar 

  21. Sagiv, S., Reps, T.W., Wilhelm, R.: Parametric shape analysis via 3-valued logic. In: POPL 1999, pp. 105–118. ACM (1999)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. RWTH Aachen University, Aachen, Germany

    Hannah Arndt, Christina Jansen, Christoph Matheja & Thomas Noll

Authors
  1. Hannah Arndt
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Christina Jansen
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Christoph Matheja
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Thomas Noll
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Christoph Matheja .

Editor information

Editors and Affiliations

  1. University of Oslo, Oslo, Norway

    Einar Broch Johnsen

  2. Braunschweig University of Technology, Braunschweig, Germany

    Ina Schaefer

Rights and permissions

Reprints and permissions

Copyright information

© 2018 Springer International Publishing AG, part of Springer Nature

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Arndt, H., Jansen, C., Matheja, C., Noll, T. (2018). Graph-Based Shape Analysis Beyond Context-Freeness. In: Johnsen, E., Schaefer, I. (eds) Software Engineering and Formal Methods. SEFM 2018. Lecture Notes in Computer Science(), vol 10886. Springer, Cham. https://doi.org/10.1007/978-3-319-92970-5_17

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-92970-5_17

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-92969-9

  • Online ISBN: 978-3-319-92970-5

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation