A Decidable Fragment in Separation Logic with Inductive Predicates - PowerPoint PPT Presentation

A Decidable Fragment in Separation Logic with Inductive Predicates and Arithmetic Quang Loc Le (TU) Makoto Tatsuta (NII) Jun Sun (SUTD) Wei-Ngan Chin (NUS) Computer Aided Verification, 29th International Conference Heidelberg Germany July 28, 2017 Loc Le (Teesside University) Decidable Fragment in Separation Logic July 28, 2017 1 / 21

A fragment of Separation Logic ∆ ::= ∃ ¯ Formula Φ ::= ∆ | Φ 1 ∨ Φ 2 v . ( κ ∧ π ) ::= emp | x �→ c ( v i ) | P (¯ Spatial formula v ) | κ 1 ∗ κ 2 κ Pure formula π ::= π 1 ∧ π 2 | α | φ α : Pointer (Dis)Equalities φ : Presburger arithmetic P : inductive predicate. Predicate Definition: P (¯ t ) ≡ Φ Warning: no pointer arithmetic and no magic wand Loc Le (Teesside University) Decidable Fragment in Separation Logic July 28, 2017 2 / 21

A fragment of Separation Logic Inductive predicate: Singly-linked list with size property pred ll size ( root , n ) ≡ emp ∧ root = null ∧ n = 0 ∨ ∃ r , n 1 · root �→ node ( , r ) ∗ ll size ( r , n 1 ) ∧ n = n 1 + 1 Example: ll size ( x , 3 ) Numerical projection ll size N ( n ) ≡ n = 0 ∨ ∃ n 1 · ll size N ( n 1 ) ∧ n = n 1 + 1 Loc Le (Teesside University) Decidable Fragment in Separation Logic July 28, 2017 3 / 21

Satisfiability Problem Input: A formula ∆ in the fragment Question: Is ∆ satisfiable? Challenges: Unbounded heaps Infinite numerical domain Loc Le (Teesside University) Decidable Fragment in Separation Logic July 28, 2017 4 / 21

Satisfiability Problem The satisfiability problem is undecidable by simulating Peano arithmetic (Tatsuta et. al. - APLAS 2016). What is decidable? Loc Le (Teesside University) Decidable Fragment in Separation Logic July 28, 2017 5 / 21

Contributions Decidable Fragment: A subfragment which is decidable and more expressive than all fragments which have been shown to be decidable previously. Decision Procedure: Base Computation Compute for each inductive predicate a finite representation that precisely characterises its satisfiability. Loc Le (Teesside University) Decidable Fragment in Separation Logic July 28, 2017 6 / 21

Decidable Fragment Finite Representation: Base Formula (without inductive predicates) Combining empty heap ( emp ), points-to ( �→ ), spatial conjunction ( ∗ ) and Presburger Arithmetic Example: ∆ 1 ≡ emp ∧ x = null ∧ n = 0 SAT ∆ 2 ≡ x �→ node ( n , y ) ∗ y �→ node ( n − 1 , null ) ∧ x = y UNSAT The fragment of base formulas is decidable (Piskac, Wies and Zufferey - CAV 2013, Navarro and Rybalchenko - APLAS 2013) Loc Le (Teesside University) Decidable Fragment in Separation Logic July 28, 2017 7 / 21

Foundation of Base Computation For each formula, eliminating existentially quantified pointer-typed variables produces an equi-satisfiable formula. Example: ∆ 1 ≡∃ r . ll size ( r , n ) ∧ x = null ∧ n = 0 is equi-satisfiable with ∆ 2 ≡∃ r . ll size N ( n ) ∧ x = null ∧ n = 0 If ll size N ( n ) can be computed as a Presburger formula, then ∆ 2 can be reduced into a base formula and thus is decidable. Loc Le (Teesside University) Decidable Fragment in Separation Logic July 28, 2017 8 / 21

Decidable Fragment: Base Computation Given an inductive predicate P (¯ x ) ≡ Φ , Construct a cyclic unfolding tree for ∆ 0 ≡ P (¯ x ) 1 Flatten the tree into a disjunctive set of base formulas 2 ∆ 0 ∆ 0 ∆ 11 ∆ b 31 ∆ 11 ∆ ⋆ 12 ∆ 21 ∆ 22 ∆ 21 ∆ 22 ∆ 31 ∆ ⋆ 32 base P ( P (¯ x )) ≡{ ∆ 21 , ∆ b 31 } Loc Le (Teesside University) Decidable Fragment in Separation Logic July 28, 2017 9 / 21

Constructing Cyclic Unfolding Tree Given an inductive predicate P (¯ x ) ≡ Φ , construct a unfolding tree for ∆ 0 ≡ P (¯ x ) through iterations of actions: Choose a (open) leaf, close it if 1 it can be reduced into a base formula. a base formula a formula in which pointer-typed parameters of every inductive predicates are existentially quantified. its over-approximation is unsat. can be linked back to form a circular path. Otherwise, unfold it. 2 ∆ 0 ∆ 11 ∆ ⋆ 12 ∆ 21 ∆ 22 ∆ 31 ∆ ⋆ 32 Loc Le (Teesside University) Decidable Fragment in Separation Logic July 28, 2017 10 / 21

Constructing Cyclic Unfolding Tree pred Q ( x , y , n ) ≡ ∃ y 1 . x �→ node ( null , y 1 ) ∧ y = null ∧ x � = null ∧ n = 1 ∨ ∃ x 1 , y 1 , n 1 . y �→ node ( x 1 , y 1 ) ∗ Q ( x , y 1 , n 1 ) ∧ y � = null ∧ n = n 1 + 2 ; ∆ 0 ≡ Q ( x , y , n ) Base Detection. None 1 ∆ 0 Over-Approximation. π 0 ≡ true . 2 Not UNSAT Figure : Unfolding Tree T 0 . Cyclic Detection. None 3 Loc Le (Teesside University) Decidable Fragment in Separation Logic July 28, 2017 11 / 21

Constructing Cyclic Unfolding Tree pred Q ( x , y , n ) ≡ ∃ y 1 . x �→ node ( null , y 1 ) ∧ y = null ∧ x � = null ∧ n = 1 ∨ ∃ x 1 , y 1 , n 1 . y �→ node ( x 1 , y 1 ) ∗ Q ( x , y 1 , n 1 ) ∧ y � = null ∧ n = n 1 + 2 ; ∆ 0 ≡ Q ( x , y , n ) ∆ 1 ≡∃ y 1 . x �→ node ( null , y 1 ) ∧ y = null ∧ x � = null ∧ n = 1 ∆ 2 ≡∃ x 1 , y 1 , n 1 . y �→ node ( x 1 , y 1 ) ∗ Q ( x , y 1 , n 1 ) ∧ y � = null ∧ n = n 1 + 2 Base Detection. ∆ 1 1 ∆ 0 Over-Approximation. 2 π 2 ≡∃ x 1 , y 1 , n 1 . y �→ node ( x 1 , y 1 ) ∧ true ∆ 1 ∆ 2 ∧ y � = null ∧ n = n 1 + 2. Not UNSAT Figure : Unfolding Tree T 1 . Cyclic Detection. None 3 Loc Le (Teesside University) Decidable Fragment in Separation Logic July 28, 2017 12 / 21

Constructing Cyclic Unfolding Tree pred Q ( x , y , n ) ≡ ∃ y 1 . x �→ node ( null , y 1 ) ∧ y = null ∧ x � = null ∧ n = 1 ∨ ∃ x 1 , y 1 , n 1 . y �→ node ( x 1 , y 1 ) ∗ Q ( x , y 1 , n 1 ) ∧ y � = null ∧ n = n 1 + 2 ; ∆ 2 ≡∃ x 1 , y 1 , n 1 . y �→ node ( x 1 , y 1 ) ∗ Q ( x , y 1 , n 1 ) ∧ y � = null ∧ n = n 1 + 2 ∆ 3 ≡∃ x 1 , y 1 , n 1 , y 2 . y �→ node ( x 1 , y 1 ) ∗ x �→ node ( null , y 2 ) ∧ y 1 = null ∧ x � = null ∧ n 1 = 1 ∧ y � = null ∧ n = n 1 + 2 ∆ 4 ≡∃ x 1 , y 1 , n 1 , x 2 , y 2 , n 2 . y �→ node ( x 1 , y 1 ) ∗ y 1 �→ node ( x 2 , y 2 ) ∗ Q ( x , y 2 , n 2 ) ∧ y 1 � = null ∧ n 1 = n 2 + 2 ∧ y � = null ∧ n = n 1 + 2 ∆ 0 Base Detection. ∆ 3 1 Over-Approximation. π 4 ≡ .... . ∆ 1 ∆ ♣ 2 2 Not UNSAT ∆ 3 Cyclic Detection. Yes ∆ ♣ 3 4 Figure : T Q 2 . Loc Le (Teesside University) Decidable Fragment in Separation Logic July 28, 2017 13 / 21

Constructing Cyclic Unfolding Tree Cyclic Detection ∆ 2 ≡∃ x 1 , y 1 , n 1 . y �→ node ( x 1 , y 1 ) ∗ Q ( x , y 1 , n 1 ) ∧ y � = null ∧ n = n 1 + 2 ∆ 4 ≡∃ x 1 , y 1 , n 1 , x 2 , y 2 , n 2 . y �→ node ( x 1 , y 1 ) ∗ y 1 �→ node ( x 2 , y 2 ) ∗ Q ( x , y 2 , n 2 ) ∧ y 1 � = null ∧ n 1 = n 2 + 2 ∧ y � = null ∧ n = n 1 + 2 Steps matching externally visible points-to predicate: y �→ node ( , ) 1 matching externally visible inductive predicates: Q ( x , , ) 2 In general, we may need to group isomorphic inductive predicates beforehand (same predicate name and same sequence of free arguments) matching externally visible (dis)equalities over pointers: y � = null 3 Loc Le (Teesside University) Decidable Fragment in Separation Logic July 28, 2017 14 / 21

Flattening Cyclic Unfolding Tree ∆ 0 ∆ 1 ∆ ♣ 2 ∆ 3 ∆ ♣ 4 Loc Le (Teesside University) Decidable Fragment in Separation Logic July 28, 2017 15 / 21

Flattening Cyclic Unfolding Tree ∆ 0 ∆ 0 ∆ 1 ∆ 2 ∆ 1 ∆ ♣ 2 ∆ 3 ∆ 4 ∆ 3 ∆ ♣ ∆ 1 ∆ 1 4 3 4 ... ∆ flat 3 ≡ ∆ 3 ∨ ∆ 1 3 ∨ ... ∆ 3 ≡ ∃ x 1 , y 1 , n 1 , y 2 . ( y �→ node ( x 1 , y 1 ) ∗ x �→ node ( null , y 2 ) ∧ x � = null ∧ y � = null ∧ n = n 1 + 2 ) ∧ ( y 1 = null ∧ n 1 = 1 ) ∆ 1 3 ≡∃ x 1 , y 1 , n 1 , x 2 , y 2 , n 2 , y 3 . ( y �→ node ( x 1 , y 1 ) ∗ x �→ node ( null , y 3 ) ∧ x � = null y � = null ∧ n = n 1 + 2 ) ∗ ( y 1 �→ node ( x 2 , y 2 ) ∧ y 2 = null ∧ n 1 = n 2 + 2 ∧ n 2 = 1 ) Loc Le (Teesside University) Decidable Fragment in Separation Logic July 28, 2017 16 / 21

Flattening Cyclic Unfolding Tree ∆ 0 ∆ 1 ∆ ♣ 2 ∆ 3 ∆ ♣ 4 P cyc ( n 1 ) ≡ n 1 = 1 ∨ ∃ n 2 . n 1 = n 2 + 2 ∧ P cyc ( n 2 ) P cyc ( n 1 ) ≡∃ k . n 1 = 2 k + 1 ∧ k ≥ 0 ∆ b 3 is equi-satisfiable to ∆ flat 3 : ∆ b 3 ≡∃ x 1 , y 1 , x 2 , y 2 , n 1 . ( y �→ node ( x 1 , y 1 ) ∗ x �→ node ( null , y 2 ) ∧ x � = null ∧ y � = null ∧ n = n 1 + 2 ) ∧ ( ∃ k . n 1 = 2 k + 1 ∧ k ≥ 0 ) Loc Le (Teesside University) Decidable Fragment in Separation Logic July 28, 2017 17 / 21

Flattening Cyclic Unfolding Tree ∆ 0 ∆ 0 = ⇒ ∆ 1 ∆ b 3 ∆ 1 ∆ ♣ 2 ∆ 3 ∆ ♣ 4 base P ( Q ( x , y , n )) ≡{ ∆ 1 , ∆ b 3 } Loc Le (Teesside University) Decidable Fragment in Separation Logic July 28, 2017 18 / 21

Proposed Decidable Fragment An inductive predicate is in the proposed decidable fragment if all numerical projections of base leaves; and P cyc predicates are Presburger-definable (i.e., can be computed as Presburger formulas). Some systems of arithmetic inductive predicates are Presburger-definable: DPI (Tatsuta et. al. - APLAS 2016) periodic sets (Bozga et. al. - CAV 2010) Loc Le (Teesside University) Decidable Fragment in Separation Logic July 28, 2017 19 / 21