Automated Inference of Shape Specifications L Q Loc, Gherghina (Google), Qin (Teesside), W-N Chin Dept of Computer Science - National University of Singapore December 16, 2014 Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 1 / 51
Overview 1 get data Example 2 sll2dll Example 3 tll Example 4 Implementation and Experiments 5 Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 2 / 51
Related Work Shape analysis: discover invariants that describe the data structures in a program Given pre-shapes, infer post-shapes TVLA: T. Reps et. al. [POPL ’99]. Xisa: Rival et. al. [ POPL ’08]. More Automatic Bi-abduction: Calcagno et.al. [POPL ’09, J.ACM’11], Predator [CAV’11]. infer both pre- and post-shapes bottom-up, verify Linux kernel 2.6.25.4 with 2.473MLOC in 1739.28 seconds √ Forestor: Vojnar et.al. [CAV’13]. top-down Cycle proof: James et.al. [SAS’14]. Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 3 / 51
Bi-Abduction [POPL ’09,J.ACM’11] Frame Inference ∆ ante � ∆ conseq ∗ ?∆ frame Example struct nnode { struct nnode ∗ next } . x �→ nnode ( n 1 ) ∗ y �→ nnode ( n 1 ) � y �→ nnode ( n 2 ) ∗ ?∆ frame ∆ frame = x �→ nnode ( n 1 ) ∧ x � = y ∧ y � = NULL ∧ n 1 = n 2 Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 4 / 51
Bi-Abduction [POPL ’09,J.ACM’11] Abduction ?∆ pre ∗ ∆ ante � ∆ conseq Example: ?∆ pre ∧ true � y �→ nnode ( n 2 ) ∆ pre = y �→ nnode ( n 2 ) Do not infer trivial precondition, i.e. false Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 5 / 51
Bi-Abduction [POPL ’09,J.ACM’11] Abduction + Frame Inference = Bi-Abduction ?∆ pre ∗ ∆ ante � ∆ conseq ∗ ?∆ frame Example: ?∆ pre ∗ x �→ nnode ( n 1 ) ∧ x � = y � y �→ nnode ( n 2 ) ∗ ?∆ frame ∆ pre = y �→ nnode ( n 2 ) ∆ frame = x �→ nnode ( n 1 ) ∧ x � = y ∧ y � = NULL Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 6 / 51
Bi-Abduction [POPL ’09,J.ACM’11] Bi-Abduction (Calcagno et. al. [J.ACM’11]) 1 void free_list(struct snode *x){ struct snode *t; 2 while(x!=0){ 3 t=x; 4 x=x->next; 5 free(t); 6 } 7 8 } UNSOUND! Aims: scalability √ 1 expressive data structures { lists,.. ? } 2 soundness ? 3 Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 7 / 51
Second-Order Bi-Abduction Unknown Predicates as Second-Order Variables R ∧ ∆ ante � ∆ conseq ∗ ∆ frame R is a set of relational assumptions R = � n i = 1 (∆ i @ ∆ g ⇒ Φ i ) Entailment syntax: ∆ ante ⊢ ∆ conseq ❀ ( R , ∆ frame ) Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 8 / 51
Second-Order Bi-Abduction Examples: Abductive Unfold H ( y ) ∗ x �→ nnode ( n 1 ) ⊢ y �→ nnode ( n 2 ) ❀ ( R , ∆ frame ) R ≡ H ( y ) ⇒ y �→ nnode ( n 2 ) ∗ U ( n 2 ) ∆ frame = x �→ nnode ( n 1 ) ∗ U ( n 2 ) Abductive Fold x �→ nnode ( NULL ) ∗ y �→ nnode ( NULL ) ⊢ G ( x ) ❀ ( x �→ nnode ( NULL ) ⇒ G ( x ) , y �→ nnode ( NULL )) Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 9 / 51
from Verification to Inference Research Problem: Given a program, find pre-shape and post-shape such that the program is absence of memory-errors (null dereference)? Solution: Assume pre-shape is P(..), post-shape is Q(..) 1 Transform requirement to relational assumptions on P ,Q. 2 Denote proof obligations to be met Solve 3 Our framework: Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 10 / 51
Overview 1 get data Example 2 sll2dll Example 3 tll Example 4 Implementation and Experiments 5 Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 11 / 51
Shape Inference: get next Example Method Specification: ptr �→ node � d , p � requires ptr �→ node � d , p �∧ res = p ; ensures Verification 1 struct node ∗ get next ( struct node ∗ ptr ) { //α 1 : ptr �→ node � d , p � // ( binding ) E 1 : α 1 ⊢ ∃ d 1 , p 1 · ptr �→ node � d 1 , p 1 � 2 > next ; return ptr - //α 2 : ∃ d 1 , p 1 · ptr �→ node � d 1 , p 1 �∧ d 1 = d ∧ p 1 = p ∧ res = p 1 // ( post ) E 2 : α 2 ⊢ ptr �→ node � d , p �∧ res = p 3 } Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 12 / 51
Shape Inference: get next Example Method Specification: requires H ( ptr ) ensures G ( ptr , res ); Verification to Inference 1 struct node ∗ get next ( struct node ∗ ptr ) { //α ′ 1 : H ( ptr ) // ( binding ) E ′ 1 : α ′ 1 ⊢ ... > next ; 2 return ptr - //α ′ 2 : ... // ( post ) E ′ 2 : α ′ 2 ⊢ G ( ptr , res ) Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 13 / 51
Shape Inference: get next Example Method Specification: requires H ( ptr ) ensures G ( ptr , res ); Verification to Inference 1 struct node ∗ get next ( struct node ∗ ptr ) { //α ′ 1 : H ( ptr ) // ( binding ) E ′ 1 : α ′ 1 ⊢ ∃ d 1 , p 1 · ptr �→ node � d 1 , p 1 � > next ; 2 return ptr - //α ′ 2 : ... // ( post ) E ′ 2 : α ′ 2 ⊢ G ( ptr , res ) 3 } Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 14 / 51
Shape Inference: get next Example Method Specification: requires H ( ptr ) ensures G ( ptr , res ); Verification to Inference 1 struct node ∗ get next ( struct node ∗ ptr ) { //α ′ 1 : H ( ptr ) // ( binding ) E ′ 1 : α ′ 1 ⊢ ∃ d 1 , p 1 · ptr �→ node � d 1 , p 1 � > next ; 2 return ptr - //α ′ 2 : ... // ( post ) E ′ 2 : α ′ 2 ⊢ G ( ptr , res ) 3 } ❀ ( R 1 , ∆ 1 E 1 ′ frame ) ∆ 1 R 1 ≡ H ( ptr ) ⇒ ptr �→ node ( , p 1 ) ∗ U ( p 1 ) frame = ptr �→ node ( p 1 ) ∗ U ( p 1 ) Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 15 / 51
Shape Inference: get next Example Method Specification: requires H ( ptr ) ensures G ( ptr , res ); Verification to Inference R 1 ≡ H ( ptr ) ⇒ ptr �→ node ( , p 1 ) ∗ U ( p 1 ) 1 struct node ∗ ( struct node ∗ ptr ) { //α ′ 1 : H ( ptr ) // ( binding ) E ′ 1 : α ′ 1 ⊢ ∃ d 1 , p 1 · ptr �→ node � d 1 , p 1 � 2 > next ; return ptr - //α ′ 2 : ∃ d 1 , p 1 · ptr �→ node � d 1 , p 1 �∗ U ( p 1 ) ∧ res = p 1 // ( post ) E ′ 2 : α ′ 2 ⊢ G ( ptr , res ) 3 } Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 16 / 51
Shape Inference: get next Example Method Specification: requires H ( ptr ) ensures G ( ptr , res ); Verification to Inference 1 struct node ∗ ( struct node ∗ ptr ) { //α ′ 1 : H ( ptr ) // ( binding ) E ′ 1 : α ′ 1 ⊢ ∃ d 1 , p 1 · ptr �→ node � d 1 , p 1 � 2 return ptr - > next ; //α ′ 2 : ∃ d 1 , p 1 · ptr �→ node � d 1 , p 1 �∗ U ( p 1 ) ∧ res = p 1 // ( post ) E ′ 2 : α ′ 2 ⊢ G ( ptr , res ) 3 } ❀ ( R 2 , ∆ 2 E 2 ′ frame ) ∆ 2 R 2 ≡ ptr �→ node ( , p 1 ) ∗ U ( p 1 ) ∧ res = p 1 ⇒ G ( ptr , res ) frame = U ( p 1 ) Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 17 / 51
Shape Inference: get next Example Method Specification: requires H ( ptr ) ensures G ( ptr , res ); Relational Assumptions derived: R 1 ≡ H ( ptr ) ⇒ ptr �→ node ( , p 1 ) ∗ U ( p 1 ) R 2 ≡ ptr �→ node ( , p 1 ) ∗ U ( p 1 ) ∧ res = p 1 ⇒ G ( ptr , res ) Dangling Predicates, such as U ( p 1 ) : Uninstantiated predicates Can link pre/post specification Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 18 / 51
Shape Inference: get next Example Method Specification: requires H ( ptr ) ensures G ( ptr , res ); Weakest Pre-Predicate: H ( ptr ) ≡ ptr �→ node ( , DP ) Strongest Post-Predicate: G ( ptr , res ) ≡ ptr �→ node ( , DP ) ∧ res = DP Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 19 / 51
Overview 1 get data Example 2 sll2dll Example 3 tll Example 4 Implementation and Experiments 5 Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 20 / 51
Shape Inference: sll2dll Example 1 struct node{struct node* prev ;struct node* next ;} 2 void node* sll2dll (struct node *x, struct node *q) { if(x==NULL) return; 3 4 else{ x->prev=q; 5 sll2dll(x->next ,x); 6 } 7 8 } sll ( x ) dll ( x , q ) requires ensures Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 21 / 51
Shape Inference: sll2dll Example 1 struct node{struct node* prev ;struct node* next ;} 2 void node* sll2dll (struct node *x, struct node *q) { if(x==NULL) return; 3 else{ 4 x->prev=q; 5 sll2dll(x->next ,x); 6 } 7 8 } Unknown Predicates as Second-Order Variables: H ( x , q # ) G ( x , q ) requires ensures Infer Relational Assumptions via Second-Order Bi-abduction 1 Derive Predicate Definitions 2 Normalize Predicate Definitions 3 Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 22 / 51
Shape Inference: sll2dll Example. Step 1 void sll2dll ( struct node ∗ x , struct node ∗ q ) { ( α 1 ) H ( x , q # ) if ( x == NULL ) ( α 2 ) H ( x , q # ) ∧ x = NULL return ; > prev = q ; x - sll2dll ( x - > next , x ); } Post Proving at α 2 H ( x , q # ) ∧ x = NULL ⊢ G ( x , q ) ❀ (( A1 ) : H ( x , q # ) ∧ x = NULL ⇒ G ( x , q ) , emp ∧ x = NULL ) Loc, Gherghina, Qin, Chin (NUS) Shape Inference Tut 2b 23 / 51
Recommend
More recommend
