Lazy Heap Analysis with Symbolic Memory Graphs Alexander Driemeyer

Outline 1. Motivation 2. CPAchecker and Symbolic Memory Graphs 3. Abstractions of Symbolic Memory Graphs 4. Using counterexample guided abstraction refinement with Symbolic Memory Graphs 5. Challenges and conclusion

Motivation ● Use symbolic memory graphs to verify programs with complex heap structures ● Use abstraction to be able to check all possible states of a program for the specified safety property ● Use abstraction refinement to find a level of abstraction that is as coarse as possible while still fine enough to eliminate all spurious safety property violation

CPAchecker CPAchecker program + specification CFA ARG 5 @ N2 1 int main() { main 2 [] 2 Line 9: int a; int a; 3 int a = nondet_int(); 6 @ N3 3 main [] 5 a = nondet(); Line 9: a = __VERIFIER_nondet_int(); 6 if(a == 5) { 7 @ N4 4 main 7 a = 7; [] [a != 5] [a == 5] 8 } else { Line 11: [!(a == 5)] Line 11: [a == 5] 7 6 9 a = 6; 9 @ N7 8 @ N6 main main [] [main::a=5] 10 } a = 6; a = 7; Line 14: a = 6; Line 12: a = 7; 11 } 10 @ N9 13 @ N8 main main 9 8 [main::a=6] [main::a=7] Line 14: Line 15: 11 @ N5 14 @ N5 5 main main [main::a=6] [main::a=7] default return; Line 15: default return Line 15: default return 12 @ N0 15 @ N0 0 main exit main exit [main::a=6] [main::a=7]

Symbolic Memory Graph (SMG) ● Represents sets of heap graphs of a program at a program location ● Supports read and write operations, join of smgs, checking values for equality and inequality, and list abstraction ● Detects memory leaks and invalid read, write or free operations

List Abstraction ● Used to handle infinitely recursive list segments ● Heap objects are abstracted to list segments and the sub-graphs of the heap objects are joined together ● Whether to execute a possible list abstraction depends on the number of heap objects that can be abstracted into a list, and the loss of information when joining their sub graphs

SMG Precision ● Determines the level of abstraction of a program verification with symbolic memory graphs ● Consist of sets of memory locations, memory paths and locks for list abstractions for every program location ● Adjusts symbolic memory graphs of abstract states in the ARG after each calculation of new abstract states for the ARG

Counterexample guided abstraction refinement ● Method to obtain a good level of abstraction for an analysis for a program ● 1 Step Abstraction : Construct an abstract model of the program ● 2 Step Verification: Check if the model violates a chosen safety property ● 3 Step Refinement: Refine the level of abstraction based on a found spurious counterexample

CEGAR with Symbolic Memory Graphs ● Use SMG precision to determine the level of abstraction for Step 1 ● Use the full SMG precision on a path to check if a found counterexample is feasible for Step 2 ● Use the flow dependence of the SMGs of the spurious counterexample to calculate the new SMG precision for step 3

Lazy Abstraction ● Used to improve performance of Counterexample guided abstraction refinement ● Instead of continuously recalculating the abstract model after each refinement step, calculate the model and the refinement of the model on the fly

Lazy Abstraction

Example

Challenges And Conclusion ● Finding a better refinement method for list abstractions ● A method to reduce the loss of information when writing to program location that is not known at the current level of abstraction ● Heap abstraction for trees and other data structures

Lazy Heap Analysis with Symbolic Memory Graphs Alexander Driemeyer - PowerPoint PPT Presentation

Lazy Heap Analysis with Symbolic Memory Graphs Alexander Driemeyer Outline 1. Motivation 2. CPAchecker and Symbolic Memory Graphs 3. Abstractions of Symbolic Memory Graphs 4. Using counterexample guided abstraction refinement with Symbolic

Shape Analysis via Symbolic Memory Graphs and Conversion from Pointers to Containers Kamil Dudka

Symbolic Memory Graphs invariant and corresponding optimizations for SMGCPA Anton Vasilyev

EDA045F: Program Analysis LECTURE 6: DATALOG Christoph Reichenbach In the last lecture. . .

Interprocedural Heap Analysis using Access Graphs and Value Contexts with applications to

Symbolic Heap Abstraction with Demand-Driven Axiomatization of Memory Invariants Isil Dillig

Symbolic Reachability Analysis of Lazy Linear Hybrid Automata Susmit Jha, Bryan Brady and

Say Goodbye to Off-heap Caches! On-heap Caches Using Memory-Mapped I/O Iacovos G. Kolokasis 1 ,

Dynamic Memory Allocation in the Heap (malloc and free) Explicit allocators (a.k.a. manual memory

A non-moving collector Organization of heap memory in GC Heap memory falls in 4 sets in a GC

Dynamic Memory Overview Dynamically allocated memory is stored in the Heap-section of

the stack & the heap hic 1 memory management So far: data representations: how are

Last week Data can be allocated on the stack or on the heap (aka dynamic memory) or on the heap

Heap Cloning: Enabling Dynamic Symbolic Execution of Java Programs Saswat Anand Mary Jean

Dynamic Memory Allocation in the Heap (malloc and free) Now: Explicit allocators (a.k.a. manual

Symbolic Bayesian inference by lazy partial evaluation Chung-chieh Shan (Indiana University)

Virtual Memory Thierry Sans The problem of managing the memory How to make programs and

Dynamic Memory Faculty of Computer Science Dalhousie University Management Winter 2019 The

heaps and heapsort on n elements height of a heap is in (log n ) building a heap bottum-up in O (

Model Checking for Symbolic-Heap Separation Logic with Inductive Predicates James Brotherston 1

Heap Recycling for Lazy Languages Stefan Holdermans (Joint work with Jurriaan Hage) Dept. of

PROGRAM HEAP 2020-2021 WHAT IS HEAP? HEAP is a federally funded program that assists low

Objectives Graphs Graph Connectivity, Traversal BFS & DFS Implementations, Analysis

Section 8 2/22/12 Agenda Malloc/Free Process Memory Image memory protected kernel virtual

PA PACE Programming Languages, Architecture and Compilers Education Laboratory Heap analysis