I NTRODUCTION T HE copytree EXAMPLE H YBRID S EPARATION L OGIC E XAMPLE PROOFS A UTOMATIC REASONING C ONCLUSION Program Proofs in Hybrid Separation Logic Armaël Guéneau & Jules Villard Imperial College of London & ENS Lyon 4th September 2014 Armaël Guéneau Program Proofs in Hybrid Separation Logic 1/31
I NTRODUCTION T HE copytree EXAMPLE H YBRID S EPARATION L OGIC E XAMPLE PROOFS A UTOMATIC REASONING C ONCLUSION I NTRODUCTION General field of study: imperative programs verification. § We want to prove specifications, as Hoare triples: t P u c t Q u § We are also interested in memory safety An existing framework: Separation logic § Assertions P , Q describe memory heaps § An additional inference rule for triples § Proving a specification requires memory safety Armaël Guéneau Program Proofs in Hybrid Separation Logic 2/31
I NTRODUCTION T HE copytree EXAMPLE H YBRID S EPARATION L OGIC E XAMPLE PROOFS A UTOMATIC REASONING C ONCLUSION O UTLINE OF THIS TALK § Let’s play with separation logic: a motivational example § Introducing hybrid separation logic § Can we do nicer proofs of our example using it? § Can we automate these proofs? Armaël Guéneau Program Proofs in Hybrid Separation Logic 3/31
A MOTIVATIONAL EXAMPLE : copytree
I NTRODUCTION T HE copytree EXAMPLE H YBRID S EPARATION L OGIC E XAMPLE PROOFS A UTOMATIC REASONING C ONCLUSION T HE copytree EXAMPLE [R EY 02] struct tree { tree* copytree(tree* x) { int val; if (x == NULL) tree* l; return x; tree* r; }; tree* l’ = copytree(x->l); tree* r’ = copytree(x->r); tree* x’ = malloc(sizeof(tree )); x’->l = l’; x’->r = r’; What specification for return x’; copytree? } Armaël Guéneau Program Proofs in Hybrid Separation Logic 5/31
I NTRODUCTION T HE copytree EXAMPLE H YBRID S EPARATION L OGIC E XAMPLE PROOFS A UTOMATIC REASONING C ONCLUSION T HE copytree EXAMPLE [R EY 02] A FIRST SPECIFICATION Separating conjunction ô P 1 › P 2 P 1 P 2 t tree x u x’ = copytree(x) t tree x › tree x 1 u Armaël Guéneau Program Proofs in Hybrid Separation Logic 6/31
I NTRODUCTION T HE copytree EXAMPLE H YBRID S EPARATION L OGIC E XAMPLE PROOFS A UTOMATIC REASONING C ONCLUSION T HE copytree EXAMPLE [R EY 02] A FIRST SPECIFICATION x ÞÑ a , b , c : emp : the empty heap ” pD l , r : x ÞÑ val , l , r › tree l › tree r q tree x _p x = 0 ^ emp q Armaël Guéneau Program Proofs in Hybrid Separation Logic 7/31
I NTRODUCTION T HE copytree EXAMPLE H YBRID S EPARATION L OGIC E XAMPLE PROOFS A UTOMATIC REASONING C ONCLUSION // t tree x u tree* copytree(tree* x) { if (x == NULL) return x; tree* l’ = copytree(x->l); tree* r’ = copytree(x->r); tree* x’ = malloc(sizeof(tree )); x’->l = l’; x’->r = r’; x’->val = x->val; return x’; } // t tree x › tree x 1 u Armaël Guéneau Program Proofs in Hybrid Separation Logic 8/31
I NTRODUCTION T HE copytree EXAMPLE H YBRID S EPARATION L OGIC E XAMPLE PROOFS A UTOMATIC REASONING C ONCLUSION // t tree x u tree* copytree(tree* x) { if (x == NULL) return x; // t x ÞÑ val , l , r › tree l › tree r u tree* l’ = copytree(x->l); // t x ÞÑ val , l , r › tree l › tree r › tree l 1 u t P u c t Q u tree* r’ = copytree(x->r); Frame t P › R u c t Q › R u tree* x’ = malloc(sizeof(tree )); x’->l = l’; x’->r = r’; x’->val = x->val; return x’; } // t tree x › tree x 1 u Armaël Guéneau Program Proofs in Hybrid Separation Logic 8/31
I NTRODUCTION T HE copytree EXAMPLE H YBRID S EPARATION L OGIC E XAMPLE PROOFS A UTOMATIC REASONING C ONCLUSION // t tree x u tree* copytree(tree* x) { if (x == NULL) return x; // t x ÞÑ val , l , r › tree l › tree r u // � t tree l u tree* l’ = copytree(x->l); // � t tree l › tree l 1 u // t x ÞÑ val , l , r › tree l › tree r › tree l 1 u t P u c t Q u tree* r’ = copytree(x->r); Frame t P › R u c t Q › R u tree* x’ = malloc(sizeof(tree )); x’->l = l’; x’->r = r’; x’->val = x->val; return x’; } // t tree x › tree x 1 u Armaël Guéneau Program Proofs in Hybrid Separation Logic 8/31
I NTRODUCTION T HE copytree EXAMPLE H YBRID S EPARATION L OGIC E XAMPLE PROOFS A UTOMATIC REASONING C ONCLUSION // t tree x u tree* copytree(tree* x) { if (x == NULL) return x; // t x ÞÑ val , l , r › tree l › tree r u // � t tree l u tree* l’ = copytree(x->l); // � t tree l › tree l 1 u // t x ÞÑ val , l , r › tree l › tree r › tree l 1 u tree* r’ = copytree(x->r); // t x ÞÑ val , l , r › tree l › tree r › tree l 1 › tree r 1 u tree* x’ = malloc(sizeof(tree )); x’->l = l’; x’->r = r’; x’->val = x->val; return x’; } // t tree x › tree x 1 u Armaël Guéneau Program Proofs in Hybrid Separation Logic 8/31
I NTRODUCTION T HE copytree EXAMPLE H YBRID S EPARATION L OGIC E XAMPLE PROOFS A UTOMATIC REASONING C ONCLUSION // t tree x u tree* copytree(tree* x) { if (x == NULL) return x; // t x ÞÑ val , l , r › tree l › tree r u // � t tree l u tree* l’ = copytree(x->l); // � t tree l › tree l 1 u // t x ÞÑ val , l , r › tree l › tree r › tree l 1 u tree* r’ = copytree(x->r); // t x ÞÑ val , l , r › tree l › tree r › tree l 1 › tree r 1 u tree* x’ = malloc(sizeof(tree )); x’->l = l’; x’->r = r’; x’->val = x->val; // t x ÞÑ val , l , r › tree l › tree r › x 1 ÞÑ val , l 1 , r 1 › tree l 1 › tree r 1 u return x’; } // t tree x › tree x 1 u Armaël Guéneau Program Proofs in Hybrid Separation Logic 8/31
I NTRODUCTION T HE copytree EXAMPLE H YBRID S EPARATION L OGIC E XAMPLE PROOFS A UTOMATIC REASONING C ONCLUSION T HE copytree EXAMPLE [R EY 02] In fact, copytree also works on dags (directed acyclic graphs). dag x ” D l , r : x ÞÑ val , l , r › p dag l ?? dag r q _p x = 0 ^ emp q Armaël Guéneau Program Proofs in Hybrid Separation Logic 9/31
I NTRODUCTION T HE copytree EXAMPLE H YBRID S EPARATION L OGIC E XAMPLE PROOFS A UTOMATIC REASONING C ONCLUSION T HE copytree EXAMPLE [R EY 02] T ALKING ABOUT OVERLAPPING HEAPS Overlapping conjunction P 1 ô P 1 Y › P 2 P 2 Armaël Guéneau Program Proofs in Hybrid Separation Logic 10/31
I NTRODUCTION T HE copytree EXAMPLE H YBRID S EPARATION L OGIC E XAMPLE PROOFS A UTOMATIC REASONING C ONCLUSION T HE copytree EXAMPLE [R EY 02] W HAT DEFINITION OF dag x ? dag x ” D l , r : x ÞÑ val , l , r › p dag l Y › dag r q _p x = 0 ^ emp q Armaël Guéneau Program Proofs in Hybrid Separation Logic 11/31
I NTRODUCTION T HE copytree EXAMPLE H YBRID S EPARATION L OGIC E XAMPLE PROOFS A UTOMATIC REASONING C ONCLUSION T HE copytree EXAMPLE [R EY 02] t dag x u x’ = copytree(x) t dag x › tree x 1 u We cannot prove this specification. // t x ÞÑ val , l , r › p dag l Y › dag r qu tree* l’ = copytree(x->l); › dag r q › tree l 1 u // t x ÞÑ val , l , r › p dag l Y Armaël Guéneau Program Proofs in Hybrid Separation Logic 12/31
I NTRODUCTION T HE copytree EXAMPLE H YBRID S EPARATION L OGIC E XAMPLE PROOFS A UTOMATIC REASONING C ONCLUSION T HE copytree EXAMPLE [R EY 02] t dag x u x’ = copytree(x) t dag x › tree x 1 u We cannot prove this specification. // t x ÞÑ val , l , r › p dag l Y › dag r qu // � t dag l u tree* l’ = copytree(x->l); // � t dag l › tree l 1 u › dag r q › tree l 1 u // t x ÞÑ val , l , r › p dag l Y Armaël Guéneau Program Proofs in Hybrid Separation Logic 12/31
I NTRODUCTION T HE copytree EXAMPLE H YBRID S EPARATION L OGIC E XAMPLE PROOFS A UTOMATIC REASONING C ONCLUSION T HE copytree EXAMPLE [R EY 02] Solution idea from Reynolds [Rey02]: use an assertion variable that implicitly quantifies over properties on the heap. t p ^ dag τ x u x’ Ð copytree(x) t p › tree τ x u § Has a taste of second-order logic § Overkill? Armaël Guéneau Program Proofs in Hybrid Separation Logic 13/31
I NTRODUCTION T HE copytree EXAMPLE H YBRID S EPARATION L OGIC E XAMPLE PROOFS A UTOMATIC REASONING C ONCLUSION T HE copytree EXAMPLE [R EY 02] Solution from Hobor & Villard [HobVill13]: § Very precise dag predicate (parametrized by a mathematical view of the dag) § Prove functional correctness § Ramification instead of frame rule + heavy semantic proofs Armaël Guéneau Program Proofs in Hybrid Separation Logic 14/31
I NTRODUCTION T HE copytree EXAMPLE H YBRID S EPARATION L OGIC E XAMPLE PROOFS A UTOMATIC REASONING C ONCLUSION T HE copytree EXAMPLE Automated reasoning requires a much simpler reasoning. To talk about preserving parts of the heap, we can use labels ! (think heap variables ) Armaël Guéneau Program Proofs in Hybrid Separation Logic 15/31
H YBRID S EPARATION L OGIC : SEPARATION LOGIC + LABELS
I NTRODUCTION T HE copytree EXAMPLE H YBRID S EPARATION L OGIC E XAMPLE PROOFS A UTOMATIC REASONING C ONCLUSION I NTRODUCING THE HYBRID SEPARATION LOGIC Separation logic: defines the interpretation of ^ , _ , ñ , › , − − › , ... Hybrid separation logic: separation logic + ℓ ( heap variables or labels ) + @ ℓ A ( @ -modality) + D -quantifiers on labels ρ : valuation: Labels á Heaps h | ù ρ ℓ ô h = ρ p ℓ q h | ù ρ @ ℓ A ô ρ p ℓ q | ù ρ A h | ù ρ D ℓ : A ô exists h ℓ heap st. h | ù ρ r ℓ Ñ h ℓ s A Armaël Guéneau Program Proofs in Hybrid Separation Logic 17/31
Recommend
More recommend
