A Product of Shape and Sequence Abstractions
Résumé
Traditional separation logic-based shape analyses utilize in-
ductive summarizing predicates so as to capture general properties of the
layout of data-structures, to verify accurate manipulations of, e.g., various
forms of lists or trees. However, they also usually abstract away contents
properties, so that they may only verify memory safety and invariance of
data-structure shapes. In this paper, we introduce a novel abstract domain
to describe sequences of values of unbounded size, and track constraints
on their length and on extremal values contained in them. We define a
reduced product of such a sequence abstraction together with an existing
shape abstraction so as to infer both shape and contents properties of
data-structures. We report on the implementation of the sequence domain,
its integration into a static analyzer for C code, and we evaluate its ability to
verify partial functional correctness properties for list and tree algorithms.
Domaines
Informatique [cs]Origine | Fichiers produits par l'(les) auteur(s) |
---|