Citation Context

...volves defining an abductive inference algorithm for use with a shape analysis. We define a new procedure for performing abductive inference for (certain) separation logic assertions which, following =-=[5, 11]-=-, are used to define the abstract states in our analysis. In fact, to treat procedure calls we must deal with a more general problem, which we call biabduction, that infers “frames” describing extra, ...

Citation Context

...action (a.k.a. canonicalization or blurring) to aid convergence to a fixed point. In this work we use a representation of abstract states based on separation logic formulæ, building on the methods of =-=[1, 4]-=-. There are two key technical ideas used in our new analysis: Generic inductive spatial predicates: We define a new abstract domain which uses a higher-order generalization of the list predicates cons...

Citation Context

...wever, requires both. Towards the elusive goal of finding a scalable and precise analysis, in this paper we describe a new join operation, ⊔† , for shape analysis tools based on the separation domain =-=[10, 17, 4]-=-. ⊔† provides a mixture of scalability and precision sufficient for the problem of proving pointer safety of whole industrial device drivers. A join operation (in the terminology of abstract interpret...

Citation Context

... (→E) which incrementally reveals the pointer structure of abstracted or summarized heap objects, and an abstraction step (→) which enables convergence to fixed-points. Sonar is based on SpaceInvaDer =-=[7]-=-. The difference between the two analysis engines is in Sonar’s tracking of depths of inductive heap predicates. Depth does not necessarily refer to lengths of pointer chains in the heap, but instead ...

Citation Context

...ed Heap Abstractions 247 3.2 Intraprocedural Analysis As a part of its interprocedural analysis, Summate must also implement an intraprocedural analysis. For this Summate implements the analysis from =-=[6, 4]-=-. This analysis is defined in Appendix B. A complete exposition is found in [6]. The intraprocedural analysis defines a set of canonical symbolic heaps CSH ⊂ SH on which the analysis operates, a canon...

Citation Context

...ρ is empty. Note that the above definition of lsegi is imprecise (cf. Def. 8 in §2.4): lsegi(E,E, ∅) describes both the empty heap and a cyclic list. So far program analyses based on separation logic =-=[7, 24]-=- have used precise list segments. Using imprecise list segments simplifies the theorem prover, as the side-conditions for appending list segments are not needed. In contrast, frame inference (i.e. giv...

Citation Context

...uantified invariant is studied. A second line of work uses abstract interpretation based techniques for shape analysis. Examples include those based on three-valued logic [28,22] and Separation Logic =-=[10]-=-. The abstract domain for arrays presented in [12] captures properties similar to range predicates. Predicate abstraction [13] based approaches for shape analysis [11,9,5,26,21,1] can also be viewed a...