Shape Analysis concerns the problem of determining "shape invariants"...

This paper addresses the problem of establishing temporal properties of programs written in languages, such as Java, that make extensive use of the heap to allocate--- and deallocate---new objects and threads. Establishing liveness properties is a particularly hard challenge. One of the crucial obstacles is that heap locations have no static names and the number of heap locations is unbounded. The paper presents a framework for the verification of Java-like programs. Unlike classical model checking, which uses propositional temporal logic, we use first-order temporal logic to specify temporal properties of heap evolutions; this logic allows domain changes to be expressed, which permits allocation and deallocation to be modelled naturally. The paper also presents an abstract-interpretation algorithm that automatically verifies temporal properties expressed using the logic.

Abstract. This paper addresses the problem of establishing temporal properties of programs written in languages, such as Java, that make extensive use of the heap to allocate—and deallocate—new objects and threads. Establishing liveness properties is a particularly hard challenge. One of the crucial obstacles is that heap locations have no static names and the number of heap locations is unbounded. The paper presents a framework for the verification of Java-like programs. We use first-order modal logic to specify temporal properties of heap evolutions; this logic is a simple variant of existing first-order modal logics that allow expressing universe changes. The paper also presents an abstract-interpretation algorithm that automatically verifies temporal properties expressed using the logic. 1

1 Introduction Modern programming languages, such as Java, make extensive use of the heap. Thecontents of the heap may evolve during program execution due to dynamic allocation and deallocation of objects. Moreover, in Java, threads are first-class objects that can bedynamically allocated. Statically reasoning about temporal properties of such programs is quite challenging, because there are no a priori bounds on the number of allocatedobjects, or restrictions on the way the heap may evolve. In particular, proving liveness properties of such programs, e.g., that a thread is eventually created in response to eachrequest made to a web server, can be a quite difficult task.