Abstract

Abstract. The problem of preserving unmodified facts across a statement is often referred to as the frame problem in program verification. The problem manifests most often while reasoning about procedure calls, because of scoping and modification of possibly unbounded set of heap locations. Existing approaches to deal with the frame problem are either too imprecise, require specialized extension to the assertion logic or require introducing untrusted assumptions in the verifier. In this work, we propose a frame rule for arbitrary statements, without requiring specialized assertion logic. We show how to exploit this frame rule for procedure calls to deal with scoping. We also provide a new annotation called call invariants that allows the user to specify the frame when dealing with unbounded updates in a call. Our approach allows us to leverage existing techniques for reasoning about call-free programs to precisely reason about programs with procedure calls. We have implemented the approach and applied it to the verification of examples containing dynamic memory allocations, linked lists, and arrays. We observe that most call invariants have a fairly simple shape and discuss ways to reduce the annotation overhead. 1

Citations