TY - GEN
T1 - Property-directed shape analysis
AU - Itzhaky, Shachar
AU - Bjørner, Nikolaj
AU - Reps, Thomas
AU - Sagiv, Mooly
AU - Thakur, Aditya
PY - 2014
Y1 - 2014
N2 - This paper addresses the problem of automatically generating quantified invariants for programs that manipulate singly and doubly linked-list data structures. Our algorithm is property-directed-i.e., its choices are driven by the properties to be proven. The algorithm is able to establish that a correct program has no memory-safety violations-e.g., null-pointer dereferences, double frees-and that data-structure invariants are preserved. For programs with errors, the algorithm produces concrete counterexamples. More broadly, the paper describes how to integrate IC3 with full predicate abstraction. The analysis method is complete in the following sense: if an inductive invariant that proves that the program satisfies a given property is expressible as a Boolean combination of a given set of predicates, then the analysis will find such an invariant. To the best of our knowledge, this method represents the first shape-analysis algorithm that is capable of (i) reporting concrete counterexamples, or alternatively (ii) establishing that the predicates in use are not capable of proving the property in question.
AB - This paper addresses the problem of automatically generating quantified invariants for programs that manipulate singly and doubly linked-list data structures. Our algorithm is property-directed-i.e., its choices are driven by the properties to be proven. The algorithm is able to establish that a correct program has no memory-safety violations-e.g., null-pointer dereferences, double frees-and that data-structure invariants are preserved. For programs with errors, the algorithm produces concrete counterexamples. More broadly, the paper describes how to integrate IC3 with full predicate abstraction. The analysis method is complete in the following sense: if an inductive invariant that proves that the program satisfies a given property is expressible as a Boolean combination of a given set of predicates, then the analysis will find such an invariant. To the best of our knowledge, this method represents the first shape-analysis algorithm that is capable of (i) reporting concrete counterexamples, or alternatively (ii) establishing that the predicates in use are not capable of proving the property in question.
UR - http://www.scopus.com/inward/record.url?scp=84904811642&partnerID=8YFLogxK
U2 - 10.1007/978-3-319-08867-9_3
DO - 10.1007/978-3-319-08867-9_3
M3 - פרסום בספר כנס
AN - SCOPUS:84904811642
SN - 9783319088662
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 35
EP - 51
BT - Computer Aided Verification - 26th International Conference, CAV 2014, Held as Part of the Vienna Summer of Logic, VSL 2014, Proceedings
PB - Springer Verlag
Y2 - 18 July 2014 through 22 July 2014
ER -