Biabduction (and Related Problems) in Array Separation Logic

We investigate array separation logic (ASL), a variant of symbolic-heap separation logic in which the data structures are either pointers or arrays, i.e., contiguous blocks of allocated memory. This logic provides a language for compositional memory safety proofs of imperative array programs. We focus on the biabduction problem for this logic, which has been established as the key to automatic specification inference at the industrial scale. We present an NP decision procedure for biabduction in ASL that produces solutions of reasonable quality, and we also show that the problem of finding a consistent solution is NP-hard. Along the way, we study satisfiability and entailment in our logic, giving decision procedures and complexity bounds for both problems. We show satisfiability to be NP-complete, and entailment to be decidable with high complexity. The somewhat surprising fact that biabduction is much simpler than entailment is explained by the fact that, as we show, the element of choice over biabduction solutions enables us to dramatically reduce the search space.

[1]  Larry J. Stockmeyer,et al.  The Polynomial-Time Hierarchy , 1976, Theor. Comput. Sci..

[2]  Henny B. Sipma,et al.  What's Decidable About Arrays? , 2006, VMCAI.

[3]  Joël Ouaknine,et al.  Foundations for Decision Problems in Separation Logic with General Inductive Predicates , 2014, FoSSaCS.

[4]  Peter Müller,et al.  Automatic Verification of Iterated Separating Conjunctions Using Symbolic Execution , 2016, CAV.

[5]  W. Marsden.  I and J , 2012 .

[6]  David S. Johnson,et al.  Computers and Intractability: A Guide to the Theory of NP-Completeness , 1978 .

[7]  Andrei Voronkov,et al.  Finding Loop Invariants for Programs over Arrays Using a Theorem Prover , 2009, FASE.

[8]  Peter W. O'Hearn,et al.  Compositional Shape Analysis by Means of Bi-Abduction , 2011, JACM.

[9]  R. Stephenson.  A and V , 1962, The British journal of ophthalmology.

[10]  Samin Ishtiaq,et al.  SLAyer: Memory Safety for Systems-Level Code , 2011, CAV.

[11]  Peter W. O'Hearn,et al.  Resources, concurrency, and local reasoning , 2007 .

[12]  Peter W. O'Hearn,et al.  A Semantic Basis for Local Reasoning , 2002, FoSSaCS.

[13]  Shengchao Qin,et al.  Automated Verification of Shape, Size and Bag Properties , 2007, 12th IEEE International Conference on Engineering Complex Computer Systems (ICECCS 2007).

[14]  Daisuke Kimura,et al.  Separation Logic with Monadic Inductive Definitions and Implicit Existentials , 2015, APLAS.

[15]  Taolue Chen,et al.  A Complete Decision Procedure for Linearly Compositional Separation Logic with Data Constraints , 2016, IJCAR.

[16]  Amir Pnueli,et al.  Range Allocation for Separation Logic , 2004, CAV.

[17]  James Brotherston.  Formalised Inductive Reasoning in the Logic of Bunched Implications , 2007, SAS.

[18]  Reuben N. S. Rowe,et al.  Model checking for symbolic-heap separation logic with inductive predicates , 2016, POPL.

[19]  Jürgen Giesl,et al.  Automatically Proving Termination and Memory Safety for Programs with Pointer Arithmetic , 2014, Journal of Automated Reasoning.

[20]  Joël Ouaknine,et al.  Tractable Reasoning in a Fragment of Separation Logic , 2011, CONCUR.

[21]  Peter W. O'Hearn,et al.  A Decidable Fragment of Separation Logic , 2004, FSTTCS.

[22]  James Brotherston,et al.  Cyclic Abduction of Inductively Defined Safety and Termination Preconditions , 2014, SAS.

[23]  Supratik Chakraborty,et al.  Bottom-Up Shape Analysis , 2009, SAS.

[24]  Constantin Enea,et al.  A Logic-Based Framework for Reasoning about Composite Data Structures , 2009, CONCUR.

[25]  John C. Reynolds,et al.  Separation logic: a logic for shared mutable data structures , 2002, Proceedings 17th Annual IEEE Symposium on Logic in Computer Science.

[26]  Silvio Ghilardi,et al.  Decision Procedures for Flat Array Properties , 2014, Journal of Automated Reasoning.

[27]  Peter W. O'Hearn,et al.  Moving Fast with Software Verification , 2015, NFM.

[28]  James Brotherston,et al.  A decision procedure for satisfiability in separation logic with inductive predicates , 2014, CSL-LICS.

[29]  Silvio Ghilardi,et al.  Decision Procedures for Flat Array Properties , 2014, TACAS.

[30]  B. Scarpellini.  Complexity of subcases of Presburger arithmetic , 1984 .

[31]  Neil Immerman,et al.  Sparse sets in NP-P: Exptime versus nexptime , 1983, STOC.

[32]  Peter W. O'Hearn,et al.  Resources, Concurrency and Local Reasoning , 2004, CONCUR.

[33]  Shengchao Qin,et al.  Shape Analysis via Second-Order Bi-Abduction , 2014, CAV.

[34]  Radu Iosif,et al.  The Tree Width of Separation Logic with Recursive Definitions , 2013, CADE.

[35]  Frank Piessens,et al.  VeriFast: A Powerful, Sound, Predictable, Fast Verifier for C and Java , 2011, NASA Formal Methods.

[36]  P ? ? ? ? ? ? ? % ? ? ? ? , 1991 .

[37]  Isil Dillig,et al.  Fluid Updates: Beyond Strong vs. Weak Updates , 2010, ESOP.

[38]  ChinWei-Ngan,et al.  Automated verification of shape, size and bag properties via user-defined predicates in separation logic , 2012 .

[39]  Peter W. O'Hearn,et al.  The Complexity of Abduction for Separated Heap Abstractions , 2011, SAS.

[40]  Peter W. O'Hearn,et al.  Compositional Shape Analysis by Means of Bi-Abduction , 2011, JACM.

[41]  Patrick Cousot,et al.  Automatic Inference of Necessary Preconditions , 2013, VMCAI.

[42]  Jun Sun,et al.  Satisfiability Modulo Heap-Based Programs , 2016, CAV.

[43]  Peter W. O'Hearn,et al.  Separation and information hiding , 2004, POPL.

[44]  Patrick Cousot,et al.  A parametric segmentation functor for fully automatic and scalable array content analysis , 2011, POPL '11.

[45]  Ronald Fagin,et al.  The Closure of Monadic NP , 2000, J. Comput. Syst. Sci..

[46]  Neil Immerman,et al.  Sparse Sets in NP-P: EXPTIME versus NEXPTIME , 1985, Inf. Control..

[47]  Xin-She Yang,et al.  Introduction to Algorithms , 2021, Nature-Inspired Optimization Algorithms.

[48]  Erich Grädel.  Subclasses of Presburger Arithmetic and the Polynomial-Time Hierarchy , 1988, Theor. Comput. Sci..

[49]  Constantin Enea,et al.  Accurate Invariant Checking for Programs Manipulating Lists and Arrays with Infinite Data , 2012, ATVA.

[50]  Christoph Haase,et al.  Subclasses of presburger arithmetic and the weak EXP hierarchy , 2014, CSL-LICS.