Modular Data Structure kuncak/papers/Kuncak07DecisionProcedures... Developers write Jahob...

download Modular Data Structure kuncak/papers/Kuncak07DecisionProcedures... Developers write Jahob speci¯¬¾cations

of 166

  • date post

    01-Jun-2020
  • Category

    Documents

  • view

    0
  • download

    0

Embed Size (px)

Transcript of Modular Data Structure kuncak/papers/Kuncak07DecisionProcedures... Developers write Jahob...

  • Modular Data Structure Verification

    by

    Viktor Kuncak

    Submitted to the Department of Electrical Engineering and Computer Science

    in partial fulfillment of the requirements for the degree of

    Doctor of Philosophy

    at the

    MASSACHUSETTS INSTITUTE OF TECHNOLOGY

    February 2007

    c© Massachusetts Institute of Technology 2007. All rights reserved.

    Author . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

    Department of Electrical Engineering and Computer Science

    February 2007

    Certified by. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

    Martin C. Rinard

    Professor of Computer Science and Engineering

    Thesis Supervisor

    Accepted by . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

    Arthur C. Smith

    Chairman, Department Committee on Graduate Students

  • 2

  • Modular Data Structure Verification

    by

    Viktor Kuncak

    Submitted to the Department of Electrical Engineering and Computer Science on February 2007, in partial fulfillment of the

    requirements for the degree of Doctor of Philosophy

    Abstract

    This dissertation describes an approach for automatically verifying data structures, focusing on techniques for automatically proving formulas that arise in such verification. I have implemented this approach with my colleagues in a verification system called Jahob. Jahob verifies properties of Java programs with dynamically allocated data structures.

    Developers write Jahob specifications in classical higher-order logic (HOL); Jahob re- duces the verification problem to deciding the validity of HOL formulas. I present a new method for proving HOL formulas by combining automated reasoning techniques. My method consists of 1) splitting formulas into individual HOL conjuncts, 2) soundly approx- imating each HOL conjunct with a formula in a more tractable fragment and 3) proving the resulting approximation using a decision procedure or a theorem prover. I present three concrete logics; for each logic I show how to use it to approximate HOL formulas, and how to decide the validity of formulas in this logic.

    First, I present an approximation of HOL based on a translation to first-order logic, which enables the use of existing resolution-based theorem provers. Second, I present an approximation of HOL based on field constraint analysis, a new technique that enables decision procedures for special classes of graphs (such as monadic second-order logic over trees) to be applied to arbitrary graphs.

    Third, I present an approximation using Boolean Algebra with Presburger Arithmetic (BAPA), a logic that combines reasoning about sets of elements with reasoning about car- dinalities of sets. BAPA can express relationships between sizes of data structures and invariants that correlate data structure size with integer variables. I present the first im- plementation of a BAPA decision procedure, and establish the exact complexity bounds for BAPA and quantifier-free BAPA.

    Together, these techniques enabled Jahob to modularly and automatically verify data structure implementations based on singly and doubly-linked lists, trees with parent point- ers, priority queues, and hash tables. In particular, Jahob was able to prove that data structure implementations satisfy their specifications, maintain key data structure invari- ants expressed in a rich logical notation, and never produce run-time errors such as null dereferences or out of bounds accesses.

    Thesis Supervisor: Martin C. Rinard Title: Professor of Computer Science and Engineering

    3

  • Acknowledgments

    I would like to thank my advisor Martin Rinard for his guidance in all the years of graduate school, for providing me with an environment where I was able to dedicate myself to research as never before, for teaching me to think about the implications of my research, and for his patience to work with me on papers and talks. I thank my thesis committee member Daniel Jackson for numerous discussions on logic and its use in software analysis, for a very enjoyable collaboration experience, and for his excellent questions about my technique for combining reasoning procedures described in Chapter 4. I thank my thesis committee member Professor Arvind for great discussions about programing languages, analysis, and methodology.

    I thank my collaborators, who greatly enriched my research and life experience and made the sleepless nights before each deadline so entertaining. I thank Andreas Podelski for discussions about program analysis that started a fruitful collaboration, for his wise ad- vice, and for hosting me at the Max-Planck Institute for Computer Science. I thank Charles Bouillaguet for his work on the translation to first-order logic described in Chapter 5. I thank Thomas Wies for developing a sophisticated symbolic shape analysis whose one part is the field constraint analysis described in Chapter 6, and implementing parts of Jahob in- frastructure. I thank Huu Hai Nguyen for implementing a first translation from higher-order logic to BAPA and an interface to the Omega solver, on which the experience of Section 7.7 is based. I thank Karen Zee for her contributions to Hob and Jahob infrastructure, for many proved formulas and many discussions. I thank Patrick Lam for his role in designing and building the Hob system. Without our experience with Hob, I would have never started building Jahob. I thank Bruno Marnette for exciting discussions on polynomial-time logics for sets with cardinality constraints. I thank Rustan Leino for a great internship experience at Microsoft Research and many insightful discussions on program verification methodol- ogy. I thank Konstantine Arkoudas for introducing me to his Athena interactive theorem proving environment. I thank Peter Schmitt and Suhabe Bugrara who used Jahob in its early days to specify and verify Java programs.

    For useful discussions I also thank: current and previous members of our research group C. Scott Ananian, Chandrasekhar Boyapati, Michael Carbin, Brian Demsky, Zoran Džunić, Maria-Cristina Marinescu, Darko Marinov, Radu Rugina, Alexandru Salcianu, and Amy Williams, my MIT colleagues including Greg Dennis, Micha l Karczmarek, Sarfraz Khurshid, Angelina Lee, Karola Meszaros, Sayan Mitra, Derek Rayside, Gregory Shakhnarovich, Mana Taghdiri, Bill Thies, Michael Taylor, Emina Torlak, Mandana Vaziri, David Wentzlaff, and to my colleagues around the world, including Sumit Gulwani, Mayur Naik, Ružica Piskač, Andrey Rybalchenko, and Greta Yorsh.

    I thank my parents, Katarina Kunčak and Jaroslav Kunčak, and to my brother, Miro Kunčak, for their continuous support, for numerous emails, and for coming to visit me in Boston this October—it was a wonderful week.

    Finally, I thank you, the reader who came across this document. While no part of a dissertation can be as entertaining as the acknowledgments, I hope you find something of interest on the pages that follow.

    Viktor Kuncak , Cambridge, Massachusetts

    November 2006

    4

  • Contents

    1 Introduction 9

    1.1 Program Verification Today . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

    1.2 Verification of Data Structures . . . . . . . . . . . . . . . . . . . . . . . . . 10

    1.3 The Design of the Jahob Verification System . . . . . . . . . . . . . . . . . 11

    1.4 Reasoning about Expressive Constraints in Jahob . . . . . . . . . . . . . . . 12

    1.5 Summary of Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

    2 An Example of Data Structure Verification in Jahob 15

    2.1 A Jahob Session . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

    2.2 Specifying Java Programs in Jahob . . . . . . . . . . . . . . . . . . . . . . . 15

    2.3 Details of a Container Implementation and Specification . . . . . . . . . . . 17

    2.4 Generating Verification Conditions in Jahob . . . . . . . . . . . . . . . . . . 21

    2.5 Proving Formulas using Multiple Reasoning Procedures . . . . . . . . . . . 23

    3 An Overview of the Jahob Verification System 27

    3.1 Implementation Language Supported by Jahob . . . . . . . . . . . . . . . . 27

    3.2 Specification Constructs in Jahob . . . . . . . . . . . . . . . . . . . . . . . . 28

    3.2.1 Procedure Contracts . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

    3.2.2 Specification Variables . . . . . . . . . . . . . . . . . . . . . . . . . . 29

    3.2.3 Class Invariants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

    3.2.4 Encapsulating State in Jahob . . . . . . . . . . . . . . . . . . . . . . 31

    3.2.5 Annotations within Procedure Bodies . . . . . . . . . . . . . . . . . 32

    3.2.6 Meaning of Formulas . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

    3.2.7 Receiver Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

    3.2.8 Meaning of Frame Conditions . . . . . . . . . . . . . . . . . . . . . . 35

    3.3 Generating Verification Conditions . . . . . . . . . . . . . . . . . . . . . . . 36

    3.3.1 From Java to Guarded Command Language . . . . . . . . . . . . . . 36

    3.3.2 Weakest Preconditions . . . . . . . . . . . . . . . . . . . . . . . . . . 37

    3.3.3 Handling Specification Variables . . . . . . . . . . . . . . . . . . . . 38

    3.3.4 A