Slide 1

Type-Based Data Structure VerificationMing Kawaguchi, Patrick Rondon, Ranjit JhalaUniversity of California, San Diego1Goal: Static Software Verification

Verify absence of run-time errors

Buffer overflowsDeadlocksAssertion failures

Requires precise data structure verificationThe Problem With Structures125341253412435Unbounded Size Need Universally Quantified PropertiesEvery element has property PSpend a lot of time here3ContributionsPrecise properties of individual cellsTypesPredicatesLift properties toinvariants on structures4ContributionsRecursive Structures (Lists, Trees)Table Structures (Fields, Arrays, Hash Maps)Supports InferenceExpressive Sorted, Duplicate-Free, Height-Balanced, Acyclic, Practical Sorting Algorithms, Splay Heaps, Binary Heaps, AVL Trees, Red-Black Trees, Vectors, Union-Find, BDDs, Predicate-Type MechanismsTypeMechanisms Refined5PlanContributionsTypes & StructuresRefined Types & Data StructuresExpressivenessResultsMake black spaces then delete6Types & Structures How do types handle structures?Represent Universal PropertiesAlgorithm for Instantiating PropertiesAlgorithm for Generalizing PropertiesAlgorithm for Inference71. Representation: Recursive Types1231::(2::(3::[]))type int list = | [] | :: of x:int * int list[]::x:int[]::x:int[]::h1:int[]::x:int[]::h2:int[]::x:int[]::h3:int[]::x:int1. Representation: Recursive TypesType UnfoldingUniversal Property:For all x in l, x is an intUniversal Property:h1: int, h2: int, h3: int, Types & Structures How do types handle structures?Represent Universal PropertiesAlgorithm for Instantiating PropertiesAlgorithm for Generalizing PropertiesAlgorithm for Inference

2. Instantiation Algorithm: Unfold[]::x:intUnfold::h:int[]::x:intl : int listh:intt:int listInstantiatetll = h::t3. Generalization Algorithm: Fold[]::x:intFold::h:int[]::x:inth:intt:int listGeneralizetll = h::tl : int listTypes & Structures How do types handle structures?Represent Universal PropertiesAlgorithm for Instantiating PropertiesAlgorithm for Generalizing PropertiesAlgorithm for Inference

let rec insert(x,l) = match l with | [] -> x::[] | h::t -> if x x::[] | h::t -> if x x::[] | h::t -> if x x::[] | h::t -> if x x::[] | h::t -> if x