1. Local Heap Shape Analysis Noam Rinetzky Tel Aviv University Joint work with Jörg Bauer Universität des Saarlandes Thomas Reps University of Wisconsin Mooly Sagiv Tel Aviv University Reinhard Wilhelm Universität des Saarlandes Eran Yahav IBM Watson

2. Motivation Verify heap intensive programs  Imperative programs with procedures  Recursive data structures Lists Trees …

3. Motivation class List { List n; } main() { List x=null, y=null; int k = getLen(); x = create(k); y = reverse(x); } … k=4 x y nnn x y nnn No null dereferences No memory leaks x and y point to the same list y points to an acyclic list k=4 x y reverse: reverses terminates

4. What is the problem? Recursive procedures  Unbounded number of activation records Dynamic allocation  Unbounded number of objects Checking heap properties is undecidable

5. Our approach Use abstractions Over-approximation algorithms Effective (termination) Every verified property holds (sound)  May not prove all properties (incomplete)

6. y t g p Local heaps y t g call f(x); x p p p x

7. Canonical abstraction x n n n x n n

8. Tabulation exits y Interprocedural shape analysis call f(x) p x y x p

9. p y Interprocedural shape analysis call f(x) x y p p No tabulation Analyze f p x

10. y t g p Cutpoints y t g call f(x); x p p p ? x

11. Cutpoints and abstraction x n n n y n n n d d d d call f(x) p n n n Canonical abstraction p n n n p n n n

12. y t g p p Abstraction of cutpoints y t g call f(x); x p p x

13. Prototype implementation Data structureVerified properties Singly linked list Insert delete reverse … No memory errors acyclicity Sorting (of singly linked lists) insertion quickSort + Sortedness Unshared binary trees Insert Delete … No memory errors, tree-ness

14. Related Work Interprocedural shape analysis  Rinetzky and Sagiv, CC ’01  Chong and Rugina, SAS ’03  Jeannet et al., SAS ’04  Hackett and Rugina, POPL ’05  Rinetzky et al., POPL ‘05 Local Reasoning  Ishtiaq and O’Hearn, POPL ‘01  Reynolds, LICS ’02 Encapsulation  Noble et al. IWACO ’03 ...

15. End www.cs.tau.ac.il/~maon Interprocedural shape analysis for cutpoint-free programs Noam Rinetzky, Mooly Sagiv, and Eran Yahav SAS, 2005 A Semantics for procedure local heaps and its abstraction Noam Rinetzky, Jörg Bauer, Thomas Reps, Mooly Sagiv, and Reinhard Wilhelm POPL, 2005