Lazy Heap Analysis with Symbolic Memory Graphs Alexander Driemeyer

Outline 1. Motivation 2. CPAchecker and Symbolic Memory Graphs 3. Abstractions of Symbolic Memory Graphs 4. Using counterexample guided abstraction refinement with Symbolic Memory Graphs 5. Challenges and conclusion

Motivation ● Use symbolic memory graphs to verify programs with complex heap structures ● Use abstraction to be able to check all possible states of a program for the specified safety property ● Use abstraction refinement to find a level of abstraction that is as coarse as possible while still fine enough to eliminate all spurious safety property violation

CPAchecker CPAchecker program + specification CFA ARG 5 @ N2 1 int main() { main 2 [] 2 Line 9: int a; int a; 3 int a = nondet_int(); 6 @ N3 3 main [] 5 a = nondet(); Line 9: a = __VERIFIER_nondet_int(); 6 if(a == 5) { 7 @ N4 4 main 7 a = 7; [] [a != 5] [a == 5] 8 } else { Line 11: [!(a == 5)] Line 11: [a == 5] 7 6 9 a = 6; 9 @ N7 8 @ N6 main main [] [main::a=5] 10 } a = 6; a = 7; Line 14: a = 6; Line 12: a = 7; 11 } 10 @ N9 13 @ N8 main main 9 8 [main::a=6] [main::a=7] Line 14: Line 15: 11 @ N5 14 @ N5 5 main main [main::a=6] [main::a=7] default return; Line 15: default return Line 15: default return 12 @ N0 15 @ N0 0 main exit main exit [main::a=6] [main::a=7]

Symbolic Memory Graph (SMG) ● Represents sets of heap graphs of a program at a program location ● Supports read and write operations, join of smgs, checking values for equality and inequality, and list abstraction ● Detects memory leaks and invalid read, write or free operations

List Abstraction ● Used to handle infinitely recursive list segments ● Heap objects are abstracted to list segments and the sub-graphs of the heap objects are joined together ● Whether to execute a possible list abstraction depends on the number of heap objects that can be abstracted into a list, and the loss of information when joining their sub graphs

SMG Precision ● Determines the level of abstraction of a program verification with symbolic memory graphs ● Consist of sets of memory locations, memory paths and locks for list abstractions for every program location ● Adjusts symbolic memory graphs of abstract states in the ARG after each calculation of new abstract states for the ARG

Counterexample guided abstraction refinement ● Method to obtain a good level of abstraction for an analysis for a program ● 1 Step Abstraction : Construct an abstract model of the program ● 2 Step Verification: Check if the model violates a chosen safety property ● 3 Step Refinement: Refine the level of abstraction based on a found spurious counterexample

CEGAR with Symbolic Memory Graphs ● Use SMG precision to determine the level of abstraction for Step 1 ● Use the full SMG precision on a path to check if a found counterexample is feasible for Step 2 ● Use the flow dependence of the SMGs of the spurious counterexample to calculate the new SMG precision for step 3

Lazy Abstraction ● Used to improve performance of Counterexample guided abstraction refinement ● Instead of continuously recalculating the abstract model after each refinement step, calculate the model and the refinement of the model on the fly

Lazy Abstraction

Example

Challenges And Conclusion ● Finding a better refinement method for list abstractions ● A method to reduce the loss of information when writing to program location that is not known at the current level of abstraction ● Heap abstraction for trees and other data structures

Lazy Heap Analysis with Symbolic Memory Graphs Alexander Driemeyer - PowerPoint PPT Presentation

Lazy Heap Analysis with Symbolic Memory Graphs Alexander Driemeyer Outline 1. Motivation 2. CPAchecker and Symbolic Memory Graphs 3. Abstractions of Symbolic Memory Graphs 4. Using counterexample guided abstraction refinement with Symbolic

Shape Analysis via Symbolic Memory Graphs and Conversion from Pointers to Containers Kamil Dudka

Symbolic Memory Graphs invariant and corresponding optimizations for SMGCPA Anton Vasilyev

EDA045F: Program Analysis LECTURE 6: DATALOG Christoph Reichenbach In the last lecture. . .

Interprocedural Heap Analysis using Access Graphs and Value Contexts with applications to

Symbolic Heap Abstraction with Demand-Driven Axiomatization of Memory Invariants Isil Dillig

Symbolic Reachability Analysis of Lazy Linear Hybrid Automata Susmit Jha, Bryan Brady and

Say Goodbye to Off-heap Caches! On-heap Caches Using Memory-Mapped I/O Iacovos G. Kolokasis 1 ,

Dynamic Memory Allocation in the Heap (malloc and free) Explicit allocators (a.k.a. manual memory

A non-moving collector Organization of heap memory in GC Heap memory falls in 4 sets in a GC

Dynamic Memory Overview Dynamically allocated memory is stored in the Heap-section of

the stack & the heap hic 1 memory management So far: data representations: how are

Last week Data can be allocated on the stack or on the heap (aka dynamic memory) or on the heap

Heap Cloning: Enabling Dynamic Symbolic Execution of Java Programs Saswat Anand Mary Jean

Dynamic Memory Allocation in the Heap (malloc and free) Now: Explicit allocators (a.k.a. manual

Symbolic Bayesian inference by lazy partial evaluation Chung-chieh Shan (Indiana University)

Virtual Memory Thierry Sans The problem of managing the memory How to make programs and

iPod Usage Study Quantitative Research Report Prepared for Apple iPod Team December 4, 2015

Open Source SQL databases enters millions queries per second era Alexander Korotkov, Sveta

NOvA Beam Stability Alexander Radovic College of William and Mary Justin Vasel Indiana

Mass dependence of the heavy quark potential and its effects on quarkonium states Alexander

NANCY DUARTE Alexander Zandelov & Julia Panek || Interaction Engeneering || Prof. Dr. Michael

Design Patterns: Background Design Patterns: Background Five Principles (revisited)

Software Engineering I cs361 Announcements Friday Extra office hour of Coding Lab 2-3pm

Christopher Alexanders Thought and Eastern Philosophy Zen, Mindfulness and Egoless Creation