Modular Verification with Shared Abstractions

Transcription

1 Modular Verification with Shared Abstractions Uri Juhasz Noam Rinetzky Arnd Poetzsch-Heffter Mooly Sagiv Eran Yahav Tel Aviv University Tel Aviv University Universität Kaiserlautern Tel Aviv University IBM Research

2 goal verify imperative heap-manipulating programs cleanness (no memory errors) invariants partial correctness... modularly

3 a non-modular verification Client DS x, z; Data Struct. DS{... b()...}

4 a non-modular verification x z Client DS x, z; Data Struct. DS{... b()...}

5 a non-modular verification x z Client z.b() DS x, z; Data Struct. DS{... b()...}

6 a non-modular verification x z z Client z.b() DS x, z; Data Struct. DS{... b()...}

7 a non-modular verification x z x z Client z.b() DS x, z; Data Struct. DS{... b()...}

8 modular verification Client DS x, z; Data Struct. DS{... b()...}

9 modular verification x z Client DS x, z; Data Struct. DS{... b()...}

10 modular verification x z Client z.b() DS x, z; Data Struct. DS{... b()...}

11 modular verification x z z Client z.b() DS x, z; Data Struct. DS{... b()...}

12 modular verification x z x z Client z.b() DS x, z; Data Struct. DS{... b()...}

13 the plot thicken... modular verification sharing Client DS x, z; Data Struct. DS{... b()...}

14 the plot thicken... modular verification sharing x z Client DS x, z; Data Struct. DS{... b()...}

15 the plot thicken... modular verification sharing x z Client DS x, z; Data Struct. DS{... b()...}

16 the plot thicken... modular verification sharing x z Client DS x, z; Data Struct. DS{... b()...}

17 the plot thicken... modular verification sharing x z Client DS x, z; Data Struct. DS{... b()...}

18 the plot thicken... modular verification sharing x z Client z.b() DS x, z; Data Struct. DS{... b()...}

19 the plot thicken... modular verification sharing x z z Client z.b() DS x, z; Data Struct. DS{... b()...}

20 the plot thicken... modular verification sharing x z z Client z.b() DS x, z; Data Struct. DS{... b()...}

21 the plot thicken... modular verification sharing x z x z Client z.b() DS x, z; Data Struct.? DS{... b()...}

22 the plot thicken... modular verification sharing x z x z Client z.b() DS x, z; Data Struct. DS{... b()...}?

23 the plot thicken... modular verification sharing x z x z Client z.b() DS x, z; Data Struct. DS{... b()...}?

24 the plot thicken... modular verification sharing x z x z Client z.b() DS x, z; Data Struct. DS{... b()...}?

25 main contributions approach for modular verification allows sharing spec + proof obligation control inter-module sharing modular static analysis

26 S(y) sep. logic for oo [Bierman+ 05] disjoint abstractions x z x y P(x,y) S(y) Q(z,y) P(x,y) y

27 y S( Boogie [Barnett+ 04] packed abstractions x z x y y P(x,y) S(y) Q(z,y) P(x,y)

28 x our approach z x z P(x,y) y S(y) Q(z,y) & P(x,y) y y S(y) Q(z,y)

29 our approach shared abstractions z x z y y y S(y) Q(z,y) P(x,y) Q(z,y) y S(y)

30 our approach controlled exposure of aliasing Client DS x, z; Data Struct. DS{... b()...}

31 our approach controlled exposure of aliasing x z Client DS x, z; Data Struct. DS{... b()...}

32 our approach controlled exposure of aliasing x z Client DS x, z; Data Struct. DS{... b()...}

33 our approach controlled exposure of aliasing x z Client DS x, z; Data Struct. DS{... b()...}

34 our approach controlled exposure of aliasing x z Client DS x, z; Data Struct. DS{... b()...}

35 our approach controlled exposure of aliasing x z Client z.b() DS x, z; Data Struct. DS{... b()...}

36 our approach controlled exposure of aliasing x z z Client z.b() DS x, z; Data Struct. DS{... b()...}

37 our approach controlled exposure of aliasing x z z Client z.b() DS x, z; Data Struct. DS{... b()...}

38 our approach controlled exposure of aliasing x z x z Client z.b() DS x, z; Data Struct. DS{... b()...}?

39 our approach controlled exposure of aliasing x z x z Client z.b() DS x, z; Data Struct. DS{... b()...}?

40 our approach controlled exposure of aliasing aggregate model function x z x z Client z.b() DS x, z; Data Struct. DS{... b()...}?

41 our approach controlled exposure of aliasing aggregate model function x z x z Client z.b() DS x, z; Data Struct. DS{... b()...}?

42 our approach controlled exposure of aliasing aggregate model function x z x z Client z.b() DS x, z; Data Struct. DS{... b()...}

43 our approach controlled exposure of aliasing module: declare possible exposed references client: track actual sharing

44 our approach controlled exposure of aliasing module: declare possible exposed references client: track actual sharing aggregate model function module: declare how to update abstract state due to change in sub-structures client: update possibly effected structures

45 some details

46 programming model program = collections of modules module = types + procedures module-private fields

47 verification of ADT [Hoare 72] modular verification hides module implementation from clients - client manipulate abstract values - representation function connects implementation & abstract value unknown to the client

48 example: Map code ( Java.util ) Hoare-style spec. class Map { model map: N N }

49 example: KeySet code ( Java.util ) Hoare-style spec. } class KeySet{ private Map m; KeySet(Map _m){ m = _m; } bool contains(int k){ return map.haskey(k); } model set: P(N) // MF set(this) = dom(this.m) {this.set = S} bool contains(int k) {this.set = S, ret = k in S}...

50 modular verification: take 1 client Map m = new Map(); m.put(1,1); m.put(2,4); KeySet s = new KeySet(m); m.put(3,9); assert(s.contains(3));

51 modular verification: take 1 client Map m = new Map(); m m.put(1,1); m.put(2,4); KeySet s = new KeySet(m); m.put(3,9); assert(s.contains(3));

52 modular verification: take 1 client Map m = new Map(); m m.put(1,1); m.put(2,4); m 1 1,2 4 KeySet s = new KeySet(m); m.put(3,9); assert(s.contains(3));

53 modular verification: take 1 client Map m = new Map(); m m.put(1,1); m.put(2,4); KeySet s = new KeySet(m); m 1 1,2 4 m 1 1,2 4 s {1,2} m.put(3,9); assert(s.contains(3));

54 modular verification: take 1 client Map m = new Map(); m m.put(1,1); m.put(2,4); KeySet s = new KeySet(m); m 1 1,2 4 m 1 1,2 4 {1,2} s m.put(3,9); m 1 1,2 4,3 9 assert(s.contains(3));

55 modular verification: take 1 client Map m = new Map(); m m.put(1,1); m.put(2,4); KeySet s = new KeySet(m); m 1 1,2 4 m 1 1,2 4 {1,2} s m.put(3,9); m 1 1,2 4,3 9 assert(s.contains(3));

56 modular verification: take 1 client Map m = new Map(); m m.put(1,1); m.put(2,4); KeySet s = new KeySet(m); m 1 1,2 4 m 1 1,2 4 {1,2} s m.put(3,9); assert(s.contains(3)); m 1 1,2 4,3 9 {1,2} s

57 our approach code spec } class KeySet{ private Map m; KeySet(Map _m){ m = _m; } bool contains(int k){ return haskey(k); } model set: P(N); // MF set (this) = dom(this.m) {this.set = S} bool contains(int k) {this.set = S, ret = k in S}...

58 our approach code spec } class KeySet{ private Map m; KeySet(Map _m){ m = _m; } bool contains(int k){ return haskey(k); } model set: P(N); // MF set (this) = dom(this.m) model pivot amap: Map; model function AMF set(this)=dom(amap.map) {_m.map = M} KeySet(Map _m) {this.amap = _m,... }...

59 example: KeySet client Map m = new Map(); m.put(1,1); m.put(2,4); KeySet s = new KeySet(m); m. put(3,9); assert(s.ismember(3));

60 example: KeySet client Map m = new Map(); m m.put(1,1); m.put(2,4); KeySet s = new KeySet(m); m. put(3,9); assert(s.ismember(3));

61 example: KeySet client Map m = new Map(); m m.put(1,1); m.put(2,4); m 1 1,2 4 KeySet s = new KeySet(m); m. put(3,9); assert(s.ismember(3));

62 example: KeySet client Map m = new Map(); m m.put(1,1); m.put(2,4); KeySet s = new KeySet(m); m 1 1,2 4 m 1 1,2 4 s {1,2} m. put(3,9); assert(s.ismember(3));

63 example: KeySet client Map m = new Map(); m m.put(1,1); m.put(2,4); m 1 1,2 4 amap KeySet s = new KeySet(m); m 1 1,2 4 s {1,2} m. put(3,9); assert(s.ismember(3));

64 example: KeySet client Map m = new Map(); m m.put(1,1); m.put(2,4); m 1 1,2 4 amap KeySet s = new KeySet(m); m 1 1,2 4 {1,2} s m. put(3,9); assert(s.ismember(3)); m 1 1,2 4,3 9

65 example: KeySet client Map m = new Map(); m m.put(1,1); m.put(2,4); m 1 1,2 4 amap KeySet s = new KeySet(m); m 1 1,2 4 {1,2} s m. put(3,9); assert(s.ismember(3)); m 1 1,2 4,3 9

66 example: KeySet client Map m = new Map(); m m.put(1,1); m.put(2,4); m 1 1,2 4 amap KeySet s = new KeySet(m); m 1 1,2 4 {1,2} s m. put(3,9); assert(s.ismember(3)); m 1 1,2 4,3 9 {1,2} s

67 example: KeySet client Map m = new Map(); m m.put(1,1); m.put(2,4); m 1 1,2 4 amap KeySet s = new KeySet(m); m. put(3,9); m 1 1,2 4 {1,2} s amap assert(s.ismember(3)); m 1 1,2 4,3 9 {1,2} s

68 example: KeySet client Map m = new Map(); m m.put(1,1); m.put(2,4); m 1 1,2 4 amap KeySet s = new KeySet(m); m. put(3,9); m 1 1,2 4 {1,2} s amap assert(s.ismember(3)); m 1 1,2 4,3 9 {1,2,3} {1,2} s

69 restrictions acyclic module import relation one entry point per data structure no subtyping

70 our approach: recap controlled exposure of aliasing module: declare possible exposed references client: track actual sharing aggregate model function module: declare how to update abstract state due to change in sub-structure client: update possibly effected structures

71 proof obligations [Hoare 72]-like proof obligations

72 proof obligations [Hoare 72]-like proof obligations aggregate model function consistency AFM (this) ==FM (this) model pivot consistency rep amap = map

73 proof obligations [Hoare 72]-like proof obligations aggregate model function consistency AFM (this) ==FM (this) set set model pivot consistency rep amap = map

74 proof obligations [Hoare 72]-like proof obligations aggregate model function consistency AFM (this) ==FM (this) model pivot consistency rep amap = map single header model function dependency is locally acyclic

75 proof obligations [Hoare 72]-like proof obligations aggregate model function consistency AFM (this) ==FM (this) set set model pivot consistency rep amap = map single header model function dependency is locally acyclic

76 success stories (manual verification) data structure abstraction sequences: list, sorted-list, tree maps: list, tree intentionally exposed (shared) imp. sum, coordinate KeySet Model-View-Controller (passive)

77 modular static analysis abstract interpretation hybrid modular semantics shape abstraction most general intrusive client (MGIC)

78 modular static analysis abstract interpretation hybrid modular semantics shape abstraction most general intrusive client (MGIC)

79 standard local-heap semantics client Map m = new Map; m.put(1,1); m.put(2,4); KeySet s = new KeySet(m); m.put(3,9); assert(s.ismember(3));

80 standard local-heap semantics client Map m = new Map; m m.put(1,1); m.put(2,4); KeySet s = new KeySet(m); m.put(3,9); assert(s.ismember(3));

81 standard local-heap semantics client Map m = new Map; m.put(1,1); m.put(2,4); m m k:1, v:1 k:2, v:4 KeySet s = new KeySet(m); m.put(3,9); assert(s.ismember(3));

82 standard local-heap semantics client Map m = new Map; m.put(1,1); m.put(2,4); KeySet s = new KeySet(m); m m k:1, v:1 k:2, v:4 this k:1, v:1 k:2, v:4 m.put(3,9); assert(s.ismember(3));

83 hybrid modular semantics client Map m = new Map; m.put(1,1); m.put(2,4); KeySet s = new KeySet(m); m.put(3,9); assert(s.contains(3));

84 hybrid modular semantics client Map m = new Map; m m.put(1,1); m.put(2,4); KeySet s = new KeySet(m); m.put(3,9); assert(s.contains(3));

85 hybrid modular semantics client Map m = new Map; m m.put(1,1); m.put(2,4); m 1 1,2 4 KeySet s = new KeySet(m); m.put(3,9); assert(s.contains(3));

86 hybrid modular semantics client Map m = new Map; m m.put(1,1); m.put(2,4); m 1 1,2 4 amap KeySet s = new KeySet(m); m 1 1,2 4 s {1,2} m.put(3,9); assert(s.contains(3));

87 hybrid modular semantics client Map m = new Map; m m.put(1,1); m.put(2,4); m 1 1,2 4 amap KeySet s = new KeySet(m); m 1 1,2 4 s {1,2} m.put(3,9); assert(s.contains(3));

88 hybrid modular semantics code ( Java.util ) class Map { put(int k, int v) {... this k:1, v:1 k:2, v:4 } }

89 hybrid modular semantics code ( Java.util ) class Map { put(int k, int v) {... this k:1, v:1 k:2, v:4 } } this k:1, v:1 k:2, v:4 k:3, v:9

90 hybrid modular semantics client Map m = new Map; m m.put(1,1); m.put(2,4); m 1 1,2 4 amap KeySet s = new KeySet(m); m 1 1,2 4 {1,2} s m.put(3,9); assert(s.contains(3)); m 1 1,2 4,3 9

91 hybrid modular semantics client Map m = new Map; m m.put(1,1); m.put(2,4); m 1 1,2 4 amap KeySet s = new KeySet(m); m 1 1,2 4 {1,2} s m.put(3,9); assert(s.contains(3)); m 1 1,2 4,3 9

92 hybrid modular semantics client Map m = new Map; m m.put(1,1); m.put(2,4); m 1 1,2 4 amap KeySet s = new KeySet(m); m.put(3,9); m 1 1,2 4 {1,2} s amap assert(s.contains(3)); m 1 1,2 4,3 9 {1,2} s

93 hybrid modular semantics client Map m = new Map; m m.put(1,1); m.put(2,4); m 1 1,2 4 amap KeySet s = new KeySet(m); m.put(3,9); m 1 1,2 4 {1,2} s amap assert(s.contains(3)); m 1 1,2 4,3 9 {1,2,3} {1,2} s

94 modular static analysis most general intrusive client (MGIC)

95 modular static analysis most general intrusive client (MGIC) Map m = new Mapspec; while (?){ switch (?){ 0: m.putspec(?,?); 1: m.removespec(?); } }

96 modular static analysis most general intrusive client (MGIC) Map m = new Mapspec; while (?){ switch (?){ 0: m.putspec(?,?); 1: m.removespec(?); } } KeySet s = new KeySetbody(m); while(?){ switch (?){ 0: int k=?; {let s = s.set;} bool b=s.containsbody(k); {assert(b==k in s & s ==s.set); } } 1: m.putspec(?,?); 2: m.removespec(?); assert(afm (s) ==FM (s)); set set

97 modular static analysis most general intrusive client (MGIC) Map m = new Mapspec; while (?){ switch (?){ 0: m.putspec(?,?); 1: m.removespec(?); } } KeySet s = new KeySetbody(m); while(?){ switch (?){ 0: int k=?; {let s = s.set;} bool b=s.containsbody(k); {assert(b==k in s & s ==s.set); } } 1: m.putspec(?,?); 2: m.removespec(?); assert(afm (s) ==FM (s)); set set

98 success stories (automatic verification) wrappers sequence: list, sorted-list, tree map: list KeySet Model-View-Controller (passive)

99 closely related work separation logic [O Hearn+, POPL 04], [Bierman&Parkinson, POPL 05] ownership-based [Muller, PhD 01], [Barnett+,JOOT 04], [Muller&Leino, ESOP 07],... static analysis [Logozzo, VMCAI 04], [Rinetzky+, ESOP 07], [Distefano&Parkinson, OOPSLA 08], [Wies+, VMCAI 06]...

100 summary novel approach for modular verification controlled exposure of aliasing aggregate model function additional proof burden ~ sharing allowed sharing + permitted sharing hybrid modular semantics modular static analysis using MGIC

101 modify clauses dynamic encapsulation (ownership transfer) acyclic module aggregate model function dependencies composite pattern (acyclic heaps) active MVC (cyclic heaps) callbacks iterators inheritance unbounded sharing future work

102 thank you!

103

104 what s the lesson? (a joke)

105 possibly not funny! what s the lesson? (a joke)

106 possibly not funny! what s the lesson? (a joke)

107 possibly not funny! what s the lesson? (a joke)

108 possibly not funny! what s the lesson? (a joke)

109 possibly not funny! what s the lesson? (a joke)

110 possibly not funny! what s the lesson? (a joke)

111 moral

112 moral

113