Graph-Based Shape Analysis Beyond Context-Freeness

TL;DR

This paper introduces a novel shape analysis framework using hypergraphs and extended graph grammars to reason about complex data structures like balanced trees with minimal user input.

Contribution

It extends context-free graph grammars to model complex data structures and provides an automated analysis tool that requires only user-supplied grammars.

Findings

Successfully analyzed AVL trees, lists, and their combinations.

Automated analysis with minimal user artifacts.

Capable of modeling complex data structures like balanced trees.

Abstract

We develop a shape analysis for reasoning about relational properties of data structures. Both the concrete and the abstract domain are represented by hypergraphs. The analysis is parameterized by user-supplied indexed graph grammars to guide concretization and abstraction. This novel extension of context-free graph grammars is powerful enough to model complex data structures such as balanced binary trees with parent pointers, while preserving most desirable properties of context-free graph grammars. One strength of our analysis is that no artifacts apart from grammars are required from the user; it thus offers a high degree of automation. We implemented our analysis and successfully applied it to various programs manipulating AVL trees, (doubly-linked) lists, and combinations of both.

Figures

Tables

Table 1. Table 1 : An excerpt of our experimental results. Provided verification times are in seconds including model-checking. Verified properties include memory safety , correct heap shape (including balancedness), correct return values, every element has been accessed, and the input data structure coincides with the output data structure. Column properties provides the worst runtime for verified LTL specifications. The complete benchmark results are found in Appendix  0.A.1 .

Program	Mem. Safety	Shape	Program	Mem. Safety	Properties
AVL trees with parent pointers			Data structure traversals / other algorithms
binary search	0.089	0.153	List of cyclic lists	0.115	0.115
min. value	0.128	0.204	Tree (Lindstrom)	0.084	11.60
search and back	0.140	0.158	Skip list	0.117	0.117
search and swap	0.823	1.106	Tree (recursive)	0.080	8.700
rebalance	1.500	1.769	Zip list (recursive)	0.118	0.118
insert	1.562	3.079	DLL reversal	0.054	0.126
list to AVLTree	1.784	1.892	DLL insertion sort	0.369	1.134

Table 2. Table 2 : Full Benchmark Results

Benchmark	#States	SSG	MC	Verif.	Total
\csvreader[head to column names]benchmark-results.csv  ( Property 1 )	\states	\generation	\mc	\verification	\total

Equations

$$1$$

$$2$$

$$3$$

$$4$$

$$5$$

$$6$$

$$7$$

$$8$$

$$9$$

$$10$$

$$11$$

$$12$$

$$13$$

$$14$$

$$15$$

$$V=$$

$$\text{lab}=$$

$$\text{att}=$$

$$L_G(H)=$$

$$L_G^{-1}(H)=$$

$${\text{GL}}_C:\text{IHC}\to \mathcal{P}(\text{IHC}),H\mapsto$$

$${\text{GL}}_C^{-1}:\text{IHC}\to \mathcal{P}(\text{IHC}),H\mapsto$$

$$P::=$$

$$|$$

$$B::=$$

$$\text{Ptr}::=$$

$$\mathcal{C}[[.]]:\text{Progs}\to \text{HC}\to \text{HC}$$

$$\mathcal{C}[[x\text{=}\text{Ptr}]]=\text{setVar}[x,\mathcal{V}[[\text{Ptr}]]]\mathcal{C}[[x.f\text{=}\text{Ptr}]]=\text{setField}[x,f,\mathcal{V}[[\text{Ptr}]]]$$

$$\mathcal{C}[[\text{new}(x)]]=\text{addNode}[x]\mathcal{C}[[\text{noop}]]={\text{id}}_{\text{HC}}\mathcal{C}[[P_1\text{;}{P}_2]]=\mathcal{C}[[P_1]]\text{fatsemi}\mathcal{C}[[P_2]]$$

$$\mathcal{C}[[\text{if}(B)\{P_1\}\text{else}\{P_2\}]]=\text{if}(\mathcal{B}[[B]])\text{then}\mathcal{C}[[P_1]]\text{else}\mathcal{C}[[P_2]]$$

$$\mathcal{C}[[\text{while}(B)\{P\}]]=\text{lfp}Y.\left(Y\mapsto \text{if}(\mathcal{B}[[B]])\text{then}\mathcal{C}[[P_1]]\text{fatsemi}Y\text{else}\mathcal{C}[[\text{noop}]]\right)$$

$$\text{if}(B)\text{then}f\text{else}g:S\to S$$

$$\text{if}(B)\text{then}f\text{else}g(s)=\{\begin{array}{ll}f(s)& \text{if}B(s)=\text{true}\\ g(s)& \text{if}B(s)=\text{false}\\ \perp & \text{otherwise}\end{array}$$

$$\mathcal{V}[[\text{null}]](H)=$$

$$\mathcal{V}[[x]](H)=$$

$$\mathcal{V}[[x.f]](H)=$$

$$\mathcal{B}[[E_1=E_2]](H)=$$

$$\mathcal{B}[[B_1\wedge B_2]]=$$

$$\mathcal{B}[[\neg B]](H)=$$

$$\text{setVar}[x,\mathcal{V}[[\text{Ptr}]]]=$$

$$(\text{att}\upharpoonright E^{\prime })\cup \{e\mapsto u\},(\text{ind}\upharpoonright E^{\prime })\cup \{e\mapsto z\},\text{ext})$$

$$\text{setField}[x,f,\mathcal{V}[[\text{Ptr}]]]=$$

$$(\text{att}\upharpoonright E^{\prime })\cup \{e\mapsto uv\},(\text{ind}\upharpoonright E^{\prime })\cup \{e\mapsto z\},\text{ext})$$

$$\text{addNode}[x]=$$

$$(\text{att}\upharpoonright E^{\prime })\cup \{e\mapsto v\},(\text{ind}\upharpoonright E^{\prime })\cup \{e\mapsto z\},\text{ext})$$

Full text

One strength of our analysis is that no artifacts apart from grammars are required from the user; it thus offers a high degree of automation. We implemented our analysis and successfully applied it to various programs manipulating AVL trees, (doubly-linked) lists, and combinations of both.

1 Introduction

The aim of shape analysis is to support software verification by discovering precise abstractions of the data structures in a program’s heap. For shape analyses to be effective, they need to track detailed information about the heap configurations arising during computations. Although recent shape analyses have become quite potent [1, 5, 7, 13, 20], discovering abstractions that go beyond structural shape properties remains far from fully solved. For example, this is the case when considering balancedness properties of data structures, such as the AVL property: A full binary tree is an AVL tree if and only if for each of its inner nodes, the difference between the heights of its two subtrees is $-1$, [math], or $1$. In this setting, reasoning about constraints over lengths of paths or sizes of branches in a tree is required. However, as already noted in [7], inference of shape-numeric invariants “is especially challenging and is not particularly well explored.”

We develop a shape analysis that is capable of inferring relational properties, such as balancedness, from a program and an intuitive data structure specification given by a graph grammar. Context-free graph grammars [14] have previously been successfully applied in shape analyses [15]. They are, however, not expressive enough to capture typical relational properties of data structures. Hence, we lift the concept of indexed grammars — a classical extension of context-free string grammars due to Aho [2] — to graph grammars. More concretely, we attach an index, i.e. a finite sequence of symbols, to each nonterminal. This information can then be accessed by the graph grammar to gain a fine-grained control over the applicable rules. For example, by using indices to represent the height of trees, a context-free graph grammar modeling binary trees can easily be lifted to a grammar representing balanced binary trees.

One strength of indexed graph grammars is that they offer an intuitive formalism for specifying data structures without requiring deep knowledge about relational properties. Furthermore, all key aspects of shape analysis (using the terminology of [20]) have natural correspondences in the theoretically well-understood domain of graph transformations: Materialization, an operation to partially concretize before performing a strong update of the heap, corresponds to the common notion of grammar derivations. Concretization then means exhaustively applying derivations. Conversely, abstraction (or canonicalization) coincides with applying inverse derivations as long as possible. In particular, effective versions of the above operations can be derived automatically from a grammar through existing normal forms [17]. Finally, checking for subsumption between two abstract states is an instance of the language inclusion problem for graph grammars. While this problem is undecidable in general [4], we present a fragment of indexed graph grammars with a decidable language inclusion problem that is well-suited for shape analysis.

We implemented our shape analysis and successfully verified Java programs manipulating AVL trees, (doubly-linked) lists and combinations of both. Supplementary material to formalization and implementation is found in the Appendix.

2 Informal Example

Our analysis is a standard forward abstract interpretation [11] that approximates for each program location the set of reachable memory states. It thus applies an abstract program semantics to elements of an abstract domain capturing the resulting sets until a fixed point is reached. The analysis is parameterized by a user-supplied indexed hyperedge replacement grammar: For any given grammar, we automatically derive an abstract program semantics from the concrete semantics of a programming language. Moreover, we obtain suitable abstraction and concretization functions. In this section we take a brief tour through the essentials of our approach by means of an example.

Example program. We consider a procedure searchAndSwap (see Figure 1) that takes an AVL tree n with back pointers and an integer value key. It consists of two phases: First, it performs a binary search in order to find a node in the tree with the given key (l. 9). If such a node is found, it moves back to the root of the tree (l. 13). However, before moving up one level in the tree, the procedure swaps the two subtrees of the current node (l. 12).

Abstract domain. We assume a storeless model that is agnostic of concrete memory addresses. Memory states are then naturally modeled as graphs — more precisely indexed heap configurations (IHC) (Section 3). That is, an edge may be connected to an arbitrary number of nodes and is additionally labeled with an index that indicates, for instance, the height of a tree. Consider the IHC depicted in Figure 2: A node (drawn as a circle) either represents an object or a literal, such as null, true, false, etc. The black circle denotes the special location null.111We often draw multiple black circles, but they all correspond to the same location. Pointers between objects are drawn as directed edges between two nodes that are drawn to indicate the corresponding field of its source object (left (dashed), right (dotted), and parent (solid) for AVL trees). For example, the parent pointer of the topmost node in Figure 2 points to null.

Furthermore, IHCs contain program variables and nonterminal edges. Program variables are drawn as diamonds that are labeled with the variable name and are attached to the unique node representing the value of the variable. Hence, variable $n$ points to the rightmost node in Figure 2. Nonterminal edges model a set of abstracted heap shapes, such as linked lists or balanced trees. They are drawn as gray boxes and attached to one or more nodes. Figure 2 contains two of these edges. Their label, $B$, indicates that both model a set of balanced binary trees. Further, their indices, $X$ and $sX$, denote that they model balanced binary trees of height $X$ and $X+1$, respectively, where $X$ stands for an arbitrary non-negative value. Hence, the IHC in Figure 2 models the set of all balanced binary trees with back pointers in which the height of the right subtree of the root is the height of its left subtree plus one. Moreover, variable $n$ points to the right child of the root.

Abstraction and Concretization. The set of heaps described by an IHC is determined by an indexed hyperedge replacement grammar whose rules map nonterminal edges to an IHC. An example of a rule is provided in Figure 3 (inside the gray box; above step (1)). Its left-hand side is $(B,s\nu)$, where $\nu$ is a variable. The rule allows to replace any edge that is labeled with $B$ and whose index starts with an $s$ by the IHC below. In that case, variable $\nu$ is substituted by the remainder of the index of the replaced hyperedge. The IHC on the rule’s right-hand side contains two external nodes (labeled $1$ and $2$) that indicate how two IHCs are glued together when replacing a hyperedge (Section 3).

Example execution. Let us assume we are given a suitable grammar in which nonterminal $B$ represents balanced binary trees and index $sX$ stands for a height of $X+1$. We consider one execution sequence in detail. The individual execution steps are illustrated in Figures 3, 4, and 5, respectively. Notice that the full analysis explores all abstract executions.

Step (1). Starting with the leftmost IHC in Figure 3, we first execute a binary search (Figure 1, l. 9). Assuming that the searched key is not at the root, we move to the children of n. Since these are currently hidden in the hyperedge labeled with $(B,sX)$, we apply materialization [21] (partial concretization). For our analysis, materialization corresponds to forward derivations using the supplied graph grammar, i.e. we replace an edge by an IHC according to a rule of the grammar. Here, we used the rule above step (1) in Figure 3. To apply this rule, we first remove the original hyperedge labeled $(B,sX)$. After that we paste the graph belonging to the rule into the original graph. Finally, we identify the nodes originally attached to the removed hyperedge with the external nodes of the rule (as indicated by gray dashed and dotted lines in Figure 3).

Step (2). After materialization, executing one step of the concrete program semantics amounts to a simple graph transformation (moving variable n to a child). To keep the example small, assume the binary search has already explored the left subtree without finding the key. It thus returned to the root and the next step is to move variable n to its right child. That is, we execute \texttt{n}\,\textnormal{{=}}\,\texttt{n}.\texttt{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}right}. This leads to the rightmost graph depicted in Figure 3. In our example execution, we assume n now carries the searched key, i.e. $\texttt{n}.\texttt{key}$ equals key. Hence, the binary search returns the current position of n and we move to the while-loop of our example program (Figure 1, l. 10). Since neither variable n is attached to null nor its parent pointer points to null, we enter the loop.

Step (3). Before we can climb up the tree to the root again, we have to swap the subtrees of n (Figure 1, l. 12). Again, these are hidden in a hyperedge labeled with $(B,X)$, i.e. we have to materialize again. As part of the example execution, we apply the rule in Figure 4 (above step (3)). However, this rule requires the index of a hyperedge to be of the form $ss\nu$. Intuitively, this means the rule models balanced trees of height at least two. Since $X$ is a placeholder for trees of arbitrary height, we apply index materialization to the IHC first. That is, we replace $X$ by $ssX$ in all hyperedges222Again, note that we consider a single execution path in this example. The full analysis also explores the cases in which $X$ is substituted by $z$ and $sz$. and move to the leftmost hypergraph in Figure 4. After that, we apply materialization as illustrated in the third step.

Step (4). We apply the concrete semantics to execute a sequence of assignments in order to swap the left and right subtree of n (Figure 1, l. 12). This results in the rightmost IHC of Figure 4, in which variable t has not been set to null yet. After executing the remaining two assignments, i.e. t = null and \texttt{n}\,\textnormal{{=}}\,\texttt{n}.\texttt{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}parent}, we end up in the leftmost IHC in Figure 5.

Notice that both the abstract semantics as well as materialization are derived automatically from the grammar and the concrete program semantics (Sections 3 and 4). In particular, materialization corresponds to forward derivations using the grammar. Analogously, the abstraction function corresponds to applying backward derivations. Each occurrence of an IHC used as the right-hand side of a grammar rule is replaced by a hyperedge labeled with the rule’s left-hand side.

Step (5). After executing \texttt{n}\,\textnormal{{=}}\,\texttt{n}.\texttt{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}parent} (Figure 1, l. 13), abstracted is performed before moving on to the next loop iteration. We abstract using a rule symmetric to the one applied in step (3) for materialization. This corresponds to first detecting the IHC in the rule as a subgraph of the given IHC. This subgraph is deleted except for those nodes identified with the external nodes (labeled by numbers) of the rule graph (see gray dash-dotted lines in Figure 5). Then a hyperedge attached to the latter nodes is added to the remaining IHC.

Step (6). The IHC obtained after step (5) can be further abstracted. This time, we employ the rule that has been applied for materialization first (Figure 3, above step (1)). The resulting graph is found in Figure 5 next to step (6). Note that the indices of both hyperedges to be abstracted are $ssX$ whereas the rule used for abstraction contains hyperedges with indices $\nu$. The variable $\nu$ is used as a placeholder to restore the original indices after the replacement. The resulting hypergraph (Figure 5 following step (6)) contains a single hyperedge labeled $(B,sssX)$. Hence, the result of our example execution is a balanced binary tree (of height at least three) again.

Step (7). As a final operation, we apply the converse of index materialization in step (3): index abstraction. For this purpose, we replace $sssX$ by $X$, i.e. we generalize from trees of height at least three to trees of arbitrary height. Proceeding with the analysis, we evaluate the loop guard (Figure 1, l. 10) to false, because \texttt{n}.\texttt{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}parent} equals null. Hence, the analysis terminates this branch of its execution with a final hypergraph that covers the initial one. The problem of checking whether a hypergraph covers another one is addressed in Section 5.

3 Program States and Indexed Grammars

As outlined in Section 2, it is intuitive to model heaps as graphs. In this section, we formalize heap configurations as a model for program states and their semantics in terms of a graph grammar. These grammars guide concretization and abstraction in our analysis, which is presented subsequently in Section 4.

3.1 Program States

To set the stage for our analysis, we consider program states to consist of a heap and a stack. We assume the heap to contain records with a finite number of reference fields that are collected in Fields. Apart from the heap, a program state is equipped with a stack mapping program variables in Var to records.

Furthermore, our abstract domain equips graphs with nonterminal hyperedges that act as abstract placeholders for sets of graphs, e.g. all (balanced) binary trees. These hyperedges are labeled with a nonterminal taken from a finite set $N$ and an index taken from a finite set $I$, respectively. Throughout this paper, we fix a set $\textnormal{{Types}}=\textnormal{{Fields}}\cup\textnormal{{Var}}\cup N$. Every element of Types is ranked by a function $\textit{rank}:\textnormal{{Types}}\to\mathbb{N}$, where fields always have rank two, i.e. $\textit{rank}(\textnormal{{Fields}})=\{2\}$ and variables always have rank one, i.e. $\textit{rank}(\textnormal{{Var}})=\{1\}$, respectively. Program states are then formally modeled as follows:

Definition 1

An indexed heap configuration (IHC for short) is defined as a tuple $H=(V,E,\textit{lab},\textit{att},\textit{ind},\textit{ext})$, where

• •

$V$ and $E$ are finite sets of nodes and hyperedges, respectively,

• •

$\textit{lab}:E\to\textnormal{{Types}}$ is a hyperedge labeling function,

• •

$\textit{att}:E\to V^{*}$ maps each edge to a sequence of attached nodes that respects the rank of hyperedge labels, i.e. for all $e\in E$, we have $\textit{rank}(\textit{lab}(e))=|\textit{att}(e)|$.

• •

$\textit{ind}:E\to I^{+}$ assigns a non-empty index sequence to each edge in $E$, and

• •

$\textit{ext}\in V^{+}$ is a repetition-free sequence of external nodes.333External nodes are needed to define the semantics of nonterminal edges.

Throughout this paper, we do not distinguish between the terms graph and hypergraph nor between edge and hyperedge. Furthermore, we refer to the components of a graph $H$ by $V_{H}$, $E_{H}$, etc. If an edge $e$ is attached to exactly two nodes, say $\textit{att}(e)=uv$, we interpret $e$ as a directed edge from node $u$ to node $v$. Notice that all graphs in Section 2 are examples of IHCs.

To simplify the technical development, we impose a few sanity conditions on IHCs: We require that (1) every variable $x\in\textnormal{{Var}}$ occurs at most once in $H$ and (2) for every field $f\in\textnormal{{Fields}}$ every node has at most one outgoing edge $e$ labeled with $f$ (recall that $\textit{rank}(f)=2$). The special location null is treated as a global variable. Hence, we assume a unique node $v_{\textnormal{{null}}}$ representing null which is the first external node and the first node attached to every nonterminal edge.444I.e., $v_{\textnormal{{null}}}=\textit{ext}(1)$ and for each $e\in E$ with $\textit{lab}(e)\in N$, we have $\textit{att}(e)(1)=v_{\textnormal{{null}}}$.

3.2 Indexed Grammars

The semantics of edges labeled with a nonterminal, is specified by an indexed graph grammar — an extension of context-free graph grammars. As it is common in graph rewriting, we do not distinguish between isomorphic graphs. Thus, *all sets of graphs in this paper are to be understood up to isomorphism.*555A formal definition of graph isomorphism is found in Appendix LABEL:app:excursus.

Definition 2

Let $\nu$ be a dedicated index variable and $I^{\prime}=I\cup\{\nu\}$ be the set of index symbols. An indexed hyperedge replacement grammar (IG) is a finite set of rules $G$ of the form $X,\sigma\,\to\,H$ mapping a nonterminal $X\in N$ and an index $\sigma\in I^{*}(I\cup\{\nu\})$ to an IHC $H$ such that $\textit{rank}(X)=|\textit{ext}_{H}|$. Moreover, if $\sigma$ does not contain the variable $\nu$ then $H$ does not contain $\nu$ either, i.e. $\textit{ind}_{H}(E_{H})\subseteq I^{+}$.

Example 1

Figure 6 depicts an IG $G$ with six rules that each map to an IHC whose first external node is null and whose second external node is the root of a tree-like graph. Indices of edges not labeled with $B$ are omitted for readability.

The sets of graphs modeled by IGs are defined similarly to languages of context-free word grammars (CFG) in which a nonterminal is replaced by a finite string: An IG derivation replaces an edge, say $e$, that is labeled with a nonterminal by a finite graph, say $K$. However, since arbitrarily many nodes may be attached to edge $e$, we have to clarify how the original graph and $K$ are glued together. Hence, we identify each node attached to edge $e$ with an external node of $K$ (according to their position in both sequences). Formally,

Definition 3

Let $H,K$ be IHCs with pairwise disjoint sets of nodes and edges. Moreover, let $e\in E_{H}$ be an edge with $\textit{rank}(\textit{lab}_{E_{H}}(e))=|\textit{ext}_{K}|$. Then the replacement of $e$ in $H$ by $K$ is given by $H\left[e\mapsto K\right]=(V,E,\textit{att},\textit{lab},\textit{ind},\textit{ext})$, where

[TABLE]

where mod replaces each external node by the corresponding node attached to $e$.666$f\upharpoonright M$ denotes the restriction of function $f$ to domain $M$ and $(f\,\fatsemi\,g)(s)=g(f(s))$. Moreover, function $\textit{mod}=\{\textit{ext}_{K}(k)\mapsto\textit{att}_{H}(e)(k)~{}|~{}1\leq k\leq|\textit{ext}_{K}|\}\cup\{v\mapsto v~{}|~{}v\in V\setminus\textit{ext}_{K}\}$ is lifted to sequences of nodes by pointwise application.

The above is the standard definition of hyperedge replacement in which indices and edge labels are treated the same (cf. [14]). It is then tempting to define that an IG $G$ derives $K$ from $H$ if and only if there exists an edge $e\in E_{H}$ and a rule $(\textit{lab}_{H}(e),\textit{ind}_{H}(e)\,\to\,R)\in G$ such that $K$ is isomorphic to $H\left[e\mapsto R\right]$. However, this notion is too weak to model balanced trees. In particular, since an index is treated as just another label, we cannot apply a derivation if the index of an edge does not exactly match an index on the left-hand side of an IG rule.

Instead, we use a finite prefix of indices in derivations and hide the remainder in variable $\nu$. For example, assume an IG contains a rule $B,ss\nu\,\to\,R$. Given an edge with label $B$ and index $\sigma=sssz$, an IG derivation may then hide $sz$ in $\nu$. The resulting index is $ss\nu$ and a derivation as defined naively above is possible. Finally, all occurrences of $\nu$ are replaced by the hidden suffix $sz$ again.

To formalize indexed derivations, two auxiliary definitions are needed: Given a set $M\subseteq\textnormal{{Types}}$, we write $E_{H}^{M}$ to refer to all edges of $H$ that are labeled with a symbol in $M$, i.e. $E_{H}^{M}=\{e\in E_{H}~{}|~{}\textit{lab}_{H}(e)\in M\}$. We write $H\left[\nu\mapsto\rho\right]$ to replace all occurrences of $\nu$ in (the index function ind of) $H$ by $\rho$.777$H\left[\nu\mapsto\rho\right]=(V_{H},E_{H},\textit{att}_{H},\textit{lab}_{H},\textit{ind},\textit{ext}_{H})$ with $\textit{ind}=\{\textit{ind}_{H}(e)\left[\nu\mapsto\rho\right]~{}|~{}e\in E_{H}\}$.

Definition 4

Let $G$ be an IG and $H,K$ be IHCs. Then $G$ directly derives $K$ from $H$, written $H\Rightarrow_{G}K$, if and only if either

• •

there exists a rule $(X,\sigma\,\to\,R)\in G$ and an edge $e\in E_{H}^{\{X\}}$ such that $\textit{ind}_{H}(e)=\sigma$ and $K$ is isomorphic to $H\left[e\mapsto R\right]$, or

• •

there exists a rule $(X,\sigma\nu\,\to\,R)\in G$, an edge $e\in E_{H}^{\{X\}}$, and a sequence $\rho\in I^{+}$ such that $\textit{ind}_{H}(e)=\sigma\rho$ and $K$ is isomorphic to $H\left[e\mapsto R\left[\nu\mapsto\rho\right]\right]$.

The reflexive, transitive closure of $\Rightarrow_{G}$ is denoted by $\Rightarrow_{G}^{*}$. The inverse of $\Rightarrow_{G}$ is given by $\,{{}_{G}\!\!\Leftarrow}$. Finally, $H\,{{}_{G}\!\!\nLeftarrow}$ iff there exists no $K$ such that $H\,{{}_{G}\!\!\Leftarrow}K$.

The language of an IG and an IHC $H$ is the set of all graphs that can be derived from $H$ and that do not contain nonterminals. Conversely, the inverse language of $H$ is obtained by exhaustively applying inverse derivations to $H$.

Definition 5

The language $L_{G}$ and the inverse language $L^{-1}_{G}$ of IG $G$ are given by the following functions mapping indexed graphs to sets of indexed graphs:

[TABLE]

For instance, the language of the IG in Figure 6 for an IHC consisting of one edge labeled with $B,ssz$ is the set of all balanced binary trees of height two.

To ensure existence of inverse languages and thus termination of abstraction, we assume that all rules of an IG $G$ are increasing, i.e. for each rule $(X,\sigma\,\to\,H)\in G$ it holds that $|V_{H}|+|E_{H}|>\textit{rank}(X)+1$. As an example, notice that all rules of the IG in Figure 6 are increasing. This amounts to a syntactic check on all rules that is easily discharged automatically. We conclude our introduction of IGs with a collection of useful properties.

Theorem 3.1

Let $G$ be an IG and $H$ be an IHC over $N$ and $I$. Then:

$H\Rightarrow_{G}^{*}K$* implies $L_{G}(K)\subseteq L_{G}(H)$.* 2. 2.

$L_{G}(H)=\begin{cases}\{H\}&~{}\text{if}~{}E_{H}^{N}=\emptyset\\ \bigcup_{H\Rightarrow_{G}K}L_{G}(K)&~{}\text{otherwise.}\end{cases}$** 3. 3.

It is decidable whether $L_{G}(H)=\emptyset$ holds. 4. 4.

The inverse language $L^{-1}_{G}(H)$ of an increasing IG $G$ is non-empty and finite.

The first two properties are crucial for proving our analysis sound. The remaining properties ensure that we can construct well-defined (inverse) languages.

4 Abstract Domain

Our analysis is a typical forward abstract interpretation [12] that is parameterized by a user-supplied IG $G$. Its concrete domain consists of all IHCs without nonterminals. The abstract domain contains all IHCs to which no inverse IG derivation is applicable. The order of our abstract domain is language inclusion. Concretization $\gamma$ and abstraction $\alpha$ correspond to computing the language and the inverse language of $G$, respectively. Our setting is summarized in Figure 7.

The concrete semantics of common imperative programs amounts to straightforward graph transformations. Let us assume that Progs is the set of all programs. Moreover, assume the concrete semantics of each program $P\in\textnormal{{Progs}}$ is given by a (partial) function $\mathcal{C}\llbracket P\rrbracket:\textnormal{{IHC}}\to\textnormal{{IHC}}$ that captures the effect of executing $P$ on an IHC.888We defined $\mathcal{C}\llbracket.\rrbracket$ inductively for a Java-like language. Furthermore, we proved locality for all Progs-programs. Details are found in Appendix LABEL:app:sec-concrete-semantics. For example, step (2) in Section 2 computes \mathcal{C}\llbracket\texttt{n}\,\textnormal{{=}}\,\texttt{n}.\texttt{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}right}\rrbracket.

As is standard, our analysis performs a fixed-point iteration of the abstract semantics that overapproximates the concrete semantics. Following the terminology of [20], our abstract semantics consists of three phases: materialization, execution of the concrete semantics, and canonicalization. That is, our abstract semantics is a function of the form $\mathcal{A}\llbracket.\rrbracket\,:\,\textnormal{{Progs}}\to\textnormal{{Abs}}\to\textnormal{{Abs}}$ that is defined inductively on the structure of programs. In particular, for an atomic program $P\in\textnormal{{Progs}}$, we have $\mathcal{A}\llbracket P\rrbracket=\textnormal{{materialize}}\llbracket P\rrbracket\,\fatsemi\,\mathcal{C}\llbracket P\rrbracket\,\fatsemi\,\textnormal{{canonicalize}}\llbracket P\rrbracket$.999$f\,\fatsemi\,g$ denotes sequential composition of $f$ and $g$, i.e. $(f\,\fatsemi\,g)(s)=g(f(s))$. The inductive cases are straightforward (cf. Appendix LABEL:app:sec-abstract-semantics).

Although materialization and canonicalization naturally depend on the user-provided grammar $G$, for readability we tacitly omit adding $G$ as a parameter. Materialization ensures applicability of the concrete semantics by partially concretizing an IHC. It is thus a function $\textnormal{{materialize}}\llbracket.\rrbracket:\textnormal{{Progs}}\to\textnormal{{IHC}}\to\mathcal{P}_{\textit{finite}}(\textnormal{{IHC}})$ that, for a given program, maps an IHC to a finite set of IHCs. Intuitively, materialization applies derivations $\Rightarrow_{G}$ until the concrete semantics can be applied (cf. Theorem 3.1.2). A detailed discussion of suitable materializations that are derived from a grammar $G$ is found in [15, 17]. In this paper, we consider a sufficient condition to ensure soundness.

Definition 6

For every atomic program $P\in\textnormal{{Progs}}$, we require a materialization function $\textnormal{{materialize}}\llbracket.\rrbracket$ such that $\gamma\,\fatsemi\,\mathcal{C}\llbracket P\rrbracket\,\dot{\subseteq}\,\textnormal{{materialize}}\llbracket P\rrbracket\,\fatsemi\,\mathcal{C}\llbracket P\rrbracket\,\fatsemi\,\gamma.$

Here, $\,\dot{\subseteq}\,$ denotes pointwise application of $\subseteq$. Examples of applying materialization are provided in steps (1) and (3) of Section 2.

Conversely to materialization, canonicalization takes a partially concretized program state and computes an abstract program state again. It is thus a function of the form $\textnormal{{canonicalize}}\llbracket.\rrbracket:\textnormal{{Progs}}~{}\to~{}\textnormal{{IHC}}~{}\to~{}\textnormal{{Abs}}$.

Definition 7

For every program $P\in\textnormal{{Progs}}$, we require a canonicalization function $\textnormal{{canonicalize}}\llbracket.\rrbracket$ such that $\gamma~{}\,\dot{\subseteq}\,~{}\textnormal{{canonicalize}}\llbracket P\rrbracket\,\fatsemi\,\gamma$.

By Theorem 3.1(1), inverse IG derivations as well as the abstraction function $\alpha$ are suitable candidates for canonicalization. Examples of applying canonicalization are provided in steps (5) and (6) of Section 2.

Assuming suitable materialization and canonicalization functions as of Definitions 6 and 7, our abstract semantics $\mathcal{A}\llbracket.\rrbracket$ computes an overapproximation of the concrete semantics $\mathcal{C}\llbracket.\rrbracket$ (detailed proofs are found in Appendix LABEL:app:sec-sound):

Theorem 4.1 (Soundness)

For all $P\in\textnormal{{Progs}}$, $\gamma\,\fatsemi\,\mathcal{C}\llbracket P\rrbracket~{}\,\dot{\subseteq}\,~{}\mathcal{A}\llbracket P\rrbracket\,\fatsemi\,\gamma$.

The quality of our analysis depends, naturally, on the quality of the user-defined grammar. That is, the better our grammar matches the data structures employed by a program, the more precise the results obtained from our analysis. In particular, our analysis does not necessarily terminate. For example, we cannot analyze a program working on doubly-linked lists if the user-supplied IG models trees only. As usual, termination has to be ensured by some sort of widening. In the simplest case, termination is achieved by fixing a maximal size of IHCs a priori. Whenever an IHC exceeds the fixed size, the analysis stops.

5 Backward Confluent IGs

Two components of our analysis are particularly involved: First, the inverse language of an IHC with respect to an IG has to be computed repeatedly during canonicalization, i.e. we have to exhaustively apply inverse IG derivations. Applying inverse derivations in turn requires finding isomorphic subgraphs in an IHC that can be replaced by a hyperedge. Since the subgraph isomorphism problem is NP-complete [10], canonicalization is expensive.

Second, computing a fixed point requires us to check for language inclusion. However, the language inclusion problem for IGs is undecidable as it is already undecidable for context-free string grammars [4]. Undecidability of inclusion is common in the area of shape analysis, where supported data structures are either severely restricted to obtain decidability, or approximations are used.

We now discuss a subclass of IGs that addresses both problems:

Definition 8

An IG $G$ is backward confluent iff for all IHCs $H$ the inverse language $L^{-1}_{G}(H)$ is a singleton set, i.e. $|L^{-1}_{G}(H)|=1$.

The definition of backward confluent IGs is, admittedly, rather semantics-driven. In particular, it solves the problem of expensive canonicalizations directly: Since the inverse language of an IHC is unique it suffices to exhaustively apply inverse derivations instead of trying all possible combinations. Fortunately, as shown in [19], backward confluence can be checked automatically. In particular, we constructed backward confluent IGs for singly- and doubly-linked, (a)cyclic lists, (balanced) trees (w/o back pointers), in-trees, lists of lists, and (in-)trees with linked leaves. In general, however, the class of graph languages generated by backward confluent IGs is strictly smaller than the class of languages generated by arbitrary IGs.101010A formal proof is found in Appendix LABEL:app:sec-backwardconfluent-expressiveness.

We now turn to our second desired property: a decidable inclusion problem. This property relies on the observation that two IHCs $H,K$ that cannot be abstracted further, i.e. $H,K\,{{}_{G}\!\!\nLeftarrow}$, are either isomorphic or have disjoint languages.

Theorem 5.1

Let $G$ be a backward confluent IG. Moreover, let $H,K\in\textnormal{{IHC}}$ such that $K\,{{}_{G}\!\!\nLeftarrow}$. Then it is decidable whether $L_{G}(H)\subseteq L_{G}(K)$ holds.

To conclude this section, we remark that, for backward-confluent IGs, our concrete and abstract domain (cf. Figure 7) form a Galois connection, i.e. our analysis falls within the classical setting of abstract interpretation [11].

6 Global Index Abstraction

The goal of our shape analysis is to enable reasoning about complex data structures, such as balanced binary trees. However, we might encounter infinitely many IHCs that vary in their indices only, thus preventing termination (cf. steps (1) and step (6) in Section 2). Our abstraction is thus often too precise.

To capture that an IHC models balanced trees, however, it suffices to keep track of the differences between indices: Assume, for example, that a node has two subtrees specified by nonterminal edges with indices $sz$ and $ssz$. If we replace these indices by $ssz$ and $sssz$, the underlying trees remain balanced.

Hence, we propose an index abstraction on top of IG-based abstraction. Intuitively, this abstraction removes a common suffix from all indices and replaces it by a placeholder. Apart from balancedness, it is applicable to properties such as “all sublists in a list of lists have equal length”. The abstraction is again formalized by grammars; right-linear context-free word grammars (CFG) to be precise. Thus, let $I=I_{N}\cup I_{T}$ be a finite set of index symbols that is partitioned into a set of nonterminals $I_{N}$ and a set of terminals $I_{T}$ including the end-of-index symbol $z$. We call an index $\sigma\in I^{+}$ well-formed if $\sigma\in(I_{T}\setminus\{z\})^{*}(I_{N}\cup\{z\})$. That is, a well-formed index always ends with a nonterminal or the end-of-index symbol $z$. Accordingly, an IHC is well-formed if all of its indices are. We assume all indices — including indices in CFG rules — to be well-formed. Hence, all considered CFGs are right-linear and thus generate regular languages. We do not allow nonterminal index symbols in IGs, i.e. we assume for each IG rule $X,\sigma\,\to\,H$ that $\textit{ind}_{H}(E_{H}^{N})\subseteq I_{T}^{*}\{z,\nu\}$, where $\nu$ has been introduced in Definition 2.

To maintain relationships between indices, such as their difference, we require that all indices ending with the same nonterminal of an IHC are modified simultaneously. This leads us to a notion of global derivations and global languages.

Definition 9

Let $H,K\in\textnormal{{IHC}}$. A CFG $C$ globally derives $K$ from $H$, written $H\rightrightarrows_{C}K$, if and only if there exists a rule $(X\,\to\,\tau)\in C$ such that $\textit{ind}_{H}(E_{H}^{N})\subseteq I_{T}^{*}I_{N}$ and $K$ is isomorphic to $H\left[X\mapsto\tau\right]$, i.e. $H$ in which all occurrences of $X$ are replaced by $\tau$. Again, $\rightrightarrows_{C}^{*}$ the reflexive, transitive closure of $\rightrightarrows_{C}$. $\,{}_{C}\!\!\leftleftarrows$ denotes inverse derivations and $\,{}_{C}\!\!\not\leftleftarrows$ that no inverse derivation is possible.

Definition 10

The global language and the inverse global language of a right-linear CFG $C$ over $I$ are given by:

[TABLE]

Global derivations enjoy the same properties as IG derivations (Theorem 3.1). These properties are crucial to ensure soundness and termination of abstraction.

To combine global derivations and IG derivations, we consider a new derivation relation of the form $(\Rightarrow_{G}\cup\rightrightarrows_{C})^{*}$. We can further simply this relation, because global derivations and IG derivations enjoy an orthogonality property:

Theorem 6.1

$H\,(\Rightarrow_{G}\cup\rightrightarrows_{C})^{*}\,K~{}\text{if and only if}~{}H\,(\rightrightarrows_{C}^{*}\,\fatsemi\,\Rightarrow_{G}^{*})\,K$.111111For binary relations $R_{1},R_{2}$, we set $R_{1}\,\fatsemi\,R_{2}=\{(u,w)~{}|~{}\exists v:(u,v)\in R_{1},(v,w)\in R_{2}\}$.

Thus, for materialization, it suffices to first apply global derivations and then apply IG derivations. Conversely, for abstraction, it suffices to first apply inverse IG derivations and then apply inverse global derivations.

It is then straightforward to refine our analysis from Section 4 by using the above derivation relation (cf. Appendix LABEL:app:sec-cfg-analysis). To conclude this section, we remark that all results from Sections 4 and 5 can be lifted to the refined analysis.

7 Implementation

We implemented our analysis in Attestor [3] to analyze Java programs. The source code and our experiments are available online.121212https://github.com/moves-rwth/attestor-examples/releases/tag/v0.3.5-SEFM2018

Input. Attestor supports a fragment of Java that includes recursive procedure calls, but no arithmetic. Apart from programs and grammars, linear temporal logic (LTL) specifications over execution paths can be supplied. Atomic propositions include heap shapes and reachability of variables (cf. [18]).

Output. Attestor generates a transition system in which each state consists of a program location and an IHC representing the abstract program state, i.e., a set of reachable heaps. This state space can also be explored graphically.131313A brief tutorial on using the tool is found in Appendix 0.A.1. Collecting the IHCs of all states with the same program location then coincides with the result of the abstract semantics presented in Section 4. Moreover, the tool applies LTL model-checking to verify provided LTL specifications.

Experimental results. We evaluated our implementation against common challenging algorithms on various data structures and multiple LTL specifications. The results are shown in Table 1. Experiments were performed on an Intel Core i7-5820K at 3.30GHz with the Java virtual machine limited to 2GB of RAM. Program inputs covered all instances of the respective data structure through nonterminal edges for each employed data structure. Further details regarding individual case studies are provided in Appendix 0.A.1 and online.††footnotemark: In particular, list to AVLTree traverses a singly-linked list while inserting each of its elements into an (initially empty) AVL tree including all rebalancing procedures. Our implementation successfully verifies that the result is a balanced binary tree and the list has been completely traversed. This demonstrates that our analysis is capable of precisely reasoning about combinations of multiple data structures.

8 Related Work

Graph Transformations. Our work is an extension of an existing analysis based on context-free graph grammars [15]: From a theoretical perspective, IGs allow covering infinitely many context-free rules by a single nonterminal with an index variable. Covering infinitely many rules is essential when reasoning about relational properties, e.g. balancedness. From a practical perspective, our analysis is a standard forward abstract interpretation in contrast to previous approaches.

Separation Logic. The class of graphs described by context-free graph grammars is equivalent to a fragment of symbolic heap separation logic (SL) [16]. In contrast to SL, graph grammars give us access to a rich set of theoretical results from string and graph rewriting. For example, the concept of IGs is derived from Aho’s indexed string grammars [2]. Moreover, the notion of backward confluence is well-studied in the context of graph rewriting (cf. [19]) and provides us with a decidable criterion to discharge entailments (language inclusion). Hip/Sleek uses SL enriched with arithmetic to specify size constraints on data structures (cf. [9]). Their focus is on program verification with user-supplied invariants. In contrast, our approach synthesizes invariants automatically. Furthermore, we provide decidable criteria for good data structure specifications whereas Hip/Sleek relies on heuristics to discharge entailments.

Static analysis. [6, 8] introduce a generic framework for relational inductive shape analysis based on user-supplied invariants. Applicability to red-black trees is demonstrated in an example, but not covered by experiments. In [1], forest automata are extended by constraints between data elements associated with nodes of the heaps. The authors conjecture that their method generalizes to handle lengths of branches in a tree, which are needed to express balancedness properties. The details, however, are not worked out.

9 Conclusion

We developed a shape analysis that is capable of proving certain relational properties of data structures, such as balancedness of AVL trees. Our analysis is parameterized by user-supplied indexed graph grammars — a novel extension of context-free graph grammars. We implemented our approach and successfully applied it to common algorithms on AVL trees, lists, and combinations thereof.

Appendix 0.A Appendix

The appendix contains missing proofs, detailed formalizations of the concrete and abstract semantics, and further details regarding the implementation. It is structured as follows:

• •

Appendix 0.A.1 is a brief tutorial explaining how Attestor is installed and executed. In particular, we show how our experimental results (see Section 7) can be reproduced. Moreover, we briefly describe how results can be graphically explored.

• •

Appendix LABEL:app:sec-concrete-semantics formally defines a simple imperative programming language Progs together with its concrete semantics $\mathcal{C}\llbracket.\rrbracket$ defined on indexed heap configurations (see Section 4).

• •

Appendix LABEL:app:excursus provides the missing formal definition of isomorphic indexed heap configurations.

• •

Appendix LABEL:app:sec-abstract-semantics formally defines the abstract semantics of Progs programs that was informally introduced in Section 4.

• •

Appendix LABEL:app:sec-ig-props contains the proof of Theorem 3.1, i.e. properties of indexed graph grammars.

• •

Appendix LABEL:app:sec-sound formalizes that our analysis is sound (Theorem 4.1).

• •

Appendix LABEL:app:sec-local formalizes that our analysis allows for local reasoning.

• •

Appendix LABEL:app:sec-backwardconfluent-expressiveness formally shows that not every language of an IG can also be expressed by a backward confluent IG (see Section 5).

• •

Appendix LABEL:app:sec-backwardconfluent-inclusion formally proves that language inclusion is decidable for backward confluent IGs, see Theorem 5.1.

• •

Appendix LABEL:app:sec-cfg-props contains the missing proofs showing that index abstraction and concretization preserves the desirable properties of IGs (see Section 6).

• •

Appendix LABEL:app:sec-cfg-analysis formally defines the modified analysis that additionally uses index abstraction (see Section 6).

• •

Appendix LABEL:app:grammars contains additional examples of indexed graph grammars.

In case of publication, the appendix will be made available online as a separate technical report.

0.A.1 Tutorial: Reproducing Experimental Results with Attestor

This section is a brief tutorial on reproducing our experimental results. Furthermore, a more detailed table with all benchmark results is found at the end of this tutorial.

0.A.1.1 System Requirements

In order to use Attestor, please first make sure that the following software is installed:

• •

Java JDK 1.8 (see http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html)

• •

Apache Maven (see https://maven.apache.org/)

• •

Git (see https://git-scm.com/)

Furthermore, notice that an active internet connection is required during installation as maven will automatically download additional required packages.

0.A.1.2 Reproducing Experiments

A bundle of Attestor and our experiments is obtained as follows:

git clone --branch v0.3.5-SEFM2018
https://github.com/moves-rwth/attestor-examples.git

We provide a shell script that automatically installs the bundle, executes all experiments and generates a latex document with the results. To use the script, please run the following inside of the cloned repository:

chmod +x run.sh ./run.sh pdflatex benchmark-results.tex

Alternatively, e.g. if shell scripts cannot be executed on your operating system, all experiments can be executed using maven:

mvn clean install exec:exec@run

Notice that no latex document will be generated without using the shell script. All relevant data are displayed on the console though and are additionally exported to benchmark-results.csv.

0.A.1.3 Graphical Exploration

It is possible to generate a “report” to graphically explore generated state spaces. To this end, install the Attestor bundle as described above. Then execute:

mvn clean install exec:exec@runWithReport

Notice that this will take considerably more time than just running all benchmarks. For each benchmark, an additional directory will be created containing a website that allows to explore the state space in your web browser. The names of created directories match the names used in the benchmark settings files.

For example, consider the AVL binary search benchmark. Assuming you cloned the attestor-examples repository, the configuration file of this benchmark is located in

attestor-examples/AVLTree/configuration/settings/binary_search.json

The corresponding website to graphically explore the state space is found in

attestor-examples/AVLTree/binary_search/stateSpace

To explore the state space, first start a web server by running (inside of the created directory)

java -jar attestor-report

On most operating systems, this should open your default web browser and display the report (otherwise start your web browser and go to http://localhost:8080). Notice that you can also open index.html directly if you are using Firefox. A screenshot of the graphical state space exploration (for a binary search in an AVL tree) is depicted in Figure 8. The left pane depicts the state space. The right pane depicts the currently selected heap configuration. Moreover, the topmost pane displays further information about the currently selected state, e.g. the corresponding program statement to be executed and its atomic propositions to be considered for model-checking.

0.A.1.4 Installing Attestor

The version of Attestor used in this paper is available on GitHub141414https://github.com/moves-rwth/attestor/releases/tag/v0.3.5-SEFM2018 and maven central.151515http://repo1.maven.org/maven2/de/rwth/i2/attestor/0.3.5-SEFM2018/ To install Attestor, please execute the following in your terminal:

git clone --branch v0.3.5-SEFM2018
https://github.com/moves-rwth/attestor.git mvn clean install

A corresponding jar file including all dependencies will be generated in the target directory. Please confer https://github.com/moves-rwth/attestor/wiki for further details. Example files are provided in the attestor-examples repository (see “Reproducing Experiments” above).

0.A.1.5 Full Benchmark Results

Table LABEL:table:full below depicts the results for our full collection of benchmarks. Each benchmark is marked with additional flags indicating the verified properties. More precisely,

• •

(M) means that we checked memory safety.

• •

(S) means that we checked shape properties, e.g. that a data structure is indeed an AVLTree.

• •

(C) means that we checked correctness properties, e.g. that the head pointer is placed correctly upon termination.

• •

(V) means that we checked whether every node in the initial heap has been visited, e.g. all elements of a list have been traversed.

• •

(N) means that we checked whether the neighbourhood of every node in the initial data structure is the same upon termination, e.g. the output data structure coincides with the input data structure.

• •

(X) means that a property is violated and we successfully constructed a non-spurious counterexample.

• •

(Y) means that a property is violated, but all counterexamples are spurious.

For each benchmark, we consider

• •

the total number of generated states (#States),

• •

state space generation time in seconds (SSG),

• •

model-checking time in seconds (MC),

• •

total verification time (including SSG and MC) in seconds (Verif.), and

• •

the total runtime (including parsing) in seconds (Total).

Further information about each individual benchmark is found in the examples repository (see “Reproducing Experiments”).

&

0.A.2 Programming Language & Concrete Semantics

0.A.2.1 Programming Language

For the sake of concreteness, we present our analysis in terms of a small heap-manipulating programming language. Note that our implementation actually supports a a richer set of programming language features, such as (potentially recursive) procedure calls, that have been omitted to improve readability.

Let $x$ be a variable taken from Var and $f\in\textnormal{{Fields}}$ be a field. Then the syntax of programs Progs ($P$), Boolean expressions BExp ($B$), and pointer expressions PExp (Ptr) is defined by the context-free grammar in Figure LABEL:fig:syntax.

The meaning of Progs-programs is straightforward. For instance, an assignment $x.f\,\textnormal{{=}}\,\textnormal{{null}}$ sets the $f$-field of the record referenced by variable $x$ to the location null. Formally, the semantics of Progs-programs is given by a function

[TABLE]

that takes a program $P$ and a program state, i.e. an HC $H$, and yields an HC capturing the effect of executing $P$ on $H$ (if defined). In Figure LABEL:fig:semantics the transformer $\mathcal{C}\llbracket.\rrbracket$ is defined inductively on the structure of Progs-programs. For example, the semantics of an assignment $x.f\,\textnormal{{=}}\,y$ first determines the nodes $\mathcal{V}\llbracket x\rrbracket$ and $\mathcal{V}\llbracket y\rrbracket$ attached to variable edges $x$ and $y$, respectively. After that, existing outgoing edges of $\mathcal{V}\llbracket x\rrbracket$ labeled with $f$ are removed. Finally, a new edge $e$ from $\mathcal{V}\llbracket x\rrbracket$ to $\mathcal{V}\llbracket y\rrbracket$ with label $f$ is added. The semantics of the control-flow structures is standard.

In the following, we formalize the auxiliary functions and graph transformations used in the definition of the concrete semantics.

0.A.2.2 Auxiliary Functions used within Concrete Semantics

Conditional Function

Let $B:S\to\{\textnormal{{true}},\textnormal{{false}}\}$ and $f,g:S\to S$ be partial functions. Then the conditional function

[TABLE]

is the partial function given by:

[TABLE]

Semantics of Pointer Expressions

Let $H\in\textnormal{{IHC}}$. Moreover, let $x\in\textnormal{{Var}}$ and $f\in\textnormal{{Fields}}$.

[TABLE]

Semantics of Boolean Expressions

[TABLE]

0.A.2.3 Graph Transformations used within Concrete Semantics

Let $H=(V,E,\textit{lab},\textit{att},\textit{ind},\textit{ext})\in\textnormal{{IHC}}$.

$\textnormal{\text{setVar}}[.,.]$

Let $e\notin E$ be a fresh edge. If $\mathcal{V}\llbracket\textit{Ptr}\rrbracket=\bot$ then $\textnormal{\text{setVar}}[x,\mathcal{V}\llbracket\textit{Ptr}\rrbracket]$ is undefined. Otherwise, if $\mathcal{V}\llbracket\textit{Ptr}\rrbracket(H)=u\in V$, we define:

[TABLE]

$\textnormal{\text{setField}}[.,.,.]$

Let $e\notin E$ be a fresh edge. If $\mathcal{V}\llbracket\textit{Ptr}\rrbracket=\bot$ or $\mathcal{V}\llbracket x\rrbracket=\bot$ then $\textnormal{\text{setField}}[x,f,\mathcal{V}\llbracket\textit{Ptr}\rrbracket]$ is undefined. Assume that $\mathcal{V}\llbracket x\rrbracket=u\in V$. Moreover, let $U=\{e^{\prime}\in E~{}|~{}\textit{lab}(e^{\prime})=f~{}\text{and}~{}\textit{att}(e^{\prime})(1)=u\}$. If $U=\emptyset$ then $\textnormal{\text{setField}}[x,f,\mathcal{V}\llbracket\textit{Ptr}\rrbracket]$ is undefined. Otherwise, if $\mathcal{V}\llbracket E\rrbracket(H)=v\in V$, we define:

[TABLE]

$\textnormal{\text{addNode}}[.]$

Let $v\notin V$ be a fresh node and $e\notin E$ be a fresh edge. Then:

[TABLE]

0.A.3 Definition of Isomorphic Indexed Heap Configurations

Definition 11

Let $H,K$ be IHCs. Then $H$ and $K$ are isomorphic, written $H\cong K$, if and only if there exist bijective functions $f:V_{H}\to V_{K}$ and $g:E_{H}\to E_{K}$ such that

• •

for each $e\in E_{H}$, $\textit{lab}_{H}(e)=\textit{lab}_{K}(g(e))$ and $\textit{ind}_{H}(e)=\textit{ind}_{K}(g(e))$,

• •

for each $e\in E_{H}$, $f(\textit{att}_{H}(e))=\textit{att}_{K}(g(e))$, and

• •

$f(\textit{ext}_{H})=\textit{ext}_{K}$.

0.A.4 Abstract Semantics

In this section, we inductively define the abstract semantics of Progs-programs, which have been formally defined in Appendix LABEL:app:sec-concrete-semantics.

[TABLE]

Here lfp denotes the least fixed point operator. Note that evaluating a guard $B$ might require materialization. Since $B$ is formally not a program, we write $\textnormal{{materialize}}\llbracket B\rrbracket$ as a shortcut for

[TABLE]

which ensures that $B$ can be evaluated without affecting the program state.

0.A.5 Properties of Indexed Graph Grammars (Proof of Theorem 3.1)

As before, we write $H\cong K$ to denote that $H$ and $K$ are isomorphic (see Appendix LABEL:app:excursus). Moreover, let $T=\textnormal{{Types}}\setminus N$ the set of terminal labels.

Given a natural number $n\in\mathbb{N}$, we write $H\Rightarrow_{G}^{n}K$ to denote that $G$ derives $K$ from $H$ in exactly $n$ steps. Formally,

• •

$H\Rightarrow_{G}^{0}H$, and

• •

$H\Rightarrow_{G}^{n+1}K$ iff $\exists R:H\Rightarrow_{G}R$ and $R\Rightarrow_{G}^{n}K$.

Then $\Rightarrow_{G}^{*}~{}=~{}\bigcup_{n\in\mathbb{N}}\Rightarrow_{G}^{n}$.

Theorem 3.1(1). Let $G$ be an IG and $H,K$ be indexed heap configurations. Then $H\Rightarrow_{G}^{*}K$ implies $L_{G}(K)\subseteq L_{G}(H)$.

Proof

We show for all $n\in\mathbb{N}$ that $H\Rightarrow_{G}^{n}K$ implies $L_{G}(H)\subseteq L_{G}(H)$. By induction on $n\in\mathbb{N}$.

I.B. For $n=0$ we have

[TABLE]

I.H. Assume for an arbitrary, but fixed $n\in\mathbb{N}$ that $H\Rightarrow_{G}^{n}K$ implies $L_{G}(H)\subseteq L_{G}(H)$.

I.S. For $n\mapsto n+1$ we have

[TABLE]

It then suffices to show that $L_{G}(R)\subseteq L_{G}(H)$ holds as

[TABLE]

The remaining proof obligation is shown as follows:

[TABLE]

∎

Theorem 3.1(2). Let $G$ be an IG and $H,K$ be indexed heap configurations. Then

[TABLE]

Proof

Case 1: Assume that $\neg\exists e\in E_{H}:\textit{lab}_{H}(e)\in N$. By Def. 4, we know that $H\nRightarrow_{G}$. Then

[TABLE]

Case 2: Assume that $\exists e\in E_{H}:\textit{lab}_{H}(e)\in N$. By Def. 5, $H\notin L_{G}(H)$. If $L_{G}(H)=\emptyset$, there is nothing to show. Thus assume $L_{G}(H)\neq\emptyset$. By Def. 4, this means that there exists a $K$ such that $H\Rightarrow_{G}K$. Then

[TABLE]

∎

Theorem 3.1(3). Let $G$ be an IG and $H$ be an indexed heap configuration. Then it is decidable whether $L_{G}(H)=\emptyset$.

Proof

Let $G$ be an IG and $H$ be an IHC. We construct an indexed context-free string grammar $C$ and a string $\rho$ such that

[TABLE]

Since the emptiness problem for indexed context-free string grammars is decidable (confer Rozenberg, Salomaa: “Handbook of Formal Languages”, Vol. 2, 1997), the emptiness problem for IGs is decidable as well.

The grammar $C$ is constructed over the same set of terminals $T$, nonterminals $N$ and index symbols $I$ as $G$. Now, let $K$ be an IHC with $E_{K}=\{e_{1},\ldots,e_{k}\}$ We then define the string

[TABLE]

Then the grammar $C$ is given by the set of rules

[TABLE]

Moreover, we set $\rho=\sigma_{H}$. ∎

Theorem 3.1(4). Let $G$ be an IG and $H,K$ be indexed heap configurations. Then the inverse language $L^{-1}_{G}(H)$ is non-empty and finite.

Proof

Recall that $H\,{{}_{G}\!\!\Leftarrow}K$ holds iff $K\Rightarrow_{G}H$. Then, since every IG is increasing (see Remark below Definition 4), we have

[TABLE]

We now show that $L^{-1}_{G}(H)$ is finite:

[TABLE]

where the last set is finite.

It remains to prove that $L^{-1}_{C}(H)$ is non-empty: First, note that $H\,{{}_{G}\!\!\Leftarrow}^{0}H$ always holds. Further, by $(\spadesuit)$, after at most $m$ inverse IG derivation steps, i.e. $\bigcup_{0\leq n\leq m}\,{{}_{G}\!\!\Leftarrow}^{n}$, no further inverse IG derivation is possible. Hence, $L^{-1}_{C}(H)\neq\emptyset$. ∎

0.A.6 Proof of Theorem 4.1 (Soundness)

Theorem 4.1. $\forall P\in\textnormal{{Progs}}\,:\,\gamma\,\fatsemi\,\mathcal{C}\llbracket P\rrbracket~{}\,\dot{\subseteq}\,~{}\mathcal{A}\llbracket P\rrbracket\,\fatsemi\,\gamma$.

Proof

By induction on the structure of Progs-programs.

Base cases. Let $P\in\{x\,\textnormal{{=}}\,\textit{Ptr},x.f\,\textnormal{{=}}\,\textit{Ptr},\textnormal{{new}}(x),\textnormal{{noop}}\}$. Then:

[TABLE]

Sequential Composition.

[TABLE]

Conditionals.

Let $Q=\textnormal{{if}}\,(B)\,\{\textnormal{{noop}}\}\,\textnormal{{else}}\,\{\textnormal{{noop}}\}$. By Fig. LABEL:fig:semantics, we have $\mathcal{C}\llbracket Q\rrbracket=\textit{id}_{\textnormal{{HC}}}$. Moreover, we have

[TABLE]

as, by Def. 6, $\textnormal{{materialize}}\llbracket Q\rrbracket\neq\bot$. Thus $B$ is evaluated in the same way on both graphs. Then:

[TABLE]

Loops.

We use a standard characterization of the semantics of loops as the supremum of its finite unrollings. Thus, let

[TABLE]

be the finite unrollings, where [math] unrollings corresponds to a program that is undefined everywhere, such as $\textnormal{{while}}\,(\textnormal{{true}})\,\{\textnormal{{noop}}\}$. Then, by standard arguments, we have

[TABLE]

To complete the proof we show for all $k\in\mathbb{N}$ that

[TABLE]

I.B. For $k=0$, we have

[TABLE]

I.S. For $k\mapsto k+1$, we have

[TABLE]

∎

0.A.7 Local Reasoning

Our analysis enjoys a local reasoning property that is similar to the frame rule in separation logic. In order to formulate this property, we write $\textit{Mod}\llbracket P\rrbracket(H)$ to denote the set of all nodes and edges that are added or deleted when running $P$ on $H$.

More precisely, the function $\textit{Mod}\llbracket.\rrbracket(.)$ is defined inductively on the structure of Progs programs (see Appendix LABEL:app:sec-concrete-semantics). For the base cases, let $H\in\textnormal{{IHC}}$ and $K=\mathcal{C}\llbracket P\rrbracket(H)$. Then, $\textit{Mod}\llbracket P\rrbracket(H)$ is given by:

[TABLE]

The composite cases are defined as follows:

[TABLE]

where $\textnormal{{while}}^{k}\,(B)\,\{P\}$ denotes the $k$-th loop unrolling of the loop $\textnormal{{while}}\,(B)\,\{P\}$. Formally,

[TABLE]

where [math] unrollings corresponds to a program that is undefined everywhere, such as $\textnormal{{while}}\,(\textnormal{{true}})\,\{\textnormal{{noop}}\}$.

Moreover, $H\cup R$ denotes the componentwise union of two (not necessarily disjoint) IHCs $H$ and $R$. To be precise, we define $H\cup R=(V_{H}\cup V_{R},E_{H}\cup E_{R},\textit{lab}_{H}\cup\textit{lab}_{R},\textit{att}_{H}\cup\textit{att}_{R},\textit{ind}_{H}\cup\textit{ind}_{R},\textit{ext}_{H})$. Moreover, if $\textit{ext}_{H}\neq\textit{ext}_{R}$ or $(H\cup R)\notin\textnormal{{IHC}}$, we set $H\cup R$ to be undefined.

Theorem 0.A.1 (Local Reasoning)

Let $P\in\textnormal{{Progs}}$ and $H,R$ be IHCs. Then $\mathcal{C}\llbracket P\rrbracket(H)=K$ and $\textit{Mod}\llbracket P\rrbracket(H)\cap(V_{R}\cup E_{R})=\emptyset$ implies $\mathcal{C}\llbracket P\rrbracket(H\cup R)=K\cup R$.

Proof

Without loss of generality, we assume $H\cup R\in\textnormal{{IHC}}$ and $\textit{ext}_{H}=\textit{ext}_{R}$. Otherwise, $H\cup R$ is undefined. Then it is straightforward to show that also $K\cup R$ and $\mathcal{C}\llbracket P\rrbracket{H\cup R}$ are undefined, i.e., the theorem holds.

Let $\mathcal{C}\llbracket P\rrbracket(H)=K$ and $\textit{Mod}\llbracket P\rrbracket(H)\cap(V_{R}\cup E_{R})=\emptyset$. The proof proceeds by induction on the structure of Progs programs.

I.B.

The case $P=(x\,\textnormal{{=}}\,\textit{Ptr})$.

[TABLE]

The case $P=(x.f\,\textnormal{{=}}\,\textit{Ptr})$.

[TABLE]

The case $P=(\textnormal{{new}}(x))$.

[TABLE]

The case $P=(\textnormal{{noop}})$. Then

[TABLE]

I.H. Assume for all (sub-)programs $P$ and all $H,R\in\textnormal{{IHC}}$ that

[TABLE]

I.S.

The case $P=(P_{1}\textnormal{{;}}P_{2})$.

[TABLE]

The case $P=(\textnormal{{if}}\,(B)\,\{P_{1}\}\,\textnormal{{else}}\,\{P_{2}\})$.

[TABLE]

The case $P=(\textnormal{{while}}\,(B)\,\{P^{\prime}\})$. As in proof of Theorem 4.1, we use a standard characterization of the semantics of loops as the supremum of its finite unrollings. Thus, let

[TABLE]

be the finite unrollings, where [math] unrollings corresponds to a program that is undefined everywhere, such as $\textnormal{{while}}\,(\textnormal{{true}})\,\{\textnormal{{noop}}\}$. Then, by standard arguments, we have

[TABLE]

To complete the proof we show for all $k\in\mathbb{N}$ that

[TABLE]

The proof proceeds by induction on $k$. The base cases $k=0$ and $k=1$ are trivial. For the induction step, we have

[TABLE]

∎

0.A.8 Expressiveness of Backward Confluent Grammars

Theorem 0.A.2

There exist languages of IHCs that can be generated by an IG, but not by any backward confluent IG.

Proof

Given a nonterminal symbol, say $S$, let $e_{S}$ denote a single hyperedge that is labeled with $S$ and attached to $\textit{rank}(S)$ distinct nodes. Now, consider the IG $G$ below in which all indices as well as the null node are omitted for simplicity.

$\texttt{S}~{}\rightarrow~{}$12a12b1a$S$21$$2

$G$ generates non-empty singly-linked list segments whose next pointer is either labeled with $a$ or $b$. More precisely, $L_{G}(e_{S})$ consists of all IHCs that are non-empty singly-linked list segments that either start with arbitrarily many (including zero) fields labeled $a$ and then end with exactly one field labeled $b$, or consist only of fields labeled with $a$. We claim that $L_{G}(e_{S})$ cannot be generated by a backward confluent IG. Towards a contradiction, assume there exists a backward confluent IG $G^{\prime}$ and a nonterminal $S^{\prime}$ such that $L_{G^{\prime}}(e_{S^{\prime}})=L_{G}(e_{S})$.

Clearly, each of the following three IHCs (on the left-hand side of $\,{{}_{G}\!\!\Leftarrow}^{*}$) belongs to $L_{G}(e_{S})$. Hence, the following three inverse derivations are possible:

ab,aa,a\,{{}_{G^{\prime}}\!\!\Leftarrow}^{*}$$S^{\prime}$$1$$2

Since $G^{\prime}$ is backward confluent, this means that also the following inverse derivation is possible:

aa\,{{}_{G^{\prime}}\!\!\Leftarrow}^{*}$$S^{\prime}$$S^{\prime}$$1$$2$$1$$2$$\,{{}_{G^{\prime}}\!\!\Leftarrow}^{*}$$S^{\prime}$$1$$2

Then we can also apply an inverse derivation that starts in an IHC $H$:

abab\,{{}_{G^{\prime}}\!\!\Leftarrow}^{*}$$S^{\prime}$$S^{\prime}$$1$$2$$1$$2$$\,{{}_{G^{\prime}}\!\!\Leftarrow}^{*}$$S^{\prime}$$1$$2

By Theorem 3.1, this implies $H\in L_{G^{\prime}}(e_{S^{\prime}})$. However, this contradicts our assumption $L_{G^{\prime}}(e_{S^{\prime}})=L_{G}(e_{S})$, because $H\notin L_{G}(e_{S})$. ∎

0.A.9 Decidability of Language Inclusion

We first formalize a crucial property informally stated in Section 5.

Theorem 0.A.3

Let $G$ be a backward confluent IG. Moreover, let $H,K\in\textnormal{{IHC}}$ such that $H\,{{}_{G}\!\!\nLeftarrow}$ and $K\,{{}_{G}\!\!\nLeftarrow}$. Then

[TABLE]

Proof

We first show that $L_{G}(H)\cap L_{G}(K)\neq\emptyset$ implies that $H$ and $K$ are isomorphic:

[TABLE]

The converse direction, i.e. if $H$ is isomorphic to $K$ then $L_{G}(H)\cap L_{G}(K)\neq\emptyset$, is trivial. ∎

Theorem 5.1. Let $G$ be a backward confluent IG. Moreover, let $H,K\in\textnormal{{IHC}}$ such that $K\,{{}_{G}\!\!\nLeftarrow}$. Then it is decidable whether $L_{G}(H)\subseteq L_{G}(K)$ holds.

Proof

Note that it is decidable whether $K\Rightarrow_{G}^{*}H$ holds, because $K\Rightarrow_{G}^{*}H$ holds if and only if there exists a natural number $0\leq m\leq|V_{H}|+|E_{H}|$ such that $K\Rightarrow_{G}^{m}H$ holds, where $\Rightarrow_{G}^{m}$ means that we apply up to $m$ IG derivations. We distinguish two cases:

Assume $K\Rightarrow_{G}^{*}H$ holds. By Theorem 3.1(1) this implies $L_{G}(H)\subseteq L_{G}(K)$. 2. 2.

Assume $K\Rightarrow_{G}^{*}H$ does not hold. Since $G$ is backward confluent there exists a unique $R\in L^{-1}_{G}(H)$. Moreover, by our assumption $K\,{{}_{G}\!\!\nLeftarrow}$, we have $L^{-1}_{G}(K)=\{K\}$. Then $R$ and $K$ are not isomorphic. Hence,

[TABLE]

Thus $L_{G}(H)\subseteq L_{G}(K)$ holds if and only if $L_{G}(H)=\emptyset$. By Theorem 3.1(3), it is decidable whether $L_{G}(H)=\emptyset$. ∎

0.A.10 Properties of Indexed Graph Grammars with Index Abstraction

0.A.10.1 Well-Formedness of Indices

Lemma 1

If $H$ is well-formed and $H\rightrightarrows_{C}^{*}K$ or $H\Rightarrow_{G}^{*}K$ then $K$ is well-formed.

Proof

Let $C$ be a CFG and $G$ be an IG satisfying the assumptions at the beginning of Section 6. Moreover, let $H$ be a well-formed IHC.

We first prove that $H\rightrightarrows_{C}K$ implies that $K$ is well-formed:

[TABLE]

Next we prove that $H\Rightarrow_{G}K$ implies that $K$ is well-formed. By Definition 4, two cases arise:

There exists a rule $(X,\sigma\,\to\,R)\in G$ and an edge $e\in E_{H}^{N}$ such that $\textit{ind}_{H}(e)=\sigma$ and $K$ is isomorphic to $H\left[e\mapsto R\right]$. By assumption, $\textit{ind}_{R}(e^{\prime})\subseteq I_{T}^{*}z$. Thus, for each $e^{\prime}\in E_{R}$, $\textit{ind}_{R}(e)$ is well-formed. Then, by Definition 3 and the fact that $H$ is well-formed, $\textit{ind}_{K}(e^{\prime\prime})$ is well-formed for each $e^{\prime\prime}\in E_{K}=(E_{H}\setminus\{e\})\cup E_{K}$. Hence, $K$ is well-formed. 2. 2.

There exists a rule $(X,\sigma\nu\,\to\,R)\in G$, an edge $e\in E_{H}^{N}$, and a sequence $\rho\in I^{+}$ such that $\textit{ind}_{H}(e)=\sigma\rho$ and $K$ is isomorphic to $H\left[e\mapsto R\left[\nu\mapsto\rho\right]\right]$. Since $H$ is well-formed, so is $\rho$. By assumption $\textit{ind}_{R}(E_{R}^{N})\subseteq I_{T}^{*}\nu$. This means that $R\left[\nu\mapsto\rho\right]$ is well-formed. Hence, $H\left[e\mapsto R\left[\nu\mapsto\rho\right]\right]$ and thus $K$ is well-formed.

It then follows by a straightforward induction on the length of derivations $\Rightarrow_{G}^{*}$ and global derivations $\rightrightarrows_{C}^{*}$ that $H\rightrightarrows_{G}^{*}K$ implies that $K$ is well-formed and $H\Rightarrow_{G}^{*}K$ implies that $K$ is well-formed. ∎

0.A.10.2 Analogon to Theorem 3.1 for Global Derivations

Theorem 0.A.4

Let $C$ be a CFG and $H,K\in\textnormal{{IHC}}$. Then:

$H\rightrightarrows_{C}^{*}K$* implies $\textit{GL}_{C}(K)\subseteq\textit{GL}_{C}(H)$.* 2. 2.

$\textit{GL}_{C}(H)=\begin{cases}\{H\}&~{}\text{if}~{}\textit{ind}_{H}(E_{H}^{N})\subseteq I_{T}^{*}z\\ \bigcup_{H\rightrightarrows_{C}K}\textit{GL}_{C}(K)&~{}\text{otherwise.}\end{cases}$** 3. 3.

If $C$ contains a single nonterminal, i.e. $|I_{N}|=1$, it is decidable whether $\textit{GL}_{C}(H)=\emptyset$ holds. 4. 4.

If $C$ contains no rule of the form $X\,\to\,Y$, where $X,Y\in I_{N}$, then the global inverse language $\textit{GL}^{-1}_{C}(H)$ is non-empty and finite.

We write $H\rightrightarrows_{C}^{n}K$ to denote that $C$ globally derives $K$ from $H$ in exactly $n\in\mathbb{N}$ steps. Formally,

• •

$H\rightrightarrows_{C}^{0}H$, and

• •

$H\rightrightarrows_{C}^{n+1}K$ iff $\exists R:H\rightrightarrows_{C}R$ and $R\rightrightarrows_{C}K$.

Then $\rightrightarrows_{C}^{*}=\bigcup_{n\in\mathbb{N}}\rightrightarrows_{C}^{n}$.

Theorem LABEL:thm:cfg-props(1). Let $C$ be a CFG and $H,K\in\textnormal{{IHC}}$. Then $H\rightrightarrows_{C}^{*}K$ implies $\textit{GL}_{C}(K)\subseteq\textit{GL}_{C}(H)$.

Proof

Similarly to the proof of Theorem 3.1(1), we show for all natural numbers $n\in\mathbb{N}$ that $H\rightrightarrows_{C}^{n}K$ implies $\textit{GL}_{C}(K)\subseteq\textit{GL}_{C}(H)$. By induction on $n$. I.B. For $n=0$, we have

[TABLE]

I.H. Assume for an arbitrary, but fixed $n\in\mathbb{N}$ that $H\rightrightarrows_{C}^{n}K$ implies $\textit{GL}_{C}(H)\subseteq\textit{GL}_{C}(K)$.

I.S. For $n\mapsto n+1$ we have

[TABLE]

It then suffices to show that $\textit{GL}_{C}(R)\subseteq\textit{GL}_{C}(H)$ holds as

[TABLE]

The remaining proof obligation is shown as follows:

[TABLE]

∎

Theorem LABEL:thm:cfg-props(2). Let $C$ be a CFG and $H,K\in\textnormal{{IHC}}$. Then

[TABLE]

Proof

Case 1: Assume that $\textit{ind}_{H}(E_{H}^{N})\subseteq I_{T}^{*}z$. By Definition 9 this means that $H\not\rightrightarrows_{C}$. Then

[TABLE]

Case 2: Assume that $\textit{ind}_{H}(E_{H}^{N})\not\subseteq I_{T}^{*}z$. Then there exists $X\in I_{N}$ and $e\in E_{H}$ such that $\textit{ind}_{H}(e)\subseteq I_{T}^{*}X$. By Definition 10, $H\notin\textit{GL}_{C}(H)$. If $\textit{GL}_{C}(H)=\emptyset$, there is nothing to show. Thus assume $\textit{GL}_{C}(H)\neq\emptyset$. By Definition 9 this means that there exists a $K$ such that $H\rightrightarrows_{C}K$. Then

[TABLE]

∎

Theorem LABEL:thm:cfg-props(3). Let $C$ be a CFG with a single nonterminal, i.e. $|\textit{ind}_{H}|=1$, and $H\in\textnormal{{IHC}}$. Then it is decidable whether $\textit{GL}_{C}(H)=\emptyset$ holds.

Proof

Let $C$ be a CFG and $H\in\textnormal{{IHC}}$. By assumption (cf. Section 6), $H$ is well-formed. That is, $\textit{ind}_{H}(E_{H})\subseteq(I_{T}\setminus\{z\})^{*}(I_{N}\cup\{z\})$. Furthermore, again by assumption, we know that for each rule $(X\,\to\,\sigma)\in C$, $\sigma$ is well-formed. We distinguish three cases:

$\textit{ind}_{H}(E_{H})\subseteq(I_{T}\setminus\{z\})^{*}\{z\}\subseteq I_{T}^{+}$. By Definition 10, this means that $H\in\textit{GL}_{C}(H)$ and thus $\textit{GL}_{C}(H)\neq\emptyset$. 2. 2.

For the single nonterminal $X$ of $C$, we have $\textit{ind}_{H}(E_{H})\subseteq(I_{T}\setminus\{z\})^{*}\{X\}$. Then

[TABLE]

where the last line is an instance of the emptiness problem for context-free string grammars. This problem is well-known to be decidable in linear time.161616For details confer Rozenberg, Salomaa: “Handbook of Formal Languages”, Vol. 1, 1997 3. 3.

Neither the first, nor the second case holds. By Definition 10 this means that $H\notin\textit{GL}_{C}(H)$. Moreover, by Definition 9, there exists no $K$ such that $H\rightrightarrows_{C}K$. Hence, $\textit{GL}_{C}(H)=\emptyset$.

Hence, we can decide whether $\textit{GL}_{C}(H)=\emptyset$ holds by first checking which of the above cases applies to the finite set $\textit{ind}_{H}(E_{H})$ and then proceed as shown for each case. ∎

Theorem LABEL:thm:cfg-props(4). Let $C$ be a CFG containing no rule of the form $X\,\to\,Y$ for $X,Y\in I_{N}$. Moreover, let $H,K\in\textnormal{{IHC}}$. Then the global inverse language $\textit{GL}^{-1}_{C}(H)$ is non-empty and finite.

Proof

Recall that $H\,_{C}\!\!\leftleftarrows K$ holds iff $K\rightrightarrows_{C}H$ holds. Let

[TABLE]

be the maximal length of all indices in $H$. By Definition 9, we know that $K\rightrightarrows_{C}H$ implies

[TABLE]

By the premise of the theorem and the fact that all indices are well-formed, we have:

[TABLE]

In particular, this means that

[TABLE]

We now prove that $\textit{GL}^{-1}_{C}(H)$ is finite:

[TABLE]

where the last set is finite. It remains to prove that $\textit{GL}^{-1}_{C}(H)\neq\emptyset$: First, note that $H\rightrightarrows_{C}^{0}H$ always holds. Further, by $(\spadesuit)$, after at most $m$ inverse global derivation steps, i.e. $\bigcup_{0\leq n\leq m}\,{}_{C}\!\!\leftleftarrows^{n}$, no further inverse global derivation is possible. Hence, $\textit{GL}^{-1}_{C}(H)\neq\emptyset$. ∎

0.A.10.3 Commutability of IG Derivations and Gobal Derivations

Theorem 0.A.5

[TABLE]

Proof

[TABLE]

∎

0.A.11 Analysis with Index Abstraction

We now refine our analysis presented in Section 4 such that only relevant relationships between indices are kept. Our new abstraction places the inverse global language of a CFG on top of our original abstraction guided by an IG. Hence, given an IG $G$ and a CFG $C$, we change the original setting (cf. Figure 7, p. 14) as follows:

• •

Concrete domain: $(\textnormal{{Con}}=\mathcal{P}(\underbrace{L_{G}(\textit{GL}_{C}(\textnormal{{IHC}}))}_{\text{concrete IHCs}}),\subseteq)$

• •

Abstract domain: $(\textnormal{{Abs}}=\mathcal{P}(\underbrace{\textit{GL}^{-1}_{C}({L^{-1}_{G}(\textnormal{{IHC}})})}_{\text{fully abstract IHCs}}),\,\sqsubseteq\,)$

• •

Concretization and abstraction: $\gamma~{}=~{}\textit{GL}_{C}\,\fatsemi\,L_{G}$, $\alpha~{}=~{}L^{-1}_{G}\,\fatsemi\,\textit{GL}^{-1}_{C}$

• •

Ordering of abstract domain: $H\,\sqsubseteq\,K$ iff $\gamma(H)\subseteq\gamma(K)$

Materialization and canonicalization now formally also depend on the user-provided CFG $C$. We experienced that aggressively abstracting indices and partially concretizing them whenever needed works well in practice.

We remark that all results from Sections 4 and 5 can be lifted to our refined analysis. In particular, the analysis is sound and — in the case of backward confluent grammars — the inclusion problem is decidable:

Theorem 0.A.6 (Soundness)

The refined analysis from above is sound. That is, $\forall P\in\textnormal{{Progs}}\,:\,\gamma\,\fatsemi\,\mathcal{C}\llbracket P\rrbracket~{}\,\dot{\subseteq}\,~{}\mathcal{A}\llbracket P\rrbracket\,\fatsemi\,\gamma$.

Theorem 0.A.7

Let $C$ and $G$ be a backward confluent CFG and IG, respectively.171717$C$ is backward confluent if for all well-formed IHCs $H$, we have $|\textit{GL}^{-1}_{C}(H)|=1$. Moreover, let $H,K$ be well-formed IHCs such that $K\,_{C}\!\!\not\leftleftarrows$ and $K\,{{}_{G}\!\!\nLeftarrow}$. Then it is decidable whether $H\,\sqsubseteq\,K$ holds.

Both theorems are proven analogously to Theorem 4.1 and Corollary 5.1.

Theorem 0.A.8

If $C$ and $G$ are backward confluent then

[TABLE]

is a Galois connection.

0.A.12 Grammar for Doubly-Linked List Segments

Please find below two additional indexed graph grammars. The first specifies doubly-linked lists. The second provides additional rules for balanced trees that have been omitted in Figure 6 (although they do not affect the overall language).

\texttt{DLL}~{}\rightarrow~{}$$\texttt{DLL}~{}\rightarrow~{}$$\texttt{DLL}~{}\rightarrow~{}$$\texttt{DLL}~{}\rightarrow~{}2345123DLL4511$$2$$3$$4$$523DLL4511$$2$$3$$4$$523DLL**DLL4511$$2$$3$$4$$5$$1$$2$$3$$4$$5

$P,\nu\rightarrow$2$B,\nu$12$$1$$P,\nu\rightarrow2$B,\nu$12$$1$$P,s\nu$$2$$1