Modular Verification of Heap Reachability Properties in Separation Logic

TL;DR

This paper introduces a modular verification method for heap reachability properties in separation logic, enabling automated, precise reasoning about complex heap structures and supporting concurrent program verification.

Contribution

It presents a novel reachability framing technique for separation logic that allows local specification and modular reasoning about heap reachability in complex data structures.

Findings

Supports verification of acyclic and cyclic graphs with bounded outdegree.

Enables procedure-modular reasoning through reachability framing.

Successfully integrated into SMT-based verification with benchmark examples.

Abstract

The correctness of many algorithms and data structures depends on reachability properties, that is, on the existence of chains of references between objects in the heap. Reasoning about reachability is difficult for two main reasons. First, any heap modification may affect an unbounded number of reference chains, which complicates modular verification, in particular, framing. Second, general graph reachability is not supported by SMT solvers, which impedes automatic verification. In this paper, we present a modular specification and verification technique for reachability properties in separation logic. For each method, we specify reachability only locally within the fragment of the heap on which the method operates. A novel form of reachability framing for relatively convex subheaps allows one to extend reachability properties from the heap fragment of a callee to the larger fragment of its caller, enabling precise procedure-modular reasoning. Our technique supports practically important heap structures, namely acyclic graphs with a bounded outdegree as well as (potentially cyclic) graphs with at most one path (modulo cycles) between each pair of nodes. The integration into separation logic allows us to reason about reachability and other properties in a uniform way, to verify concurrent programs, and to automate our technique via existing separation logic verifiers. We demonstrate that our verification technique is amenable to SMT-based verification by encoding a number of benchmark examples into the Viper verification infrastructure.