TypeBased Data Structure Verification Ming Kawaguchi Patrick Rondon

Type-Based Data Structure Verification Ming Kawaguchi, Patrick Rondon , Ranjit Jhala University of California, San Diego

Goal: Static Software Verification Verify absence of run-time errors • Buffer overflows • Deadlocks • Assertion failures Requires precise data structure verification

The Problem With Structures 1 1 2 3 4 5 2 3 1 5 4 2 3 4 5 Unbounded Size Need Universally Quantified Properties “Every element has property P”

Contributions Predicates Types Precise properties of individual cells Lift properties to invariants on structures

Contributions Refined -Type Mechanisms Predicate Mechanisms • • Recursive Structures (Lists, Trees) Table Structures (Fields, Arrays, Hash Maps) Supports Inference Expressive Sorted, Duplicate-Free, Height-Balanced, Acyclic, … • Practical Sorting Algorithms, Splay Heaps, Binary Heaps, AVL Trees, Red-Black Trees, Vectors, Union-Find, BDDs, …

Plan • Contributions • Types & Structures • Refined Types & Data Structures • Expressiveness • Results

Types & Structures How do types handle structures ? 1. 2. 3. 4. Represent Universal Properties Algorithm for Instantiating Properties Algorithm for Generalizing Properties Algorithm for Inference

1. Representation: Recursive Types [] : : x: int type int list = | [] | : : of x: int * int list 11: : (2: : (3: : [])) 2 3

1. Representation: Recursive Types [] : : hx 1: int [] : : hx 2: int [] : : hx: 3 int : int Type. Property: Unfolding Universal Property: h 1: For int, h 2: h 3: int, … all x in l, xint, is an int [] : : x: int

Types & Structures How do types handle structures ? 1. 2. 3. 4. Represent Universal Properties Algorithm for Instantiating Properties Algorithm for Generalizing Properties Algorithm for Inference

2. Instantiation Algorithm: Unfold [] l : : Unfold h: int x: int list : : l = h: : t Instantiate [] t : : x: int h: int t: int list

3. Generalization Algorithm: Fold [] l : : Fold h: int x: int list : : l = h: : t Generalize [] t : : x: int h: int t: int list

Types & Structures How do types handle structures ? 1. 2. 3. 4. Represent Universal Properties Algorithm for Instantiating Properties Algorithm for Generalizing Properties Algorithm for Inference

Ex: Typecheck Insertion Into List 1. 2. 3. let rec insert(x, l) = match l with | [] -> x: : [] | h: : t -> if x<h then x: : l else h: : insert(x, t) insert : : (x: int, l: int list) ! int list Verification = Generalization + Instantiation

Ex: Typecheck Insertion Into List 1/3 let rec insert(x, l) = match l with | [] -> x: : [] 1. G | h: : t -> if x<h then 2. x: : l else h: : insert(x, t) 3. Assume Input Type []: int list x: int Generalize x: : []: int list Output Checks! insert : : (x: int, l: int list) ! int list

Ex: Typecheck Insertion into List 2/3 let rec insert(x, l) = match l with | [] -> x: : [] 1. | h: : t -> if x<h then 2. G x: : l else h: : insert(x, t) 3. Assume Input Type x: int list Generalize x: : l: int list Output Checks! insert : : (x: int, l: int list) ! int list

Ex: Typecheck Insertion into List 3/3 let rec insert(x, l) = match l with | [] -> x: : [] 1. | h: : t -> I if x<h then 2. x: : l else h: : insert(x, t) 3. G Input Assumption h: : t: int list Instantiate h: int t: int list insert(x, t): int list x: int Generalize h: : insert(x, t): int list Output Checks! insert : : (x: int, l: int list) ! int list

Verification = Generalization + Instantiation G I G G let rec insert(x, l) = match l with | [] -> x: : [] • Gen when adding to struct. | h: : t -> • Ins when taking from struct. if x<h then x: : l else h: : insert(x, t) insert : : (x: int, l: int list) ! int list

Types & Structures How do types handle structures ? 1. 2. 3. 4. Represent Universal Properties Algorithm for Instantiating Properties Algorithm for Generalizing Properties Algorithm for Inference

Plan • Contributions • Types & Structures • Refined Types & Data Structures • Expressiveness • Results

Refined Types & Data Structures 1. 2. 3. 4. Idea: “Piggyback” Predicates over Type Representation for Universal Data Properties Algorithm for Instantiating Data Properties Algorithm for Generalizing Data Properties Algorithm for Inference

1. Representation: Refined Rec. Types [] : : hx: int 0<x 0<h Refined Type Unfolding

1. Representation: Refined Rec. Types [] Refined Type Unfolding : : hx 1: : int 0<x 0<h 1 [] : : hx 2: : int 0<x 2 0<h [] : : hx 3: : int 0<h 3 0<x [] : : x: int 0<x Universal Data Property: For all xint in l, | 0<x l: {x: 0<x} list

1. Representation: Rec. Refined Rec. Types [] : : x<V Refines tail’s elements xx 1: : int 0<x Refines all elements V Refers to Each Element in Tail

1. Representation: Rec. Refined Rec. Types [] : : h<V x<V hx: int h<x Instantiate V Rec. Refined Type Unfolding Push Edge Predicate Into Node

1. Representation: Rec. Refined Rec. Types [] : : hx 1: : int Rec. Refined Type Unfolding hx<V 1<V [] : : x<V h 2<V hx 2: int h 1<h <x 2 [] : : hx 3: : int hh 11<h <x 3 h 2<h <x 3 Universal Recursive Data Property h h 2 < list h 3 < … l: sorted 1 < hx<V 3<V [] : : x: int h 1<x h 2<x h 3<x x<V

2. Instantiation Algorithm: Unfold [] : : x<V x: int : : Unfold l [] h: int l: sorted list Instantiate x<V x: int t l = h: : t : : h<x h: int t: sorted list & {h<x} list

3. Generalization Algorithm: Fold [] : : x<V x: int : : Fold l [] h: int l: sorted list Generalize x<V x: int t l = h: : t : : h<x h: int t: sorted list & {h<x} list

Refined Types & Data Structures Idea: “Piggyback” Predicates over Type 1. 2. 3. 4. Representation for Universal Data Properties Algorithm for Instantiating Data Properties Algorithm for Generalizing Data Properties Algorithm for Inference

Refinement Type Inference [] : : Kx<V 2 x: int K 1 0<x Refinements Determine Property 1. Unknown refinements are variables 2. Constraints over variables 3. Solve to find refinements

Refinement Type Inference [] : : x: int K 1 Kx<V 2 x<V *<* 0<x 0<* x=V *=* …… 0<x Hints Type Inference Instantiate With Program Variables Apply atfor Refinement Points Keep Only Valid Refinements Determine Property 1. Unknown refinements are variables 2. Constraints over variables 3. Solve to find refinements

Refined Types & Data Structures Idea: “Piggyback” Predicates over Type 1. 2. 3. 4. Representation for Universal Data Properties Free Representation Algorithm for Instantiating Data Properties Algorithm for Generalizing Data Properties Free Algorithms Algorithm for Inference

Verify Insertion Into Sorted List G I G G let rec insert(x, l) = match l with | [] -> x: : [] | h: : t -> if x<h then x: : l else h: : insert(x, t) Generalize , Instantiate at same place as typechecker! • Gen when adding to struct. • Ins when taking from struct. insert : : (x: int, l: sorted list) ! sorted list (x: int, l: int list) !+int list Verification = Generalization Instantiation

Plan • Contributions • Types & Structures • Refined Types & Data Structures • Expressiveness • Results

Property: h 1 <sorted h 2 < hlist 3 < … [] : : hx 1: : int Refined Type Unfolded x<V : : h 2: int h 1<h 2 : : int [] Refinements Determine h. Property 3: h 1<h 3 h 2<h 3 : : x: int h 1<x h 2<x h 3<x x<V

Property: duplicate-free Property: h 1 h 2 h 3 list … [] : : hx 1: : int x V : : h 2: int h 1 h 2 Refined Type Unfolded : : h 3: int h 1 h 3 h 2 h 3 Non-aliasing in Collections e. g. list of distinct addresses [] : : x: int h 1 x h 2 x h 3 x x V

Trees: Refined Type V<x Node x: int Leaf x<V

Type tree Unfold. Refined Property: binary-search V<r V<x Node x<V x: int Node r<V x<V r: int x: int Leaf V<x Node x<V x: int x<r r<x Leaf Push edge predicate inside < RHS nodes LHS nodes < root

Refined Type l Node r |Hl – Hr|< 2 Leaf Refine Node l , r = Names of left, right trees H l, H r = Heights of left, right trees

Refined Typetree Unfold Height balanced at each level Property: balanced l 1 l l Node r r r 1 Node |Hl 1––Hr|< Hr 1|< |Hl 22 Leaf l Node |Hl – Hr|< 2 Leaf r

Plan • Contributions • Types & Structures • Refined Types & Data Structures • Expressiveness • Results

Our Inference Tool OCaml Program Specification Hints Dsolve Safe Unsafe

Data Structures Program List-sort Map Lines 111 98 Redblack 106 Stablesort 124 Vec 343 Bin. Heap 122 Splay. Heap 134 Malloc Bdd 71 206 Union. Find 65 Subv. Solve 264 Total 1736

Data Structures Program List-sort Map Lines 111 98 Property Sorted, Outputs Permutation of Input Balance, BST, Implements a Set Redblack 106 Balance, BST, Color Stablesort 124 Sorted Vec 343 Balance, Bounds Checking, … Bin. Heap 122 Heap, Returns Minimum, … Splay. Heap 134 BST, Returns Minimum, Implements a Set Malloc Bdd 71 206 Used and Free Lists Are Accurate Maintains Variable Order Union. Find 65 Acyclic Subv. Solve 264 Acyclic Total 1736

Data Structures Program List-sort Map Lines 111 98 Property Sorted, Outputs Permutation of Input Balance, BST, Implements a Set Redblack 106 Balance, BST, Color Stablesort 124 Sorted Vec 343 Balance, Bounds Checking, … Bin. Heap 122 Heap, Returns Minimum, … Splay. Heap 134 BST, Returns Minimum, Implements a Set Malloc Bdd 71 206 Used and Free Lists Are Accurate Maintains Variable Order Union. Find 65 Acyclic Subv. Solve 264 Acyclic Total 1736

Data Structures Program List-sort Map Lines 111 98 Property Sorted, Outputs Permutation of Input Balance, BST, Implements a Set Redblack 106 Balance, BST, Color Stablesort 124 Sorted Vec 343 Balance, Bounds Checking, … Bin. Heap 122 Heap, Returns Minimum, … Splay. Heap 134 BST, Returns Minimum, Implements a Set Malloc Bdd 71 206 Used and Free Lists Are Accurate Maintains Variable Order Union. Find 65 Acyclic Subv. Solve 264 Acyclic Total 1736

Data Structures Program List-sort Map Lines 111 98 Property Sorted, Outputs Permutation of Input Balance, BST, Implements a Set Redblack 106 Balance, BST, Color Stablesort 124 Sorted Vec 343 Balance, Bounds Checking, … Bin. Heap 122 Heap, Returns Minimum, … Splay. Heap 134 BST, Returns Minimum, Implements a Set Malloc Bdd 71 206 Used and Free Lists Are Accurate Maintains Variable Order Union. Find 65 Acyclic Subv. Solve 264 Acyclic Total 1736

Data Structures Program List-sort Map Lines 111 98 Property Sorted, Outputs Permutation of Input Balance, BST, Implements a Set Redblack 106 Balance, BST, Color Stablesort 124 Sorted Vec 343 Balance, Bounds Checking, … Bin. Heap 122 Heap, Returns Minimum, … Splay. Heap 134 BST, Returns Minimum, Implements a Set Malloc Bdd 71 206 Used and Free Lists Are Accurate Maintains Variable Order Union. Find 65 Acyclic Subv. Solve 264 Acyclic Total 1736

Data Structures Program List-sort Map Lines 111 98 Redblack 106 Stablesort 124 Vec 343 Bin. Heap 122 Splay. Heap 134 Malloc Bdd 71 206 Union. Find 65 Subv. Solve 264 Total 1736

Data Structures Program Lines Hints 111 7 98 14 Redblack 106 2 Stablesort 124 1 Vec 343 9 Bin. Heap 122 6 Splay. Heap 134 3 71 2 206 3 Union. Find 65 2 Subv. Solve 264 2 1736 54 List-sort Map Malloc Bdd Total 3% of code size

Data Structures Program List-sort Lines Hints Time (sec) 111 7 5 98 14 25 Redblack 106 2 29 Stablesort 124 1 4 Vec 343 9 87 Bin. Heap 122 6 33 Splay. Heap 134 3 6 71 2 2 206 3 80 Union. Find 65 2 5 Subv. Solve 264 2 20 1736 54 300 Map Malloc Bdd Total

Data Structures Program List-sort Lines Hints Time (sec) 111 7 5 98 14 25 Redblack 106 2 29 Stablesort 124 1 4 Vec 343 9 87 Bin. Heap 122 6 33 Splay. Heap 134 3 6 71 2 2 206 3 80 Union. Find 65 2 5 Subv. Solve 264 2 20 1736 54 300 Map Malloc Bdd Total

Vec: Extensible Arrays (317 LOC) “Python-style” arrays for OCaml find, insert, delete, join etc. Efficiency via balanced trees Balanced Height difference between siblings ≤ 2 Dsolve found balance violation

Recursive Rebalance fatal off-by-one error

Debugging via Inference Using Dsolve we found Where imbalance occurred (specific path conditions) How imbalance occurred (left tree off by up to 4) Leading to test and fix

Plan • Contributions • Types & Structures • Refined Types & Data Structures • Expressiveness • Results

http: //pho. ucsd. edu/liquid source, papers, demo, etc.

Conclusion Predicates Types Data Precision Lifting to Structures Data Structure Verification

(Finite) Maps 1 (node, node list) Map Key Data 2 3 4 5 n 1. succs=[n 2; n 3; n 4] get succs n Field Read/Get n. succs set succs n e Field Write/Set n. succs : = e

Refined Maps 1 (node, node list) Map (n: node, {x: node|n<x} list) Map Acyclic Graph! 3 5 Howsetting to Generalize? Refine poly-type set When key for to data P(x 0), P(x 1), … 2 8 x. P(x) When getting data for from How to Instantiate? Refine poly-type getkey 4

Textual Representation x<V [] : : x: int type int list = | [] | : : of x: int * int list 0<x <<>, <0<x, true>> μt. [] ++ : : (x: int, t) μt. + : : (x: int, <x<V, true>>t) [] + [] : : (x: {0 < x}, μt. <<>, [] <…>t)) [] has no Refines parameters Refines Tail Elements

Insertion Sort Type and Hint let rec ins l x = match l with | [] -> x : : [] | h : : xs -> if x < h then x : : h : : xs else h : : (ins xs x) hint: * =< * let insert_sort lst = List. fold_left ins [] lst sorted = μt. [] + : : (x: int, <<>, <V >= x, true>>t) insert_sort : sorted ! sorted