Lambda the Ultimate

Shape analysis for composite data structures. MSR-TR-2007-13.

We propose a shape analysis that adapts to some of the complex composite data structures found in industrial systems-level programs. Examples of such data structures include ``cyclic doubly-linked lists of acyclic doubly-linked lists'', ``singly-linked lists of cyclic doubly-linked lists with back-pointers to head nodes'', etc. The analysis introduces the use of generic higher-order inductive predicates describing spatial relationships together with a method of synthesizing new parametrized spatial predicates which can be used in combination with the higher-order predicates. In order to evaluate the proposed approach for realistic programs we have implemented the analysis and performed experiments with it on examples drawn from device drivers. During our experiments the analysis proved the memory safety of several routines belonging to an IEEE 1394 (firewire) driver, and also found several previously unknown memory safety bugs and memory leaks. To our knowledge this represents the first known successful application of shape analysis to non-trivial systems-level code.

Seems relevant to some of the discussions currently going on (e.g., how PLT can help practitioners).

The analysis described in this paper fits in to the common structure of shape analyses, and is based on abstract interpretation.