Sound and Complete Invariant-Based Heap Encodings (Technical Report)

2025-04-22

AI Summary

Verifying programs manipulating unbounded heap-allocated data structures—such as linked lists and trees—remains challenging due to complex aliasing, pointer arithmetic, and dynamic memory behavior. Method: This paper proposes an invariant-based automated verification approach that reduces correctness checking of heap-manipulating programs to the satisfiability problem of integer-constrained Horn clauses (CHCs). It employs uninterpreted predicates and oracle variables to construct a relational heap model, integrating CHC solving with integer arithmetic reasoning. Contribution/Results: The work establishes the first sound and complete formal verification framework for such programs, accompanied by a rigorous correctness proof. Experiments demonstrate that the method substantially extends the capabilities of existing CHC solvers, enabling fully automatic, end-to-end verification of intricate heap operations—including bidirectional list insertion/deletion and binary search tree restructuring—for the first time.

Technology Category

• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Knowledge Representation and Reasoning: Automated Reasoning and Theorem Proving
• Search and Optimization: Heuristic Search

Application Category

• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Semantics and Knowledge: Methods, algorithms and applications for the development of semantic models, knowledge graphs and other forms of structured data models with machine-interpretable semantics
• Systems and Infrastructure for Web, Mobile and WoT: Web performance, measurement, and characterization

Abstract

Verification of programs operating on mutable, heap-allocated data structures poses significant challenges due to potentially unbounded structures like linked lists and trees. In this paper, we present a novel relational heap encoding leveraging uninterpreted predicates and prophecy variables, reducing heap verification tasks to satisfiability checks over integers in constrained Horn clauses (CHCs). To the best of our knowledge, our approach is the first invariant-based method that achieves both soundness and completeness for heap-manipulating programs. We provide formal proofs establishing the correctness of our encodings. Through an experimental evaluation we demonstrate that our method significantly extends the capability of existing CHC-based verification tools, allowing automatic verification of programs with heap previously unreachable by state-of-the-art tools.

Problem

• Verifying heap-manipulating programs with unbounded data structures
• Achieving sound and complete invariant-based heap encodings
• Extending CHC-based tools for automatic heap program verification

Innovation

• Relational heap encoding with uninterpreted predicates
• Prophecy variables for heap verification
• Sound and complete invariant-based method