Compositional Symbolic Execution for the Next 700 Memory Models (Extended Version)

2025-08-21

AI Summary

Existing compositional symbolic execution (CSE) platforms lack a formal foundation supporting parametrized memory models. Method: We propose a unified formal framework that, for the first time, integrates separation logic (SL) and incorrectness separation logic (ISL) within a single logical system, enabling parametric modeling of diverse memory models—including C11 and CHERI—via standard logical definitions to ensure cross-platform compatibility. All core metatheoretic results, including soundness and completeness properties, are mechanized and verified in the Rocq theorem prover, guaranteeing formal rigor and reliability. Contribution/Results: Our framework significantly enhances flexibility, generality, and trustworthiness in program verification and bug finding. It provides a scalable, unified foundation for analyzing programs across multiple programming languages and memory models, thereby advancing the state of compositional reasoning for realistic concurrent and memory-safe systems.

Technology Category

• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Cognitive Modeling & Cognitive Systems: Symbolic Representations
• Knowledge Representation and Reasoning: Logic Programming

Application Category

• Semantics and Knowledge: Methods, algorithms and applications for the development of semantic models, knowledge graphs and other forms of structured data models with machine-interpretable semantics
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Security and Privacy: Large-scale security measurements

Abstract

Multiple successful compositional symbolic execution (CSE) tools and platforms exploit separation logic (SL) for compositional verification and/or incorrectness separation logic (ISL) for compositional bug-finding, including VeriFast, Viper, Gillian, CN, and Infer-Pulse. Previous work on the Gillian platform, the only CSE platform that is parametric on the memory model, meaning that it can be instantiated to different memory models, suggests that the ability to use custom memory models allows for more flexibility in supporting analysis of a wide range of programming languages, for implementing custom automation, and for improving performance. However, the literature lacks a satisfactory formal foundation for memory-model-parametric CSE platforms. In this paper, inspired by Gillian, we provide a new formal foundation for memory-model-parametric CSE platforms. Our foundation advances the state of the art in four ways. First, we mechanise our foundation (in the interactive theorem prover Rocq). Second, we validate our foundation by instantiating it to a broad range of memory models, including models for C and CHERI. Third, whereas previous memory-model-parametric work has only covered SL analyses, we cover both SL and ISL analyses. Fourth, our foundation is based on standard definitions of SL and ISL (including definitions of function specification validity, to ensure sound interoperation with other tools and platforms also based on standard definitions).

Problem

• Providing formal foundation for memory-model-parametric compositional symbolic execution
• Extending support to both separation logic and incorrectness separation logic analyses
• Validating foundation across multiple memory models including C and CHERI

Innovation

• Mechanized foundation in Rocq theorem prover
• Validated with multiple memory models including C/CHERI
• Covers both separation logic and incorrectness logic analyses