Universal symbolic execution and its application to likely data structure invariant generation

Abstract

Local data structure invariants are asserted over a bounded fragment of a data structure around a distinguished node M of the data structure. An example of such an invariant a sorted doubly linked list is for all nodes M of the list, if M ≠ null and M.next ≠ null, then M.next.prev = M and M.value ≤ M.next.value. It has been shown that such local invariants are both natural and sufficient describing a large class of data structures. This paper explores a novel technique, called Krystal, to infer likely local data structure invariants using a variant of symbolic execution, called universal symbolic execution. Universal symbolic execution is like traditional symbolic execution except the fact that we create a fresh symbolic variable every read of a lvalue that has no mapping in the symbolic state rather than creating a symbolic variable only inputs. This helps universal symbolic execution to symbolically track data flow all memory locations along an execution even if input values do not flow directly into those memory locations. We have implemented our algorithm and applied it to several data structure implementations in Java. Our experimental results show that we can infer many interesting local invariants these data structures.