## Space Invading Systems Code

### Cached

### Download Links

Citations: | 2 - 0 self |

### BibTeX

@MISC{Calcagno_spaceinvading,

author = {Cristiano Calcagno and Dino Distefano and Hongseok Yang},

title = {Space Invading Systems Code},

year = {}

}

### OpenURL

### Abstract

Space Invader is a static analysis tool that aims to perform accurate, automatic verification of the way that programs use pointers. It uses separation logic assertions [10,11] to describe states, and works by performing a proof search, using abstract interpretation to enable convergence. As well as having roots in separation

### Citations

705 | Separation logic: a logic for shared mutable data structures
- Reynolds
(Show Context)
Citation Context ...mperial College 1 Introduction Space Invader is a static analysis tool that aims to perform accurate, automatic verification of the way that programs use pointers. It uses separation logic assertions =-=[10,11]-=- to describe states, and works by performing a proof search, using abstract interpretation to enable convergence. As well as having roots in separation logic, Invader draws on the fundamental work of ... |

445 | G.: Lazy abstraction
- Henzinger, Jhala, et al.
- 2002
(Show Context)
Citation Context ...ble convergence. As well as having roots in separation logic, Invader draws on the fundamental work of Sagiv et. al. on shape analysis [12]. It is complementary to other tools – e.g., SLAM [1], Blast =-=[8]-=-, ASTRÉE [6] – that use abstract interpretation for verification, but that use coarse or limited models of the heap. Space Invader began life as a theoretical prototype working on a toy language [7], ... |

293 | Solving shapeanalysis problems in languages with destructive updating
- Sagiv, Reps, et al.
(Show Context)
Citation Context ...y performing a proof search, using abstract interpretation to enable convergence. As well as having roots in separation logic, Invader draws on the fundamental work of Sagiv et. al. on shape analysis =-=[12]-=-. It is complementary to other tools – e.g., SLAM [1], Blast [8], ASTRÉE [6] – that use abstract interpretation for verification, but that use coarse or limited models of the heap. Space Invader began... |

268 | Local reasoning about programs that alter data structures
- O’Hearn, Reynolds, et al.
- 2001
(Show Context)
Citation Context ...mperial College 1 Introduction Space Invader is a static analysis tool that aims to perform accurate, automatic verification of the way that programs use pointers. It uses separation logic assertions =-=[10,11]-=- to describe states, and works by performing a proof search, using abstract interpretation to enable convergence. As well as having roots in separation logic, Invader draws on the fundamental work of ... |

141 | Thorough static analysis of device drivers
- Ball, Bounimova, et al.
- 2006
(Show Context)
Citation Context ...tion to enable convergence. As well as having roots in separation logic, Invader draws on the fundamental work of Sagiv et. al. on shape analysis [12]. It is complementary to other tools – e.g., SLAM =-=[1]-=-, Blast [8], ASTRÉE [6] – that use abstract interpretation for verification, but that use coarse or limited models of the heap. Space Invader began life as a theoretical prototype working on a toy lan... |

127 | A local shape analysis based on separation logic
- Distefano, O’Hearn, et al.
- 2006
(Show Context)
Citation Context ...t [8], ASTRÉE [6] – that use abstract interpretation for verification, but that use coarse or limited models of the heap. Space Invader began life as a theoretical prototype working on a toy language =-=[7]-=-, which was itself an outgrowth of a previous toy-language tool [3]. Then, in May of 2006, spurred by discussions with Byron Cook, we decided to move beyond our toy languages and challenge programs, a... |

87 | Shape analysis for composite data structures
- Berdine, Calcagno, et al.
- 2007
(Show Context)
Citation Context ...cate that describes linked lists. This allows for the description of complex, nested (though linear) data structures, as well as for adapting to the varied data structures found in different programs =-=[2]-=-. – Near-perfect Join. The adaptive analysis allowed several driver routines to be verified, but it timed out on others. The limit was around 1K LOC, when given a nested data structure and a procedure... |

87 | Compositional shape analysis by means of bi-abduction
- Calcagno, Distefano, et al.
- 2009
(Show Context)
Citation Context ...tive inference to infer assertions describing missing portions of heap – leads to a compositional analysis which has been applied to larger programs, such as a complete linux distribution of 2.5M LOC =-=[5]-=-. The compositional and adaptive verification techniques fit together particularly well. If you want to automatically find a spec of the data structure usage in a procedure in some program you don’t k... |

85 | Scalable shape analysis for systems code
- Yang, Lee, et al.
- 2008
(Show Context)
Citation Context ... existence of a partial join operator that leads to speed-ups which allow entire drivers to be analyzed, while retaining enough precision for the goal of proving pointer safety with zero false alarms =-=[9]-=-. – Compositionality. The version of Space Invader with adaptation and join was a top-down, whole-program analysis (like all previous heap verification methods). This meant the user had to either supp... |

18 | Footprint analysis: A shape analysis that discovers preconditions
- Calcagno, Distefano, et al.
(Show Context)
Citation Context ... code, or to large codes. We discovered a method of inferring a preconditon and postcondition for a procedure, without knowing its calling context: the method aims to find the “footprint” of the code =-=[4]-=-, a description of the cells it accesses. The technique – which involves the use of abductive inference to infer assertions describing missing portions of heap – leads to a compositional analysis whic... |

14 |
P.W.: Smallfoot: Automatic modular assertion checking with separation logic
- Berdine, Calcagno, et al.
- 2006
(Show Context)
Citation Context ...on, but that use coarse or limited models of the heap. Space Invader began life as a theoretical prototype working on a toy language [7], which was itself an outgrowth of a previous toy-language tool =-=[3]-=-. Then, in May of 2006, spurred by discussions with Byron Cook, we decided to move beyond our toy languages and challenge programs, and test our ideas against realworld systems code, starting with a W... |