Containers are ubiquitous data structures that support a variety of manipulations on the
elements, inducing the indirect value flows in the program. Tracking value flows through …

To infer complex structural invariants, shape analyses rely on expressive families of logical
properties. Many such analyses manipulate abstract memory states that consist of …

In dynamic languages, objects are open–they support iteration over and dynamic
addition/deletion of their attributes. Open objects, because they have an unbounded number …

Separation logic is a state-of-the-art logic for dealing with the program heap. Using its frame
rule, initial works have strived towards automated modular verification for heap-manipulating …

Programs written in modern languages perform intricate manipulations of containers such as
arrays, lists, dictionaries, and sets. We present an abstract interpretation-based framework …

Discovering program specifications automatically for heap-manipulating programs is a
challenging task due to the complexity of aliasing and mutability of data structures. This task …

Recursion can complicate program analysis significantly. Some program analyzers simply
ignore recursion or even refuse to check recursive programs. In this paper, we propose an …

Automatically verifying heap-manipulating programs is a challenging task, especially when
dealing with complex data structures with strong invariants, such as sorted lists and AVL/red …

When constructing complex program analyses, it is often useful to reason about not just
individual values, but collections of values. Symbolic set abstractions provide building …

Program invariants such as loop invariants and method specifications (aka procedural
summaries) are key components in program verification. Such invariants are usually …