In this paper, we propose an approach for automated test case generation based on techniques from Constraint Programming. We show how an imperative language can be extended with constraint variables and its operational semantics with constraints. By running a program in this extended language, we obtain constraints on the initial environment and heap. Solving these constrains, we obtain concret...

This paper presents an efficient context-sensitive heap analysis algorithm called Data Structure Analysis designed to enable analyses and transformations on entire disjoint recursive data structures. The analysis has several challenging properties needed to enable such transformations: context-sensitivity with cloning (essential for proving disjointness), field-sensitivity, and the use of an ex...

Speculative multithreading is a promising technique for automatic parallelization. However, our experience with a software implementation indicates that there is significant overhead involved in managing the heap memory internal to the speculative system and significant complexity in correctly managing the call stack memory used by speculative tasks. We first describe a specialized heap managem...

Heap and data structures represent one of the biggest challenges when applying model checking to the analysis of software programs: in order to verify (unbounded) safety of a program, it is typically necessary to formulate quantified inductive invariants that state properties about an unbounded number of heap locations. Methods like Craig interpolation, which are commonly used to infer invarian...

,4 simple implementation of doubleended priority queues is presented. The proposed structure, called a min-max heap, can be built in linear time; in contrast to conventional heaps, it allows both FindMin and FindMax to be performed in constant time; Insert, DeleteMin, and DeleteMax operations can be performed in logarithmic time. Min-max heaps can be generalized to support other similar order-s...

A standard heap ordered tree with n + 1 nodes is a finite rooted tree in which all the nodes except the root are labeled with the natural numbers between 1 and n, and that satisfies the property that the labels of the children of a node are all larger than the label of the node. Denote the set of standard heap ordered trees with n+1 nodes by Tn. Let kT = ⊕ n≥0 kTn. It is known that there are Ho...

Separation logic (SL) is an extension of Hoare logic by operations and formulas that not only talk about program variables, but also about heap portions. Its general purpose is to enable more flexible reasoning about linked object/record structures. In the present paper we give an algebraic extension of SL at the data structure level. We define operations that additionally to heap separation ma...

We describe an interprocedural shape analysis that makes use of spatial locality (i.e. the fact that most procedures modify only a small subset of the heap) in its representation of abstract states. Instead of tracking reachability information directly and aliasing information indirectly, our representation tracks reachability indirectly and aliasing directly. Computing the effect of procedure ...

In this paper we derive a linear-time, constant-space algorithm to construct a binary heap whose inorder traversal equals a given sequence. We do so in two steps. First, we invert a program that computes the inorder traversal of a binary heap, using the proof rules for program inversion by W. Chen and J.T. Udding. This results in a linear-time solution in terms of binary trees. Subsequently, we...