Shape Analysis of Acyclic Singly-Linked Lists

This directory contains analyses of programs manipulating acyclic unshared singly linked lists of the form

typedef struct node {
   struct node *n;
   int data;
} *L;

Goal

The aim of the analyses is to verify:
  1. Absence of null dereferences. This property is checked in all examples;
  2. No memory leakage. This means that no elements become unreachable from the program variables.
  3. Output list is unshared.
The first property is checked in all examples and the last two properties are checked only in appropriate examples (that perform list mutations).

List of examples and their descriptions

(see additional comments below)
Example Example description Properties checked Command line
create A function that creates new list of elements and appends them to the input list
  1. Absence of null dereferences
  2. No memory leakage
  3. Output list is unshared
tvla create sll
delete A function that deletes an element with a specified value from a list
  1. Absence of null dereferences
  2. No memory leakage
  3. Output list is unshared
tvla delete sll
deleteAll A function that deallocates all elements in a list
  1. Absence of null dereferences
  2. No memory leakage
tvla deleteAll sll
getLast A function that returns a pointer to the last element of a list Absence of null dereferences tvla getLast sll
insert A function that creates an element with a specified value and inserts it before the first element with a larger value
  1. Absence of null dereferences
  2. No memory leakage
  3. Output list is unshared
tvla insert sll
merge A function that merges two ordered lists into one ordered list
  1. Absence of null dereferences
  2. No memory leakage
  3. Output list is unshared
tvla merge merge
reverse A function that successfuly reverses a singly-linked list in-situ
  1. Absence of null dereferences
  2. No memory leakage
  3. Output list is unshared
tvla reverse sll
rotate A function that moves the first element to the position following the last element
  1. Absence of null dereferences
  2. No memory leakage
  3. Output list is unshared
tvla rotate rotate
search A function that searches a list for an element with a specified value Absence of null dereferences tvla search sll
search_nullderef A function that searches a list for an element with a specified value and causes a null dereference Absence of null dereferences tvla search_nullderef sll
swap A function that swaps the first two elements in a list
  1. Absence of null dereferences
  2. No memory leakage
  3. Output list is unshared
tvla swap sll

Comments on the way C functions are modelled by first-order transition systems

The original C functions were pre-processed in the following ways in order to simplify the analysis:
  1. Statements that assign to fields are preceded by statements that assign the value NULL to the fields.
    For example, x->n = y; is replaced with x->n = NULL; x->n = y;
  2. Statements that deallocate memory are preceded by statements that assign NULL to fields.
    For example, free(x); is replaced with x->n = NULL; free(x);
  3. Statements that copy a value from one field to another are simplified by using temporary variables.
    For example, x->n = y->n; is replaced with the sequence of assignments
    t = y->n; x->n = NULL; x->n = t; t = NULL;
Program conditions are modelled by two actions---one for the true branch and one for the false branch.