A CLP Heap Solver for Test Case Generation

Elvira Albert1, Marıa Garcıa de la Banda2,5, MiguelG-Zamalloa1, Jose Miguel Rojas3 and Peter Stuckey4,5

(1) Complutense University of Madrid, Spain(2) Monash University, Australia

(3) Technical University of Madrid, Spain(4) National ICT Australia and University of Melbourne, Australia

(5) IMDEA Software, Madrid, Spain

ICLP 2013Istanbul, August 26, 2013

2 11

Motivation

I Software testing – manual, expensive, time-consuming

I Automation

I Test case generation

I Symbolic execution

I Scalability is a major goalI Challenge: Efficiently handling heap-manipulating programs

I Complex dynamic data structuresI Aliasing of referencesI Explore all possible heap shapesI Path explosion problemI Outperform Lazy Initialization

2 11

Motivation

I Software testing – manual, expensive, time-consuming

I Automation

I Test case generation

I Symbolic execution

I Scalability is a major goalI Challenge: Efficiently handling heap-manipulating programs

I Complex dynamic data structuresI Aliasing of referencesI Explore all possible heap shapesI Path explosion problemI Outperform Lazy Initialization

2 11

Motivation

I Software testing – manual, expensive, time-consuming

I Automation

I Test case generation

I Symbolic execution

I Scalability is a major goalI Challenge: Efficiently handling heap-manipulating programs

I Complex dynamic data structuresI Aliasing of referencesI Explore all possible heap shapesI Path explosion problemI Outperform Lazy Initialization

2 11

Motivation

I Software testing – manual, expensive, time-consuming

I Automation

I Test case generation

I Symbolic execution

I Scalability is a major goalI Challenge: Efficiently handling heap-manipulating programs

I Complex dynamic data structuresI Aliasing of referencesI Explore all possible heap shapesI Path explosion problemI Outperform Lazy Initialization

2 11

Motivation

I Software testing – manual, expensive, time-consuming

I Automation

I Test case generation

I Symbolic execution

I Scalability is a major goal

I Challenge: Efficiently handling heap-manipulating programsI Complex dynamic data structuresI Aliasing of referencesI Explore all possible heap shapesI Path explosion problemI Outperform Lazy Initialization

2 11

Motivation

I Software testing – manual, expensive, time-consuming

I Automation

I Test case generation

I Symbolic execution

I Scalability is a major goalI Challenge: Efficiently handling heap-manipulating programs

I Complex dynamic data structuresI Aliasing of referencesI Explore all possible heap shapesI Path explosion problemI Outperform Lazy Initialization

2 11

Motivation

I Software testing – manual, expensive, time-consuming

I Automation

I Test case generation

I Symbolic execution

I Scalability is a major goalI Challenge: Efficiently handling heap-manipulating programs

I Complex dynamic data structures

I Aliasing of referencesI Explore all possible heap shapesI Path explosion problemI Outperform Lazy Initialization

2 11

Motivation

I Software testing – manual, expensive, time-consuming

I Automation

I Test case generation

I Symbolic execution

I Scalability is a major goalI Challenge: Efficiently handling heap-manipulating programs

I Complex dynamic data structuresI Aliasing of references

I Explore all possible heap shapesI Path explosion problemI Outperform Lazy Initialization

2 11

Motivation

I Software testing – manual, expensive, time-consuming

I Automation

I Test case generation

I Symbolic execution

I Scalability is a major goalI Challenge: Efficiently handling heap-manipulating programs

I Complex dynamic data structuresI Aliasing of referencesI Explore all possible heap shapes

I Path explosion problemI Outperform Lazy Initialization

2 11

Motivation

I Software testing – manual, expensive, time-consuming

I Automation

I Test case generation

I Symbolic execution

I Scalability is a major goalI Challenge: Efficiently handling heap-manipulating programs

I Complex dynamic data structuresI Aliasing of referencesI Explore all possible heap shapesI Path explosion problem

I Outperform Lazy Initialization

2 11

Motivation

I Software testing – manual, expensive, time-consuming

I Automation

I Test case generation

I Symbolic execution

I Scalability is a major goalI Challenge: Efficiently handling heap-manipulating programs

I Complex dynamic data structuresI Aliasing of referencesI Explore all possible heap shapesI Path explosion problemI Outperform Lazy Initialization

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I Standard technique to handle aliasing. Used in state-of-the-artsystems, e.g., PET (UCM&UPM) and SPF (NASA Ames)

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I Standard technique to handle aliasing. Used in state-of-the-artsystems, e.g., PET (UCM&UPM) and SPF (NASA Ames)

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I Field accesses on unknown references trigger non-determinism:1) Null 2) New reference 3) Each aliasing possibility

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I Field accesses on unknown references trigger non-determinism:1) Null 2) New reference 3) Each aliasing possibility

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I Field accesses on unknown references trigger non-determinism:1) Null 2) New reference 3) Each aliasing possibility

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I Field accesses on unknown references trigger non-determinism:1) Null 2) New reference 3) Each aliasing possibility

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I Field accesses on unknown references trigger non-determinism:1) Null 2) New reference 3) Each aliasing possibility

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I Field accesses on unknown references trigger non-determinism:1) Null 2) New reference 3) Each aliasing possibility

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I Symbolic execution quickly becomes impracticalI Redundant exploration of large number of paths

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I Symbolic execution quickly becomes impracticalI Redundant exploration of large number of paths

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I Symbolic execution quickly becomes impracticalI Redundant exploration of large number of paths

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I Symbolic execution quickly becomes impracticalI Redundant exploration of large number of paths

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I Symbolic execution quickly becomes impracticalI Redundant exploration of large number of paths

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I Symbolic execution quickly becomes impracticalI Redundant exploration of large number of paths

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I Symbolic execution quickly becomes impracticalI Redundant exploration of large number of paths

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I A more scalable approach than lazy initialization

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I A more scalable approach than lazy initialization

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I Avoid non-determinism as much as possible

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I Treatment of reference aliasing by means of disjunctions

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I Treatment of reference aliasing by means of disjunctions

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I Propagation of heap-related constraints

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I Support for heap assumptions to avoid certain aliasingconfigurations. E.g., acyclic(x), non-aliasing(x,z)

3 11

Handling heap-manipulating programsLazy Initialization vs Heap Solver

m(C x,C y, C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)

m3(y.f);else

m4(y.f);}

I Implemented in PET

I Applicable to other systems

4 11

Test Case Generation by Symbolic Execution in CLPThe PET System

I Static structural CLP-based approach

I Bounded symbolic execution

I Symbolic values (constrained variables) as input arguments

I Non-determinism at branching points involving unknown data

I Backtracking and constraint manipulation/solving

I Special built-ins to handle heap operations

4 11

Test Case Generation by Symbolic Execution in CLPThe PET System

I Static structural CLP-based approach

I Bounded symbolic execution

I Symbolic values (constrained variables) as input arguments

I Non-determinism at branching points involving unknown data

I Backtracking and constraint manipulation/solving

I Special built-ins to handle heap operations

4 11

Test Case Generation by Symbolic Execution in CLPThe PET System

I Static structural CLP-based approach

I Bounded symbolic execution

I Symbolic values (constrained variables) as input arguments

I Non-determinism at branching points involving unknown data

I Backtracking and constraint manipulation/solving

I Special built-ins to handle heap operations

4 11

Test Case Generation by Symbolic Execution in CLPThe PET System

I Static structural CLP-based approach

I Bounded symbolic execution

I Symbolic values (constrained variables) as input arguments

I Non-determinism at branching points involving unknown data

I Backtracking and constraint manipulation/solving

I Special built-ins to handle heap operations

4 11

Test Case Generation by Symbolic Execution in CLPThe PET System

I Static structural CLP-based approach

I Bounded symbolic execution

I Symbolic values (constrained variables) as input arguments

I Non-determinism at branching points involving unknown data

I Backtracking and constraint manipulation/solving

I Special built-ins to handle heap operations

4 11

Test Case Generation by Symbolic Execution in CLPThe PET System

I Static structural CLP-based approach

I Bounded symbolic execution

I Symbolic values (constrained variables) as input arguments

I Non-determinism at branching points involving unknown data

I Backtracking and constraint manipulation/solving

I Special built-ins to handle heap operations

4 11

Test Case Generation by Symbolic Execution in CLPThe PET System

I Static structural CLP-based approach

I Bounded symbolic execution

I Symbolic values (constrained variables) as input arguments

I Non-determinism at branching points involving unknown data

I Backtracking and constraint manipulation/solving

I Special built-ins to handle heap operations

5 11

CLP Heap Solver - The Heap

Internal Representation

Heap ≡ 〈S,N ,RC〉

I S ::= getF (Ref ,FSig ,Var ,S) | setF (Ref ,FSig ,Data,S) | ∅I N maps fresh numeric references to new objects

I RC is a set of disequality constraints over references

Operations

I Field read access: get field(Hin,Ref,FSig,Var,Hout)

I Field write access: set field(Hin,Ref,FSig,Data,Hout)

I Reference equality: ref eq(Hin,Ref1,Ref2,Hout)

I Reference disequality: ref neq(Hin,Ref1,Ref2,Hout)

I Object creation: new object(Hin,C,Ref,Hout)

5 11

CLP Heap Solver - The Heap

Internal Representation

Heap ≡ 〈S,N ,RC〉

I S ::= getF (Ref ,FSig ,Var ,S) | setF (Ref ,FSig ,Data,S) | ∅I N maps fresh numeric references to new objects

I RC is a set of disequality constraints over references

Operations

I Field read access: get field(Hin,Ref,FSig,Var,Hout)

I Field write access: set field(Hin,Ref,FSig,Data,Hout)

I Reference equality: ref eq(Hin,Ref1,Ref2,Hout)

I Reference disequality: ref neq(Hin,Ref1,Ref2,Hout)

I Object creation: new object(Hin,C,Ref,Hout)

5 11

CLP Heap Solver - The Heap

Internal Representation

Heap ≡ 〈S,N ,RC〉

I S ::= getF (Ref ,FSig ,Var ,S) | setF (Ref ,FSig ,Data,S) | ∅I N maps fresh numeric references to new objects

I RC is a set of disequality constraints over references

Operations

I Field read access: get field(Hin,Ref,FSig,Var,Hout)

I Field write access: set field(Hin,Ref,FSig,Data,Hout)

I Reference equality: ref eq(Hin,Ref1,Ref2,Hout)

I Reference disequality: ref neq(Hin,Ref1,Ref2,Hout)

I Object creation: new object(Hin,C,Ref,Hout)

5 11

CLP Heap Solver - The Heap

Internal Representation

Heap ≡ 〈S,N ,RC〉

I S ::= getF (Ref ,FSig ,Var ,S) | setF (Ref ,FSig ,Data,S) | ∅I N maps fresh numeric references to new objects

I RC is a set of disequality constraints over references

Operations

I Field read access: get field(Hin,Ref,FSig,Var,Hout)

I Field write access: set field(Hin,Ref,FSig,Data,Hout)

I Reference equality: ref eq(Hin,Ref1,Ref2,Hout)

I Reference disequality: ref neq(Hin,Ref1,Ref2,Hout)

I Object creation: new object(Hin,C,Ref,Hout)

5 11

CLP Heap Solver - The Heap

Internal Representation

Heap ≡ 〈S,N ,RC〉

I S ::= getF (Ref ,FSig ,Var ,S) | setF (Ref ,FSig ,Data,S) | ∅I N maps fresh numeric references to new objects

I RC is a set of disequality constraints over references

Operations

I Field read access: get field(Hin,Ref,FSig,Var,Hout)

I Field write access: set field(Hin,Ref,FSig,Data,Hout)

I Reference equality: ref eq(Hin,Ref1,Ref2,Hout)

I Reference disequality: ref neq(Hin,Ref1,Ref2,Hout)

I Object creation: new object(Hin,C,Ref,Hout)

5 11

CLP Heap Solver - The Heap

Internal Representation

Heap ≡ 〈S,N ,RC〉

I S ::= getF (Ref ,FSig ,Var ,S) | setF (Ref ,FSig ,Data,S) | ∅I N maps fresh numeric references to new objects

I RC is a set of disequality constraints over references

Operations

I Field read access: get field(Hin,Ref,FSig,Var,Hout)

I Field write access: set field(Hin,Ref,FSig,Data,Hout)

I Reference equality: ref eq(Hin,Ref1,Ref2,Hout)

I Reference disequality: ref neq(Hin,Ref1,Ref2,Hout)

I Object creation: new object(Hin,C,Ref,Hout)

6 11

CLP Heap Solver - How does the it work?Running example

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

6 11

CLP Heap Solver - How does the it work?Running example

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

6 11

CLP Heap Solver - How does the it work?Running example

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

6 11

CLP Heap Solver - How does the it work?Running example

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

6 11

CLP Heap Solver - How does the it work?Running example

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

6 11

CLP Heap Solver - How does the it work?Running example

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

6 11

CLP Heap Solver - How does the it work?Running example

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

6 11

CLP Heap Solver - How does the it work?Running example

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

6 11

CLP Heap Solver - How does the it work?Running example

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

6 11

CLP Heap Solver - How does the it work?Running example

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

6 11

CLP Heap Solver - How does the it work?Running example

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

6 11

CLP Heap Solver - How does the it work?Running example

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

6 11

CLP Heap Solver - How does the it work?Running example

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

6 11

CLP Heap Solver - How does the it work?Running example

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

6 11

CLP Heap Solver - How does the it work?Running example

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

6 11

CLP Heap Solver - How does the it work?Running example

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

6 11

CLP Heap Solver - How does the it work?Running example

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

6 11

CLP Heap Solver - How does the it work?Running example

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

7 11

CLP Heap Solver - How does the it work?Example featuring object creation

Java program

m(C x,C y,C z){

x = new C();x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-new object(Hin,X,C,H1),set field(H1,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

7 11

CLP Heap Solver - How does the it work?Example featuring object creation

Java program

m(C x,C y,C z){

x = new C();x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-new object(Hin,X,C,H1),set field(H1,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

N

Cf:

X=0

7 11

CLP Heap Solver - How does the it work?Example featuring object creation

Java program

m(C x,C y,C z){

x = new C();x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-new object(Hin,X,C,H1),set field(H1,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

N

Cf:1

X=0

7 11

CLP Heap Solver - How does the it work?Example featuring object creation

Java program

m(C x,C y,C z){

x = new C();x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-new object(Hin,X,C,H1),set field(H1,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

N

Cf:1

X=0

7 11

CLP Heap Solver - How does the it work?Example featuring object creation

Java program

m(C x,C y,C z){

x = new C();x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-new object(Hin,X,C,H1),set field(H1,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

N

Cf:1

X=0

7 11

CLP Heap Solver - How does the it work?Example featuring object creation

Java program

m(C x,C y,C z){

x = new C();x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-new object(Hin,X,C,H1),set field(H1,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

N

Cf:1

X=0

7 11

CLP Heap Solver - How does the it work?Example featuring object creation

Java program

m(C x,C y,C z){

x = new C();x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-new object(Hin,X,C,H1),set field(H1,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

N

Cf:1

X=0

7 11

CLP Heap Solver - How does the it work?Example featuring object creation

Java program

m(C x,C y,C z){

x = new C();x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-new object(Hin,X,C,H1),set field(H1,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

N

Cf:1

X=0

7 11

CLP Heap Solver - How does the it work?Example featuring object creation

Java program

m(C x,C y,C z){

x = new C();x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-new object(Hin,X,C,H1),set field(H1,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

N

Cf:1

X=0

7 11

CLP Heap Solver - How does the it work?Example featuring object creation

Java program

m(C x,C y,C z){

x = new C();x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-new object(Hin,X,C,H1),set field(H1,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

N

Cf:1

X=0

7 11

CLP Heap Solver - How does the it work?Example featuring object creation

Java program

m(C x,C y,C z){

x = new C();x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-new object(Hin,X,C,H1),set field(H1,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

N

Cf:1

X=0

7 11

CLP Heap Solver - How does the it work?Example featuring object creation

Java program

m(C x,C y,C z){

x = new C();x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-new object(Hin,X,C,H1),set field(H1,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

N

Cf:1

X=0

7 11

CLP Heap Solver - How does the it work?Example featuring object creation

Java program

m(C x,C y,C z){

x = new C();x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-new object(Hin,X,C,H1),set field(H1,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

N

Cf:1

X=0

7 11

CLP Heap Solver - How does the it work?Example featuring object creation

Java program

m(C x,C y,C z){

x = new C();x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-new object(Hin,X,C,H1),set field(H1,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

N

Cf:1

X=0

7 11

CLP Heap Solver - How does the it work?Example featuring object creation

Java program

m(C x,C y,C z){

x = new C();x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-new object(Hin,X,C,H1),set field(H1,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

N

Cf:1

X=0

7 11

CLP Heap Solver - How does the it work?Example featuring object creation

Java program

m(C x,C y,C z){

x = new C();x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-new object(Hin,X,C,H1),set field(H1,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

N

Cf:1

X=0

7 11

CLP Heap Solver - How does the it work?Example featuring object creation

Java program

m(C x,C y,C z){

x = new C();x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x==z)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-new object(Hin,X,C,H1),set field(H1,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),if([X,Y,Z],[],H6,Hout).

if([X,Y,Z],[],H6,Hout) :-ref eq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([X,Y,Z],[],H6,Hout) :-ref neq(H6,X,Z,H7),get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

N

Cf:1

X=0

8 11

CLP Heap Solver - How does the it work?Example for back-propagation

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x.f==1)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),get field(H6,X,f,Xf2,H7),if([Xf2,Y],[],H7,Hout).

if([Xf2,Y],[],H7,Hout) :-Xf2 #= 1,get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([Xf2,Y],[],H7,Hout) :-Xf2 #\= 1,get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

8 11

CLP Heap Solver - How does the it work?Example for back-propagation

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x.f==1)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),get field(H6,X,f,Xf2,H7),if([Xf2,Y],[],H7,Hout).

if([Xf2,Y],[],H7,Hout) :-Xf2 #= 1,get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([Xf2,Y],[],H7,Hout) :-Xf2 #\= 1,get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

8 11

CLP Heap Solver - How does the it work?Example for back-propagation

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x.f==1)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),get field(H6,X,f,Xf2,H7),if([Xf2,Y],[],H7,Hout).

if([Xf2,Y],[],H7,Hout) :-Xf2 #= 1,get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([Xf2,Y],[],H7,Hout) :-Xf2 #\= 1,get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

8 11

CLP Heap Solver - How does the it work?Example for back-propagation

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x.f==1)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),get field(H6,X,f,Xf2,H7),if([Xf2,Y],[],H7,Hout).

if([Xf2,Y],[],H7,Hout) :-Xf2 #= 1,get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([Xf2,Y],[],H7,Hout) :-Xf2 #\= 1,get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

8 11

CLP Heap Solver - How does the it work?Example for back-propagation

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x.f==1)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),get field(H6,X,f,Xf2,H7),if([Xf2,Y],[],H7,Hout).

if([Xf2,Y],[],H7,Hout) :-Xf2 #= 1,get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([Xf2,Y],[],H7,Hout) :-Xf2 #\= 1,get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

8 11

CLP Heap Solver - How does the it work?Example for back-propagation

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x.f==1)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),get field(H6,X,f,Xf2,H7),if([Xf2,Y],[],H7,Hout).

if([Xf2,Y],[],H7,Hout) :-Xf2 #= 1,get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([Xf2,Y],[],H7,Hout) :-Xf2 #\= 1,get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

8 11

CLP Heap Solver - How does the it work?Example for back-propagation

Java program

m(C x,C y,C z){

x.f = 1;z.f = -5;y.f = x.f+1;m2();if (x.f==1)m3(y.f);

elsem4(y.f);

}

CLP-translation

m([X,Y,Z],[],Hin,Hout) :-set field(Hin,X,f,1,H2),set field(H2,Z,f,-5,H3),get field(H3,X,f,Xf,H4),Yf #= Xf+1,set field(H4,Y,f,Yf,H5),m2([],[],H5,H6),get field(H6,X,f,Xf2,H7),if([Xf2,Y],[],H7,Hout).

if([Xf2,Y],[],H7,Hout) :-Xf2 #= 1,get field(H7,Y,f,Yf,H8),m3([Yf],[],H8,Hout).

if([Xf2,Y],[],H7,Hout) :-Xf2 #\= 1,get field(H7,Y,f,Yf,H8),m4([Yf],[],H8,Hout).

Heap Updates

S

9 11

Experimental Results

I 12 benchmarks from net.datastructures Java library

I Loops iterated at most one time per run

I Constraint system solved to obtain actual test cases

Method C N1 T1 N2 T2 N3 T3

DLL.add 139 33 36 200 177 33 42Seq.removeAt 213 36 42 89 116 37 50Seq.replaceAt 187 36 41 39 47 37 27PQ.insert 399 101 160 3602 10672 101 182PQ.remove 193 12 11 86 68 12 15BST.addAll 293 379 2019 919 - 379 2535BST.find 269 62 108 184 285 62 98BST.findAll 428 330 2385 1165 - 330 2538BST.insert 426 970 2527 8365 - 970 3924BST.remove 516 203 615 2745 5587 203 725HPQ.insert 349 61 283 135 638 95 163HPQ.remove 469 80 1814 2021 - 146 2378

Number of paths

0 2 4 6 8 10 12

0

2,000

4,000

6,000

8,000 No AliasingLazy Initialization

Heap-Solver

Total TCG time

0 2 4 6 8 10 12

0

2,000

4,000

6,000No Aliasing

Lazy InitializationHeap-Solver

I Handling reference aliasing efficiently is paramount

I The more complex the program, the bigger the gains

9 11

Experimental Results

I 12 benchmarks from net.datastructures Java library

I Loops iterated at most one time per run

I Constraint system solved to obtain actual test cases

Method C N1 T1 N2 T2 N3 T3

DLL.add 139 33 36 200 177 33 42Seq.removeAt 213 36 42 89 116 37 50Seq.replaceAt 187 36 41 39 47 37 27PQ.insert 399 101 160 3602 10672 101 182PQ.remove 193 12 11 86 68 12 15BST.addAll 293 379 2019 919 - 379 2535BST.find 269 62 108 184 285 62 98BST.findAll 428 330 2385 1165 - 330 2538BST.insert 426 970 2527 8365 - 970 3924BST.remove 516 203 615 2745 5587 203 725HPQ.insert 349 61 283 135 638 95 163HPQ.remove 469 80 1814 2021 - 146 2378

Number of paths

0 2 4 6 8 10 12

0

2,000

4,000

6,000

8,000 No AliasingLazy Initialization

Heap-Solver

Total TCG time

0 2 4 6 8 10 12

0

2,000

4,000

6,000No Aliasing

Lazy InitializationHeap-Solver

I Handling reference aliasing efficiently is paramount

I The more complex the program, the bigger the gains

9 11

Experimental Results

I 12 benchmarks from net.datastructures Java library

I Loops iterated at most one time per run

I Constraint system solved to obtain actual test cases

Method C N1 T1 N2 T2 N3 T3

DLL.add 139 33 36 200 177 33 42Seq.removeAt 213 36 42 89 116 37 50Seq.replaceAt 187 36 41 39 47 37 27PQ.insert 399 101 160 3602 10672 101 182PQ.remove 193 12 11 86 68 12 15BST.addAll 293 379 2019 919 - 379 2535BST.find 269 62 108 184 285 62 98BST.findAll 428 330 2385 1165 - 330 2538BST.insert 426 970 2527 8365 - 970 3924BST.remove 516 203 615 2745 5587 203 725HPQ.insert 349 61 283 135 638 95 163HPQ.remove 469 80 1814 2021 - 146 2378

Number of paths

0 2 4 6 8 10 12

0

2,000

4,000

6,000

8,000 No AliasingLazy Initialization

Heap-Solver

Total TCG time

0 2 4 6 8 10 12

0

2,000

4,000

6,000No Aliasing

Lazy InitializationHeap-Solver

I Handling reference aliasing efficiently is paramount

I The more complex the program, the bigger the gains

9 11

Experimental Results

I 12 benchmarks from net.datastructures Java library

I Loops iterated at most one time per run

I Constraint system solved to obtain actual test cases

Method C N1 T1 N2 T2 N3 T3

DLL.add 139 33 36 200 177 33 42Seq.removeAt 213 36 42 89 116 37 50Seq.replaceAt 187 36 41 39 47 37 27PQ.insert 399 101 160 3602 10672 101 182PQ.remove 193 12 11 86 68 12 15BST.addAll 293 379 2019 919 - 379 2535BST.find 269 62 108 184 285 62 98BST.findAll 428 330 2385 1165 - 330 2538BST.insert 426 970 2527 8365 - 970 3924BST.remove 516 203 615 2745 5587 203 725HPQ.insert 349 61 283 135 638 95 163HPQ.remove 469 80 1814 2021 - 146 2378

Number of paths

0 2 4 6 8 10 12

0

2,000

4,000

6,000

8,000 No AliasingLazy Initialization

Heap-Solver

Total TCG time

0 2 4 6 8 10 12

0

2,000

4,000

6,000No Aliasing

Lazy InitializationHeap-Solver

I Handling reference aliasing efficiently is paramount

I The more complex the program, the bigger the gains

9 11

Experimental Results

I 12 benchmarks from net.datastructures Java library

I Loops iterated at most one time per run

I Constraint system solved to obtain actual test cases

Method C N1 T1 N2 T2 N3 T3

DLL.add 139 33 36 200 177 33 42Seq.removeAt 213 36 42 89 116 37 50Seq.replaceAt 187 36 41 39 47 37 27PQ.insert 399 101 160 3602 10672 101 182PQ.remove 193 12 11 86 68 12 15BST.addAll 293 379 2019 919 - 379 2535BST.find 269 62 108 184 285 62 98BST.findAll 428 330 2385 1165 - 330 2538BST.insert 426 970 2527 8365 - 970 3924BST.remove 516 203 615 2745 5587 203 725HPQ.insert 349 61 283 135 638 95 163HPQ.remove 469 80 1814 2021 - 146 2378

Number of paths

0 2 4 6 8 10 12

0

2,000

4,000

6,000

8,000 No AliasingLazy Initialization

Heap-Solver

Total TCG time

0 2 4 6 8 10 12

0

2,000

4,000

6,000No Aliasing

Lazy InitializationHeap-Solver

I Handling reference aliasing efficiently is paramount

I The more complex the program, the bigger the gains

9 11

Experimental Results

I 12 benchmarks from net.datastructures Java library

I Loops iterated at most one time per run

I Constraint system solved to obtain actual test cases

Method C N1 T1 N2 T2 N3 T3

DLL.add 139 33 36 200 177 33 42Seq.removeAt 213 36 42 89 116 37 50Seq.replaceAt 187 36 41 39 47 37 27PQ.insert 399 101 160 3602 10672 101 182PQ.remove 193 12 11 86 68 12 15BST.addAll 293 379 2019 919 - 379 2535BST.find 269 62 108 184 285 62 98BST.findAll 428 330 2385 1165 - 330 2538BST.insert 426 970 2527 8365 - 970 3924BST.remove 516 203 615 2745 5587 203 725HPQ.insert 349 61 283 135 638 95 163HPQ.remove 469 80 1814 2021 - 146 2378

Number of paths

0 2 4 6 8 10 12

0

2,000

4,000

6,000

8,000 No AliasingLazy Initialization

Heap-Solver

Total TCG time

0 2 4 6 8 10 12

0

2,000

4,000

6,000No Aliasing

Lazy InitializationHeap-Solver

I Handling reference aliasing efficiently is paramount

I The more complex the program, the bigger the gains

9 11

Experimental Results

I 12 benchmarks from net.datastructures Java library

I Loops iterated at most one time per run

I Constraint system solved to obtain actual test cases

Method C N1 T1 N2 T2 N3 T3

DLL.add 139 33 36 200 177 33 42Seq.removeAt 213 36 42 89 116 37 50Seq.replaceAt 187 36 41 39 47 37 27PQ.insert 399 101 160 3602 10672 101 182PQ.remove 193 12 11 86 68 12 15BST.addAll 293 379 2019 919 - 379 2535BST.find 269 62 108 184 285 62 98BST.findAll 428 330 2385 1165 - 330 2538BST.insert 426 970 2527 8365 - 970 3924BST.remove 516 203 615 2745 5587 203 725HPQ.insert 349 61 283 135 638 95 163HPQ.remove 469 80 1814 2021 - 146 2378

Number of paths

0 2 4 6 8 10 12

0

2,000

4,000

6,000

8,000 No AliasingLazy Initialization

Heap-Solver

Total TCG time

0 2 4 6 8 10 12

0

2,000

4,000

6,000No Aliasing

Lazy InitializationHeap-Solver

I Handling reference aliasing efficiently is paramount

I The more complex the program, the bigger the gains

10 11

Conclusions

I Novel approach to TCG for heap-manipulating programsI As effective as previous approaches

I No loss of precision

I More efficient and scalableI Applicable to other TCG tools

I In the paperI Formalization of heap representation and operationsI Extension to handle arraysI Support for heap assumptions: non-aliasing(a,b), acyclic(a),

non-sharing(a,b)I Implementation details and experimental evaluation

10 11

Conclusions

I Novel approach to TCG for heap-manipulating programs

I As effective as previous approachesI No loss of precision

I More efficient and scalableI Applicable to other TCG tools

I In the paperI Formalization of heap representation and operationsI Extension to handle arraysI Support for heap assumptions: non-aliasing(a,b), acyclic(a),

non-sharing(a,b)I Implementation details and experimental evaluation

10 11

Conclusions

I Novel approach to TCG for heap-manipulating programsI As effective as previous approaches

I No loss of precision

I More efficient and scalableI Applicable to other TCG tools

I In the paperI Formalization of heap representation and operationsI Extension to handle arraysI Support for heap assumptions: non-aliasing(a,b), acyclic(a),

non-sharing(a,b)I Implementation details and experimental evaluation

10 11

Conclusions

I Novel approach to TCG for heap-manipulating programsI As effective as previous approaches

I No loss of precision

I More efficient and scalableI Applicable to other TCG tools

I In the paperI Formalization of heap representation and operationsI Extension to handle arraysI Support for heap assumptions: non-aliasing(a,b), acyclic(a),

non-sharing(a,b)I Implementation details and experimental evaluation

10 11

Conclusions

I Novel approach to TCG for heap-manipulating programsI As effective as previous approaches

I No loss of precision

I More efficient and scalable

I Applicable to other TCG tools

I In the paperI Formalization of heap representation and operationsI Extension to handle arraysI Support for heap assumptions: non-aliasing(a,b), acyclic(a),

non-sharing(a,b)I Implementation details and experimental evaluation

10 11

Conclusions

I Novel approach to TCG for heap-manipulating programsI As effective as previous approaches

I No loss of precision

I More efficient and scalableI Applicable to other TCG tools

I In the paperI Formalization of heap representation and operationsI Extension to handle arraysI Support for heap assumptions: non-aliasing(a,b), acyclic(a),

non-sharing(a,b)I Implementation details and experimental evaluation

10 11

Conclusions

I Novel approach to TCG for heap-manipulating programsI As effective as previous approaches

I No loss of precision

I More efficient and scalableI Applicable to other TCG tools

I In the paper

I Formalization of heap representation and operationsI Extension to handle arraysI Support for heap assumptions: non-aliasing(a,b), acyclic(a),

non-sharing(a,b)I Implementation details and experimental evaluation

10 11

Conclusions

I Novel approach to TCG for heap-manipulating programsI As effective as previous approaches

I No loss of precision

I More efficient and scalableI Applicable to other TCG tools

I In the paperI Formalization of heap representation and operations

I Extension to handle arraysI Support for heap assumptions: non-aliasing(a,b), acyclic(a),

non-sharing(a,b)I Implementation details and experimental evaluation

10 11

Conclusions

I Novel approach to TCG for heap-manipulating programsI As effective as previous approaches

I No loss of precision

I More efficient and scalableI Applicable to other TCG tools

I In the paperI Formalization of heap representation and operationsI Extension to handle arrays

I Support for heap assumptions: non-aliasing(a,b), acyclic(a),non-sharing(a,b)

I Implementation details and experimental evaluation

10 11

Conclusions

I Novel approach to TCG for heap-manipulating programsI As effective as previous approaches

I No loss of precision

I More efficient and scalableI Applicable to other TCG tools

I In the paperI Formalization of heap representation and operationsI Extension to handle arraysI Support for heap assumptions: non-aliasing(a,b), acyclic(a),

non-sharing(a,b)

I Implementation details and experimental evaluation

10 11

Conclusions

I Novel approach to TCG for heap-manipulating programsI As effective as previous approaches

I No loss of precision

I More efficient and scalableI Applicable to other TCG tools

I In the paperI Formalization of heap representation and operationsI Extension to handle arraysI Support for heap assumptions: non-aliasing(a,b), acyclic(a),

non-sharing(a,b)I Implementation details and experimental evaluation

Thanks!

12 11

Extra ExampleField read and write accesses

Mutually inclusive rules are generated for read-accesses

int a = x.f;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),get field(H1,Y,f,Yf,H2),get field(H2,Z,f,Zf,H3),

Mutually exclusive rules are generated for write-accesses

12 11

Extra ExampleField read and write accesses

Mutually inclusive rules are generated for read-accesses

int a = x.f;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),get field(H1,Y,f,Yf,H2),get field(H2,Z,f,Zf,H3),

Mutually exclusive rules are generated for write-accesses

12 11

Extra ExampleField read and write accesses

Mutually inclusive rules are generated for read-accesses

int a = x.f;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),get field(H1,Y,f,Yf,H2),get field(H2,Z,f,Zf,H3),

Mutually exclusive rules are generated for write-accesses

12 11

Extra ExampleField read and write accesses

Mutually inclusive rules are generated for read-accesses

int a = x.f;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),get field(H1,Y,f,Yf,H2),get field(H2,Z,f,Zf,H3),

Mutually exclusive rules are generated for write-accesses

12 11

Extra ExampleField read and write accesses

Mutually inclusive rules are generated for read-accesses

int a = x.f;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),get field(H1,Y,f,Yf,H2),get field(H2,Z,f,Zf,H3),

Mutually exclusive rules are generated for write-accesses

12 11

Extra ExampleField read and write accesses

Mutually inclusive rules are generated for read-accesses

int a = x.f;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),get field(H1,Y,f,Yf,H2),get field(H2,Z,f,Zf,H3)

Mutually exclusive rules are generated for write-accesses

12 11

Extra ExampleField read and write accesses

Mutually inclusive rules are generated for read-accesses

int a = x.f;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),get field(H1,Y,f,Yf,H2),get field(H2,Z,f,Zf,H3)

Mutually exclusive rules are generated for write-accesses

12 11

Extra ExampleField read and write accesses

Mutually inclusive rules are generated for read-accesses

int a = x.f;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),get field(H1,Y,f,Yf,H2),get field(H2,Z,f,Zf,H3)

Mutually exclusive rules are generated for write-accesses

12 11

Extra ExampleField read and write accesses

Mutually inclusive rules are generated for read-accesses

int a = x.f;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),get field(H1,Y,f,Yf,H2),get field(H2,Z,f,Zf,H3)

Mutually exclusive rules are generated for write-accesses

12 11

Extra ExampleField read and write accesses

Mutually inclusive rules are generated for read-accesses

int a = x.f;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),get field(H1,Y,f,Yf,H2),get field(H2,Z,f,Zf,H3)

Mutually exclusive rules are generated for write-accesses

int a = x.f;w.f = a;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),set field(H1,W,f,Wf,H2),get field(H2,Y,f,Yf,H3),get field(H3,Z,f,Zf,H4),

12 11

Extra ExampleField read and write accesses

Mutually inclusive rules are generated for read-accesses

int a = x.f;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),get field(H1,Y,f,Yf,H2),get field(H2,Z,f,Zf,H3)

Mutually exclusive rules are generated for write-accesses

int a = x.f;w.f = a;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),set field(H1,W,f,Wf,H2),get field(H2,Y,f,Yf,H3),get field(H3,Z,f,Zf,H4),

12 11

Extra ExampleField read and write accesses

Mutually inclusive rules are generated for read-accesses

int a = x.f;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),get field(H1,Y,f,Yf,H2),get field(H2,Z,f,Zf,H3)

Mutually exclusive rules are generated for write-accesses

int a = x.f;w.f = a;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),set field(H1,W,f,Wf,H2),get field(H2,Y,f,Yf,H3),get field(H3,Z,f,Zf,H4),

12 11

Extra ExampleField read and write accesses

Mutually inclusive rules are generated for read-accesses

int a = x.f;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),get field(H1,Y,f,Yf,H2),get field(H2,Z,f,Zf,H3)

Mutually exclusive rules are generated for write-accesses

int a = x.f;w.f = a;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),set field(H1,W,f,Wf,H2),get field(H2,Y,f,Yf,H3),get field(H3,Z,f,Zf,H4),

12 11

Extra ExampleField read and write accesses

Mutually inclusive rules are generated for read-accesses

int a = x.f;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),get field(H1,Y,f,Yf,H2),get field(H2,Z,f,Zf,H3)

Mutually exclusive rules are generated for write-accesses

int a = x.f;w.f = a;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),set field(H1,W,f,Wf,H2),get field(H2,Y,f,Yf,H3),get field(H3,Z,f,Zf,H4),

12 11

Extra ExampleField read and write accesses

Mutually inclusive rules are generated for read-accesses

int a = x.f;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),get field(H1,Y,f,Yf,H2),get field(H2,Z,f,Zf,H3)

Mutually exclusive rules are generated for write-accesses

int a = x.f;w.f = a;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),set field(H1,W,f,Wf,H2),get field(H2,Y,f,Yf,H3),get field(H3,Z,f,Zf,H4),

12 11

Extra ExampleField read and write accesses

Mutually inclusive rules are generated for read-accesses

int a = x.f;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),get field(H1,Y,f,Yf,H2),get field(H2,Z,f,Zf,H3)

Mutually exclusive rules are generated for write-accesses

int a = x.f;w.f = a;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),set field(H1,W,f,Wf,H2),get field(H2,Y,f,Yf,H3),get field(H3,Z,f,Zf,H4),

12 11

Extra ExampleField read and write accesses

Mutually inclusive rules are generated for read-accesses

int a = x.f;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),get field(H1,Y,f,Yf,H2),get field(H2,Z,f,Zf,H3)

Mutually exclusive rules are generated for write-accesses

int a = x.f;w.f = a;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),set field(H1,W,f,Wf,H2),get field(H2,Y,f,Yf,H3),get field(H3,Z,f,Zf,H4)

12 11

Extra ExampleField read and write accesses

Mutually inclusive rules are generated for read-accesses

int a = x.f;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),get field(H1,Y,f,Yf,H2),get field(H2,Z,f,Zf,H3)

Mutually exclusive rules are generated for write-accesses

int a = x.f;w.f = a;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),set field(H1,W,f,Wf,H2),get field(H2,Y,f,Yf,H3),get field(H3,Z,f,Zf,H4)

12 11

Extra ExampleField read and write accesses

Mutually inclusive rules are generated for read-accesses

int a = x.f;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),get field(H1,Y,f,Yf,H2),get field(H2,Z,f,Zf,H3)

Mutually exclusive rules are generated for write-accesses

int a = x.f;w.f = a;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),set field(H1,W,f,Wf,H2),get field(H2,Y,f,Yf,H3),get field(H3,Z,f,Zf,H4)

12 11

Extra ExampleField read and write accesses

Mutually inclusive rules are generated for read-accesses

int a = x.f;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),get field(H1,Y,f,Yf,H2),get field(H2,Z,f,Zf,H3)

Mutually exclusive rules are generated for write-accesses

int a = x.f;w.f = a;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),set field(H1,W,f,Wf,H2),get field(H2,Y,f,Yf,H3),get field(H3,Z,f,Zf,H4)

12 11

Extra ExampleField read and write accesses

Mutually inclusive rules are generated for read-accesses

int a = x.f;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),get field(H1,Y,f,Yf,H2),get field(H2,Z,f,Zf,H3)

Mutually exclusive rules are generated for write-accesses

int a = x.f;w.f = a;int b = y.f;int c = z.f;

get field(H0,X,f,Xf,H1),set field(H1,W,f,Wf,H2),get field(H2,Y,f,Yf,H3),get field(H3,Z,f,Zf,H4)

13 11

Heap Operations

get field(Hin,Ref,FSig,Var{R},Hout)

(Ref 7→ O) ∈ NVar ← O[FSig ]

〈S,N ,RC〉; 〈S,N ,RC〉

(Ref 7→ O) /∈ N 〈R, dom(Var)〉 ← ψ(S,Ref ,FSig ,Var , true)S′ ← getF (Ref ,FSig ,Var ,S)

〈S,N ,RC〉; 〈S′,N ,RC〉

where ψ(S,Ref ,FSig ,Var , ϕ) =

〈{ϕ→ Var = F} , dom(F )〉 (F fresh) S = ∅

〈{ϕ→ Var = F} , dom(F )〉 S = [g |s]etF (Ref ,FSig ,F ,Si )

〈{ϕ ∧ Ref = Ref i → Var = F} ∪ Ri , dom(F ) ∪ Di 〉 S = getF (Ref i ,FSig ,F ,Si )where 〈Ri ,Di 〉 = ψ(Si ,Ref ,FSig ,Var , ϕ)

〈{ϕ ∧ Ref = Ref i → Var = F} ∪ Ri , dom(F ) ∪ Di 〉 S = setF (Ref i ,FSig ,F ,Si )where 〈Ri ,Di 〉 = ψ(Si ,Ref ,FSig ,Var , ϕ ∧ Ref 6= Ref i )

ψ(Si ,Ref ,FSig ,Var , ϕ) S = [g |s]etF (Ref i ,FSig ,F ,Si )

14 11

Heap Operations

set field(Hin,Ref,FSig,Data,Hout)

(Ref 7→ O) ∈ NN ′ ← N [Ref 7→ O[FSig 7→ Data]]

〈S,N ,RC〉; 〈S,N ′,RC〉

(Ref 7→ O) /∈ NS′ ← setF (Ref ,FSig ,Data,S)

〈S,N ,RC〉; 〈S′,N ,RC〉

new object(Hin,C,Ref,Hout)

new(Ref ) createObject(C ,O) N ′ = N ∪ {Ref 7→ O}

〈S,N ,RC〉; 〈S,N ′,RC〉

15 11

Heap Operations

ref eq(Hin,Ref1,Ref2,Hout)

t ≡ Ref 1 = Ref 2 S′ ← propagate(S, t)

〈S,N ,RC〉; 〈S′,N ,RC〉

propagate(S, t): ∀getF (Ref ,FSig , Var , ) in S, ∀r ∈ R:

(I) If t ∈ lhs(r), remove t from lhs(r), if new lhs(r) ≡ true, add rhs(r) toconstraint store

(II) If ¬t ∈ lhs(r), then lhs(r) can never hold, remove r from R

ref neq(Hin,Ref1,Ref2,Hout)

t ≡ Ref 1 6= Ref 2 S′ ← propagate(S, t) RC′ = RC ∪ {t}

〈S,N ,RC〉; 〈S′,N ,RC′〉