Array-Carrying Symbolic Execution for Function Contract Generation

2026-02-26

AI Summary

This work addresses the challenge of generating precise function contracts for procedures involving array manipulations to support effective interprocedural analysis. The authors propose a novel symbolic execution framework that explicitly models and propagates invariants and modification information of contiguous array segments during execution. This approach is the first to systematically handle the dynamic evolution of array segments within symbolic execution, overcoming key limitations of existing techniques when dealing with complex array operations. Implemented on LLVM, the framework integrates the ACSL assertion language and interfaces with the Frama-C verification platform. Experimental evaluation demonstrates that the method effectively generates high-precision function contracts across multiple benchmarks and real-world library functions, significantly outperforming state-of-the-art approaches.

Technology Category

• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Cognitive Modeling & Cognitive Systems: Symbolic Representations
• Computer Vision: Visual Reasoning & Symbolic Representations

Application Category

• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Systems and Infrastructure for Web, Mobile and WoT: Experiences and lessons learnt from Web-based algorithms and system deployments
• Security and Privacy: Large-scale security measurements

Abstract

Function contract generation is a classical problem in program analysis that targets the automated analysis of functions in a program with multiple procedures. The problem is fundamental in inter-procedural analysis where properties of functions are first obtained via the generation of function contracts and then the generated contracts are used as building blocks to analyze the whole program. Typical objectives in function contract generation include pre-/post-conditions and assigns information (that specifies the modification information over program variables and memory segments during function execution). In programs with array manipulations, a crucial point in function contract generation is the treatment of array segments that imposes challenges in inferring invariants and assigns information over such segments. To address this challenge, we propose a novel symbolic execution framework that carries invariants and assigns information over contiguous segments of arrays. We implement our framework as a prototype within LLVM, and further integrate our prototype with the ACSL assertion format and the Frama-C software verification platform. Experimental evaluation over a variety of benchmarks from the literature and functions from realistic libraries shows that our framework is capable of handling array manipulating functions that indeed involve the carry of array information and are beyond existing approaches.

Problem

• function contract generation
• array manipulation
• symbolic execution
• inter-procedural analysis
• assigns information

Innovation

• symbolic execution
• function contract generation
• array segments
• assigns information
• invariant inference