The decision procedures presented are implemented as an extension of the \cspen\ solver~\cite{GuCW16}, called \cspenp, available at~\cite{CompSpenSite}.

Let us briefly recall some information about {\cspen}. {\cspen} is written in C++ and includes several decision procedures for symbolic heap fragments including

The decision procedures presented are implemented as an extension of the

\cspen\ solver~\cite{GuCW16},

called \cspenp, available at~\cite{CompSpenSite}.

%Let us briefly recall some information about {\cspen}.

{\cspen} is written in C++ and includes several decision procedures

for symbolic heap fragments including

(i) inductive predicates that are compositional~\cite{EneaSW15}

(the predicate $\ls{}(x,y)$ for list segments is a simple example)

and (ii) integer data constraints.

It uses SMT solvers (e.g., \textsc{Z3})

for solving linear integer arithmetic constraints.

\cspen\ ranked third among the eleven solvers in the general podium

of the last edition of SL-COMP, the competition of separation-logic solvers~\cite{SLCOMPsite}.

%\cspen\ ranked third among the eleven solvers in the general podium of

\cspen\ was ranked among the best solvers at

the last edition of SL-COMP, the competition of separation-logic solvers~\cite{SLCOMPsite}.

\cspenp\ %, as an extension of \cspen,

supports the new theory \slah.

%The \slah\ theory is defined by following the SMTLIB2 standard \cite{BarST-RR-10}.

% (the first one to our knowledge).

%Moreover, it allows a more general class of inductive definitions for $\hls{}$,

%where the chunk's header may include some information in a finite domain.

\cspenp\ supports the new theory \slah.

Internally, \cspenp\ parses the input file

which shall include the definition of $\hls{}$

(which fixes the size of the header to a constant which may be different from 2)

%ESOP 21 Reviewer 3: so this isn't built in specially? Or is it just that the tool expects the definition to be there because of the format? Does the definition have to be in syntactically exactly the form expected?

and the satisfiability or entailment queries in the SL-COMP format~\cite{SLCOMPsite}.

%~\cite{DBLP:conf/tacas/SighireanuPRGIR19}.

%

\begin{compactitem}

\item For satisfiability queries,

...

...

@@ -82,8 +82,8 @@ classified into four suites, whose sizes are given in Table~\ref{tab-exp}, as fo

\item MEM-SAT and MEM-ENT are satisfiability resp. entailment problems

generated by the verification of programs that are building blocks of heap-list based memory allocators, including:

create a heap-list with one element,

split a memory chunk into two consecutive memory chunks,

join two memory chunks,

split a memory chunk into two consecutive memory chunks (equivalent to cell insertion),

join two memory chunks (equivalent to cell delete),

search a memory chunk of size bigger than a given parameter (our running example),

or search an address inside a heap-list.

%

...

...

@@ -93,7 +93,8 @@ classified into four suites, whose sizes are given in Table~\ref{tab-exp}, as fo

we replace some $\hls{}$ atoms with their unfoldings in order to generate

formulas with more spatial atoms.

RANDOM-SAT includes also formulas where the atoms and their start

and end address terms are generated randomly. In addition, we generate some benchmarks manually.

and end address terms are generated randomly.

In addition, we generate some benchmarks manually.

This suite is motivated by testing the scalability of \cspenp.

%which usually contain more spatial atoms than those in MEM-SAT and MEM-ENT, motivated by testing the scalability of \cspenp.

@@ -143,7 +143,7 @@ The ordered entailment problem is then decided by matching each spatial atom in

Splitting a spatial atom into multiple ones in the antecedent is attributed to pointer arithmetic and unnecessary for SH fragments with nominal addresses.

%Moreover, the availability of $\hls{}$ makes the splitting more involved.

We implemented the decision procedures on top of \cspen\ solver~\cite{GuCW16}.

We implemented the decision procedures on top of \cspen\footnote{We anonymize the name of the tool to comply with the double blind procedure.} solver~\cite{GuCW16}.

We evaluate the performance of the new solver, called {\cspenp}~\cite{CompSpenSite},

on a set of formulas originating from path conditions and verification conditions of programs working on heap lists in memory allocators.

We also randomly generate some formulas, in order to test the scalability of {\cspenp} further.

where if $t^\infty\equiv\infty$, then $\Pi'\equiv\top$, otherwise,

...

...

@@ -149,8 +149,8 @@ Notice that the semantics of $\blk(x,y)$ differs from the one given in~\cite{Bro

because we consider that the location $y$ is the first after the last location in the memory block, as proposed in~\cite{CalcagnoDOHY06}.

%

Intuitively, an atom $\hls{}(x,y;v)$ with $v$ a variable

defines a heap lists where all chunks have sizes between $2$ and the value of $v$.

Notice that if $v < 2$ then the atom $\hls{}(x,y;v)$ has a model iff $x=y$.

defines a heap lists where all chunks have sizes between $\kappa$ and the value of $v$.

Notice that if $v < \kappa$ then the atom $\hls{}(x,y;v)$ has a model iff $x=y$.

%

With this semantics, the $\blk$ and $\hls{}$ predicates are compositional predicates~\cite{EneaSW15} and therefore they satisfy the following composition lemmas:

% \mihaela{r2 CADE}

...

...

@@ -167,6 +167,9 @@ With this semantics, the $\blk$ and $\hls{}$ predicates are compositional predic

%with the absolute addressing $\blk(\ell,\ell')$ or

%with base-offset addressing $\blk(\ell, i, j)$ for the array from $\ell+i$ to $\ell+j-1$.

\noindent

For readability, we fix $\kappa=2$ in Eqns~(\ref{eq:hlsv-emp})--(\ref{eq:hlsv-infty}) in the remainder of the paper.

@@ -128,7 +128,7 @@ and for which we define the following shorthand:

\label{eq:hlsv-emp}

\hls{}(x, y; v) &\Leftarrow x=y : \emp\\

\label{eq:hlsv-rec}

\hls{}(x, y; v) &\Leftarrow\exists z \cdot2\le z - x \le v :

\hls{}(x, y; v) &\Leftarrow\exists z \cdot\kappa\le z - x \le v :

x \pto z-x \sepc\blk(x+1,z) \sepc\hls{}(z,y; v)

\end{align}

The inductive definition states that a heap list from $x$ to $y$ is

...

...

@@ -139,7 +139,7 @@ The inductive definition states that a heap list from $x$ to $y$ is

(atom $x\pto z-x$).

The chunk's body is specified by a memory block atom, $\blk(x+1,z)$, starting

after the header and ending before the next chunk;

because the body can not be empty, the chunk's size is constrained to be $\ge2$\footnote{The value 2 is a minimum value; any constant $\ge2$ could be used, such that it is the sum of the header size and the minimal accepted size of the body.}

because the body can not be empty, the chunk's size is constrained to be $\ge\kappa$. For readability, we fix $\kappa=2$ in the following. Notice that 2 is the minimum value for the chunk's size of any heap list definition (i.e., the sum of sizes of the chunk's header and body).

%This predicate belongs to the class

% defined in Section~\ref{sec:logic-hls} (Equations~(\ref{eq:hlsv-emp})--(\ref{eq:hlsv-rec})),