Ownership Refinement Types for Pointer Arithmetic and Nested Arrays

Abstract: Tanaka et al. proposed a type system for verifying functional correctness properties of programs that use arrays and pointer arithmetic. Their system extends ConSORT -- a type system combining fractional ownership and refinement types for imperative program verification -- with support for pointer arithmetic. Their idea was to extend fractional ownership so that it can depend on an array index. Their formulation, however, does not handle nested arrays, which are essential for representing practical data structures such as matrices. We extend Tanaka et al.'s type system to support nested arrays by generalizing the notion of ownership to be able to refer to the indices of the outer arrays and prove the soundness of the extended type system. We have implemented a verifier based on the proposed type system and demonstrated that it can verify the correctness of programs that manipulate nested arrays, which were beyond the reach of Tanaka et al.

• The paper introduces index-dependent fractional ownership for nested arrays, enabling precise, automated verification of pointer arithmetic in imperative programs.
• It extends previous flat-array models to support multi-dimensional alias control through environment-indexed, guarded rational ownership terms.
• Experimental evaluations show that the new system handles diverse real-world matrix and tensor benchmarks with practical performance and minimal overhead.

Ownership Refinement Types for Pointer Arithmetic and Nested Arrays

Introduction and Motivation

The paper "Ownership Refinement Types for Pointer Arithmetic and Nested Arrays" (2604.22361) advances the state of type-based program verification for imperative languages featuring pointer arithmetic and sophisticated data structures such as nested arrays. Previous systems like ConSORT and its extensions had established practical frameworks for combining refinement types with fractional ownership in order to support aliasing, precise type-driven invariants, and strong updates in the presence of pointers and mutable memory. Tanaka et al. extended these ideas to single-level arrays, making ownership functions index-dependent and enabling verification of pointer-manipulating code over flat arrays. However, verification for programs using true nested arrays—crucial for modeling and verifying matrix and tensor-oriented code—remained out of reach.

This paper addresses this gap by generalizing the ownership model further: fractional ownership terms can now depend on both inner and outer indices in arbitrarily nested arrays, accurately tracking aliasing and mutation across multidimensional pointer structures. The resulting system supports precise, index-sensitive, and context-dependent tracking of ownership in deeply nested, pointer-rich imperative languages, facilitating fully automated type-based verification for classes of programs previously beyond reach.

Language Semantics and Typing

The core target language is a first-order, imperative calculus with explicit memory allocation, pointer dereferencing, pointer arithmetic, and support for nested array allocation. Heap structure is explicitly modeled; pointer values carry both a base address and an offset. Program state comprises a mapping from variables to values and a (mutable) heap from addresses to values. The language supports runtime assertion checks via assert(ϕ) and explicit aliasing checks via alias(x = y ⊕ z) and alias(x = *y) to facilitate sound strong updates in the type system.

Fractional ownership is modeled as a rational number in $[0,1]$ associated with each pointer to control access (read/write or read-only) to memory locations. Refinement types carry logical predicates—formulas over integers or more general terms—for fine-grained invariants. Ownership expressions generalize previous systems by parameterizing over all relevant index variables in the environment, naturally expressing aliasing/ownership shapes for arbitrarily nested structures.

The type of a pointer to a $k$-dimensional array becomes:

$$\Pi x_1.\,\Pi x_2.\,\ldots\,\Pi x_k.(\{\nu: \mathtt{int} \mid \varphi\} \,\mathsf{ref}^{\, r_k})\,\ldots\,\mathsf{ref}^{\, r_1}$$

where each $r_i$ is a piecewise (predicate-guarded) rational-valued term whose guards can refer to all outer indices and, crucially, outer "environment" variables.

Index-Dependent Fractional Ownership for Nested Arrays

The ownership terms are recursively defined, allowing fine-grained partitioning and sharing of permissions, now indexed over multidimensional index sets. For example, after initializing a matrix of size $n \times n$, the ownership for a pointer variable $pp$ on the outer array and the inner arrays will typically have terms like:

$r_{outer}: 0 \leq x_2 \leq n-1 \Longrightarrow 1$

$$r_{inner}: 0 \leq x_2 \leq n-1 \wedge 0 \leq x_1 \leq n-x_2-1 \Longrightarrow 1$$

where $x_2$ indexes rows and $x_1$ indexes columns within the $k$0-th row, so that the shape and allowed access permissions of each subarray can change arbitrarily as a function of the outer context.

This generalization directly supports operations on jagged, lower/upper triangular, and irregularly-shaped multidimensional structures, which cannot be encoded using prior single-index models.

Type System and Inference

The type system extends refinement type theory with pointwise, index-dependent, environment-sensitive ownership expressions, supporting splitting, updating, and redistributing permissions via sound rules. Key rules handle pointer arithmetic, dereference, assignment, and aliasing constructs, guaranteeing both functional correctness and safety (no assertion violations, out-of-bounds errors, or null dereference) in all well-typed programs. Importantly, type soundness holds even if alias declarations are incorrect: such violations lead only to explicit runtime error states ($k$1), never undefined or unsound behavior.

The inference procedure is template-based, interleaving three phases:

• Simple type inference to determine base shapes,
• Ownership inference using parameterized templates—families of guarded rational-valued functions indexed by all relevant indices and parameters,
• Refinement inference reducing value-property conditions to constrained Horn clauses solved by CHC solvers (e.g., HoIce).

Templates for ownership are expressive enough to capture real-world idioms, including iteration by pointer arithmetic, block-wise processing, and recursive traversal patterns, and allow dependencies on all array/environment indices as needed by recursive nested array algorithms.

Experimental Evaluation

The implementation is evaluated on a suite of benchmarks covering a spectrum of nested array programs, including rectangular/non-rectangular matrices, matrices with index-dependent shape (e.g., lower-triangular), multi-matrix programs with shared ownership, and generic $k$2-dimensional tensors. All benchmarks unreachable by Tanaka et al.'s system (restricted to flat arrays) are handled by the new approach.

Performance remains practical—most verification tasks complete in seconds to minutes—and the majority of required $k$3 constructs are automatically inserted by the implementation. Explicit annotation is only rarely required, and overall annotation burden is very low. Ownership terms inferred for post-states of main matrix pointers illustrate the expressivity and necessity of index-dependent fractional ownership; for instance, indexed matrix programs generate inner ownership terms like $k$4, necessitating true dependence on outer dimensions.

Performance comparison against the previous (flat-array) verifier shows the extended system incurs minimal overhead and achieves comparable or better scalability even for flat-array benchmarks.

Figure 2: Per-benchmark speed ratio (log$k$5) between Z3~4.14.1 and Z3~4.11.2, comparing performance for nested/refinement benchmarks in the two verification phases of the tool.

Implications and Future Directions

This work significantly increases the applicability of refinement-type-based verification to imperative, pointer-manipulating programs with real-world data structures. Not only does it subsume logical shape and value constraints for complex nested arrays, but the combination with automated inference and sound, explicit error handling (§Soundness) makes it suitable for the verification of low-level scientific code, matrix/tensor libraries, and other performance-critical codebases.

Practical implications include:

• Expressing index-parameterized invariants for multidimensional arrays without manual case analysis in types,
• Automatic verification of non-rectangular and context-dependent ownership patterns, a capability not previously attainable,
• Support for reasoning about ownership distribution, splitting, and recombination through pointer arithmetic and explicit aliasing.

Theoretical implications include:

• Demonstrating that fractional ownership can be formulated as full, environment-sensitive logic terms, with preservation of soundness and (template-relative) inference completeness,
• Leveraging the flexibility of the approach for potential extensions to tree-shaped or recursively-defined heap data, though significant extensions and new theory would be required for recursive heap invariants,
• Serving as an interface between type-based and alias-analysis-based approaches, since the system's soundness proof cleanly separates typing from the correctness or completeness of must-alias information.

Future work directions include:

• Reducing programmer intervention further via enhanced alias analysis,
• Extending the model to support parallel and concurrent settings where ownership splitting and merging is less rigid,
• Generalizing the approach to verification of recursive data structures (e.g., linked lists, trees) using similar environment-indexed rational-ownership terms, if possible,
• Exploring efficient scalability via improved constraint solving strategies and possibly tighter domain-specific template selection.

Conclusion

By generalizing fractional ownership refinement types to arbitrary nesting with environment-indexed, index-dependent permissions, and by developing a practicable inference and verification system for these types, the paper enables, for the first time, efficient, fully automatic type-based reasoning about the functional correctness, aliasing safety, and shape invariants of imperative pointer code using multidimensional, structure-rich arrays. This work closes a key expressiveness gap and provides a robust foundation for future verification methodologies in the context of advanced pointer-analysis and resource management for imperative programming languages.