Modular Construction of Shape-Numeric Analyzers

environments: Since the abstract counterpart for addresses are symbolic variables (or nodes) in shape graphs, an abstract environment E can simply be a function mapping program variables to nodes, that is, E ∈ E =X→V. Now, the memory abstract domainM is defined byM = E× (H ⇒ N ), and its concretization γM :M ♯ → P(E×H) can be defined as follows: γM(E ,(σ ,ν)) def = {(ν ◦E,σ) | (σ ,ν) ∈ γH(σ ) and ν ∈ γnum〈V [σ ]〉(ν)} . Note that in an abstract memory state m : (E,σ ), the abstract environment E simply gives the symbolic address of program variables, while the abstract heap σ ♯ abstracts all memory cells—just like the concrete model in Section 2.2.