// verifast_options{disable_overflow_check target:ILP32} extern void abort(void); //@ requires integer(&counter, ?veri_req_counter) &*& true; //@ ensures integer(&counter, ?veri_ens_counter) &*& true; void reach_error() //@ requires false; //@ ensures true; {}extern unsigned __VERIFIER_nondet_uint(void); //@ requires integer(&counter, ?veri_req_counter) &*& true; //@ ensures integer(&counter, ?veri_ens_counter) &*& true; void assume_abort_if_not(int cond) //@ requires integer(&counter, ?veri_req_counter) &*& (veri_req_counter == 0); //@ ensures integer(&counter, ?veri_ens_counter) &*& ((veri_ens_counter == veri_req_counter) && (veri_ens_counter == 0)); { if(!cond) {abort();} } void __VERIFIER_assert(int cond) //@ requires integer(&counter, ?veri_req_counter) &*& (1 <= cond); //@ ensures integer(&counter, ?veri_ens_counter) &*& ((veri_ens_counter == veri_req_counter) && (1 <= cond)); { if (!(cond)) { ERROR: {reach_error();} } return; } int counter = 0; int main() //@ requires module(divbin_unwindbound1__verifast_instrumented, true) &*& (counter == 0); //@ ensures (counter == 0) &*& junk(); { //@ open_module(); unsigned A, B; unsigned q, r, b; A = __VERIFIER_nondet_uint(); B = __VERIFIER_nondet_uint(); assume_abort_if_not(B < (0x7fffffff * 2U + 1U)/2); assume_abort_if_not(B >= 1); q = 0; r = A; b = B; while (counter++<1) //@ invariant integer(&counter, ?veri_inv_counter) &*& ((veri_req_counter == 0) && ((((A == r) && (veri_inv_counter == 0)) && (q == 0)) || (((A == r) && (1 <= veri_inv_counter)) && (q == 0)))); { if (!(r >= b)) break; b = 2 * b; } while (counter++<1) //@ invariant integer(&counter, ?veri_inv_counter) &*& ((((A == r) && (1 <= veri_inv_counter)) && (veri_req_counter == 0)) && (q == 0)); { __VERIFIER_assert(A == q * b + r); if (!(b != B)) break; q = 2 * q; b = b / 2; if (r >= b) { q = q + 1; r = r - b; } } __VERIFIER_assert(A == q * b + r); return 0; }