// verifast_options{disable_overflow_check target:ILP32} /* extended Euclid's algorithm */ extern void abort(void); //@ requires true; //@ ensures true; void reach_error() //@ requires false; //@ ensures true; {}extern int __VERIFIER_nondet_int(void); //@ requires true; //@ ensures true; void assume_abort_if_not(int cond) //@ requires true; //@ ensures (cond != 0); { if(!cond) {abort();} } void __VERIFIER_assert(int cond) //@ requires (1 <= cond); //@ ensures (1 <= cond); { if (!(cond)) { ERROR: {reach_error();} } return; } int main() //@ requires module(egcd_ll_valuebound2__verifast_instrumented, true); //@ ensures junk(); { //@ open_module(); long long a, b, p, q, r, s; int x, y; x = __VERIFIER_nondet_int(); assume_abort_if_not(x>=0 && x<=2); y = __VERIFIER_nondet_int(); assume_abort_if_not(y>=0 && y<=2); assume_abort_if_not(x >= 1); assume_abort_if_not(y >= 1); a = x; b = y; p = 1; q = 0; r = 0; s = 1; while (1) //@ invariant ((((((((((((r == 0) && (y <= 2)) && (s == 1)) && (0 <= x)) && (b == y)) && (q == 0)) && (1 <= y)) && (a == x)) && (x <= 2)) && (p == 1)) || ((((((((((a + (y * 2)) == (b + x)) && ((r + 1) == 0)) && (s == 1)) && (1 <= a)) && (b == y)) && (q == 0)) && (1 <= y)) && (x <= 2)) && (p == 1))) || ((((((((((r == 0) && (a <= 1)) && (b == ((q * x) + (y * s)))) && (y <= 2)) && (s == 1)) && (0 <= x)) && (1 <= b)) && (1 <= y)) && (a == x)) && (p == 1))); { __VERIFIER_assert(1 == p * s - r * q); __VERIFIER_assert(a == y * r + x * p); __VERIFIER_assert(b == x * q + y * s); if (!(a != b)) break; if (a > b) { a = a - b; p = p - q; r = r - s; } else { b = b - a; q = q - p; s = s - r; } } __VERIFIER_assert(a - b == 0); __VERIFIER_assert(p*x + r*y - b == 0); __VERIFIER_assert(q*r - p*s + 1 == 0); __VERIFIER_assert(q*x + s*y - b == 0); return 0; }