java -ea -Xmx8000000000 -jar /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/org.eclipse.equinox.launcher_1.3.100.v20150511-1540.jar -data @noDefault -ultimatedata /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data -tc ../../../trunk/examples/toolchains/AutomizerCInline_WitnessPrinter.xml -s ../../../trunk/examples/settings/default/automizer/svcomp-Reach-32bit-Automizer_Bitvector.epf -i ../../../trunk/examples/svcomp/list-ext3-properties/sll_length_check_false-unreach-call_false-valid-memcleanup.i -------------------------------------------------------------------------------- This is Ultimate 0.1.23-61f4311 [2018-11-23 11:20:50,250 INFO L170 SettingsManager]: Resetting all preferences to default values... [2018-11-23 11:20:50,252 INFO L174 SettingsManager]: Resetting UltimateCore preferences to default values [2018-11-23 11:20:50,264 INFO L177 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2018-11-23 11:20:50,264 INFO L174 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2018-11-23 11:20:50,265 INFO L174 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2018-11-23 11:20:50,266 INFO L174 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2018-11-23 11:20:50,270 INFO L174 SettingsManager]: Resetting LassoRanker preferences to default values [2018-11-23 11:20:50,272 INFO L174 SettingsManager]: Resetting Reaching Definitions preferences to default values [2018-11-23 11:20:50,274 INFO L174 SettingsManager]: Resetting SyntaxChecker preferences to default values [2018-11-23 11:20:50,275 INFO L177 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2018-11-23 11:20:50,275 INFO L174 SettingsManager]: Resetting LTL2Aut preferences to default values [2018-11-23 11:20:50,277 INFO L174 SettingsManager]: Resetting PEA to Boogie preferences to default values [2018-11-23 11:20:50,279 INFO L174 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2018-11-23 11:20:50,280 INFO L174 SettingsManager]: Resetting ChcToBoogie preferences to default values [2018-11-23 11:20:50,280 INFO L174 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2018-11-23 11:20:50,284 INFO L174 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2018-11-23 11:20:50,285 INFO L174 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2018-11-23 11:20:50,294 INFO L174 SettingsManager]: Resetting CodeCheck preferences to default values [2018-11-23 11:20:50,296 INFO L174 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2018-11-23 11:20:50,297 INFO L174 SettingsManager]: Resetting RCFGBuilder preferences to default values [2018-11-23 11:20:50,298 INFO L174 SettingsManager]: Resetting TraceAbstraction preferences to default values [2018-11-23 11:20:50,303 INFO L177 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2018-11-23 11:20:50,303 INFO L177 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2018-11-23 11:20:50,303 INFO L174 SettingsManager]: Resetting TreeAutomizer preferences to default values [2018-11-23 11:20:50,304 INFO L174 SettingsManager]: Resetting IcfgTransformer preferences to default values [2018-11-23 11:20:50,305 INFO L174 SettingsManager]: Resetting Boogie Printer preferences to default values [2018-11-23 11:20:50,306 INFO L174 SettingsManager]: Resetting ReqPrinter preferences to default values [2018-11-23 11:20:50,306 INFO L174 SettingsManager]: Resetting Witness Printer preferences to default values [2018-11-23 11:20:50,310 INFO L177 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2018-11-23 11:20:50,311 INFO L174 SettingsManager]: Resetting CDTParser preferences to default values [2018-11-23 11:20:50,311 INFO L177 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2018-11-23 11:20:50,312 INFO L177 SettingsManager]: ReqParser provides no preferences, ignoring... [2018-11-23 11:20:50,313 INFO L174 SettingsManager]: Resetting SmtParser preferences to default values [2018-11-23 11:20:50,314 INFO L174 SettingsManager]: Resetting Witness Parser preferences to default values [2018-11-23 11:20:50,316 INFO L181 SettingsManager]: Finished resetting all preferences to default values... [2018-11-23 11:20:50,316 INFO L98 SettingsManager]: Beginning loading settings from /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/../../../trunk/examples/settings/default/automizer/svcomp-Reach-32bit-Automizer_Bitvector.epf [2018-11-23 11:20:50,342 INFO L110 SettingsManager]: Loading preferences was successful [2018-11-23 11:20:50,347 INFO L112 SettingsManager]: Preferences different from defaults after loading the file: [2018-11-23 11:20:50,348 INFO L131 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2018-11-23 11:20:50,348 INFO L133 SettingsManager]: * ... calls to implemented procedures=ONLY_FOR_CONCURRENT_PROGRAMS [2018-11-23 11:20:50,348 INFO L131 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2018-11-23 11:20:50,351 INFO L133 SettingsManager]: * Create parallel compositions if possible=false [2018-11-23 11:20:50,352 INFO L133 SettingsManager]: * Use SBE=true [2018-11-23 11:20:50,352 INFO L131 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2018-11-23 11:20:50,352 INFO L133 SettingsManager]: * sizeof long=4 [2018-11-23 11:20:50,352 INFO L133 SettingsManager]: * sizeof POINTER=4 [2018-11-23 11:20:50,353 INFO L133 SettingsManager]: * Check division by zero=IGNORE [2018-11-23 11:20:50,353 INFO L133 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2018-11-23 11:20:50,353 INFO L133 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2018-11-23 11:20:50,353 INFO L133 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2018-11-23 11:20:50,353 INFO L133 SettingsManager]: * Use bitvectors instead of ints=true [2018-11-23 11:20:50,354 INFO L133 SettingsManager]: * Memory model=HoenickeLindenmann_4ByteResolution [2018-11-23 11:20:50,354 INFO L133 SettingsManager]: * sizeof long double=12 [2018-11-23 11:20:50,354 INFO L133 SettingsManager]: * Check if freed pointer was valid=false [2018-11-23 11:20:50,355 INFO L133 SettingsManager]: * Use constant arrays=true [2018-11-23 11:20:50,355 INFO L133 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2018-11-23 11:20:50,355 INFO L131 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2018-11-23 11:20:50,355 INFO L133 SettingsManager]: * Size of a code block=SequenceOfStatements [2018-11-23 11:20:50,355 INFO L133 SettingsManager]: * To the following directory=./dump/ [2018-11-23 11:20:50,356 INFO L133 SettingsManager]: * SMT solver=External_DefaultMode [2018-11-23 11:20:50,356 INFO L133 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-11-23 11:20:50,356 INFO L131 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2018-11-23 11:20:50,356 INFO L133 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2018-11-23 11:20:50,356 INFO L133 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2018-11-23 11:20:50,356 INFO L133 SettingsManager]: * Trace refinement strategy=WOLF [2018-11-23 11:20:50,357 INFO L133 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode [2018-11-23 11:20:50,357 INFO L133 SettingsManager]: * Command for external solver=cvc4nyu --tear-down-incremental --rewrite-divk --print-success --lang smt [2018-11-23 11:20:50,357 INFO L133 SettingsManager]: * Logic for external solver=AUFBV [2018-11-23 11:20:50,358 INFO L133 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true [2018-11-23 11:20:50,409 INFO L81 nceAwareModelManager]: Repository-Root is: /tmp [2018-11-23 11:20:50,421 INFO L258 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2018-11-23 11:20:50,425 INFO L214 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2018-11-23 11:20:50,426 INFO L271 PluginConnector]: Initializing CDTParser... [2018-11-23 11:20:50,426 INFO L276 PluginConnector]: CDTParser initialized [2018-11-23 11:20:50,427 INFO L418 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/../../../trunk/examples/svcomp/list-ext3-properties/sll_length_check_false-unreach-call_false-valid-memcleanup.i [2018-11-23 11:20:50,493 INFO L221 CDTParser]: Created temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/9169296a0/6bd56d2c9f0b44aca21d62a110397c6e/FLAGe4aa0fbfc [2018-11-23 11:20:51,019 INFO L307 CDTParser]: Found 1 translation units. [2018-11-23 11:20:51,020 INFO L161 CDTParser]: Scanning /storage/repos/ultimate/trunk/examples/svcomp/list-ext3-properties/sll_length_check_false-unreach-call_false-valid-memcleanup.i [2018-11-23 11:20:51,034 INFO L355 CDTParser]: About to delete temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/9169296a0/6bd56d2c9f0b44aca21d62a110397c6e/FLAGe4aa0fbfc [2018-11-23 11:20:51,305 INFO L363 CDTParser]: Successfully deleted /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/9169296a0/6bd56d2c9f0b44aca21d62a110397c6e [2018-11-23 11:20:51,314 INFO L296 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2018-11-23 11:20:51,315 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2018-11-23 11:20:51,316 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2018-11-23 11:20:51,316 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2018-11-23 11:20:51,320 INFO L276 PluginConnector]: CACSL2BoogieTranslator initialized [2018-11-23 11:20:51,321 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 23.11 11:20:51" (1/1) ... [2018-11-23 11:20:51,324 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@61edb436 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 11:20:51, skipping insertion in model container [2018-11-23 11:20:51,324 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 23.11 11:20:51" (1/1) ... [2018-11-23 11:20:51,335 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2018-11-23 11:20:51,387 INFO L176 MainTranslator]: Built tables and reachable declarations [2018-11-23 11:20:51,798 INFO L201 PostProcessor]: Analyzing one entry point: main [2018-11-23 11:20:51,815 INFO L191 MainTranslator]: Completed pre-run [2018-11-23 11:20:51,897 INFO L201 PostProcessor]: Analyzing one entry point: main [2018-11-23 11:20:51,969 INFO L195 MainTranslator]: Completed translation [2018-11-23 11:20:51,970 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 11:20:51 WrapperNode [2018-11-23 11:20:51,970 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2018-11-23 11:20:51,971 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2018-11-23 11:20:51,971 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2018-11-23 11:20:51,971 INFO L276 PluginConnector]: Boogie Procedure Inliner initialized [2018-11-23 11:20:52,052 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 11:20:51" (1/1) ... [2018-11-23 11:20:52,080 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 11:20:51" (1/1) ... [2018-11-23 11:20:52,089 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2018-11-23 11:20:52,090 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2018-11-23 11:20:52,090 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2018-11-23 11:20:52,090 INFO L276 PluginConnector]: Boogie Preprocessor initialized [2018-11-23 11:20:52,100 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 11:20:51" (1/1) ... [2018-11-23 11:20:52,100 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 11:20:51" (1/1) ... [2018-11-23 11:20:52,104 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 11:20:51" (1/1) ... [2018-11-23 11:20:52,104 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 11:20:51" (1/1) ... [2018-11-23 11:20:52,138 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 11:20:51" (1/1) ... [2018-11-23 11:20:52,148 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 11:20:51" (1/1) ... [2018-11-23 11:20:52,155 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 11:20:51" (1/1) ... [2018-11-23 11:20:52,164 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2018-11-23 11:20:52,164 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2018-11-23 11:20:52,164 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2018-11-23 11:20:52,165 INFO L276 PluginConnector]: RCFGBuilder initialized [2018-11-23 11:20:52,166 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 11:20:51" (1/1) ... No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 Starting monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-11-23 11:20:52,232 INFO L130 BoogieDeclarations]: Found specification of procedure sll_destroy [2018-11-23 11:20:52,233 INFO L138 BoogieDeclarations]: Found implementation of procedure sll_destroy [2018-11-23 11:20:52,233 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.alloc [2018-11-23 11:20:52,233 INFO L130 BoogieDeclarations]: Found specification of procedure sll_length [2018-11-23 11:20:52,233 INFO L138 BoogieDeclarations]: Found implementation of procedure sll_length [2018-11-23 11:20:52,233 INFO L130 BoogieDeclarations]: Found specification of procedure exit [2018-11-23 11:20:52,233 INFO L138 BoogieDeclarations]: Found implementation of procedure exit [2018-11-23 11:20:52,234 INFO L130 BoogieDeclarations]: Found specification of procedure sll_create [2018-11-23 11:20:52,234 INFO L138 BoogieDeclarations]: Found implementation of procedure sll_create [2018-11-23 11:20:52,234 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.init [2018-11-23 11:20:52,234 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.init [2018-11-23 11:20:52,234 INFO L130 BoogieDeclarations]: Found specification of procedure main [2018-11-23 11:20:52,235 INFO L138 BoogieDeclarations]: Found implementation of procedure main [2018-11-23 11:20:52,235 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2018-11-23 11:20:52,235 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2018-11-23 11:20:52,235 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.dealloc [2018-11-23 11:20:52,235 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2018-11-23 11:20:52,235 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2018-11-23 11:20:53,041 INFO L275 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2018-11-23 11:20:53,041 INFO L280 CfgBuilder]: Removed 4 assue(true) statements. [2018-11-23 11:20:53,042 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 11:20:53 BoogieIcfgContainer [2018-11-23 11:20:53,042 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2018-11-23 11:20:53,043 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2018-11-23 11:20:53,043 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2018-11-23 11:20:53,046 INFO L276 PluginConnector]: TraceAbstraction initialized [2018-11-23 11:20:53,047 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 23.11 11:20:51" (1/3) ... [2018-11-23 11:20:53,048 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@1c3efd97 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 23.11 11:20:53, skipping insertion in model container [2018-11-23 11:20:53,048 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 11:20:51" (2/3) ... [2018-11-23 11:20:53,048 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@1c3efd97 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 23.11 11:20:53, skipping insertion in model container [2018-11-23 11:20:53,048 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 11:20:53" (3/3) ... [2018-11-23 11:20:53,050 INFO L112 eAbstractionObserver]: Analyzing ICFG sll_length_check_false-unreach-call_false-valid-memcleanup.i [2018-11-23 11:20:53,059 INFO L156 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2018-11-23 11:20:53,066 INFO L168 ceAbstractionStarter]: Appying trace abstraction to program that has 1 error locations. [2018-11-23 11:20:53,083 INFO L257 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2018-11-23 11:20:53,115 INFO L133 ementStrategyFactory]: Using default assertion order modulation [2018-11-23 11:20:53,116 INFO L382 AbstractCegarLoop]: Interprodecural is true [2018-11-23 11:20:53,116 INFO L383 AbstractCegarLoop]: Hoare is true [2018-11-23 11:20:53,116 INFO L384 AbstractCegarLoop]: Compute interpolants for FPandBP [2018-11-23 11:20:53,116 INFO L385 AbstractCegarLoop]: Backedges is STRAIGHT_LINE [2018-11-23 11:20:53,117 INFO L386 AbstractCegarLoop]: Determinization is PREDICATE_ABSTRACTION [2018-11-23 11:20:53,117 INFO L387 AbstractCegarLoop]: Difference is false [2018-11-23 11:20:53,117 INFO L388 AbstractCegarLoop]: Minimize is MINIMIZE_SEVPA [2018-11-23 11:20:53,117 INFO L393 AbstractCegarLoop]: ======== Iteration 0==of CEGAR loop == AllErrorsAtOnce======== [2018-11-23 11:20:53,136 INFO L276 IsEmpty]: Start isEmpty. Operand 38 states. [2018-11-23 11:20:53,142 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 23 [2018-11-23 11:20:53,143 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 11:20:53,144 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 11:20:53,146 INFO L423 AbstractCegarLoop]: === Iteration 1 === [mainErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 11:20:53,152 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 11:20:53,152 INFO L82 PathProgramCache]: Analyzing trace with hash 147460460, now seen corresponding path program 1 times [2018-11-23 11:20:53,156 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 11:20:53,156 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 2 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 2 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 11:20:53,175 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 11:20:53,232 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 11:20:53,264 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 11:20:53,269 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 11:20:53,493 INFO L256 TraceCheckUtils]: 0: Hoare triple {41#true} call ULTIMATE.init(); {41#true} is VALID [2018-11-23 11:20:53,498 INFO L273 TraceCheckUtils]: 1: Hoare triple {41#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1]; {41#true} is VALID [2018-11-23 11:20:53,499 INFO L273 TraceCheckUtils]: 2: Hoare triple {41#true} assume true; {41#true} is VALID [2018-11-23 11:20:53,500 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {41#true} {41#true} #91#return; {41#true} is VALID [2018-11-23 11:20:53,500 INFO L256 TraceCheckUtils]: 4: Hoare triple {41#true} call #t~ret11 := main(); {41#true} is VALID [2018-11-23 11:20:53,501 INFO L273 TraceCheckUtils]: 5: Hoare triple {41#true} ~len~1 := 2bv32; {41#true} is VALID [2018-11-23 11:20:53,501 INFO L273 TraceCheckUtils]: 6: Hoare triple {41#true} assume !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7; {41#true} is VALID [2018-11-23 11:20:53,501 INFO L256 TraceCheckUtils]: 7: Hoare triple {41#true} call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); {41#true} is VALID [2018-11-23 11:20:53,502 INFO L273 TraceCheckUtils]: 8: Hoare triple {41#true} ~len := #in~len;~head~0.base, ~head~0.offset := 0bv32, 0bv32; {41#true} is VALID [2018-11-23 11:20:53,515 INFO L273 TraceCheckUtils]: 9: Hoare triple {41#true} assume !true; {42#false} is VALID [2018-11-23 11:20:53,515 INFO L273 TraceCheckUtils]: 10: Hoare triple {42#false} #res.base, #res.offset := ~head~0.base, ~head~0.offset; {42#false} is VALID [2018-11-23 11:20:53,516 INFO L273 TraceCheckUtils]: 11: Hoare triple {42#false} assume true; {42#false} is VALID [2018-11-23 11:20:53,516 INFO L268 TraceCheckUtils]: 12: Hoare quadruple {42#false} {41#true} #95#return; {42#false} is VALID [2018-11-23 11:20:53,516 INFO L273 TraceCheckUtils]: 13: Hoare triple {42#false} ~s~0.base, ~s~0.offset := #t~ret9.base, #t~ret9.offset;havoc #t~ret9.base, #t~ret9.offset; {42#false} is VALID [2018-11-23 11:20:53,517 INFO L256 TraceCheckUtils]: 14: Hoare triple {42#false} call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); {42#false} is VALID [2018-11-23 11:20:53,517 INFO L273 TraceCheckUtils]: 15: Hoare triple {42#false} ~head.base, ~head.offset := #in~head.base, #in~head.offset;~len~0 := 0bv32; {42#false} is VALID [2018-11-23 11:20:53,517 INFO L273 TraceCheckUtils]: 16: Hoare triple {42#false} assume !(~head.base != 0bv32 || ~head.offset != 0bv32); {42#false} is VALID [2018-11-23 11:20:53,518 INFO L273 TraceCheckUtils]: 17: Hoare triple {42#false} #res := ~len~0; {42#false} is VALID [2018-11-23 11:20:53,518 INFO L273 TraceCheckUtils]: 18: Hoare triple {42#false} assume true; {42#false} is VALID [2018-11-23 11:20:53,519 INFO L268 TraceCheckUtils]: 19: Hoare quadruple {42#false} {42#false} #97#return; {42#false} is VALID [2018-11-23 11:20:53,519 INFO L273 TraceCheckUtils]: 20: Hoare triple {42#false} assume ~len~1 != #t~ret10;havoc #t~ret10; {42#false} is VALID [2018-11-23 11:20:53,519 INFO L273 TraceCheckUtils]: 21: Hoare triple {42#false} assume !false; {42#false} is VALID [2018-11-23 11:20:53,524 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 11:20:53,524 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 11:20:53,537 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 11:20:53,537 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [2] imperfect sequences [] total 2 [2018-11-23 11:20:53,546 INFO L78 Accepts]: Start accepts. Automaton has 2 states. Word has length 22 [2018-11-23 11:20:53,550 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 11:20:53,554 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 2 states. [2018-11-23 11:20:53,630 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 22 edges. 22 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 11:20:53,630 INFO L459 AbstractCegarLoop]: Interpolant automaton has 2 states [2018-11-23 11:20:53,638 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 2 interpolants. [2018-11-23 11:20:53,638 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=1, Invalid=1, Unknown=0, NotChecked=0, Total=2 [2018-11-23 11:20:53,641 INFO L87 Difference]: Start difference. First operand 38 states. Second operand 2 states. [2018-11-23 11:20:53,864 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:20:53,864 INFO L93 Difference]: Finished difference Result 69 states and 88 transitions. [2018-11-23 11:20:53,864 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 2 states. [2018-11-23 11:20:53,865 INFO L78 Accepts]: Start accepts. Automaton has 2 states. Word has length 22 [2018-11-23 11:20:53,865 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 11:20:53,866 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 2 states. [2018-11-23 11:20:53,881 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 2 states to 2 states and 88 transitions. [2018-11-23 11:20:53,881 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 2 states. [2018-11-23 11:20:53,893 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 2 states to 2 states and 88 transitions. [2018-11-23 11:20:53,893 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 2 states and 88 transitions. [2018-11-23 11:20:54,388 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 88 edges. 88 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 11:20:54,415 INFO L225 Difference]: With dead ends: 69 [2018-11-23 11:20:54,415 INFO L226 Difference]: Without dead ends: 25 [2018-11-23 11:20:54,423 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 21 GetRequests, 21 SyntacticMatches, 0 SemanticMatches, 0 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=1, Invalid=1, Unknown=0, NotChecked=0, Total=2 [2018-11-23 11:20:54,443 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 25 states. [2018-11-23 11:20:54,620 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 25 to 25. [2018-11-23 11:20:54,620 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 11:20:54,622 INFO L82 GeneralOperation]: Start isEquivalent. First operand 25 states. Second operand 25 states. [2018-11-23 11:20:54,623 INFO L74 IsIncluded]: Start isIncluded. First operand 25 states. Second operand 25 states. [2018-11-23 11:20:54,623 INFO L87 Difference]: Start difference. First operand 25 states. Second operand 25 states. [2018-11-23 11:20:54,628 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:20:54,633 INFO L93 Difference]: Finished difference Result 25 states and 27 transitions. [2018-11-23 11:20:54,633 INFO L276 IsEmpty]: Start isEmpty. Operand 25 states and 27 transitions. [2018-11-23 11:20:54,634 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 11:20:54,634 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 11:20:54,634 INFO L74 IsIncluded]: Start isIncluded. First operand 25 states. Second operand 25 states. [2018-11-23 11:20:54,634 INFO L87 Difference]: Start difference. First operand 25 states. Second operand 25 states. [2018-11-23 11:20:54,640 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:20:54,645 INFO L93 Difference]: Finished difference Result 25 states and 27 transitions. [2018-11-23 11:20:54,645 INFO L276 IsEmpty]: Start isEmpty. Operand 25 states and 27 transitions. [2018-11-23 11:20:54,646 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 11:20:54,646 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 11:20:54,647 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 11:20:54,647 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 11:20:54,647 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 25 states. [2018-11-23 11:20:54,653 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 25 states to 25 states and 27 transitions. [2018-11-23 11:20:54,661 INFO L78 Accepts]: Start accepts. Automaton has 25 states and 27 transitions. Word has length 22 [2018-11-23 11:20:54,661 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 11:20:54,661 INFO L480 AbstractCegarLoop]: Abstraction has 25 states and 27 transitions. [2018-11-23 11:20:54,664 INFO L481 AbstractCegarLoop]: Interpolant automaton has 2 states. [2018-11-23 11:20:54,664 INFO L276 IsEmpty]: Start isEmpty. Operand 25 states and 27 transitions. [2018-11-23 11:20:54,665 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 23 [2018-11-23 11:20:54,665 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 11:20:54,665 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 11:20:54,666 INFO L423 AbstractCegarLoop]: === Iteration 2 === [mainErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 11:20:54,666 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 11:20:54,666 INFO L82 PathProgramCache]: Analyzing trace with hash -626670752, now seen corresponding path program 1 times [2018-11-23 11:20:54,670 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 11:20:54,670 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 3 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 3 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 11:20:54,697 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 11:20:54,742 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 11:20:54,761 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 11:20:54,762 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 11:20:55,031 INFO L256 TraceCheckUtils]: 0: Hoare triple {295#true} call ULTIMATE.init(); {295#true} is VALID [2018-11-23 11:20:55,032 INFO L273 TraceCheckUtils]: 1: Hoare triple {295#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1]; {295#true} is VALID [2018-11-23 11:20:55,032 INFO L273 TraceCheckUtils]: 2: Hoare triple {295#true} assume true; {295#true} is VALID [2018-11-23 11:20:55,032 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {295#true} {295#true} #91#return; {295#true} is VALID [2018-11-23 11:20:55,032 INFO L256 TraceCheckUtils]: 4: Hoare triple {295#true} call #t~ret11 := main(); {295#true} is VALID [2018-11-23 11:20:55,034 INFO L273 TraceCheckUtils]: 5: Hoare triple {295#true} ~len~1 := 2bv32; {315#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 11:20:55,036 INFO L273 TraceCheckUtils]: 6: Hoare triple {315#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} assume !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7; {315#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 11:20:55,036 INFO L256 TraceCheckUtils]: 7: Hoare triple {315#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); {295#true} is VALID [2018-11-23 11:20:55,041 INFO L273 TraceCheckUtils]: 8: Hoare triple {295#true} ~len := #in~len;~head~0.base, ~head~0.offset := 0bv32, 0bv32; {325#(= |sll_create_#in~len| sll_create_~len)} is VALID [2018-11-23 11:20:55,041 INFO L273 TraceCheckUtils]: 9: Hoare triple {325#(= |sll_create_#in~len| sll_create_~len)} assume !~bvsgt32(~len, 0bv32); {329#(not (bvsgt |sll_create_#in~len| (_ bv0 32)))} is VALID [2018-11-23 11:20:55,045 INFO L273 TraceCheckUtils]: 10: Hoare triple {329#(not (bvsgt |sll_create_#in~len| (_ bv0 32)))} #res.base, #res.offset := ~head~0.base, ~head~0.offset; {329#(not (bvsgt |sll_create_#in~len| (_ bv0 32)))} is VALID [2018-11-23 11:20:55,045 INFO L273 TraceCheckUtils]: 11: Hoare triple {329#(not (bvsgt |sll_create_#in~len| (_ bv0 32)))} assume true; {329#(not (bvsgt |sll_create_#in~len| (_ bv0 32)))} is VALID [2018-11-23 11:20:55,049 INFO L268 TraceCheckUtils]: 12: Hoare quadruple {329#(not (bvsgt |sll_create_#in~len| (_ bv0 32)))} {315#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} #95#return; {296#false} is VALID [2018-11-23 11:20:55,049 INFO L273 TraceCheckUtils]: 13: Hoare triple {296#false} ~s~0.base, ~s~0.offset := #t~ret9.base, #t~ret9.offset;havoc #t~ret9.base, #t~ret9.offset; {296#false} is VALID [2018-11-23 11:20:55,050 INFO L256 TraceCheckUtils]: 14: Hoare triple {296#false} call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); {296#false} is VALID [2018-11-23 11:20:55,050 INFO L273 TraceCheckUtils]: 15: Hoare triple {296#false} ~head.base, ~head.offset := #in~head.base, #in~head.offset;~len~0 := 0bv32; {296#false} is VALID [2018-11-23 11:20:55,050 INFO L273 TraceCheckUtils]: 16: Hoare triple {296#false} assume !(~head.base != 0bv32 || ~head.offset != 0bv32); {296#false} is VALID [2018-11-23 11:20:55,050 INFO L273 TraceCheckUtils]: 17: Hoare triple {296#false} #res := ~len~0; {296#false} is VALID [2018-11-23 11:20:55,051 INFO L273 TraceCheckUtils]: 18: Hoare triple {296#false} assume true; {296#false} is VALID [2018-11-23 11:20:55,051 INFO L268 TraceCheckUtils]: 19: Hoare quadruple {296#false} {296#false} #97#return; {296#false} is VALID [2018-11-23 11:20:55,051 INFO L273 TraceCheckUtils]: 20: Hoare triple {296#false} assume ~len~1 != #t~ret10;havoc #t~ret10; {296#false} is VALID [2018-11-23 11:20:55,052 INFO L273 TraceCheckUtils]: 21: Hoare triple {296#false} assume !false; {296#false} is VALID [2018-11-23 11:20:55,054 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 11:20:55,054 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 11:20:55,059 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 11:20:55,059 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [5] imperfect sequences [] total 5 [2018-11-23 11:20:55,061 INFO L78 Accepts]: Start accepts. Automaton has 5 states. Word has length 22 [2018-11-23 11:20:55,061 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 11:20:55,061 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 5 states. [2018-11-23 11:20:55,099 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 22 edges. 22 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 11:20:55,099 INFO L459 AbstractCegarLoop]: Interpolant automaton has 5 states [2018-11-23 11:20:55,100 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2018-11-23 11:20:55,100 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2018-11-23 11:20:55,100 INFO L87 Difference]: Start difference. First operand 25 states and 27 transitions. Second operand 5 states. [2018-11-23 11:20:55,600 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:20:55,601 INFO L93 Difference]: Finished difference Result 48 states and 54 transitions. [2018-11-23 11:20:55,601 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2018-11-23 11:20:55,601 INFO L78 Accepts]: Start accepts. Automaton has 5 states. Word has length 22 [2018-11-23 11:20:55,601 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 11:20:55,602 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 5 states. [2018-11-23 11:20:55,605 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 5 states to 5 states and 54 transitions. [2018-11-23 11:20:55,605 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 5 states. [2018-11-23 11:20:55,609 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 5 states to 5 states and 54 transitions. [2018-11-23 11:20:55,609 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 5 states and 54 transitions. [2018-11-23 11:20:55,754 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 54 edges. 54 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 11:20:55,757 INFO L225 Difference]: With dead ends: 48 [2018-11-23 11:20:55,757 INFO L226 Difference]: Without dead ends: 38 [2018-11-23 11:20:55,758 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 22 GetRequests, 18 SyntacticMatches, 0 SemanticMatches, 4 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=11, Invalid=19, Unknown=0, NotChecked=0, Total=30 [2018-11-23 11:20:55,759 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 38 states. [2018-11-23 11:20:55,780 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 38 to 31. [2018-11-23 11:20:55,780 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 11:20:55,780 INFO L82 GeneralOperation]: Start isEquivalent. First operand 38 states. Second operand 31 states. [2018-11-23 11:20:55,780 INFO L74 IsIncluded]: Start isIncluded. First operand 38 states. Second operand 31 states. [2018-11-23 11:20:55,781 INFO L87 Difference]: Start difference. First operand 38 states. Second operand 31 states. [2018-11-23 11:20:55,785 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:20:55,786 INFO L93 Difference]: Finished difference Result 38 states and 43 transitions. [2018-11-23 11:20:55,786 INFO L276 IsEmpty]: Start isEmpty. Operand 38 states and 43 transitions. [2018-11-23 11:20:55,787 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 11:20:55,787 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 11:20:55,787 INFO L74 IsIncluded]: Start isIncluded. First operand 31 states. Second operand 38 states. [2018-11-23 11:20:55,788 INFO L87 Difference]: Start difference. First operand 31 states. Second operand 38 states. [2018-11-23 11:20:55,791 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:20:55,791 INFO L93 Difference]: Finished difference Result 38 states and 43 transitions. [2018-11-23 11:20:55,792 INFO L276 IsEmpty]: Start isEmpty. Operand 38 states and 43 transitions. [2018-11-23 11:20:55,792 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 11:20:55,793 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 11:20:55,793 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 11:20:55,793 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 11:20:55,793 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 31 states. [2018-11-23 11:20:55,796 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 31 states to 31 states and 36 transitions. [2018-11-23 11:20:55,796 INFO L78 Accepts]: Start accepts. Automaton has 31 states and 36 transitions. Word has length 22 [2018-11-23 11:20:55,796 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 11:20:55,797 INFO L480 AbstractCegarLoop]: Abstraction has 31 states and 36 transitions. [2018-11-23 11:20:55,797 INFO L481 AbstractCegarLoop]: Interpolant automaton has 5 states. [2018-11-23 11:20:55,797 INFO L276 IsEmpty]: Start isEmpty. Operand 31 states and 36 transitions. [2018-11-23 11:20:55,798 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 24 [2018-11-23 11:20:55,798 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 11:20:55,798 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 11:20:55,799 INFO L423 AbstractCegarLoop]: === Iteration 3 === [mainErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 11:20:55,799 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 11:20:55,799 INFO L82 PathProgramCache]: Analyzing trace with hash 47330928, now seen corresponding path program 1 times [2018-11-23 11:20:55,800 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 11:20:55,800 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 4 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 4 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 11:20:55,825 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 11:20:55,863 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 11:20:55,877 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 11:20:55,878 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 11:20:55,985 INFO L256 TraceCheckUtils]: 0: Hoare triple {558#true} call ULTIMATE.init(); {558#true} is VALID [2018-11-23 11:20:55,986 INFO L273 TraceCheckUtils]: 1: Hoare triple {558#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1]; {558#true} is VALID [2018-11-23 11:20:55,986 INFO L273 TraceCheckUtils]: 2: Hoare triple {558#true} assume true; {558#true} is VALID [2018-11-23 11:20:55,987 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {558#true} {558#true} #91#return; {558#true} is VALID [2018-11-23 11:20:55,987 INFO L256 TraceCheckUtils]: 4: Hoare triple {558#true} call #t~ret11 := main(); {558#true} is VALID [2018-11-23 11:20:55,988 INFO L273 TraceCheckUtils]: 5: Hoare triple {558#true} ~len~1 := 2bv32; {578#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 11:20:55,991 INFO L273 TraceCheckUtils]: 6: Hoare triple {578#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} assume !!(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7;#t~post8 := ~len~1;~len~1 := ~bvadd32(1bv32, #t~post8);havoc #t~post8; {582#(= (bvadd main_~len~1 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 11:20:55,992 INFO L273 TraceCheckUtils]: 7: Hoare triple {582#(= (bvadd main_~len~1 (_ bv4294967293 32)) (_ bv0 32))} assume !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7; {582#(= (bvadd main_~len~1 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 11:20:55,992 INFO L256 TraceCheckUtils]: 8: Hoare triple {582#(= (bvadd main_~len~1 (_ bv4294967293 32)) (_ bv0 32))} call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); {558#true} is VALID [2018-11-23 11:20:55,993 INFO L273 TraceCheckUtils]: 9: Hoare triple {558#true} ~len := #in~len;~head~0.base, ~head~0.offset := 0bv32, 0bv32; {592#(= |sll_create_#in~len| sll_create_~len)} is VALID [2018-11-23 11:20:55,993 INFO L273 TraceCheckUtils]: 10: Hoare triple {592#(= |sll_create_#in~len| sll_create_~len)} assume !~bvsgt32(~len, 0bv32); {596#(not (bvsgt |sll_create_#in~len| (_ bv0 32)))} is VALID [2018-11-23 11:20:55,994 INFO L273 TraceCheckUtils]: 11: Hoare triple {596#(not (bvsgt |sll_create_#in~len| (_ bv0 32)))} #res.base, #res.offset := ~head~0.base, ~head~0.offset; {596#(not (bvsgt |sll_create_#in~len| (_ bv0 32)))} is VALID [2018-11-23 11:20:55,994 INFO L273 TraceCheckUtils]: 12: Hoare triple {596#(not (bvsgt |sll_create_#in~len| (_ bv0 32)))} assume true; {596#(not (bvsgt |sll_create_#in~len| (_ bv0 32)))} is VALID [2018-11-23 11:20:55,996 INFO L268 TraceCheckUtils]: 13: Hoare quadruple {596#(not (bvsgt |sll_create_#in~len| (_ bv0 32)))} {582#(= (bvadd main_~len~1 (_ bv4294967293 32)) (_ bv0 32))} #95#return; {559#false} is VALID [2018-11-23 11:20:55,996 INFO L273 TraceCheckUtils]: 14: Hoare triple {559#false} ~s~0.base, ~s~0.offset := #t~ret9.base, #t~ret9.offset;havoc #t~ret9.base, #t~ret9.offset; {559#false} is VALID [2018-11-23 11:20:55,996 INFO L256 TraceCheckUtils]: 15: Hoare triple {559#false} call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); {559#false} is VALID [2018-11-23 11:20:55,997 INFO L273 TraceCheckUtils]: 16: Hoare triple {559#false} ~head.base, ~head.offset := #in~head.base, #in~head.offset;~len~0 := 0bv32; {559#false} is VALID [2018-11-23 11:20:55,997 INFO L273 TraceCheckUtils]: 17: Hoare triple {559#false} assume !(~head.base != 0bv32 || ~head.offset != 0bv32); {559#false} is VALID [2018-11-23 11:20:55,997 INFO L273 TraceCheckUtils]: 18: Hoare triple {559#false} #res := ~len~0; {559#false} is VALID [2018-11-23 11:20:55,998 INFO L273 TraceCheckUtils]: 19: Hoare triple {559#false} assume true; {559#false} is VALID [2018-11-23 11:20:55,998 INFO L268 TraceCheckUtils]: 20: Hoare quadruple {559#false} {559#false} #97#return; {559#false} is VALID [2018-11-23 11:20:55,999 INFO L273 TraceCheckUtils]: 21: Hoare triple {559#false} assume ~len~1 != #t~ret10;havoc #t~ret10; {559#false} is VALID [2018-11-23 11:20:55,999 INFO L273 TraceCheckUtils]: 22: Hoare triple {559#false} assume !false; {559#false} is VALID [2018-11-23 11:20:56,001 INFO L134 CoverageAnalysis]: Checked inductivity of 1 backedges. 0 proven. 1 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 11:20:56,001 INFO L316 TraceCheckSpWp]: Computing backward predicates... [2018-11-23 11:20:56,364 INFO L273 TraceCheckUtils]: 22: Hoare triple {559#false} assume !false; {559#false} is VALID [2018-11-23 11:20:56,365 INFO L273 TraceCheckUtils]: 21: Hoare triple {559#false} assume ~len~1 != #t~ret10;havoc #t~ret10; {559#false} is VALID [2018-11-23 11:20:56,365 INFO L268 TraceCheckUtils]: 20: Hoare quadruple {558#true} {559#false} #97#return; {559#false} is VALID [2018-11-23 11:20:56,366 INFO L273 TraceCheckUtils]: 19: Hoare triple {558#true} assume true; {558#true} is VALID [2018-11-23 11:20:56,366 INFO L273 TraceCheckUtils]: 18: Hoare triple {558#true} #res := ~len~0; {558#true} is VALID [2018-11-23 11:20:56,367 INFO L273 TraceCheckUtils]: 17: Hoare triple {558#true} assume !(~head.base != 0bv32 || ~head.offset != 0bv32); {558#true} is VALID [2018-11-23 11:20:56,367 INFO L273 TraceCheckUtils]: 16: Hoare triple {558#true} ~head.base, ~head.offset := #in~head.base, #in~head.offset;~len~0 := 0bv32; {558#true} is VALID [2018-11-23 11:20:56,367 INFO L256 TraceCheckUtils]: 15: Hoare triple {559#false} call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); {558#true} is VALID [2018-11-23 11:20:56,367 INFO L273 TraceCheckUtils]: 14: Hoare triple {559#false} ~s~0.base, ~s~0.offset := #t~ret9.base, #t~ret9.offset;havoc #t~ret9.base, #t~ret9.offset; {559#false} is VALID [2018-11-23 11:20:56,369 INFO L268 TraceCheckUtils]: 13: Hoare quadruple {596#(not (bvsgt |sll_create_#in~len| (_ bv0 32)))} {660#(bvsgt (bvadd main_~len~1 (_ bv1 32)) (_ bv0 32))} #95#return; {559#false} is VALID [2018-11-23 11:20:56,370 INFO L273 TraceCheckUtils]: 12: Hoare triple {596#(not (bvsgt |sll_create_#in~len| (_ bv0 32)))} assume true; {596#(not (bvsgt |sll_create_#in~len| (_ bv0 32)))} is VALID [2018-11-23 11:20:56,370 INFO L273 TraceCheckUtils]: 11: Hoare triple {596#(not (bvsgt |sll_create_#in~len| (_ bv0 32)))} #res.base, #res.offset := ~head~0.base, ~head~0.offset; {596#(not (bvsgt |sll_create_#in~len| (_ bv0 32)))} is VALID [2018-11-23 11:20:56,378 INFO L273 TraceCheckUtils]: 10: Hoare triple {673#(or (not (bvsgt |sll_create_#in~len| (_ bv0 32))) (bvsgt sll_create_~len (_ bv0 32)))} assume !~bvsgt32(~len, 0bv32); {596#(not (bvsgt |sll_create_#in~len| (_ bv0 32)))} is VALID [2018-11-23 11:20:56,379 INFO L273 TraceCheckUtils]: 9: Hoare triple {558#true} ~len := #in~len;~head~0.base, ~head~0.offset := 0bv32, 0bv32; {673#(or (not (bvsgt |sll_create_#in~len| (_ bv0 32))) (bvsgt sll_create_~len (_ bv0 32)))} is VALID [2018-11-23 11:20:56,380 INFO L256 TraceCheckUtils]: 8: Hoare triple {660#(bvsgt (bvadd main_~len~1 (_ bv1 32)) (_ bv0 32))} call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); {558#true} is VALID [2018-11-23 11:20:56,380 INFO L273 TraceCheckUtils]: 7: Hoare triple {660#(bvsgt (bvadd main_~len~1 (_ bv1 32)) (_ bv0 32))} assume !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7; {660#(bvsgt (bvadd main_~len~1 (_ bv1 32)) (_ bv0 32))} is VALID [2018-11-23 11:20:56,382 INFO L273 TraceCheckUtils]: 6: Hoare triple {683#(bvsgt (bvadd main_~len~1 (_ bv2 32)) (_ bv0 32))} assume !!(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7;#t~post8 := ~len~1;~len~1 := ~bvadd32(1bv32, #t~post8);havoc #t~post8; {660#(bvsgt (bvadd main_~len~1 (_ bv1 32)) (_ bv0 32))} is VALID [2018-11-23 11:20:56,383 INFO L273 TraceCheckUtils]: 5: Hoare triple {558#true} ~len~1 := 2bv32; {683#(bvsgt (bvadd main_~len~1 (_ bv2 32)) (_ bv0 32))} is VALID [2018-11-23 11:20:56,383 INFO L256 TraceCheckUtils]: 4: Hoare triple {558#true} call #t~ret11 := main(); {558#true} is VALID [2018-11-23 11:20:56,384 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {558#true} {558#true} #91#return; {558#true} is VALID [2018-11-23 11:20:56,384 INFO L273 TraceCheckUtils]: 2: Hoare triple {558#true} assume true; {558#true} is VALID [2018-11-23 11:20:56,385 INFO L273 TraceCheckUtils]: 1: Hoare triple {558#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1]; {558#true} is VALID [2018-11-23 11:20:56,385 INFO L256 TraceCheckUtils]: 0: Hoare triple {558#true} call ULTIMATE.init(); {558#true} is VALID [2018-11-23 11:20:56,388 INFO L134 CoverageAnalysis]: Checked inductivity of 1 backedges. 0 proven. 1 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 11:20:56,402 INFO L312 seRefinementStrategy]: Constructing automaton from 0 perfect and 2 imperfect interpolant sequences. [2018-11-23 11:20:56,402 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [] imperfect sequences [6, 6] total 9 [2018-11-23 11:20:56,403 INFO L78 Accepts]: Start accepts. Automaton has 9 states. Word has length 23 [2018-11-23 11:20:56,403 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 11:20:56,404 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 9 states. [2018-11-23 11:20:56,514 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 36 edges. 36 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 11:20:56,515 INFO L459 AbstractCegarLoop]: Interpolant automaton has 9 states [2018-11-23 11:20:56,515 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 9 interpolants. [2018-11-23 11:20:56,515 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=21, Invalid=51, Unknown=0, NotChecked=0, Total=72 [2018-11-23 11:20:56,516 INFO L87 Difference]: Start difference. First operand 31 states and 36 transitions. Second operand 9 states. [2018-11-23 11:20:57,306 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:20:57,306 INFO L93 Difference]: Finished difference Result 55 states and 63 transitions. [2018-11-23 11:20:57,306 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 8 states. [2018-11-23 11:20:57,307 INFO L78 Accepts]: Start accepts. Automaton has 9 states. Word has length 23 [2018-11-23 11:20:57,307 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 11:20:57,307 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 9 states. [2018-11-23 11:20:57,311 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 8 states to 8 states and 63 transitions. [2018-11-23 11:20:57,311 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 9 states. [2018-11-23 11:20:57,315 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 8 states to 8 states and 63 transitions. [2018-11-23 11:20:57,315 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 8 states and 63 transitions. [2018-11-23 11:20:57,429 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 63 edges. 63 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 11:20:57,432 INFO L225 Difference]: With dead ends: 55 [2018-11-23 11:20:57,432 INFO L226 Difference]: Without dead ends: 42 [2018-11-23 11:20:57,433 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 47 GetRequests, 38 SyntacticMatches, 0 SemanticMatches, 9 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 3 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=32, Invalid=78, Unknown=0, NotChecked=0, Total=110 [2018-11-23 11:20:57,433 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 42 states. [2018-11-23 11:20:57,468 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 42 to 26. [2018-11-23 11:20:57,469 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 11:20:57,469 INFO L82 GeneralOperation]: Start isEquivalent. First operand 42 states. Second operand 26 states. [2018-11-23 11:20:57,469 INFO L74 IsIncluded]: Start isIncluded. First operand 42 states. Second operand 26 states. [2018-11-23 11:20:57,469 INFO L87 Difference]: Start difference. First operand 42 states. Second operand 26 states. [2018-11-23 11:20:57,474 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:20:57,475 INFO L93 Difference]: Finished difference Result 42 states and 48 transitions. [2018-11-23 11:20:57,475 INFO L276 IsEmpty]: Start isEmpty. Operand 42 states and 48 transitions. [2018-11-23 11:20:57,476 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 11:20:57,476 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 11:20:57,477 INFO L74 IsIncluded]: Start isIncluded. First operand 26 states. Second operand 42 states. [2018-11-23 11:20:57,477 INFO L87 Difference]: Start difference. First operand 26 states. Second operand 42 states. [2018-11-23 11:20:57,481 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:20:57,481 INFO L93 Difference]: Finished difference Result 42 states and 48 transitions. [2018-11-23 11:20:57,481 INFO L276 IsEmpty]: Start isEmpty. Operand 42 states and 48 transitions. [2018-11-23 11:20:57,482 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 11:20:57,482 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 11:20:57,482 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 11:20:57,483 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 11:20:57,483 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 26 states. [2018-11-23 11:20:57,484 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 26 states to 26 states and 28 transitions. [2018-11-23 11:20:57,485 INFO L78 Accepts]: Start accepts. Automaton has 26 states and 28 transitions. Word has length 23 [2018-11-23 11:20:57,485 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 11:20:57,485 INFO L480 AbstractCegarLoop]: Abstraction has 26 states and 28 transitions. [2018-11-23 11:20:57,485 INFO L481 AbstractCegarLoop]: Interpolant automaton has 9 states. [2018-11-23 11:20:57,485 INFO L276 IsEmpty]: Start isEmpty. Operand 26 states and 28 transitions. [2018-11-23 11:20:57,486 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 26 [2018-11-23 11:20:57,486 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 11:20:57,486 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 11:20:57,486 INFO L423 AbstractCegarLoop]: === Iteration 4 === [mainErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 11:20:57,487 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 11:20:57,487 INFO L82 PathProgramCache]: Analyzing trace with hash -1199502510, now seen corresponding path program 1 times [2018-11-23 11:20:57,487 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 11:20:57,488 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 5 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 5 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 11:20:57,510 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 11:20:57,537 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 11:20:57,569 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 11:20:57,570 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 11:20:57,741 INFO L256 TraceCheckUtils]: 0: Hoare triple {911#true} call ULTIMATE.init(); {911#true} is VALID [2018-11-23 11:20:57,742 INFO L273 TraceCheckUtils]: 1: Hoare triple {911#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1]; {911#true} is VALID [2018-11-23 11:20:57,742 INFO L273 TraceCheckUtils]: 2: Hoare triple {911#true} assume true; {911#true} is VALID [2018-11-23 11:20:57,742 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {911#true} {911#true} #91#return; {911#true} is VALID [2018-11-23 11:20:57,742 INFO L256 TraceCheckUtils]: 4: Hoare triple {911#true} call #t~ret11 := main(); {911#true} is VALID [2018-11-23 11:20:57,743 INFO L273 TraceCheckUtils]: 5: Hoare triple {911#true} ~len~1 := 2bv32; {911#true} is VALID [2018-11-23 11:20:57,743 INFO L273 TraceCheckUtils]: 6: Hoare triple {911#true} assume !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7; {911#true} is VALID [2018-11-23 11:20:57,743 INFO L256 TraceCheckUtils]: 7: Hoare triple {911#true} call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); {911#true} is VALID [2018-11-23 11:20:57,743 INFO L273 TraceCheckUtils]: 8: Hoare triple {911#true} ~len := #in~len;~head~0.base, ~head~0.offset := 0bv32, 0bv32; {911#true} is VALID [2018-11-23 11:20:57,744 INFO L273 TraceCheckUtils]: 9: Hoare triple {911#true} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {943#(not (= (_ bv0 32) sll_create_~new_head~0.base))} is VALID [2018-11-23 11:20:57,745 INFO L273 TraceCheckUtils]: 10: Hoare triple {943#(not (= (_ bv0 32) sll_create_~new_head~0.base))} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {943#(not (= (_ bv0 32) sll_create_~new_head~0.base))} is VALID [2018-11-23 11:20:57,746 INFO L273 TraceCheckUtils]: 11: Hoare triple {943#(not (= (_ bv0 32) sll_create_~new_head~0.base))} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {950#(not (= sll_create_~head~0.base (_ bv0 32)))} is VALID [2018-11-23 11:20:57,747 INFO L273 TraceCheckUtils]: 12: Hoare triple {950#(not (= sll_create_~head~0.base (_ bv0 32)))} assume !~bvsgt32(~len, 0bv32); {950#(not (= sll_create_~head~0.base (_ bv0 32)))} is VALID [2018-11-23 11:20:57,748 INFO L273 TraceCheckUtils]: 13: Hoare triple {950#(not (= sll_create_~head~0.base (_ bv0 32)))} #res.base, #res.offset := ~head~0.base, ~head~0.offset; {957#(not (= (_ bv0 32) |sll_create_#res.base|))} is VALID [2018-11-23 11:20:57,754 INFO L273 TraceCheckUtils]: 14: Hoare triple {957#(not (= (_ bv0 32) |sll_create_#res.base|))} assume true; {957#(not (= (_ bv0 32) |sll_create_#res.base|))} is VALID [2018-11-23 11:20:57,756 INFO L268 TraceCheckUtils]: 15: Hoare quadruple {957#(not (= (_ bv0 32) |sll_create_#res.base|))} {911#true} #95#return; {964#(not (= (_ bv0 32) |main_#t~ret9.base|))} is VALID [2018-11-23 11:20:57,756 INFO L273 TraceCheckUtils]: 16: Hoare triple {964#(not (= (_ bv0 32) |main_#t~ret9.base|))} ~s~0.base, ~s~0.offset := #t~ret9.base, #t~ret9.offset;havoc #t~ret9.base, #t~ret9.offset; {968#(not (= (_ bv0 32) main_~s~0.base))} is VALID [2018-11-23 11:20:57,757 INFO L256 TraceCheckUtils]: 17: Hoare triple {968#(not (= (_ bv0 32) main_~s~0.base))} call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); {911#true} is VALID [2018-11-23 11:20:57,757 INFO L273 TraceCheckUtils]: 18: Hoare triple {911#true} ~head.base, ~head.offset := #in~head.base, #in~head.offset;~len~0 := 0bv32; {975#(= sll_length_~head.base |sll_length_#in~head.base|)} is VALID [2018-11-23 11:20:57,757 INFO L273 TraceCheckUtils]: 19: Hoare triple {975#(= sll_length_~head.base |sll_length_#in~head.base|)} assume !(~head.base != 0bv32 || ~head.offset != 0bv32); {979#(= (_ bv0 32) |sll_length_#in~head.base|)} is VALID [2018-11-23 11:20:57,758 INFO L273 TraceCheckUtils]: 20: Hoare triple {979#(= (_ bv0 32) |sll_length_#in~head.base|)} #res := ~len~0; {979#(= (_ bv0 32) |sll_length_#in~head.base|)} is VALID [2018-11-23 11:20:57,759 INFO L273 TraceCheckUtils]: 21: Hoare triple {979#(= (_ bv0 32) |sll_length_#in~head.base|)} assume true; {979#(= (_ bv0 32) |sll_length_#in~head.base|)} is VALID [2018-11-23 11:20:57,760 INFO L268 TraceCheckUtils]: 22: Hoare quadruple {979#(= (_ bv0 32) |sll_length_#in~head.base|)} {968#(not (= (_ bv0 32) main_~s~0.base))} #97#return; {912#false} is VALID [2018-11-23 11:20:57,761 INFO L273 TraceCheckUtils]: 23: Hoare triple {912#false} assume ~len~1 != #t~ret10;havoc #t~ret10; {912#false} is VALID [2018-11-23 11:20:57,761 INFO L273 TraceCheckUtils]: 24: Hoare triple {912#false} assume !false; {912#false} is VALID [2018-11-23 11:20:57,763 INFO L134 CoverageAnalysis]: Checked inductivity of 1 backedges. 1 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2018-11-23 11:20:57,763 INFO L312 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2018-11-23 11:20:57,765 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 11:20:57,766 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [9] imperfect sequences [] total 9 [2018-11-23 11:20:57,766 INFO L78 Accepts]: Start accepts. Automaton has 9 states. Word has length 25 [2018-11-23 11:20:57,766 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 11:20:57,766 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 9 states. [2018-11-23 11:20:57,822 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 25 edges. 25 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 11:20:57,823 INFO L459 AbstractCegarLoop]: Interpolant automaton has 9 states [2018-11-23 11:20:57,823 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 9 interpolants. [2018-11-23 11:20:57,823 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=15, Invalid=57, Unknown=0, NotChecked=0, Total=72 [2018-11-23 11:20:57,824 INFO L87 Difference]: Start difference. First operand 26 states and 28 transitions. Second operand 9 states. [2018-11-23 11:20:58,400 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:20:58,400 INFO L93 Difference]: Finished difference Result 35 states and 37 transitions. [2018-11-23 11:20:58,400 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 9 states. [2018-11-23 11:20:58,400 INFO L78 Accepts]: Start accepts. Automaton has 9 states. Word has length 25 [2018-11-23 11:20:58,401 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 11:20:58,401 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 9 states. [2018-11-23 11:20:58,403 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 9 states to 9 states and 37 transitions. [2018-11-23 11:20:58,403 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 9 states. [2018-11-23 11:20:58,405 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 9 states to 9 states and 37 transitions. [2018-11-23 11:20:58,405 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 9 states and 37 transitions. [2018-11-23 11:20:58,464 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 37 edges. 37 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 11:20:58,466 INFO L225 Difference]: With dead ends: 35 [2018-11-23 11:20:58,466 INFO L226 Difference]: Without dead ends: 29 [2018-11-23 11:20:58,466 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 27 GetRequests, 17 SyntacticMatches, 0 SemanticMatches, 10 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 2 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=29, Invalid=103, Unknown=0, NotChecked=0, Total=132 [2018-11-23 11:20:58,467 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 29 states. [2018-11-23 11:20:58,500 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 29 to 27. [2018-11-23 11:20:58,502 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 11:20:58,502 INFO L82 GeneralOperation]: Start isEquivalent. First operand 29 states. Second operand 27 states. [2018-11-23 11:20:58,502 INFO L74 IsIncluded]: Start isIncluded. First operand 29 states. Second operand 27 states. [2018-11-23 11:20:58,503 INFO L87 Difference]: Start difference. First operand 29 states. Second operand 27 states. [2018-11-23 11:20:58,505 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:20:58,505 INFO L93 Difference]: Finished difference Result 29 states and 31 transitions. [2018-11-23 11:20:58,505 INFO L276 IsEmpty]: Start isEmpty. Operand 29 states and 31 transitions. [2018-11-23 11:20:58,506 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 11:20:58,506 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 11:20:58,506 INFO L74 IsIncluded]: Start isIncluded. First operand 27 states. Second operand 29 states. [2018-11-23 11:20:58,506 INFO L87 Difference]: Start difference. First operand 27 states. Second operand 29 states. [2018-11-23 11:20:58,508 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:20:58,508 INFO L93 Difference]: Finished difference Result 29 states and 31 transitions. [2018-11-23 11:20:58,508 INFO L276 IsEmpty]: Start isEmpty. Operand 29 states and 31 transitions. [2018-11-23 11:20:58,508 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 11:20:58,509 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 11:20:58,509 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 11:20:58,509 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 11:20:58,509 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 27 states. [2018-11-23 11:20:58,511 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 27 states to 27 states and 29 transitions. [2018-11-23 11:20:58,511 INFO L78 Accepts]: Start accepts. Automaton has 27 states and 29 transitions. Word has length 25 [2018-11-23 11:20:58,511 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 11:20:58,511 INFO L480 AbstractCegarLoop]: Abstraction has 27 states and 29 transitions. [2018-11-23 11:20:58,511 INFO L481 AbstractCegarLoop]: Interpolant automaton has 9 states. [2018-11-23 11:20:58,512 INFO L276 IsEmpty]: Start isEmpty. Operand 27 states and 29 transitions. [2018-11-23 11:20:58,512 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 27 [2018-11-23 11:20:58,512 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 11:20:58,513 INFO L402 BasicCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 11:20:58,513 INFO L423 AbstractCegarLoop]: === Iteration 5 === [mainErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 11:20:58,513 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 11:20:58,513 INFO L82 PathProgramCache]: Analyzing trace with hash -1222797750, now seen corresponding path program 1 times [2018-11-23 11:20:58,514 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 11:20:58,514 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 6 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 6 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 11:20:58,534 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 11:20:58,577 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 11:20:58,594 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 11:20:58,596 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 11:20:58,691 INFO L256 TraceCheckUtils]: 0: Hoare triple {1149#true} call ULTIMATE.init(); {1149#true} is VALID [2018-11-23 11:20:58,691 INFO L273 TraceCheckUtils]: 1: Hoare triple {1149#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1]; {1149#true} is VALID [2018-11-23 11:20:58,691 INFO L273 TraceCheckUtils]: 2: Hoare triple {1149#true} assume true; {1149#true} is VALID [2018-11-23 11:20:58,691 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {1149#true} {1149#true} #91#return; {1149#true} is VALID [2018-11-23 11:20:58,692 INFO L256 TraceCheckUtils]: 4: Hoare triple {1149#true} call #t~ret11 := main(); {1149#true} is VALID [2018-11-23 11:20:58,693 INFO L273 TraceCheckUtils]: 5: Hoare triple {1149#true} ~len~1 := 2bv32; {1169#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 11:20:58,707 INFO L273 TraceCheckUtils]: 6: Hoare triple {1169#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} assume !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7; {1169#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 11:20:58,708 INFO L256 TraceCheckUtils]: 7: Hoare triple {1169#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); {1149#true} is VALID [2018-11-23 11:20:58,709 INFO L273 TraceCheckUtils]: 8: Hoare triple {1149#true} ~len := #in~len;~head~0.base, ~head~0.offset := 0bv32, 0bv32; {1179#(= |sll_create_#in~len| sll_create_~len)} is VALID [2018-11-23 11:20:58,710 INFO L273 TraceCheckUtils]: 9: Hoare triple {1179#(= |sll_create_#in~len| sll_create_~len)} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {1179#(= |sll_create_#in~len| sll_create_~len)} is VALID [2018-11-23 11:20:58,710 INFO L273 TraceCheckUtils]: 10: Hoare triple {1179#(= |sll_create_#in~len| sll_create_~len)} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {1179#(= |sll_create_#in~len| sll_create_~len)} is VALID [2018-11-23 11:20:58,716 INFO L273 TraceCheckUtils]: 11: Hoare triple {1179#(= |sll_create_#in~len| sll_create_~len)} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {1189#(= (bvadd |sll_create_#in~len| (_ bv4294967295 32)) sll_create_~len)} is VALID [2018-11-23 11:20:58,719 INFO L273 TraceCheckUtils]: 12: Hoare triple {1189#(= (bvadd |sll_create_#in~len| (_ bv4294967295 32)) sll_create_~len)} assume !~bvsgt32(~len, 0bv32); {1193#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967295 32)) (_ bv0 32)))} is VALID [2018-11-23 11:20:58,721 INFO L273 TraceCheckUtils]: 13: Hoare triple {1193#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967295 32)) (_ bv0 32)))} #res.base, #res.offset := ~head~0.base, ~head~0.offset; {1193#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967295 32)) (_ bv0 32)))} is VALID [2018-11-23 11:20:58,722 INFO L273 TraceCheckUtils]: 14: Hoare triple {1193#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967295 32)) (_ bv0 32)))} assume true; {1193#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967295 32)) (_ bv0 32)))} is VALID [2018-11-23 11:20:58,723 INFO L268 TraceCheckUtils]: 15: Hoare quadruple {1193#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967295 32)) (_ bv0 32)))} {1169#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} #95#return; {1150#false} is VALID [2018-11-23 11:20:58,723 INFO L273 TraceCheckUtils]: 16: Hoare triple {1150#false} ~s~0.base, ~s~0.offset := #t~ret9.base, #t~ret9.offset;havoc #t~ret9.base, #t~ret9.offset; {1150#false} is VALID [2018-11-23 11:20:58,724 INFO L256 TraceCheckUtils]: 17: Hoare triple {1150#false} call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); {1150#false} is VALID [2018-11-23 11:20:58,724 INFO L273 TraceCheckUtils]: 18: Hoare triple {1150#false} ~head.base, ~head.offset := #in~head.base, #in~head.offset;~len~0 := 0bv32; {1150#false} is VALID [2018-11-23 11:20:58,724 INFO L273 TraceCheckUtils]: 19: Hoare triple {1150#false} assume !!(~head.base != 0bv32 || ~head.offset != 0bv32);#t~post4 := ~len~0;~len~0 := ~bvadd32(1bv32, #t~post4);havoc #t~post4;call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32);~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset;havoc #t~mem5.base, #t~mem5.offset; {1150#false} is VALID [2018-11-23 11:20:58,724 INFO L273 TraceCheckUtils]: 20: Hoare triple {1150#false} assume !(~head.base != 0bv32 || ~head.offset != 0bv32); {1150#false} is VALID [2018-11-23 11:20:58,724 INFO L273 TraceCheckUtils]: 21: Hoare triple {1150#false} #res := ~len~0; {1150#false} is VALID [2018-11-23 11:20:58,725 INFO L273 TraceCheckUtils]: 22: Hoare triple {1150#false} assume true; {1150#false} is VALID [2018-11-23 11:20:58,725 INFO L268 TraceCheckUtils]: 23: Hoare quadruple {1150#false} {1150#false} #97#return; {1150#false} is VALID [2018-11-23 11:20:58,725 INFO L273 TraceCheckUtils]: 24: Hoare triple {1150#false} assume ~len~1 != #t~ret10;havoc #t~ret10; {1150#false} is VALID [2018-11-23 11:20:58,725 INFO L273 TraceCheckUtils]: 25: Hoare triple {1150#false} assume !false; {1150#false} is VALID [2018-11-23 11:20:58,727 INFO L134 CoverageAnalysis]: Checked inductivity of 2 backedges. 0 proven. 1 refuted. 0 times theorem prover too weak. 1 trivial. 0 not checked. [2018-11-23 11:20:58,727 INFO L316 TraceCheckSpWp]: Computing backward predicates... [2018-11-23 11:20:59,057 INFO L273 TraceCheckUtils]: 25: Hoare triple {1150#false} assume !false; {1150#false} is VALID [2018-11-23 11:20:59,057 INFO L273 TraceCheckUtils]: 24: Hoare triple {1150#false} assume ~len~1 != #t~ret10;havoc #t~ret10; {1150#false} is VALID [2018-11-23 11:20:59,058 INFO L268 TraceCheckUtils]: 23: Hoare quadruple {1149#true} {1150#false} #97#return; {1150#false} is VALID [2018-11-23 11:20:59,058 INFO L273 TraceCheckUtils]: 22: Hoare triple {1149#true} assume true; {1149#true} is VALID [2018-11-23 11:20:59,058 INFO L273 TraceCheckUtils]: 21: Hoare triple {1149#true} #res := ~len~0; {1149#true} is VALID [2018-11-23 11:20:59,059 INFO L273 TraceCheckUtils]: 20: Hoare triple {1149#true} assume !(~head.base != 0bv32 || ~head.offset != 0bv32); {1149#true} is VALID [2018-11-23 11:20:59,059 INFO L273 TraceCheckUtils]: 19: Hoare triple {1149#true} assume !!(~head.base != 0bv32 || ~head.offset != 0bv32);#t~post4 := ~len~0;~len~0 := ~bvadd32(1bv32, #t~post4);havoc #t~post4;call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32);~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset;havoc #t~mem5.base, #t~mem5.offset; {1149#true} is VALID [2018-11-23 11:20:59,059 INFO L273 TraceCheckUtils]: 18: Hoare triple {1149#true} ~head.base, ~head.offset := #in~head.base, #in~head.offset;~len~0 := 0bv32; {1149#true} is VALID [2018-11-23 11:20:59,060 INFO L256 TraceCheckUtils]: 17: Hoare triple {1150#false} call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); {1149#true} is VALID [2018-11-23 11:20:59,060 INFO L273 TraceCheckUtils]: 16: Hoare triple {1150#false} ~s~0.base, ~s~0.offset := #t~ret9.base, #t~ret9.offset;havoc #t~ret9.base, #t~ret9.offset; {1150#false} is VALID [2018-11-23 11:20:59,063 INFO L268 TraceCheckUtils]: 15: Hoare quadruple {1193#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967295 32)) (_ bv0 32)))} {1263#(bvsgt main_~len~1 (_ bv0 32))} #95#return; {1150#false} is VALID [2018-11-23 11:20:59,064 INFO L273 TraceCheckUtils]: 14: Hoare triple {1193#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967295 32)) (_ bv0 32)))} assume true; {1193#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967295 32)) (_ bv0 32)))} is VALID [2018-11-23 11:20:59,064 INFO L273 TraceCheckUtils]: 13: Hoare triple {1193#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967295 32)) (_ bv0 32)))} #res.base, #res.offset := ~head~0.base, ~head~0.offset; {1193#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967295 32)) (_ bv0 32)))} is VALID [2018-11-23 11:20:59,065 INFO L273 TraceCheckUtils]: 12: Hoare triple {1276#(or (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967295 32)) (_ bv0 32))) (bvsgt sll_create_~len (_ bv0 32)))} assume !~bvsgt32(~len, 0bv32); {1193#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967295 32)) (_ bv0 32)))} is VALID [2018-11-23 11:20:59,069 INFO L273 TraceCheckUtils]: 11: Hoare triple {1280#(or (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967295 32)) (_ bv0 32))) (bvsgt (bvadd sll_create_~len (_ bv4294967295 32)) (_ bv0 32)))} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {1276#(or (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967295 32)) (_ bv0 32))) (bvsgt sll_create_~len (_ bv0 32)))} is VALID [2018-11-23 11:20:59,071 INFO L273 TraceCheckUtils]: 10: Hoare triple {1280#(or (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967295 32)) (_ bv0 32))) (bvsgt (bvadd sll_create_~len (_ bv4294967295 32)) (_ bv0 32)))} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {1280#(or (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967295 32)) (_ bv0 32))) (bvsgt (bvadd sll_create_~len (_ bv4294967295 32)) (_ bv0 32)))} is VALID [2018-11-23 11:20:59,071 INFO L273 TraceCheckUtils]: 9: Hoare triple {1280#(or (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967295 32)) (_ bv0 32))) (bvsgt (bvadd sll_create_~len (_ bv4294967295 32)) (_ bv0 32)))} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {1280#(or (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967295 32)) (_ bv0 32))) (bvsgt (bvadd sll_create_~len (_ bv4294967295 32)) (_ bv0 32)))} is VALID [2018-11-23 11:20:59,072 INFO L273 TraceCheckUtils]: 8: Hoare triple {1149#true} ~len := #in~len;~head~0.base, ~head~0.offset := 0bv32, 0bv32; {1280#(or (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967295 32)) (_ bv0 32))) (bvsgt (bvadd sll_create_~len (_ bv4294967295 32)) (_ bv0 32)))} is VALID [2018-11-23 11:20:59,072 INFO L256 TraceCheckUtils]: 7: Hoare triple {1263#(bvsgt main_~len~1 (_ bv0 32))} call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); {1149#true} is VALID [2018-11-23 11:20:59,073 INFO L273 TraceCheckUtils]: 6: Hoare triple {1263#(bvsgt main_~len~1 (_ bv0 32))} assume !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7; {1263#(bvsgt main_~len~1 (_ bv0 32))} is VALID [2018-11-23 11:20:59,073 INFO L273 TraceCheckUtils]: 5: Hoare triple {1149#true} ~len~1 := 2bv32; {1263#(bvsgt main_~len~1 (_ bv0 32))} is VALID [2018-11-23 11:20:59,073 INFO L256 TraceCheckUtils]: 4: Hoare triple {1149#true} call #t~ret11 := main(); {1149#true} is VALID [2018-11-23 11:20:59,074 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {1149#true} {1149#true} #91#return; {1149#true} is VALID [2018-11-23 11:20:59,074 INFO L273 TraceCheckUtils]: 2: Hoare triple {1149#true} assume true; {1149#true} is VALID [2018-11-23 11:20:59,074 INFO L273 TraceCheckUtils]: 1: Hoare triple {1149#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1]; {1149#true} is VALID [2018-11-23 11:20:59,074 INFO L256 TraceCheckUtils]: 0: Hoare triple {1149#true} call ULTIMATE.init(); {1149#true} is VALID [2018-11-23 11:20:59,076 INFO L134 CoverageAnalysis]: Checked inductivity of 2 backedges. 0 proven. 1 refuted. 0 times theorem prover too weak. 1 trivial. 0 not checked. [2018-11-23 11:20:59,078 INFO L312 seRefinementStrategy]: Constructing automaton from 0 perfect and 2 imperfect interpolant sequences. [2018-11-23 11:20:59,078 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [] imperfect sequences [6, 6] total 9 [2018-11-23 11:20:59,078 INFO L78 Accepts]: Start accepts. Automaton has 9 states. Word has length 26 [2018-11-23 11:20:59,079 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 11:20:59,079 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 9 states. [2018-11-23 11:20:59,145 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 42 edges. 42 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 11:20:59,145 INFO L459 AbstractCegarLoop]: Interpolant automaton has 9 states [2018-11-23 11:20:59,145 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 9 interpolants. [2018-11-23 11:20:59,146 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=20, Invalid=52, Unknown=0, NotChecked=0, Total=72 [2018-11-23 11:20:59,146 INFO L87 Difference]: Start difference. First operand 27 states and 29 transitions. Second operand 9 states. [2018-11-23 11:20:59,990 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:20:59,990 INFO L93 Difference]: Finished difference Result 53 states and 59 transitions. [2018-11-23 11:20:59,990 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 9 states. [2018-11-23 11:20:59,990 INFO L78 Accepts]: Start accepts. Automaton has 9 states. Word has length 26 [2018-11-23 11:20:59,991 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 11:20:59,991 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 9 states. [2018-11-23 11:20:59,993 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 9 states to 9 states and 57 transitions. [2018-11-23 11:20:59,994 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 9 states. [2018-11-23 11:20:59,998 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 9 states to 9 states and 57 transitions. [2018-11-23 11:20:59,998 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 9 states and 57 transitions. [2018-11-23 11:21:00,151 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 57 edges. 57 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 11:21:00,154 INFO L225 Difference]: With dead ends: 53 [2018-11-23 11:21:00,154 INFO L226 Difference]: Without dead ends: 39 [2018-11-23 11:21:00,155 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 53 GetRequests, 44 SyntacticMatches, 0 SemanticMatches, 9 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 4 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=31, Invalid=79, Unknown=0, NotChecked=0, Total=110 [2018-11-23 11:21:00,155 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 39 states. [2018-11-23 11:21:00,251 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 39 to 30. [2018-11-23 11:21:00,251 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 11:21:00,251 INFO L82 GeneralOperation]: Start isEquivalent. First operand 39 states. Second operand 30 states. [2018-11-23 11:21:00,252 INFO L74 IsIncluded]: Start isIncluded. First operand 39 states. Second operand 30 states. [2018-11-23 11:21:00,252 INFO L87 Difference]: Start difference. First operand 39 states. Second operand 30 states. [2018-11-23 11:21:00,255 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:21:00,255 INFO L93 Difference]: Finished difference Result 39 states and 43 transitions. [2018-11-23 11:21:00,255 INFO L276 IsEmpty]: Start isEmpty. Operand 39 states and 43 transitions. [2018-11-23 11:21:00,256 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 11:21:00,256 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 11:21:00,256 INFO L74 IsIncluded]: Start isIncluded. First operand 30 states. Second operand 39 states. [2018-11-23 11:21:00,257 INFO L87 Difference]: Start difference. First operand 30 states. Second operand 39 states. [2018-11-23 11:21:00,259 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:21:00,259 INFO L93 Difference]: Finished difference Result 39 states and 43 transitions. [2018-11-23 11:21:00,259 INFO L276 IsEmpty]: Start isEmpty. Operand 39 states and 43 transitions. [2018-11-23 11:21:00,260 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 11:21:00,260 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 11:21:00,261 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 11:21:00,261 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 11:21:00,261 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 30 states. [2018-11-23 11:21:00,262 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 30 states to 30 states and 32 transitions. [2018-11-23 11:21:00,262 INFO L78 Accepts]: Start accepts. Automaton has 30 states and 32 transitions. Word has length 26 [2018-11-23 11:21:00,263 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 11:21:00,263 INFO L480 AbstractCegarLoop]: Abstraction has 30 states and 32 transitions. [2018-11-23 11:21:00,263 INFO L481 AbstractCegarLoop]: Interpolant automaton has 9 states. [2018-11-23 11:21:00,263 INFO L276 IsEmpty]: Start isEmpty. Operand 30 states and 32 transitions. [2018-11-23 11:21:00,264 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 30 [2018-11-23 11:21:00,264 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 11:21:00,264 INFO L402 BasicCegarLoop]: trace histogram [2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 11:21:00,265 INFO L423 AbstractCegarLoop]: === Iteration 6 === [mainErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 11:21:00,265 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 11:21:00,265 INFO L82 PathProgramCache]: Analyzing trace with hash 625972540, now seen corresponding path program 2 times [2018-11-23 11:21:00,265 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 11:21:00,266 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 7 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 7 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 11:21:00,289 INFO L101 rtionOrderModulation]: Changing assertion order to OUTSIDE_LOOP_FIRST1 [2018-11-23 11:21:00,353 INFO L249 tOrderPrioritization]: Assert order OUTSIDE_LOOP_FIRST1 issued 2 check-sat command(s) [2018-11-23 11:21:00,353 INFO L250 tOrderPrioritization]: Conjunction of SSA is unsat [2018-11-23 11:21:00,369 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 11:21:00,371 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 11:21:00,526 INFO L256 TraceCheckUtils]: 0: Hoare triple {1517#true} call ULTIMATE.init(); {1517#true} is VALID [2018-11-23 11:21:00,526 INFO L273 TraceCheckUtils]: 1: Hoare triple {1517#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1]; {1517#true} is VALID [2018-11-23 11:21:00,526 INFO L273 TraceCheckUtils]: 2: Hoare triple {1517#true} assume true; {1517#true} is VALID [2018-11-23 11:21:00,526 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {1517#true} {1517#true} #91#return; {1517#true} is VALID [2018-11-23 11:21:00,527 INFO L256 TraceCheckUtils]: 4: Hoare triple {1517#true} call #t~ret11 := main(); {1517#true} is VALID [2018-11-23 11:21:00,527 INFO L273 TraceCheckUtils]: 5: Hoare triple {1517#true} ~len~1 := 2bv32; {1537#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:00,528 INFO L273 TraceCheckUtils]: 6: Hoare triple {1537#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} assume !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7; {1537#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:00,528 INFO L256 TraceCheckUtils]: 7: Hoare triple {1537#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); {1517#true} is VALID [2018-11-23 11:21:00,529 INFO L273 TraceCheckUtils]: 8: Hoare triple {1517#true} ~len := #in~len;~head~0.base, ~head~0.offset := 0bv32, 0bv32; {1547#(= |sll_create_#in~len| sll_create_~len)} is VALID [2018-11-23 11:21:00,529 INFO L273 TraceCheckUtils]: 9: Hoare triple {1547#(= |sll_create_#in~len| sll_create_~len)} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {1547#(= |sll_create_#in~len| sll_create_~len)} is VALID [2018-11-23 11:21:00,530 INFO L273 TraceCheckUtils]: 10: Hoare triple {1547#(= |sll_create_#in~len| sll_create_~len)} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {1547#(= |sll_create_#in~len| sll_create_~len)} is VALID [2018-11-23 11:21:00,530 INFO L273 TraceCheckUtils]: 11: Hoare triple {1547#(= |sll_create_#in~len| sll_create_~len)} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {1557#(= (bvadd |sll_create_#in~len| (_ bv4294967295 32)) sll_create_~len)} is VALID [2018-11-23 11:21:00,531 INFO L273 TraceCheckUtils]: 12: Hoare triple {1557#(= (bvadd |sll_create_#in~len| (_ bv4294967295 32)) sll_create_~len)} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {1557#(= (bvadd |sll_create_#in~len| (_ bv4294967295 32)) sll_create_~len)} is VALID [2018-11-23 11:21:00,532 INFO L273 TraceCheckUtils]: 13: Hoare triple {1557#(= (bvadd |sll_create_#in~len| (_ bv4294967295 32)) sll_create_~len)} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {1557#(= (bvadd |sll_create_#in~len| (_ bv4294967295 32)) sll_create_~len)} is VALID [2018-11-23 11:21:00,555 INFO L273 TraceCheckUtils]: 14: Hoare triple {1557#(= (bvadd |sll_create_#in~len| (_ bv4294967295 32)) sll_create_~len)} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {1567#(= (bvadd |sll_create_#in~len| (_ bv4294967294 32)) sll_create_~len)} is VALID [2018-11-23 11:21:00,557 INFO L273 TraceCheckUtils]: 15: Hoare triple {1567#(= (bvadd |sll_create_#in~len| (_ bv4294967294 32)) sll_create_~len)} assume !~bvsgt32(~len, 0bv32); {1571#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} is VALID [2018-11-23 11:21:00,557 INFO L273 TraceCheckUtils]: 16: Hoare triple {1571#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} #res.base, #res.offset := ~head~0.base, ~head~0.offset; {1571#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} is VALID [2018-11-23 11:21:00,558 INFO L273 TraceCheckUtils]: 17: Hoare triple {1571#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} assume true; {1571#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} is VALID [2018-11-23 11:21:00,559 INFO L268 TraceCheckUtils]: 18: Hoare quadruple {1571#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} {1537#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} #95#return; {1518#false} is VALID [2018-11-23 11:21:00,559 INFO L273 TraceCheckUtils]: 19: Hoare triple {1518#false} ~s~0.base, ~s~0.offset := #t~ret9.base, #t~ret9.offset;havoc #t~ret9.base, #t~ret9.offset; {1518#false} is VALID [2018-11-23 11:21:00,560 INFO L256 TraceCheckUtils]: 20: Hoare triple {1518#false} call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); {1518#false} is VALID [2018-11-23 11:21:00,560 INFO L273 TraceCheckUtils]: 21: Hoare triple {1518#false} ~head.base, ~head.offset := #in~head.base, #in~head.offset;~len~0 := 0bv32; {1518#false} is VALID [2018-11-23 11:21:00,561 INFO L273 TraceCheckUtils]: 22: Hoare triple {1518#false} assume !!(~head.base != 0bv32 || ~head.offset != 0bv32);#t~post4 := ~len~0;~len~0 := ~bvadd32(1bv32, #t~post4);havoc #t~post4;call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32);~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset;havoc #t~mem5.base, #t~mem5.offset; {1518#false} is VALID [2018-11-23 11:21:00,561 INFO L273 TraceCheckUtils]: 23: Hoare triple {1518#false} assume !(~head.base != 0bv32 || ~head.offset != 0bv32); {1518#false} is VALID [2018-11-23 11:21:00,561 INFO L273 TraceCheckUtils]: 24: Hoare triple {1518#false} #res := ~len~0; {1518#false} is VALID [2018-11-23 11:21:00,562 INFO L273 TraceCheckUtils]: 25: Hoare triple {1518#false} assume true; {1518#false} is VALID [2018-11-23 11:21:00,562 INFO L268 TraceCheckUtils]: 26: Hoare quadruple {1518#false} {1518#false} #97#return; {1518#false} is VALID [2018-11-23 11:21:00,562 INFO L273 TraceCheckUtils]: 27: Hoare triple {1518#false} assume ~len~1 != #t~ret10;havoc #t~ret10; {1518#false} is VALID [2018-11-23 11:21:00,562 INFO L273 TraceCheckUtils]: 28: Hoare triple {1518#false} assume !false; {1518#false} is VALID [2018-11-23 11:21:00,564 INFO L134 CoverageAnalysis]: Checked inductivity of 6 backedges. 0 proven. 5 refuted. 0 times theorem prover too weak. 1 trivial. 0 not checked. [2018-11-23 11:21:00,564 INFO L316 TraceCheckSpWp]: Computing backward predicates... [2018-11-23 11:21:01,065 INFO L273 TraceCheckUtils]: 28: Hoare triple {1518#false} assume !false; {1518#false} is VALID [2018-11-23 11:21:01,065 INFO L273 TraceCheckUtils]: 27: Hoare triple {1518#false} assume ~len~1 != #t~ret10;havoc #t~ret10; {1518#false} is VALID [2018-11-23 11:21:01,065 INFO L268 TraceCheckUtils]: 26: Hoare quadruple {1517#true} {1518#false} #97#return; {1518#false} is VALID [2018-11-23 11:21:01,066 INFO L273 TraceCheckUtils]: 25: Hoare triple {1517#true} assume true; {1517#true} is VALID [2018-11-23 11:21:01,066 INFO L273 TraceCheckUtils]: 24: Hoare triple {1517#true} #res := ~len~0; {1517#true} is VALID [2018-11-23 11:21:01,066 INFO L273 TraceCheckUtils]: 23: Hoare triple {1517#true} assume !(~head.base != 0bv32 || ~head.offset != 0bv32); {1517#true} is VALID [2018-11-23 11:21:01,066 INFO L273 TraceCheckUtils]: 22: Hoare triple {1517#true} assume !!(~head.base != 0bv32 || ~head.offset != 0bv32);#t~post4 := ~len~0;~len~0 := ~bvadd32(1bv32, #t~post4);havoc #t~post4;call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32);~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset;havoc #t~mem5.base, #t~mem5.offset; {1517#true} is VALID [2018-11-23 11:21:01,066 INFO L273 TraceCheckUtils]: 21: Hoare triple {1517#true} ~head.base, ~head.offset := #in~head.base, #in~head.offset;~len~0 := 0bv32; {1517#true} is VALID [2018-11-23 11:21:01,066 INFO L256 TraceCheckUtils]: 20: Hoare triple {1518#false} call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); {1517#true} is VALID [2018-11-23 11:21:01,067 INFO L273 TraceCheckUtils]: 19: Hoare triple {1518#false} ~s~0.base, ~s~0.offset := #t~ret9.base, #t~ret9.offset;havoc #t~ret9.base, #t~ret9.offset; {1518#false} is VALID [2018-11-23 11:21:01,086 INFO L268 TraceCheckUtils]: 18: Hoare quadruple {1571#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} {1641#(bvsgt (bvadd main_~len~1 (_ bv4294967295 32)) (_ bv0 32))} #95#return; {1518#false} is VALID [2018-11-23 11:21:01,101 INFO L273 TraceCheckUtils]: 17: Hoare triple {1571#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} assume true; {1571#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} is VALID [2018-11-23 11:21:01,109 INFO L273 TraceCheckUtils]: 16: Hoare triple {1571#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} #res.base, #res.offset := ~head~0.base, ~head~0.offset; {1571#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} is VALID [2018-11-23 11:21:01,114 INFO L273 TraceCheckUtils]: 15: Hoare triple {1654#(or (bvsgt sll_create_~len (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} assume !~bvsgt32(~len, 0bv32); {1571#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} is VALID [2018-11-23 11:21:01,118 INFO L273 TraceCheckUtils]: 14: Hoare triple {1658#(or (bvsgt (bvadd sll_create_~len (_ bv4294967295 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {1654#(or (bvsgt sll_create_~len (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} is VALID [2018-11-23 11:21:01,119 INFO L273 TraceCheckUtils]: 13: Hoare triple {1658#(or (bvsgt (bvadd sll_create_~len (_ bv4294967295 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {1658#(or (bvsgt (bvadd sll_create_~len (_ bv4294967295 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} is VALID [2018-11-23 11:21:01,119 INFO L273 TraceCheckUtils]: 12: Hoare triple {1658#(or (bvsgt (bvadd sll_create_~len (_ bv4294967295 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {1658#(or (bvsgt (bvadd sll_create_~len (_ bv4294967295 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} is VALID [2018-11-23 11:21:01,125 INFO L273 TraceCheckUtils]: 11: Hoare triple {1668#(or (bvsgt (bvadd sll_create_~len (_ bv4294967294 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {1658#(or (bvsgt (bvadd sll_create_~len (_ bv4294967295 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} is VALID [2018-11-23 11:21:01,126 INFO L273 TraceCheckUtils]: 10: Hoare triple {1668#(or (bvsgt (bvadd sll_create_~len (_ bv4294967294 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {1668#(or (bvsgt (bvadd sll_create_~len (_ bv4294967294 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} is VALID [2018-11-23 11:21:01,126 INFO L273 TraceCheckUtils]: 9: Hoare triple {1668#(or (bvsgt (bvadd sll_create_~len (_ bv4294967294 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {1668#(or (bvsgt (bvadd sll_create_~len (_ bv4294967294 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} is VALID [2018-11-23 11:21:01,126 INFO L273 TraceCheckUtils]: 8: Hoare triple {1517#true} ~len := #in~len;~head~0.base, ~head~0.offset := 0bv32, 0bv32; {1668#(or (bvsgt (bvadd sll_create_~len (_ bv4294967294 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} is VALID [2018-11-23 11:21:01,127 INFO L256 TraceCheckUtils]: 7: Hoare triple {1641#(bvsgt (bvadd main_~len~1 (_ bv4294967295 32)) (_ bv0 32))} call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); {1517#true} is VALID [2018-11-23 11:21:01,128 INFO L273 TraceCheckUtils]: 6: Hoare triple {1641#(bvsgt (bvadd main_~len~1 (_ bv4294967295 32)) (_ bv0 32))} assume !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7; {1641#(bvsgt (bvadd main_~len~1 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:01,128 INFO L273 TraceCheckUtils]: 5: Hoare triple {1517#true} ~len~1 := 2bv32; {1641#(bvsgt (bvadd main_~len~1 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:01,128 INFO L256 TraceCheckUtils]: 4: Hoare triple {1517#true} call #t~ret11 := main(); {1517#true} is VALID [2018-11-23 11:21:01,128 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {1517#true} {1517#true} #91#return; {1517#true} is VALID [2018-11-23 11:21:01,129 INFO L273 TraceCheckUtils]: 2: Hoare triple {1517#true} assume true; {1517#true} is VALID [2018-11-23 11:21:01,129 INFO L273 TraceCheckUtils]: 1: Hoare triple {1517#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1]; {1517#true} is VALID [2018-11-23 11:21:01,129 INFO L256 TraceCheckUtils]: 0: Hoare triple {1517#true} call ULTIMATE.init(); {1517#true} is VALID [2018-11-23 11:21:01,131 INFO L134 CoverageAnalysis]: Checked inductivity of 6 backedges. 0 proven. 5 refuted. 0 times theorem prover too weak. 1 trivial. 0 not checked. [2018-11-23 11:21:01,133 INFO L312 seRefinementStrategy]: Constructing automaton from 0 perfect and 2 imperfect interpolant sequences. [2018-11-23 11:21:01,133 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [] imperfect sequences [7, 7] total 11 [2018-11-23 11:21:01,133 INFO L78 Accepts]: Start accepts. Automaton has 11 states. Word has length 29 [2018-11-23 11:21:01,134 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 11:21:01,134 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 11 states. [2018-11-23 11:21:01,232 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 48 edges. 48 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 11:21:01,232 INFO L459 AbstractCegarLoop]: Interpolant automaton has 11 states [2018-11-23 11:21:01,232 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 11 interpolants. [2018-11-23 11:21:01,232 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=26, Invalid=84, Unknown=0, NotChecked=0, Total=110 [2018-11-23 11:21:01,233 INFO L87 Difference]: Start difference. First operand 30 states and 32 transitions. Second operand 11 states. [2018-11-23 11:21:02,612 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:21:02,612 INFO L93 Difference]: Finished difference Result 63 states and 72 transitions. [2018-11-23 11:21:02,612 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 10 states. [2018-11-23 11:21:02,613 INFO L78 Accepts]: Start accepts. Automaton has 11 states. Word has length 29 [2018-11-23 11:21:02,613 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 11:21:02,613 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 11 states. [2018-11-23 11:21:02,616 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 10 states to 10 states and 70 transitions. [2018-11-23 11:21:02,616 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 11 states. [2018-11-23 11:21:02,618 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 10 states to 10 states and 70 transitions. [2018-11-23 11:21:02,618 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 10 states and 70 transitions. [2018-11-23 11:21:02,843 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 70 edges. 70 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 11:21:02,845 INFO L225 Difference]: With dead ends: 63 [2018-11-23 11:21:02,845 INFO L226 Difference]: Without dead ends: 52 [2018-11-23 11:21:02,846 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 60 GetRequests, 48 SyntacticMatches, 0 SemanticMatches, 12 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 9 ImplicationChecksByTransitivity, 0.4s TimeCoverageRelationStatistics Valid=44, Invalid=138, Unknown=0, NotChecked=0, Total=182 [2018-11-23 11:21:02,846 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 52 states. [2018-11-23 11:21:02,903 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 52 to 39. [2018-11-23 11:21:02,903 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 11:21:02,903 INFO L82 GeneralOperation]: Start isEquivalent. First operand 52 states. Second operand 39 states. [2018-11-23 11:21:02,903 INFO L74 IsIncluded]: Start isIncluded. First operand 52 states. Second operand 39 states. [2018-11-23 11:21:02,903 INFO L87 Difference]: Start difference. First operand 52 states. Second operand 39 states. [2018-11-23 11:21:02,906 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:21:02,906 INFO L93 Difference]: Finished difference Result 52 states and 59 transitions. [2018-11-23 11:21:02,906 INFO L276 IsEmpty]: Start isEmpty. Operand 52 states and 59 transitions. [2018-11-23 11:21:02,906 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 11:21:02,906 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 11:21:02,907 INFO L74 IsIncluded]: Start isIncluded. First operand 39 states. Second operand 52 states. [2018-11-23 11:21:02,907 INFO L87 Difference]: Start difference. First operand 39 states. Second operand 52 states. [2018-11-23 11:21:02,910 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:21:02,910 INFO L93 Difference]: Finished difference Result 52 states and 59 transitions. [2018-11-23 11:21:02,911 INFO L276 IsEmpty]: Start isEmpty. Operand 52 states and 59 transitions. [2018-11-23 11:21:02,911 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 11:21:02,911 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 11:21:02,911 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 11:21:02,911 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 11:21:02,912 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 39 states. [2018-11-23 11:21:02,913 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 39 states to 39 states and 45 transitions. [2018-11-23 11:21:02,913 INFO L78 Accepts]: Start accepts. Automaton has 39 states and 45 transitions. Word has length 29 [2018-11-23 11:21:02,914 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 11:21:02,914 INFO L480 AbstractCegarLoop]: Abstraction has 39 states and 45 transitions. [2018-11-23 11:21:02,914 INFO L481 AbstractCegarLoop]: Interpolant automaton has 11 states. [2018-11-23 11:21:02,914 INFO L276 IsEmpty]: Start isEmpty. Operand 39 states and 45 transitions. [2018-11-23 11:21:02,915 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 32 [2018-11-23 11:21:02,915 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 11:21:02,915 INFO L402 BasicCegarLoop]: trace histogram [2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 11:21:02,915 INFO L423 AbstractCegarLoop]: === Iteration 7 === [mainErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 11:21:02,915 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 11:21:02,915 INFO L82 PathProgramCache]: Analyzing trace with hash -1758530756, now seen corresponding path program 1 times [2018-11-23 11:21:02,916 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 11:21:02,916 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 8 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 8 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 11:21:02,936 INFO L101 rtionOrderModulation]: Changing assertion order to NOT_INCREMENTALLY [2018-11-23 11:21:02,987 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 11:21:03,010 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 11:21:03,011 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 11:21:03,169 INFO L256 TraceCheckUtils]: 0: Hoare triple {1961#true} call ULTIMATE.init(); {1961#true} is VALID [2018-11-23 11:21:03,169 INFO L273 TraceCheckUtils]: 1: Hoare triple {1961#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1]; {1961#true} is VALID [2018-11-23 11:21:03,169 INFO L273 TraceCheckUtils]: 2: Hoare triple {1961#true} assume true; {1961#true} is VALID [2018-11-23 11:21:03,169 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {1961#true} {1961#true} #91#return; {1961#true} is VALID [2018-11-23 11:21:03,170 INFO L256 TraceCheckUtils]: 4: Hoare triple {1961#true} call #t~ret11 := main(); {1961#true} is VALID [2018-11-23 11:21:03,170 INFO L273 TraceCheckUtils]: 5: Hoare triple {1961#true} ~len~1 := 2bv32; {1981#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:03,171 INFO L273 TraceCheckUtils]: 6: Hoare triple {1981#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} assume !!(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7;#t~post8 := ~len~1;~len~1 := ~bvadd32(1bv32, #t~post8);havoc #t~post8; {1985#(= (bvadd main_~len~1 (_ bv4294967293 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:03,171 INFO L273 TraceCheckUtils]: 7: Hoare triple {1985#(= (bvadd main_~len~1 (_ bv4294967293 32)) (_ bv0 32))} assume !!(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7;#t~post8 := ~len~1;~len~1 := ~bvadd32(1bv32, #t~post8);havoc #t~post8; {1989#(= (bvadd main_~len~1 (_ bv4294967292 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:03,172 INFO L273 TraceCheckUtils]: 8: Hoare triple {1989#(= (bvadd main_~len~1 (_ bv4294967292 32)) (_ bv0 32))} assume !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7; {1989#(= (bvadd main_~len~1 (_ bv4294967292 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:03,172 INFO L256 TraceCheckUtils]: 9: Hoare triple {1989#(= (bvadd main_~len~1 (_ bv4294967292 32)) (_ bv0 32))} call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); {1961#true} is VALID [2018-11-23 11:21:03,172 INFO L273 TraceCheckUtils]: 10: Hoare triple {1961#true} ~len := #in~len;~head~0.base, ~head~0.offset := 0bv32, 0bv32; {1999#(= |sll_create_#in~len| sll_create_~len)} is VALID [2018-11-23 11:21:03,173 INFO L273 TraceCheckUtils]: 11: Hoare triple {1999#(= |sll_create_#in~len| sll_create_~len)} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {1999#(= |sll_create_#in~len| sll_create_~len)} is VALID [2018-11-23 11:21:03,173 INFO L273 TraceCheckUtils]: 12: Hoare triple {1999#(= |sll_create_#in~len| sll_create_~len)} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {1999#(= |sll_create_#in~len| sll_create_~len)} is VALID [2018-11-23 11:21:03,174 INFO L273 TraceCheckUtils]: 13: Hoare triple {1999#(= |sll_create_#in~len| sll_create_~len)} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {2009#(= (bvadd |sll_create_#in~len| (_ bv4294967295 32)) sll_create_~len)} is VALID [2018-11-23 11:21:03,174 INFO L273 TraceCheckUtils]: 14: Hoare triple {2009#(= (bvadd |sll_create_#in~len| (_ bv4294967295 32)) sll_create_~len)} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {2009#(= (bvadd |sll_create_#in~len| (_ bv4294967295 32)) sll_create_~len)} is VALID [2018-11-23 11:21:03,174 INFO L273 TraceCheckUtils]: 15: Hoare triple {2009#(= (bvadd |sll_create_#in~len| (_ bv4294967295 32)) sll_create_~len)} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {2009#(= (bvadd |sll_create_#in~len| (_ bv4294967295 32)) sll_create_~len)} is VALID [2018-11-23 11:21:03,199 INFO L273 TraceCheckUtils]: 16: Hoare triple {2009#(= (bvadd |sll_create_#in~len| (_ bv4294967295 32)) sll_create_~len)} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {2019#(= (bvadd |sll_create_#in~len| (_ bv4294967294 32)) sll_create_~len)} is VALID [2018-11-23 11:21:03,202 INFO L273 TraceCheckUtils]: 17: Hoare triple {2019#(= (bvadd |sll_create_#in~len| (_ bv4294967294 32)) sll_create_~len)} assume !~bvsgt32(~len, 0bv32); {2023#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} is VALID [2018-11-23 11:21:03,202 INFO L273 TraceCheckUtils]: 18: Hoare triple {2023#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} #res.base, #res.offset := ~head~0.base, ~head~0.offset; {2023#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} is VALID [2018-11-23 11:21:03,203 INFO L273 TraceCheckUtils]: 19: Hoare triple {2023#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} assume true; {2023#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} is VALID [2018-11-23 11:21:03,204 INFO L268 TraceCheckUtils]: 20: Hoare quadruple {2023#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} {1989#(= (bvadd main_~len~1 (_ bv4294967292 32)) (_ bv0 32))} #95#return; {1962#false} is VALID [2018-11-23 11:21:03,205 INFO L273 TraceCheckUtils]: 21: Hoare triple {1962#false} ~s~0.base, ~s~0.offset := #t~ret9.base, #t~ret9.offset;havoc #t~ret9.base, #t~ret9.offset; {1962#false} is VALID [2018-11-23 11:21:03,205 INFO L256 TraceCheckUtils]: 22: Hoare triple {1962#false} call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); {1962#false} is VALID [2018-11-23 11:21:03,205 INFO L273 TraceCheckUtils]: 23: Hoare triple {1962#false} ~head.base, ~head.offset := #in~head.base, #in~head.offset;~len~0 := 0bv32; {1962#false} is VALID [2018-11-23 11:21:03,206 INFO L273 TraceCheckUtils]: 24: Hoare triple {1962#false} assume !!(~head.base != 0bv32 || ~head.offset != 0bv32);#t~post4 := ~len~0;~len~0 := ~bvadd32(1bv32, #t~post4);havoc #t~post4;call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32);~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset;havoc #t~mem5.base, #t~mem5.offset; {1962#false} is VALID [2018-11-23 11:21:03,206 INFO L273 TraceCheckUtils]: 25: Hoare triple {1962#false} assume !(~head.base != 0bv32 || ~head.offset != 0bv32); {1962#false} is VALID [2018-11-23 11:21:03,206 INFO L273 TraceCheckUtils]: 26: Hoare triple {1962#false} #res := ~len~0; {1962#false} is VALID [2018-11-23 11:21:03,207 INFO L273 TraceCheckUtils]: 27: Hoare triple {1962#false} assume true; {1962#false} is VALID [2018-11-23 11:21:03,207 INFO L268 TraceCheckUtils]: 28: Hoare quadruple {1962#false} {1962#false} #97#return; {1962#false} is VALID [2018-11-23 11:21:03,207 INFO L273 TraceCheckUtils]: 29: Hoare triple {1962#false} assume ~len~1 != #t~ret10;havoc #t~ret10; {1962#false} is VALID [2018-11-23 11:21:03,208 INFO L273 TraceCheckUtils]: 30: Hoare triple {1962#false} assume !false; {1962#false} is VALID [2018-11-23 11:21:03,209 INFO L134 CoverageAnalysis]: Checked inductivity of 9 backedges. 0 proven. 8 refuted. 0 times theorem prover too weak. 1 trivial. 0 not checked. [2018-11-23 11:21:03,209 INFO L316 TraceCheckSpWp]: Computing backward predicates... [2018-11-23 11:21:03,802 INFO L273 TraceCheckUtils]: 30: Hoare triple {1962#false} assume !false; {1962#false} is VALID [2018-11-23 11:21:03,802 INFO L273 TraceCheckUtils]: 29: Hoare triple {1962#false} assume ~len~1 != #t~ret10;havoc #t~ret10; {1962#false} is VALID [2018-11-23 11:21:03,802 INFO L268 TraceCheckUtils]: 28: Hoare quadruple {1961#true} {1962#false} #97#return; {1962#false} is VALID [2018-11-23 11:21:03,802 INFO L273 TraceCheckUtils]: 27: Hoare triple {1961#true} assume true; {1961#true} is VALID [2018-11-23 11:21:03,803 INFO L273 TraceCheckUtils]: 26: Hoare triple {1961#true} #res := ~len~0; {1961#true} is VALID [2018-11-23 11:21:03,803 INFO L273 TraceCheckUtils]: 25: Hoare triple {1961#true} assume !(~head.base != 0bv32 || ~head.offset != 0bv32); {1961#true} is VALID [2018-11-23 11:21:03,803 INFO L273 TraceCheckUtils]: 24: Hoare triple {1961#true} assume !!(~head.base != 0bv32 || ~head.offset != 0bv32);#t~post4 := ~len~0;~len~0 := ~bvadd32(1bv32, #t~post4);havoc #t~post4;call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32);~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset;havoc #t~mem5.base, #t~mem5.offset; {1961#true} is VALID [2018-11-23 11:21:03,803 INFO L273 TraceCheckUtils]: 23: Hoare triple {1961#true} ~head.base, ~head.offset := #in~head.base, #in~head.offset;~len~0 := 0bv32; {1961#true} is VALID [2018-11-23 11:21:03,803 INFO L256 TraceCheckUtils]: 22: Hoare triple {1962#false} call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); {1961#true} is VALID [2018-11-23 11:21:03,803 INFO L273 TraceCheckUtils]: 21: Hoare triple {1962#false} ~s~0.base, ~s~0.offset := #t~ret9.base, #t~ret9.offset;havoc #t~ret9.base, #t~ret9.offset; {1962#false} is VALID [2018-11-23 11:21:03,807 INFO L268 TraceCheckUtils]: 20: Hoare quadruple {2023#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} {2093#(bvsgt (bvadd main_~len~1 (_ bv4294967295 32)) (_ bv0 32))} #95#return; {1962#false} is VALID [2018-11-23 11:21:03,808 INFO L273 TraceCheckUtils]: 19: Hoare triple {2023#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} assume true; {2023#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} is VALID [2018-11-23 11:21:03,808 INFO L273 TraceCheckUtils]: 18: Hoare triple {2023#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} #res.base, #res.offset := ~head~0.base, ~head~0.offset; {2023#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} is VALID [2018-11-23 11:21:03,808 INFO L273 TraceCheckUtils]: 17: Hoare triple {2106#(or (bvsgt sll_create_~len (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} assume !~bvsgt32(~len, 0bv32); {2023#(not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32)))} is VALID [2018-11-23 11:21:03,813 INFO L273 TraceCheckUtils]: 16: Hoare triple {2110#(or (bvsgt (bvadd sll_create_~len (_ bv4294967295 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {2106#(or (bvsgt sll_create_~len (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} is VALID [2018-11-23 11:21:03,813 INFO L273 TraceCheckUtils]: 15: Hoare triple {2110#(or (bvsgt (bvadd sll_create_~len (_ bv4294967295 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {2110#(or (bvsgt (bvadd sll_create_~len (_ bv4294967295 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} is VALID [2018-11-23 11:21:03,813 INFO L273 TraceCheckUtils]: 14: Hoare triple {2110#(or (bvsgt (bvadd sll_create_~len (_ bv4294967295 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {2110#(or (bvsgt (bvadd sll_create_~len (_ bv4294967295 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} is VALID [2018-11-23 11:21:03,820 INFO L273 TraceCheckUtils]: 13: Hoare triple {2120#(or (bvsgt (bvadd sll_create_~len (_ bv4294967294 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {2110#(or (bvsgt (bvadd sll_create_~len (_ bv4294967295 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} is VALID [2018-11-23 11:21:03,820 INFO L273 TraceCheckUtils]: 12: Hoare triple {2120#(or (bvsgt (bvadd sll_create_~len (_ bv4294967294 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {2120#(or (bvsgt (bvadd sll_create_~len (_ bv4294967294 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} is VALID [2018-11-23 11:21:03,821 INFO L273 TraceCheckUtils]: 11: Hoare triple {2120#(or (bvsgt (bvadd sll_create_~len (_ bv4294967294 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {2120#(or (bvsgt (bvadd sll_create_~len (_ bv4294967294 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} is VALID [2018-11-23 11:21:03,821 INFO L273 TraceCheckUtils]: 10: Hoare triple {1961#true} ~len := #in~len;~head~0.base, ~head~0.offset := 0bv32, 0bv32; {2120#(or (bvsgt (bvadd sll_create_~len (_ bv4294967294 32)) (_ bv0 32)) (not (bvsgt (bvadd |sll_create_#in~len| (_ bv4294967294 32)) (_ bv0 32))))} is VALID [2018-11-23 11:21:03,821 INFO L256 TraceCheckUtils]: 9: Hoare triple {2093#(bvsgt (bvadd main_~len~1 (_ bv4294967295 32)) (_ bv0 32))} call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); {1961#true} is VALID [2018-11-23 11:21:03,822 INFO L273 TraceCheckUtils]: 8: Hoare triple {2093#(bvsgt (bvadd main_~len~1 (_ bv4294967295 32)) (_ bv0 32))} assume !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7; {2093#(bvsgt (bvadd main_~len~1 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:03,825 INFO L273 TraceCheckUtils]: 7: Hoare triple {2136#(bvsgt main_~len~1 (_ bv0 32))} assume !!(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7;#t~post8 := ~len~1;~len~1 := ~bvadd32(1bv32, #t~post8);havoc #t~post8; {2093#(bvsgt (bvadd main_~len~1 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:03,825 INFO L273 TraceCheckUtils]: 6: Hoare triple {2140#(bvsgt (bvadd main_~len~1 (_ bv1 32)) (_ bv0 32))} assume !!(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7;#t~post8 := ~len~1;~len~1 := ~bvadd32(1bv32, #t~post8);havoc #t~post8; {2136#(bvsgt main_~len~1 (_ bv0 32))} is VALID [2018-11-23 11:21:03,826 INFO L273 TraceCheckUtils]: 5: Hoare triple {1961#true} ~len~1 := 2bv32; {2140#(bvsgt (bvadd main_~len~1 (_ bv1 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:03,826 INFO L256 TraceCheckUtils]: 4: Hoare triple {1961#true} call #t~ret11 := main(); {1961#true} is VALID [2018-11-23 11:21:03,826 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {1961#true} {1961#true} #91#return; {1961#true} is VALID [2018-11-23 11:21:03,826 INFO L273 TraceCheckUtils]: 2: Hoare triple {1961#true} assume true; {1961#true} is VALID [2018-11-23 11:21:03,827 INFO L273 TraceCheckUtils]: 1: Hoare triple {1961#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1]; {1961#true} is VALID [2018-11-23 11:21:03,827 INFO L256 TraceCheckUtils]: 0: Hoare triple {1961#true} call ULTIMATE.init(); {1961#true} is VALID [2018-11-23 11:21:03,828 INFO L134 CoverageAnalysis]: Checked inductivity of 9 backedges. 0 proven. 8 refuted. 0 times theorem prover too weak. 1 trivial. 0 not checked. [2018-11-23 11:21:03,830 INFO L312 seRefinementStrategy]: Constructing automaton from 0 perfect and 2 imperfect interpolant sequences. [2018-11-23 11:21:03,830 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [] imperfect sequences [9, 9] total 15 [2018-11-23 11:21:03,830 INFO L78 Accepts]: Start accepts. Automaton has 15 states. Word has length 31 [2018-11-23 11:21:03,831 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 11:21:03,831 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 15 states. [2018-11-23 11:21:03,945 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 52 edges. 52 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 11:21:03,945 INFO L459 AbstractCegarLoop]: Interpolant automaton has 15 states [2018-11-23 11:21:03,945 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 15 interpolants. [2018-11-23 11:21:03,946 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=42, Invalid=168, Unknown=0, NotChecked=0, Total=210 [2018-11-23 11:21:03,946 INFO L87 Difference]: Start difference. First operand 39 states and 45 transitions. Second operand 15 states. [2018-11-23 11:21:06,306 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:21:06,307 INFO L93 Difference]: Finished difference Result 70 states and 80 transitions. [2018-11-23 11:21:06,307 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 12 states. [2018-11-23 11:21:06,307 INFO L78 Accepts]: Start accepts. Automaton has 15 states. Word has length 31 [2018-11-23 11:21:06,307 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 11:21:06,307 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 15 states. [2018-11-23 11:21:06,310 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 12 states to 12 states and 78 transitions. [2018-11-23 11:21:06,310 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 15 states. [2018-11-23 11:21:06,312 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 12 states to 12 states and 78 transitions. [2018-11-23 11:21:06,313 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 12 states and 78 transitions. [2018-11-23 11:21:06,458 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 78 edges. 78 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 11:21:06,460 INFO L225 Difference]: With dead ends: 70 [2018-11-23 11:21:06,460 INFO L226 Difference]: Without dead ends: 56 [2018-11-23 11:21:06,461 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 65 GetRequests, 48 SyntacticMatches, 0 SemanticMatches, 17 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 18 ImplicationChecksByTransitivity, 0.5s TimeCoverageRelationStatistics Valid=68, Invalid=274, Unknown=0, NotChecked=0, Total=342 [2018-11-23 11:21:06,461 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 56 states. [2018-11-23 11:21:06,487 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 56 to 33. [2018-11-23 11:21:06,487 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 11:21:06,487 INFO L82 GeneralOperation]: Start isEquivalent. First operand 56 states. Second operand 33 states. [2018-11-23 11:21:06,487 INFO L74 IsIncluded]: Start isIncluded. First operand 56 states. Second operand 33 states. [2018-11-23 11:21:06,487 INFO L87 Difference]: Start difference. First operand 56 states. Second operand 33 states. [2018-11-23 11:21:06,490 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:21:06,490 INFO L93 Difference]: Finished difference Result 56 states and 64 transitions. [2018-11-23 11:21:06,490 INFO L276 IsEmpty]: Start isEmpty. Operand 56 states and 64 transitions. [2018-11-23 11:21:06,491 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 11:21:06,491 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 11:21:06,491 INFO L74 IsIncluded]: Start isIncluded. First operand 33 states. Second operand 56 states. [2018-11-23 11:21:06,491 INFO L87 Difference]: Start difference. First operand 33 states. Second operand 56 states. [2018-11-23 11:21:06,494 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:21:06,494 INFO L93 Difference]: Finished difference Result 56 states and 64 transitions. [2018-11-23 11:21:06,494 INFO L276 IsEmpty]: Start isEmpty. Operand 56 states and 64 transitions. [2018-11-23 11:21:06,494 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 11:21:06,495 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 11:21:06,495 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 11:21:06,495 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 11:21:06,495 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 33 states. [2018-11-23 11:21:06,496 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 33 states to 33 states and 35 transitions. [2018-11-23 11:21:06,496 INFO L78 Accepts]: Start accepts. Automaton has 33 states and 35 transitions. Word has length 31 [2018-11-23 11:21:06,496 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 11:21:06,497 INFO L480 AbstractCegarLoop]: Abstraction has 33 states and 35 transitions. [2018-11-23 11:21:06,497 INFO L481 AbstractCegarLoop]: Interpolant automaton has 15 states. [2018-11-23 11:21:06,497 INFO L276 IsEmpty]: Start isEmpty. Operand 33 states and 35 transitions. [2018-11-23 11:21:06,497 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 33 [2018-11-23 11:21:06,497 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 11:21:06,498 INFO L402 BasicCegarLoop]: trace histogram [3, 3, 3, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 11:21:06,498 INFO L423 AbstractCegarLoop]: === Iteration 8 === [mainErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 11:21:06,498 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 11:21:06,498 INFO L82 PathProgramCache]: Analyzing trace with hash -1318921974, now seen corresponding path program 3 times [2018-11-23 11:21:06,498 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 11:21:06,499 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 9 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 9 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 11:21:06,518 INFO L101 rtionOrderModulation]: Changing assertion order to OUTSIDE_LOOP_FIRST2 [2018-11-23 11:21:06,642 INFO L249 tOrderPrioritization]: Assert order OUTSIDE_LOOP_FIRST2 issued 4 check-sat command(s) [2018-11-23 11:21:06,642 INFO L250 tOrderPrioritization]: Conjunction of SSA is unsat [2018-11-23 11:21:06,680 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 11:21:06,681 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 11:21:06,876 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 2, 1 stores, 1 select indices, 1 select index equivalence classes, 0 disjoint index pairs (out of 0 index pairs), introduced 1 new quantified variables, introduced 0 case distinctions, treesize of input 11 treesize of output 8 [2018-11-23 11:21:06,882 INFO L478 Elim1Store]: Elim1 did not use preprocessing eliminated variable of array dimension 1, 1 stores, 0 select indices, 0 select index equivalence classes, 1 disjoint index pairs (out of 0 index pairs), introduced 0 new quantified variables, introduced 0 case distinctions, treesize of input 8 treesize of output 7 [2018-11-23 11:21:06,883 INFO L267 ElimStorePlain]: Start of recursive call 3: End of recursive call: and 1 xjuncts. [2018-11-23 11:21:06,887 INFO L267 ElimStorePlain]: Start of recursive call 2: 1 dim-1 vars, End of recursive call: and 1 xjuncts. [2018-11-23 11:21:06,897 INFO L267 ElimStorePlain]: Start of recursive call 1: 1 dim-0 vars, 1 dim-2 vars, End of recursive call: and 1 xjuncts. [2018-11-23 11:21:06,897 INFO L202 ElimStorePlain]: Needed 3 recursive calls to eliminate 2 variables, input treesize:16, output treesize:8 [2018-11-23 11:21:06,906 WARN L383 uantifierElimination]: Trying to double check SDD result, but SMT solver's response was UNKNOWN. [2018-11-23 11:21:06,907 WARN L384 uantifierElimination]: Input elimination task: ∃ [|v_#memory_$Pointer$.base_30|, v_sll_create_~head~0.base_31]. (and (= |#memory_$Pointer$.base| (store |v_#memory_$Pointer$.base_30| sll_create_~head~0.base (store (select |v_#memory_$Pointer$.base_30| sll_create_~head~0.base) sll_create_~head~0.offset v_sll_create_~head~0.base_31))) (not (= (_ bv0 32) v_sll_create_~head~0.base_31))) [2018-11-23 11:21:06,907 WARN L385 uantifierElimination]: ElimStorePlain result: ∃ []. (not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| sll_create_~head~0.base) sll_create_~head~0.offset))) [2018-11-23 11:21:07,207 INFO L256 TraceCheckUtils]: 0: Hoare triple {2433#true} call ULTIMATE.init(); {2433#true} is VALID [2018-11-23 11:21:07,208 INFO L273 TraceCheckUtils]: 1: Hoare triple {2433#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1]; {2433#true} is VALID [2018-11-23 11:21:07,208 INFO L273 TraceCheckUtils]: 2: Hoare triple {2433#true} assume true; {2433#true} is VALID [2018-11-23 11:21:07,208 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {2433#true} {2433#true} #91#return; {2433#true} is VALID [2018-11-23 11:21:07,208 INFO L256 TraceCheckUtils]: 4: Hoare triple {2433#true} call #t~ret11 := main(); {2433#true} is VALID [2018-11-23 11:21:07,208 INFO L273 TraceCheckUtils]: 5: Hoare triple {2433#true} ~len~1 := 2bv32; {2433#true} is VALID [2018-11-23 11:21:07,208 INFO L273 TraceCheckUtils]: 6: Hoare triple {2433#true} assume !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7; {2433#true} is VALID [2018-11-23 11:21:07,209 INFO L256 TraceCheckUtils]: 7: Hoare triple {2433#true} call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); {2433#true} is VALID [2018-11-23 11:21:07,209 INFO L273 TraceCheckUtils]: 8: Hoare triple {2433#true} ~len := #in~len;~head~0.base, ~head~0.offset := 0bv32, 0bv32; {2433#true} is VALID [2018-11-23 11:21:07,209 INFO L273 TraceCheckUtils]: 9: Hoare triple {2433#true} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {2433#true} is VALID [2018-11-23 11:21:07,209 INFO L273 TraceCheckUtils]: 10: Hoare triple {2433#true} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {2433#true} is VALID [2018-11-23 11:21:07,209 INFO L273 TraceCheckUtils]: 11: Hoare triple {2433#true} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {2433#true} is VALID [2018-11-23 11:21:07,210 INFO L273 TraceCheckUtils]: 12: Hoare triple {2433#true} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {2474#(not (= (_ bv0 32) sll_create_~new_head~0.base))} is VALID [2018-11-23 11:21:07,210 INFO L273 TraceCheckUtils]: 13: Hoare triple {2474#(not (= (_ bv0 32) sll_create_~new_head~0.base))} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {2474#(not (= (_ bv0 32) sll_create_~new_head~0.base))} is VALID [2018-11-23 11:21:07,211 INFO L273 TraceCheckUtils]: 14: Hoare triple {2474#(not (= (_ bv0 32) sll_create_~new_head~0.base))} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {2481#(not (= sll_create_~head~0.base (_ bv0 32)))} is VALID [2018-11-23 11:21:07,211 INFO L273 TraceCheckUtils]: 15: Hoare triple {2481#(not (= sll_create_~head~0.base (_ bv0 32)))} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {2481#(not (= sll_create_~head~0.base (_ bv0 32)))} is VALID [2018-11-23 11:21:07,211 INFO L273 TraceCheckUtils]: 16: Hoare triple {2481#(not (= sll_create_~head~0.base (_ bv0 32)))} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {2481#(not (= sll_create_~head~0.base (_ bv0 32)))} is VALID [2018-11-23 11:21:07,213 INFO L273 TraceCheckUtils]: 17: Hoare triple {2481#(not (= sll_create_~head~0.base (_ bv0 32)))} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {2491#(not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| sll_create_~head~0.base) sll_create_~head~0.offset)))} is VALID [2018-11-23 11:21:07,214 INFO L273 TraceCheckUtils]: 18: Hoare triple {2491#(not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| sll_create_~head~0.base) sll_create_~head~0.offset)))} assume !~bvsgt32(~len, 0bv32); {2491#(not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| sll_create_~head~0.base) sll_create_~head~0.offset)))} is VALID [2018-11-23 11:21:07,216 INFO L273 TraceCheckUtils]: 19: Hoare triple {2491#(not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| sll_create_~head~0.base) sll_create_~head~0.offset)))} #res.base, #res.offset := ~head~0.base, ~head~0.offset; {2498#(not (= (select (select |#memory_$Pointer$.base| |sll_create_#res.base|) |sll_create_#res.offset|) (_ bv0 32)))} is VALID [2018-11-23 11:21:07,216 INFO L273 TraceCheckUtils]: 20: Hoare triple {2498#(not (= (select (select |#memory_$Pointer$.base| |sll_create_#res.base|) |sll_create_#res.offset|) (_ bv0 32)))} assume true; {2498#(not (= (select (select |#memory_$Pointer$.base| |sll_create_#res.base|) |sll_create_#res.offset|) (_ bv0 32)))} is VALID [2018-11-23 11:21:07,224 INFO L268 TraceCheckUtils]: 21: Hoare quadruple {2498#(not (= (select (select |#memory_$Pointer$.base| |sll_create_#res.base|) |sll_create_#res.offset|) (_ bv0 32)))} {2433#true} #95#return; {2505#(not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| |main_#t~ret9.base|) |main_#t~ret9.offset|)))} is VALID [2018-11-23 11:21:07,225 INFO L273 TraceCheckUtils]: 22: Hoare triple {2505#(not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| |main_#t~ret9.base|) |main_#t~ret9.offset|)))} ~s~0.base, ~s~0.offset := #t~ret9.base, #t~ret9.offset;havoc #t~ret9.base, #t~ret9.offset; {2509#(not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| main_~s~0.base) main_~s~0.offset)))} is VALID [2018-11-23 11:21:07,227 INFO L256 TraceCheckUtils]: 23: Hoare triple {2509#(not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| main_~s~0.base) main_~s~0.offset)))} call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); {2513#(exists ((v_main_~s~0.offset_BEFORE_CALL_1 (_ BitVec 32)) (v_main_~s~0.base_BEFORE_CALL_2 (_ BitVec 32))) (not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| v_main_~s~0.base_BEFORE_CALL_2) v_main_~s~0.offset_BEFORE_CALL_1))))} is VALID [2018-11-23 11:21:07,228 INFO L273 TraceCheckUtils]: 24: Hoare triple {2513#(exists ((v_main_~s~0.offset_BEFORE_CALL_1 (_ BitVec 32)) (v_main_~s~0.base_BEFORE_CALL_2 (_ BitVec 32))) (not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| v_main_~s~0.base_BEFORE_CALL_2) v_main_~s~0.offset_BEFORE_CALL_1))))} ~head.base, ~head.offset := #in~head.base, #in~head.offset;~len~0 := 0bv32; {2517#(and (= sll_length_~head.offset |sll_length_#in~head.offset|) (exists ((v_main_~s~0.offset_BEFORE_CALL_1 (_ BitVec 32)) (v_main_~s~0.base_BEFORE_CALL_2 (_ BitVec 32))) (not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| v_main_~s~0.base_BEFORE_CALL_2) v_main_~s~0.offset_BEFORE_CALL_1)))) (= sll_length_~head.base |sll_length_#in~head.base|))} is VALID [2018-11-23 11:21:07,230 INFO L273 TraceCheckUtils]: 25: Hoare triple {2517#(and (= sll_length_~head.offset |sll_length_#in~head.offset|) (exists ((v_main_~s~0.offset_BEFORE_CALL_1 (_ BitVec 32)) (v_main_~s~0.base_BEFORE_CALL_2 (_ BitVec 32))) (not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| v_main_~s~0.base_BEFORE_CALL_2) v_main_~s~0.offset_BEFORE_CALL_1)))) (= sll_length_~head.base |sll_length_#in~head.base|))} assume !!(~head.base != 0bv32 || ~head.offset != 0bv32);#t~post4 := ~len~0;~len~0 := ~bvadd32(1bv32, #t~post4);havoc #t~post4;call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32);~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset;havoc #t~mem5.base, #t~mem5.offset; {2521#(and (exists ((v_main_~s~0.offset_BEFORE_CALL_1 (_ BitVec 32)) (v_main_~s~0.base_BEFORE_CALL_2 (_ BitVec 32))) (not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| v_main_~s~0.base_BEFORE_CALL_2) v_main_~s~0.offset_BEFORE_CALL_1)))) (= (select (select |#memory_$Pointer$.base| |sll_length_#in~head.base|) |sll_length_#in~head.offset|) sll_length_~head.base))} is VALID [2018-11-23 11:21:07,230 INFO L273 TraceCheckUtils]: 26: Hoare triple {2521#(and (exists ((v_main_~s~0.offset_BEFORE_CALL_1 (_ BitVec 32)) (v_main_~s~0.base_BEFORE_CALL_2 (_ BitVec 32))) (not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| v_main_~s~0.base_BEFORE_CALL_2) v_main_~s~0.offset_BEFORE_CALL_1)))) (= (select (select |#memory_$Pointer$.base| |sll_length_#in~head.base|) |sll_length_#in~head.offset|) sll_length_~head.base))} assume !(~head.base != 0bv32 || ~head.offset != 0bv32); {2525#(and (exists ((v_main_~s~0.offset_BEFORE_CALL_1 (_ BitVec 32)) (v_main_~s~0.base_BEFORE_CALL_2 (_ BitVec 32))) (not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| v_main_~s~0.base_BEFORE_CALL_2) v_main_~s~0.offset_BEFORE_CALL_1)))) (= (select (select |#memory_$Pointer$.base| |sll_length_#in~head.base|) |sll_length_#in~head.offset|) (_ bv0 32)))} is VALID [2018-11-23 11:21:07,231 INFO L273 TraceCheckUtils]: 27: Hoare triple {2525#(and (exists ((v_main_~s~0.offset_BEFORE_CALL_1 (_ BitVec 32)) (v_main_~s~0.base_BEFORE_CALL_2 (_ BitVec 32))) (not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| v_main_~s~0.base_BEFORE_CALL_2) v_main_~s~0.offset_BEFORE_CALL_1)))) (= (select (select |#memory_$Pointer$.base| |sll_length_#in~head.base|) |sll_length_#in~head.offset|) (_ bv0 32)))} #res := ~len~0; {2525#(and (exists ((v_main_~s~0.offset_BEFORE_CALL_1 (_ BitVec 32)) (v_main_~s~0.base_BEFORE_CALL_2 (_ BitVec 32))) (not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| v_main_~s~0.base_BEFORE_CALL_2) v_main_~s~0.offset_BEFORE_CALL_1)))) (= (select (select |#memory_$Pointer$.base| |sll_length_#in~head.base|) |sll_length_#in~head.offset|) (_ bv0 32)))} is VALID [2018-11-23 11:21:07,232 INFO L273 TraceCheckUtils]: 28: Hoare triple {2525#(and (exists ((v_main_~s~0.offset_BEFORE_CALL_1 (_ BitVec 32)) (v_main_~s~0.base_BEFORE_CALL_2 (_ BitVec 32))) (not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| v_main_~s~0.base_BEFORE_CALL_2) v_main_~s~0.offset_BEFORE_CALL_1)))) (= (select (select |#memory_$Pointer$.base| |sll_length_#in~head.base|) |sll_length_#in~head.offset|) (_ bv0 32)))} assume true; {2525#(and (exists ((v_main_~s~0.offset_BEFORE_CALL_1 (_ BitVec 32)) (v_main_~s~0.base_BEFORE_CALL_2 (_ BitVec 32))) (not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| v_main_~s~0.base_BEFORE_CALL_2) v_main_~s~0.offset_BEFORE_CALL_1)))) (= (select (select |#memory_$Pointer$.base| |sll_length_#in~head.base|) |sll_length_#in~head.offset|) (_ bv0 32)))} is VALID [2018-11-23 11:21:07,234 INFO L268 TraceCheckUtils]: 29: Hoare quadruple {2525#(and (exists ((v_main_~s~0.offset_BEFORE_CALL_1 (_ BitVec 32)) (v_main_~s~0.base_BEFORE_CALL_2 (_ BitVec 32))) (not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| v_main_~s~0.base_BEFORE_CALL_2) v_main_~s~0.offset_BEFORE_CALL_1)))) (= (select (select |#memory_$Pointer$.base| |sll_length_#in~head.base|) |sll_length_#in~head.offset|) (_ bv0 32)))} {2509#(not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| main_~s~0.base) main_~s~0.offset)))} #97#return; {2434#false} is VALID [2018-11-23 11:21:07,234 INFO L273 TraceCheckUtils]: 30: Hoare triple {2434#false} assume ~len~1 != #t~ret10;havoc #t~ret10; {2434#false} is VALID [2018-11-23 11:21:07,234 INFO L273 TraceCheckUtils]: 31: Hoare triple {2434#false} assume !false; {2434#false} is VALID [2018-11-23 11:21:07,237 INFO L134 CoverageAnalysis]: Checked inductivity of 13 backedges. 8 proven. 4 refuted. 0 times theorem prover too weak. 1 trivial. 0 not checked. [2018-11-23 11:21:07,237 INFO L316 TraceCheckSpWp]: Computing backward predicates... [2018-11-23 11:21:07,647 INFO L273 TraceCheckUtils]: 31: Hoare triple {2434#false} assume !false; {2434#false} is VALID [2018-11-23 11:21:07,647 INFO L273 TraceCheckUtils]: 30: Hoare triple {2434#false} assume ~len~1 != #t~ret10;havoc #t~ret10; {2434#false} is VALID [2018-11-23 11:21:07,649 INFO L268 TraceCheckUtils]: 29: Hoare quadruple {2550#(= (select (select |#memory_$Pointer$.base| |sll_length_#in~head.base|) |sll_length_#in~head.offset|) (_ bv0 32))} {2509#(not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| main_~s~0.base) main_~s~0.offset)))} #97#return; {2434#false} is VALID [2018-11-23 11:21:07,649 INFO L273 TraceCheckUtils]: 28: Hoare triple {2550#(= (select (select |#memory_$Pointer$.base| |sll_length_#in~head.base|) |sll_length_#in~head.offset|) (_ bv0 32))} assume true; {2550#(= (select (select |#memory_$Pointer$.base| |sll_length_#in~head.base|) |sll_length_#in~head.offset|) (_ bv0 32))} is VALID [2018-11-23 11:21:07,650 INFO L273 TraceCheckUtils]: 27: Hoare triple {2550#(= (select (select |#memory_$Pointer$.base| |sll_length_#in~head.base|) |sll_length_#in~head.offset|) (_ bv0 32))} #res := ~len~0; {2550#(= (select (select |#memory_$Pointer$.base| |sll_length_#in~head.base|) |sll_length_#in~head.offset|) (_ bv0 32))} is VALID [2018-11-23 11:21:07,650 INFO L273 TraceCheckUtils]: 26: Hoare triple {2560#(or (= (select (select |#memory_$Pointer$.base| |sll_length_#in~head.base|) |sll_length_#in~head.offset|) (_ bv0 32)) (not (= (_ bv0 32) sll_length_~head.base)))} assume !(~head.base != 0bv32 || ~head.offset != 0bv32); {2550#(= (select (select |#memory_$Pointer$.base| |sll_length_#in~head.base|) |sll_length_#in~head.offset|) (_ bv0 32))} is VALID [2018-11-23 11:21:07,651 INFO L273 TraceCheckUtils]: 25: Hoare triple {2564#(or (not (= (select (select |#memory_$Pointer$.base| sll_length_~head.base) sll_length_~head.offset) (_ bv0 32))) (= (select (select |#memory_$Pointer$.base| |sll_length_#in~head.base|) |sll_length_#in~head.offset|) (_ bv0 32)))} assume !!(~head.base != 0bv32 || ~head.offset != 0bv32);#t~post4 := ~len~0;~len~0 := ~bvadd32(1bv32, #t~post4);havoc #t~post4;call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32);~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset;havoc #t~mem5.base, #t~mem5.offset; {2560#(or (= (select (select |#memory_$Pointer$.base| |sll_length_#in~head.base|) |sll_length_#in~head.offset|) (_ bv0 32)) (not (= (_ bv0 32) sll_length_~head.base)))} is VALID [2018-11-23 11:21:07,652 INFO L273 TraceCheckUtils]: 24: Hoare triple {2433#true} ~head.base, ~head.offset := #in~head.base, #in~head.offset;~len~0 := 0bv32; {2564#(or (not (= (select (select |#memory_$Pointer$.base| sll_length_~head.base) sll_length_~head.offset) (_ bv0 32))) (= (select (select |#memory_$Pointer$.base| |sll_length_#in~head.base|) |sll_length_#in~head.offset|) (_ bv0 32)))} is VALID [2018-11-23 11:21:07,652 INFO L256 TraceCheckUtils]: 23: Hoare triple {2509#(not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| main_~s~0.base) main_~s~0.offset)))} call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); {2433#true} is VALID [2018-11-23 11:21:07,652 INFO L273 TraceCheckUtils]: 22: Hoare triple {2505#(not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| |main_#t~ret9.base|) |main_#t~ret9.offset|)))} ~s~0.base, ~s~0.offset := #t~ret9.base, #t~ret9.offset;havoc #t~ret9.base, #t~ret9.offset; {2509#(not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| main_~s~0.base) main_~s~0.offset)))} is VALID [2018-11-23 11:21:07,654 INFO L268 TraceCheckUtils]: 21: Hoare quadruple {2498#(not (= (select (select |#memory_$Pointer$.base| |sll_create_#res.base|) |sll_create_#res.offset|) (_ bv0 32)))} {2433#true} #95#return; {2505#(not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| |main_#t~ret9.base|) |main_#t~ret9.offset|)))} is VALID [2018-11-23 11:21:07,654 INFO L273 TraceCheckUtils]: 20: Hoare triple {2498#(not (= (select (select |#memory_$Pointer$.base| |sll_create_#res.base|) |sll_create_#res.offset|) (_ bv0 32)))} assume true; {2498#(not (= (select (select |#memory_$Pointer$.base| |sll_create_#res.base|) |sll_create_#res.offset|) (_ bv0 32)))} is VALID [2018-11-23 11:21:07,655 INFO L273 TraceCheckUtils]: 19: Hoare triple {2491#(not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| sll_create_~head~0.base) sll_create_~head~0.offset)))} #res.base, #res.offset := ~head~0.base, ~head~0.offset; {2498#(not (= (select (select |#memory_$Pointer$.base| |sll_create_#res.base|) |sll_create_#res.offset|) (_ bv0 32)))} is VALID [2018-11-23 11:21:07,655 INFO L273 TraceCheckUtils]: 18: Hoare triple {2491#(not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| sll_create_~head~0.base) sll_create_~head~0.offset)))} assume !~bvsgt32(~len, 0bv32); {2491#(not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| sll_create_~head~0.base) sll_create_~head~0.offset)))} is VALID [2018-11-23 11:21:07,657 INFO L273 TraceCheckUtils]: 17: Hoare triple {2481#(not (= sll_create_~head~0.base (_ bv0 32)))} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {2491#(not (= (_ bv0 32) (select (select |#memory_$Pointer$.base| sll_create_~head~0.base) sll_create_~head~0.offset)))} is VALID [2018-11-23 11:21:07,658 INFO L273 TraceCheckUtils]: 16: Hoare triple {2481#(not (= sll_create_~head~0.base (_ bv0 32)))} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {2481#(not (= sll_create_~head~0.base (_ bv0 32)))} is VALID [2018-11-23 11:21:07,659 INFO L273 TraceCheckUtils]: 15: Hoare triple {2481#(not (= sll_create_~head~0.base (_ bv0 32)))} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {2481#(not (= sll_create_~head~0.base (_ bv0 32)))} is VALID [2018-11-23 11:21:07,668 INFO L273 TraceCheckUtils]: 14: Hoare triple {2474#(not (= (_ bv0 32) sll_create_~new_head~0.base))} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {2481#(not (= sll_create_~head~0.base (_ bv0 32)))} is VALID [2018-11-23 11:21:07,668 INFO L273 TraceCheckUtils]: 13: Hoare triple {2474#(not (= (_ bv0 32) sll_create_~new_head~0.base))} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {2474#(not (= (_ bv0 32) sll_create_~new_head~0.base))} is VALID [2018-11-23 11:21:07,669 INFO L273 TraceCheckUtils]: 12: Hoare triple {2433#true} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {2474#(not (= (_ bv0 32) sll_create_~new_head~0.base))} is VALID [2018-11-23 11:21:07,669 INFO L273 TraceCheckUtils]: 11: Hoare triple {2433#true} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {2433#true} is VALID [2018-11-23 11:21:07,669 INFO L273 TraceCheckUtils]: 10: Hoare triple {2433#true} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {2433#true} is VALID [2018-11-23 11:21:07,669 INFO L273 TraceCheckUtils]: 9: Hoare triple {2433#true} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {2433#true} is VALID [2018-11-23 11:21:07,670 INFO L273 TraceCheckUtils]: 8: Hoare triple {2433#true} ~len := #in~len;~head~0.base, ~head~0.offset := 0bv32, 0bv32; {2433#true} is VALID [2018-11-23 11:21:07,670 INFO L256 TraceCheckUtils]: 7: Hoare triple {2433#true} call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); {2433#true} is VALID [2018-11-23 11:21:07,670 INFO L273 TraceCheckUtils]: 6: Hoare triple {2433#true} assume !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7; {2433#true} is VALID [2018-11-23 11:21:07,670 INFO L273 TraceCheckUtils]: 5: Hoare triple {2433#true} ~len~1 := 2bv32; {2433#true} is VALID [2018-11-23 11:21:07,670 INFO L256 TraceCheckUtils]: 4: Hoare triple {2433#true} call #t~ret11 := main(); {2433#true} is VALID [2018-11-23 11:21:07,671 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {2433#true} {2433#true} #91#return; {2433#true} is VALID [2018-11-23 11:21:07,671 INFO L273 TraceCheckUtils]: 2: Hoare triple {2433#true} assume true; {2433#true} is VALID [2018-11-23 11:21:07,671 INFO L273 TraceCheckUtils]: 1: Hoare triple {2433#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1]; {2433#true} is VALID [2018-11-23 11:21:07,671 INFO L256 TraceCheckUtils]: 0: Hoare triple {2433#true} call ULTIMATE.init(); {2433#true} is VALID [2018-11-23 11:21:07,672 INFO L134 CoverageAnalysis]: Checked inductivity of 13 backedges. 8 proven. 4 refuted. 0 times theorem prover too weak. 1 trivial. 0 not checked. [2018-11-23 11:21:07,674 INFO L312 seRefinementStrategy]: Constructing automaton from 0 perfect and 2 imperfect interpolant sequences. [2018-11-23 11:21:07,674 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [] imperfect sequences [12, 11] total 15 [2018-11-23 11:21:07,675 INFO L78 Accepts]: Start accepts. Automaton has 15 states. Word has length 32 [2018-11-23 11:21:07,675 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 11:21:07,675 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 15 states. [2018-11-23 11:21:07,746 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 39 edges. 39 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 11:21:07,746 INFO L459 AbstractCegarLoop]: Interpolant automaton has 15 states [2018-11-23 11:21:07,747 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 15 interpolants. [2018-11-23 11:21:07,747 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=41, Invalid=169, Unknown=0, NotChecked=0, Total=210 [2018-11-23 11:21:07,747 INFO L87 Difference]: Start difference. First operand 33 states and 35 transitions. Second operand 15 states. [2018-11-23 11:21:18,978 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:21:18,978 INFO L93 Difference]: Finished difference Result 40 states and 42 transitions. [2018-11-23 11:21:18,978 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 12 states. [2018-11-23 11:21:18,978 INFO L78 Accepts]: Start accepts. Automaton has 15 states. Word has length 32 [2018-11-23 11:21:18,979 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 11:21:18,979 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 15 states. [2018-11-23 11:21:18,980 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 12 states to 12 states and 41 transitions. [2018-11-23 11:21:18,980 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 15 states. [2018-11-23 11:21:18,981 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 12 states to 12 states and 41 transitions. [2018-11-23 11:21:18,982 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 12 states and 41 transitions. [2018-11-23 11:21:19,068 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 41 edges. 41 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 11:21:19,069 INFO L225 Difference]: With dead ends: 40 [2018-11-23 11:21:19,069 INFO L226 Difference]: Without dead ends: 34 [2018-11-23 11:21:19,070 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 68 GetRequests, 51 SyntacticMatches, 0 SemanticMatches, 17 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 22 ImplicationChecksByTransitivity, 0.4s TimeCoverageRelationStatistics Valid=69, Invalid=273, Unknown=0, NotChecked=0, Total=342 [2018-11-23 11:21:19,070 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 34 states. [2018-11-23 11:21:19,115 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 34 to 34. [2018-11-23 11:21:19,115 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 11:21:19,115 INFO L82 GeneralOperation]: Start isEquivalent. First operand 34 states. Second operand 34 states. [2018-11-23 11:21:19,115 INFO L74 IsIncluded]: Start isIncluded. First operand 34 states. Second operand 34 states. [2018-11-23 11:21:19,116 INFO L87 Difference]: Start difference. First operand 34 states. Second operand 34 states. [2018-11-23 11:21:19,118 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:21:19,118 INFO L93 Difference]: Finished difference Result 34 states and 36 transitions. [2018-11-23 11:21:19,118 INFO L276 IsEmpty]: Start isEmpty. Operand 34 states and 36 transitions. [2018-11-23 11:21:19,118 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 11:21:19,118 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 11:21:19,118 INFO L74 IsIncluded]: Start isIncluded. First operand 34 states. Second operand 34 states. [2018-11-23 11:21:19,119 INFO L87 Difference]: Start difference. First operand 34 states. Second operand 34 states. [2018-11-23 11:21:19,120 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:21:19,120 INFO L93 Difference]: Finished difference Result 34 states and 36 transitions. [2018-11-23 11:21:19,120 INFO L276 IsEmpty]: Start isEmpty. Operand 34 states and 36 transitions. [2018-11-23 11:21:19,120 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 11:21:19,120 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 11:21:19,120 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 11:21:19,121 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 11:21:19,121 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 34 states. [2018-11-23 11:21:19,122 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 34 states to 34 states and 36 transitions. [2018-11-23 11:21:19,122 INFO L78 Accepts]: Start accepts. Automaton has 34 states and 36 transitions. Word has length 32 [2018-11-23 11:21:19,122 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 11:21:19,122 INFO L480 AbstractCegarLoop]: Abstraction has 34 states and 36 transitions. [2018-11-23 11:21:19,122 INFO L481 AbstractCegarLoop]: Interpolant automaton has 15 states. [2018-11-23 11:21:19,123 INFO L276 IsEmpty]: Start isEmpty. Operand 34 states and 36 transitions. [2018-11-23 11:21:19,123 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 34 [2018-11-23 11:21:19,123 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 11:21:19,123 INFO L402 BasicCegarLoop]: trace histogram [3, 3, 3, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 11:21:19,124 INFO L423 AbstractCegarLoop]: === Iteration 9 === [mainErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 11:21:19,124 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 11:21:19,124 INFO L82 PathProgramCache]: Analyzing trace with hash -629833838, now seen corresponding path program 4 times [2018-11-23 11:21:19,124 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 11:21:19,124 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 10 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 10 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 11:21:19,146 INFO L101 rtionOrderModulation]: Changing assertion order to TERMS_WITH_SMALL_CONSTANTS_FIRST [2018-11-23 11:21:19,183 INFO L249 tOrderPrioritization]: Assert order TERMS_WITH_SMALL_CONSTANTS_FIRST issued 0 check-sat command(s) [2018-11-23 11:21:19,184 INFO L250 tOrderPrioritization]: Conjunction of SSA is unsat [2018-11-23 11:21:19,203 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 11:21:19,204 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 11:21:19,371 INFO L256 TraceCheckUtils]: 0: Hoare triple {2825#true} call ULTIMATE.init(); {2825#true} is VALID [2018-11-23 11:21:19,371 INFO L273 TraceCheckUtils]: 1: Hoare triple {2825#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1]; {2825#true} is VALID [2018-11-23 11:21:19,372 INFO L273 TraceCheckUtils]: 2: Hoare triple {2825#true} assume true; {2825#true} is VALID [2018-11-23 11:21:19,372 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {2825#true} {2825#true} #91#return; {2825#true} is VALID [2018-11-23 11:21:19,372 INFO L256 TraceCheckUtils]: 4: Hoare triple {2825#true} call #t~ret11 := main(); {2825#true} is VALID [2018-11-23 11:21:19,373 INFO L273 TraceCheckUtils]: 5: Hoare triple {2825#true} ~len~1 := 2bv32; {2845#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:19,373 INFO L273 TraceCheckUtils]: 6: Hoare triple {2845#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} assume !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7; {2845#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:19,374 INFO L256 TraceCheckUtils]: 7: Hoare triple {2845#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); {2825#true} is VALID [2018-11-23 11:21:19,374 INFO L273 TraceCheckUtils]: 8: Hoare triple {2825#true} ~len := #in~len;~head~0.base, ~head~0.offset := 0bv32, 0bv32; {2825#true} is VALID [2018-11-23 11:21:19,374 INFO L273 TraceCheckUtils]: 9: Hoare triple {2825#true} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {2825#true} is VALID [2018-11-23 11:21:19,374 INFO L273 TraceCheckUtils]: 10: Hoare triple {2825#true} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {2825#true} is VALID [2018-11-23 11:21:19,374 INFO L273 TraceCheckUtils]: 11: Hoare triple {2825#true} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {2825#true} is VALID [2018-11-23 11:21:19,375 INFO L273 TraceCheckUtils]: 12: Hoare triple {2825#true} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {2825#true} is VALID [2018-11-23 11:21:19,375 INFO L273 TraceCheckUtils]: 13: Hoare triple {2825#true} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {2825#true} is VALID [2018-11-23 11:21:19,375 INFO L273 TraceCheckUtils]: 14: Hoare triple {2825#true} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {2825#true} is VALID [2018-11-23 11:21:19,375 INFO L273 TraceCheckUtils]: 15: Hoare triple {2825#true} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {2825#true} is VALID [2018-11-23 11:21:19,375 INFO L273 TraceCheckUtils]: 16: Hoare triple {2825#true} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {2825#true} is VALID [2018-11-23 11:21:19,376 INFO L273 TraceCheckUtils]: 17: Hoare triple {2825#true} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {2825#true} is VALID [2018-11-23 11:21:19,377 INFO L273 TraceCheckUtils]: 18: Hoare triple {2825#true} assume !~bvsgt32(~len, 0bv32); {2825#true} is VALID [2018-11-23 11:21:19,377 INFO L273 TraceCheckUtils]: 19: Hoare triple {2825#true} #res.base, #res.offset := ~head~0.base, ~head~0.offset; {2825#true} is VALID [2018-11-23 11:21:19,377 INFO L273 TraceCheckUtils]: 20: Hoare triple {2825#true} assume true; {2825#true} is VALID [2018-11-23 11:21:19,383 INFO L268 TraceCheckUtils]: 21: Hoare quadruple {2825#true} {2845#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} #95#return; {2845#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:19,383 INFO L273 TraceCheckUtils]: 22: Hoare triple {2845#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} ~s~0.base, ~s~0.offset := #t~ret9.base, #t~ret9.offset;havoc #t~ret9.base, #t~ret9.offset; {2845#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:19,383 INFO L256 TraceCheckUtils]: 23: Hoare triple {2845#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); {2825#true} is VALID [2018-11-23 11:21:19,384 INFO L273 TraceCheckUtils]: 24: Hoare triple {2825#true} ~head.base, ~head.offset := #in~head.base, #in~head.offset;~len~0 := 0bv32; {2903#(= sll_length_~len~0 (_ bv0 32))} is VALID [2018-11-23 11:21:19,384 INFO L273 TraceCheckUtils]: 25: Hoare triple {2903#(= sll_length_~len~0 (_ bv0 32))} assume !!(~head.base != 0bv32 || ~head.offset != 0bv32);#t~post4 := ~len~0;~len~0 := ~bvadd32(1bv32, #t~post4);havoc #t~post4;call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32);~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset;havoc #t~mem5.base, #t~mem5.offset; {2907#(= (bvadd sll_length_~len~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:19,386 INFO L273 TraceCheckUtils]: 26: Hoare triple {2907#(= (bvadd sll_length_~len~0 (_ bv4294967295 32)) (_ bv0 32))} assume !!(~head.base != 0bv32 || ~head.offset != 0bv32);#t~post4 := ~len~0;~len~0 := ~bvadd32(1bv32, #t~post4);havoc #t~post4;call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32);~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset;havoc #t~mem5.base, #t~mem5.offset; {2911#(= (bvadd sll_length_~len~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:19,387 INFO L273 TraceCheckUtils]: 27: Hoare triple {2911#(= (bvadd sll_length_~len~0 (_ bv4294967294 32)) (_ bv0 32))} assume !(~head.base != 0bv32 || ~head.offset != 0bv32); {2911#(= (bvadd sll_length_~len~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:19,388 INFO L273 TraceCheckUtils]: 28: Hoare triple {2911#(= (bvadd sll_length_~len~0 (_ bv4294967294 32)) (_ bv0 32))} #res := ~len~0; {2918#(= (_ bv2 32) |sll_length_#res|)} is VALID [2018-11-23 11:21:19,394 INFO L273 TraceCheckUtils]: 29: Hoare triple {2918#(= (_ bv2 32) |sll_length_#res|)} assume true; {2918#(= (_ bv2 32) |sll_length_#res|)} is VALID [2018-11-23 11:21:19,396 INFO L268 TraceCheckUtils]: 30: Hoare quadruple {2918#(= (_ bv2 32) |sll_length_#res|)} {2845#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} #97#return; {2925#(and (= (bvadd |main_#t~ret10| (_ bv4294967294 32)) (_ bv0 32)) (= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32)))} is VALID [2018-11-23 11:21:19,396 INFO L273 TraceCheckUtils]: 31: Hoare triple {2925#(and (= (bvadd |main_#t~ret10| (_ bv4294967294 32)) (_ bv0 32)) (= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32)))} assume ~len~1 != #t~ret10;havoc #t~ret10; {2826#false} is VALID [2018-11-23 11:21:19,397 INFO L273 TraceCheckUtils]: 32: Hoare triple {2826#false} assume !false; {2826#false} is VALID [2018-11-23 11:21:19,399 INFO L134 CoverageAnalysis]: Checked inductivity of 15 backedges. 0 proven. 3 refuted. 0 times theorem prover too weak. 12 trivial. 0 not checked. [2018-11-23 11:21:19,399 INFO L316 TraceCheckSpWp]: Computing backward predicates... [2018-11-23 11:21:19,552 INFO L273 TraceCheckUtils]: 32: Hoare triple {2826#false} assume !false; {2826#false} is VALID [2018-11-23 11:21:19,553 INFO L273 TraceCheckUtils]: 31: Hoare triple {2935#(= |main_#t~ret10| main_~len~1)} assume ~len~1 != #t~ret10;havoc #t~ret10; {2826#false} is VALID [2018-11-23 11:21:19,554 INFO L268 TraceCheckUtils]: 30: Hoare quadruple {2918#(= (_ bv2 32) |sll_length_#res|)} {2845#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} #97#return; {2935#(= |main_#t~ret10| main_~len~1)} is VALID [2018-11-23 11:21:19,555 INFO L273 TraceCheckUtils]: 29: Hoare triple {2918#(= (_ bv2 32) |sll_length_#res|)} assume true; {2918#(= (_ bv2 32) |sll_length_#res|)} is VALID [2018-11-23 11:21:19,556 INFO L273 TraceCheckUtils]: 28: Hoare triple {2911#(= (bvadd sll_length_~len~0 (_ bv4294967294 32)) (_ bv0 32))} #res := ~len~0; {2918#(= (_ bv2 32) |sll_length_#res|)} is VALID [2018-11-23 11:21:19,557 INFO L273 TraceCheckUtils]: 27: Hoare triple {2911#(= (bvadd sll_length_~len~0 (_ bv4294967294 32)) (_ bv0 32))} assume !(~head.base != 0bv32 || ~head.offset != 0bv32); {2911#(= (bvadd sll_length_~len~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:19,558 INFO L273 TraceCheckUtils]: 26: Hoare triple {2907#(= (bvadd sll_length_~len~0 (_ bv4294967295 32)) (_ bv0 32))} assume !!(~head.base != 0bv32 || ~head.offset != 0bv32);#t~post4 := ~len~0;~len~0 := ~bvadd32(1bv32, #t~post4);havoc #t~post4;call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32);~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset;havoc #t~mem5.base, #t~mem5.offset; {2911#(= (bvadd sll_length_~len~0 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:19,559 INFO L273 TraceCheckUtils]: 25: Hoare triple {2903#(= sll_length_~len~0 (_ bv0 32))} assume !!(~head.base != 0bv32 || ~head.offset != 0bv32);#t~post4 := ~len~0;~len~0 := ~bvadd32(1bv32, #t~post4);havoc #t~post4;call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32);~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset;havoc #t~mem5.base, #t~mem5.offset; {2907#(= (bvadd sll_length_~len~0 (_ bv4294967295 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:19,560 INFO L273 TraceCheckUtils]: 24: Hoare triple {2825#true} ~head.base, ~head.offset := #in~head.base, #in~head.offset;~len~0 := 0bv32; {2903#(= sll_length_~len~0 (_ bv0 32))} is VALID [2018-11-23 11:21:19,560 INFO L256 TraceCheckUtils]: 23: Hoare triple {2845#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); {2825#true} is VALID [2018-11-23 11:21:19,561 INFO L273 TraceCheckUtils]: 22: Hoare triple {2845#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} ~s~0.base, ~s~0.offset := #t~ret9.base, #t~ret9.offset;havoc #t~ret9.base, #t~ret9.offset; {2845#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:19,562 INFO L268 TraceCheckUtils]: 21: Hoare quadruple {2825#true} {2845#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} #95#return; {2845#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:19,562 INFO L273 TraceCheckUtils]: 20: Hoare triple {2825#true} assume true; {2825#true} is VALID [2018-11-23 11:21:19,563 INFO L273 TraceCheckUtils]: 19: Hoare triple {2825#true} #res.base, #res.offset := ~head~0.base, ~head~0.offset; {2825#true} is VALID [2018-11-23 11:21:19,563 INFO L273 TraceCheckUtils]: 18: Hoare triple {2825#true} assume !~bvsgt32(~len, 0bv32); {2825#true} is VALID [2018-11-23 11:21:19,563 INFO L273 TraceCheckUtils]: 17: Hoare triple {2825#true} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {2825#true} is VALID [2018-11-23 11:21:19,563 INFO L273 TraceCheckUtils]: 16: Hoare triple {2825#true} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {2825#true} is VALID [2018-11-23 11:21:19,564 INFO L273 TraceCheckUtils]: 15: Hoare triple {2825#true} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {2825#true} is VALID [2018-11-23 11:21:19,564 INFO L273 TraceCheckUtils]: 14: Hoare triple {2825#true} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {2825#true} is VALID [2018-11-23 11:21:19,564 INFO L273 TraceCheckUtils]: 13: Hoare triple {2825#true} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {2825#true} is VALID [2018-11-23 11:21:19,564 INFO L273 TraceCheckUtils]: 12: Hoare triple {2825#true} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {2825#true} is VALID [2018-11-23 11:21:19,565 INFO L273 TraceCheckUtils]: 11: Hoare triple {2825#true} call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; {2825#true} is VALID [2018-11-23 11:21:19,565 INFO L273 TraceCheckUtils]: 10: Hoare triple {2825#true} assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); {2825#true} is VALID [2018-11-23 11:21:19,565 INFO L273 TraceCheckUtils]: 9: Hoare triple {2825#true} assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; {2825#true} is VALID [2018-11-23 11:21:19,565 INFO L273 TraceCheckUtils]: 8: Hoare triple {2825#true} ~len := #in~len;~head~0.base, ~head~0.offset := 0bv32, 0bv32; {2825#true} is VALID [2018-11-23 11:21:19,566 INFO L256 TraceCheckUtils]: 7: Hoare triple {2845#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); {2825#true} is VALID [2018-11-23 11:21:19,576 INFO L273 TraceCheckUtils]: 6: Hoare triple {2845#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} assume !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7; {2845#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:19,577 INFO L273 TraceCheckUtils]: 5: Hoare triple {2825#true} ~len~1 := 2bv32; {2845#(= (bvadd main_~len~1 (_ bv4294967294 32)) (_ bv0 32))} is VALID [2018-11-23 11:21:19,577 INFO L256 TraceCheckUtils]: 4: Hoare triple {2825#true} call #t~ret11 := main(); {2825#true} is VALID [2018-11-23 11:21:19,577 INFO L268 TraceCheckUtils]: 3: Hoare quadruple {2825#true} {2825#true} #91#return; {2825#true} is VALID [2018-11-23 11:21:19,577 INFO L273 TraceCheckUtils]: 2: Hoare triple {2825#true} assume true; {2825#true} is VALID [2018-11-23 11:21:19,577 INFO L273 TraceCheckUtils]: 1: Hoare triple {2825#true} #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1]; {2825#true} is VALID [2018-11-23 11:21:19,578 INFO L256 TraceCheckUtils]: 0: Hoare triple {2825#true} call ULTIMATE.init(); {2825#true} is VALID [2018-11-23 11:21:19,579 INFO L134 CoverageAnalysis]: Checked inductivity of 15 backedges. 0 proven. 3 refuted. 0 times theorem prover too weak. 12 trivial. 0 not checked. [2018-11-23 11:21:19,584 INFO L312 seRefinementStrategy]: Constructing automaton from 0 perfect and 2 imperfect interpolant sequences. [2018-11-23 11:21:19,584 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [] imperfect sequences [8, 8] total 9 [2018-11-23 11:21:19,584 INFO L78 Accepts]: Start accepts. Automaton has 9 states. Word has length 33 [2018-11-23 11:21:19,584 INFO L84 Accepts]: Finished accepts. word is accepted. [2018-11-23 11:21:19,585 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 9 states. [2018-11-23 11:21:19,621 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 29 edges. 29 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 11:21:19,621 INFO L459 AbstractCegarLoop]: Interpolant automaton has 9 states [2018-11-23 11:21:19,622 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 9 interpolants. [2018-11-23 11:21:19,622 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=17, Invalid=55, Unknown=0, NotChecked=0, Total=72 [2018-11-23 11:21:19,622 INFO L87 Difference]: Start difference. First operand 34 states and 36 transitions. Second operand 9 states. [2018-11-23 11:21:20,399 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:21:20,400 INFO L93 Difference]: Finished difference Result 48 states and 53 transitions. [2018-11-23 11:21:20,400 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 8 states. [2018-11-23 11:21:20,400 INFO L78 Accepts]: Start accepts. Automaton has 9 states. Word has length 33 [2018-11-23 11:21:20,400 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 11:21:20,400 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 9 states. [2018-11-23 11:21:20,402 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 8 states to 8 states and 46 transitions. [2018-11-23 11:21:20,402 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 9 states. [2018-11-23 11:21:20,403 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 8 states to 8 states and 46 transitions. [2018-11-23 11:21:20,403 INFO L86 InductivityCheck]: Starting indutivity check of a Floyd-Hoare automaton with 8 states and 46 transitions. [2018-11-23 11:21:20,491 INFO L119 InductivityCheck]: Floyd-Hoare automaton has 46 edges. 46 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. [2018-11-23 11:21:20,493 INFO L225 Difference]: With dead ends: 48 [2018-11-23 11:21:20,493 INFO L226 Difference]: Without dead ends: 45 [2018-11-23 11:21:20,493 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 66 GetRequests, 56 SyntacticMatches, 2 SemanticMatches, 8 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 4 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=21, Invalid=69, Unknown=0, NotChecked=0, Total=90 [2018-11-23 11:21:20,494 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 45 states. [2018-11-23 11:21:20,556 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 45 to 42. [2018-11-23 11:21:20,556 INFO L214 AbstractMinimizeNwa]: Start testing correctness of minimizeSevpa [2018-11-23 11:21:20,556 INFO L82 GeneralOperation]: Start isEquivalent. First operand 45 states. Second operand 42 states. [2018-11-23 11:21:20,556 INFO L74 IsIncluded]: Start isIncluded. First operand 45 states. Second operand 42 states. [2018-11-23 11:21:20,556 INFO L87 Difference]: Start difference. First operand 45 states. Second operand 42 states. [2018-11-23 11:21:20,559 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:21:20,559 INFO L93 Difference]: Finished difference Result 45 states and 50 transitions. [2018-11-23 11:21:20,559 INFO L276 IsEmpty]: Start isEmpty. Operand 45 states and 50 transitions. [2018-11-23 11:21:20,559 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 11:21:20,559 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 11:21:20,560 INFO L74 IsIncluded]: Start isIncluded. First operand 42 states. Second operand 45 states. [2018-11-23 11:21:20,560 INFO L87 Difference]: Start difference. First operand 42 states. Second operand 45 states. [2018-11-23 11:21:20,561 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 11:21:20,561 INFO L93 Difference]: Finished difference Result 45 states and 50 transitions. [2018-11-23 11:21:20,561 INFO L276 IsEmpty]: Start isEmpty. Operand 45 states and 50 transitions. [2018-11-23 11:21:20,562 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2018-11-23 11:21:20,562 INFO L83 IsIncluded]: Finished isIncluded. Language is included [2018-11-23 11:21:20,562 INFO L88 GeneralOperation]: Finished isEquivalent. [2018-11-23 11:21:20,562 INFO L221 AbstractMinimizeNwa]: Finished testing correctness of minimizeSevpa [2018-11-23 11:21:20,562 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 42 states. [2018-11-23 11:21:20,563 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 42 states to 42 states and 48 transitions. [2018-11-23 11:21:20,563 INFO L78 Accepts]: Start accepts. Automaton has 42 states and 48 transitions. Word has length 33 [2018-11-23 11:21:20,564 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 11:21:20,564 INFO L480 AbstractCegarLoop]: Abstraction has 42 states and 48 transitions. [2018-11-23 11:21:20,564 INFO L481 AbstractCegarLoop]: Interpolant automaton has 9 states. [2018-11-23 11:21:20,564 INFO L276 IsEmpty]: Start isEmpty. Operand 42 states and 48 transitions. [2018-11-23 11:21:20,565 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 35 [2018-11-23 11:21:20,565 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 11:21:20,565 INFO L402 BasicCegarLoop]: trace histogram [3, 3, 3, 3, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 11:21:20,565 INFO L423 AbstractCegarLoop]: === Iteration 10 === [mainErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 11:21:20,565 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 11:21:20,565 INFO L82 PathProgramCache]: Analyzing trace with hash -742938102, now seen corresponding path program 5 times [2018-11-23 11:21:20,566 INFO L223 ckRefinementStrategy]: Switched to mode CVC4_FPBP [2018-11-23 11:21:20,566 INFO L69 tionRefinementEngine]: Using refinement strategy WolfRefinementStrategy No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/cvc4nyu Starting monitored process 11 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 11 with cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk [2018-11-23 11:21:20,586 INFO L101 rtionOrderModulation]: Changing assertion order to INSIDE_LOOP_FIRST1 [2018-11-23 11:21:20,744 INFO L249 tOrderPrioritization]: Assert order INSIDE_LOOP_FIRST1 issued 4 check-sat command(s) [2018-11-23 11:21:20,745 INFO L250 tOrderPrioritization]: Conjunction of SSA is sat [2018-11-23 11:21:20,871 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2018-11-23 11:21:20,998 INFO L469 BasicCegarLoop]: Counterexample might be feasible [2018-11-23 11:21:20,998 WARN L521 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 11 cvc4nyu --tear-down-incremental --print-success --lang smt --rewrite-divk ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder.RCFGBacktranslator [?] CALL call ULTIMATE.init(); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |old(#NULL.base)|=(_ bv0 32), |old(#NULL.offset)|=(_ bv0 32)] [?] #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1]; VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |old(#NULL.base)|=(_ bv0 32), |old(#NULL.offset)|=(_ bv0 32)] [?] assume true; VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |old(#NULL.base)|=(_ bv0 32), |old(#NULL.offset)|=(_ bv0 32)] [?] RET #91#return; VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32)] [?] CALL call #t~ret11 := main(); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32)] [?] ~len~1 := 2bv32; VAL [main_~len~1=(_ bv2 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32)] [?] assume !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7; VAL [main_~len~1=(_ bv2 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32)] [?] CALL call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32)] [?] ~len := #in~len;~head~0.base, ~head~0.offset := 0bv32, 0bv32; VAL [sll_create_~head~0.base=(_ bv0 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv3 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32)] [?] assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; VAL [sll_create_~head~0.base=(_ bv0 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv3 32), sll_create_~new_head~0.base=(_ bv1427127328 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#t~malloc2.base|=(_ bv1427127328 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); VAL [sll_create_~head~0.base=(_ bv0 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv3 32), sll_create_~new_head~0.base=(_ bv1427127328 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#t~malloc2.base|=(_ bv1427127328 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; VAL [sll_create_~head~0.base=(_ bv1427127328 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv2 32), sll_create_~new_head~0.base=(_ bv1427127328 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#t~malloc2.base|=(_ bv1427127328 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; VAL [sll_create_~head~0.base=(_ bv1427127328 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv2 32), sll_create_~new_head~0.base=(_ bv2696972873 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#t~malloc2.base|=(_ bv2696972873 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); VAL [sll_create_~head~0.base=(_ bv1427127328 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv2 32), sll_create_~new_head~0.base=(_ bv2696972873 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#t~malloc2.base|=(_ bv2696972873 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; VAL [sll_create_~head~0.base=(_ bv2696972873 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv1 32), sll_create_~new_head~0.base=(_ bv2696972873 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#t~malloc2.base|=(_ bv2696972873 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; VAL [sll_create_~head~0.base=(_ bv2696972873 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv1 32), sll_create_~new_head~0.base=(_ bv1615373849 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#t~malloc2.base|=(_ bv1615373849 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); VAL [sll_create_~head~0.base=(_ bv2696972873 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv1 32), sll_create_~new_head~0.base=(_ bv1615373849 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#t~malloc2.base|=(_ bv1615373849 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; VAL [sll_create_~head~0.base=(_ bv1615373849 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv0 32), sll_create_~new_head~0.base=(_ bv1615373849 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#t~malloc2.base|=(_ bv1615373849 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] assume !~bvsgt32(~len, 0bv32); VAL [sll_create_~head~0.base=(_ bv1615373849 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv0 32), sll_create_~new_head~0.base=(_ bv1615373849 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#t~malloc2.base|=(_ bv1615373849 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] #res.base, #res.offset := ~head~0.base, ~head~0.offset; VAL [sll_create_~head~0.base=(_ bv1615373849 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv0 32), sll_create_~new_head~0.base=(_ bv1615373849 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#res.base|=(_ bv1615373849 32), |sll_create_#res.offset|=(_ bv0 32), |sll_create_#t~malloc2.base|=(_ bv1615373849 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] assume true; VAL [sll_create_~head~0.base=(_ bv1615373849 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv0 32), sll_create_~new_head~0.base=(_ bv1615373849 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#res.base|=(_ bv1615373849 32), |sll_create_#res.offset|=(_ bv0 32), |sll_create_#t~malloc2.base|=(_ bv1615373849 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] RET #95#return; VAL [main_~len~1=(_ bv2 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |main_#t~ret9.base|=(_ bv1615373849 32), |main_#t~ret9.offset|=(_ bv0 32)] [?] ~s~0.base, ~s~0.offset := #t~ret9.base, #t~ret9.offset;havoc #t~ret9.base, #t~ret9.offset; VAL [main_~len~1=(_ bv2 32), main_~s~0.base=(_ bv1615373849 32), main_~s~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32)] [?] CALL call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_length_#in~head.base|=(_ bv1615373849 32), |sll_length_#in~head.offset|=(_ bv0 32)] [?] ~head.base, ~head.offset := #in~head.base, #in~head.offset;~len~0 := 0bv32; VAL [sll_length_~head.base=(_ bv1615373849 32), sll_length_~head.offset=(_ bv0 32), sll_length_~len~0=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_length_#in~head.base|=(_ bv1615373849 32), |sll_length_#in~head.offset|=(_ bv0 32)] [?] assume !!(~head.base != 0bv32 || ~head.offset != 0bv32);#t~post4 := ~len~0;~len~0 := ~bvadd32(1bv32, #t~post4);havoc #t~post4;call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32);~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset;havoc #t~mem5.base, #t~mem5.offset; VAL [sll_length_~head.base=(_ bv2696972873 32), sll_length_~head.offset=(_ bv0 32), sll_length_~len~0=(_ bv1 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_length_#in~head.base|=(_ bv1615373849 32), |sll_length_#in~head.offset|=(_ bv0 32)] [?] assume !!(~head.base != 0bv32 || ~head.offset != 0bv32);#t~post4 := ~len~0;~len~0 := ~bvadd32(1bv32, #t~post4);havoc #t~post4;call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32);~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset;havoc #t~mem5.base, #t~mem5.offset; VAL [sll_length_~head.base=(_ bv1427127328 32), sll_length_~head.offset=(_ bv0 32), sll_length_~len~0=(_ bv2 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_length_#in~head.base|=(_ bv1615373849 32), |sll_length_#in~head.offset|=(_ bv0 32)] [?] assume !!(~head.base != 0bv32 || ~head.offset != 0bv32);#t~post4 := ~len~0;~len~0 := ~bvadd32(1bv32, #t~post4);havoc #t~post4;call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32);~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset;havoc #t~mem5.base, #t~mem5.offset; VAL [sll_length_~head.base=(_ bv0 32), sll_length_~head.offset=(_ bv0 32), sll_length_~len~0=(_ bv3 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_length_#in~head.base|=(_ bv1615373849 32), |sll_length_#in~head.offset|=(_ bv0 32)] [?] assume !(~head.base != 0bv32 || ~head.offset != 0bv32); VAL [sll_length_~head.base=(_ bv0 32), sll_length_~head.offset=(_ bv0 32), sll_length_~len~0=(_ bv3 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_length_#in~head.base|=(_ bv1615373849 32), |sll_length_#in~head.offset|=(_ bv0 32)] [?] #res := ~len~0; VAL [sll_length_~head.base=(_ bv0 32), sll_length_~head.offset=(_ bv0 32), sll_length_~len~0=(_ bv3 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_length_#in~head.base|=(_ bv1615373849 32), |sll_length_#in~head.offset|=(_ bv0 32), |sll_length_#res|=(_ bv3 32)] [?] assume true; VAL [sll_length_~head.base=(_ bv0 32), sll_length_~head.offset=(_ bv0 32), sll_length_~len~0=(_ bv3 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_length_#in~head.base|=(_ bv1615373849 32), |sll_length_#in~head.offset|=(_ bv0 32), |sll_length_#res|=(_ bv3 32)] [?] RET #97#return; VAL [main_~len~1=(_ bv2 32), main_~s~0.base=(_ bv1615373849 32), main_~s~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |main_#t~ret10|=(_ bv3 32)] [?] assume ~len~1 != #t~ret10;havoc #t~ret10; VAL [main_~len~1=(_ bv2 32), main_~s~0.base=(_ bv1615373849 32), main_~s~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32)] [?] assume !false; VAL [main_~len~1=(_ bv2 32), main_~s~0.base=(_ bv1615373849 32), main_~s~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32)] [?] CALL call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32] [?] #NULL.base, #NULL.offset := 0bv32, 0bv32; [?] #valid := #valid[0bv32 := 0bv1]; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32] [?] ensures true; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32] [?] RET call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32] [?] CALL call #t~ret11 := main(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32] [L592] ~len~1 := 2bv32; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~len~1=2bv32] [L593-L595] assume !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7); [L593] havoc #t~nondet7; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~len~1=2bv32] [L596] CALL call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32] [L563-L575] ~len := #in~len; [L564] ~head~0.base, ~head~0.offset := 0bv32, 0bv32; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head~0.base=0bv32, ~head~0.offset=0bv32, ~len=3bv32] [L565-L573] assume !!~bvsgt32(~len, 0bv32); [L566] call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32); [L566] ~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1427127328bv32, #t~malloc2.offset=0bv32, ~head~0.base=0bv32, ~head~0.offset=0bv32, ~len=3bv32, ~new_head~0.base=1427127328bv32, ~new_head~0.offset=0bv32] [L567-L569] assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1427127328bv32, #t~malloc2.offset=0bv32, ~head~0.base=0bv32, ~head~0.offset=0bv32, ~len=3bv32, ~new_head~0.base=1427127328bv32, ~new_head~0.offset=0bv32] [L570] call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32); [L571] ~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1427127328bv32, #t~malloc2.offset=0bv32, ~head~0.base=1427127328bv32, ~head~0.offset=0bv32, ~len=2bv32, ~new_head~0.base=1427127328bv32, ~new_head~0.offset=0bv32] [L565-L573] assume !!~bvsgt32(~len, 0bv32); [L566] call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32); [L566] ~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=2696972873bv32, #t~malloc2.offset=0bv32, ~head~0.base=1427127328bv32, ~head~0.offset=0bv32, ~len=2bv32, ~new_head~0.base=2696972873bv32, ~new_head~0.offset=0bv32] [L567-L569] assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=2696972873bv32, #t~malloc2.offset=0bv32, ~head~0.base=1427127328bv32, ~head~0.offset=0bv32, ~len=2bv32, ~new_head~0.base=2696972873bv32, ~new_head~0.offset=0bv32] [L570] call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32); [L571] ~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=2696972873bv32, #t~malloc2.offset=0bv32, ~head~0.base=2696972873bv32, ~head~0.offset=0bv32, ~len=1bv32, ~new_head~0.base=2696972873bv32, ~new_head~0.offset=0bv32] [L565-L573] assume !!~bvsgt32(~len, 0bv32); [L566] call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32); [L566] ~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=2696972873bv32, ~head~0.offset=0bv32, ~len=1bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L567-L569] assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=2696972873bv32, ~head~0.offset=0bv32, ~len=1bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L570] call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32); [L571] ~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=1615373849bv32, ~head~0.offset=0bv32, ~len=0bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L565-L573] assume !~bvsgt32(~len, 0bv32); VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=1615373849bv32, ~head~0.offset=0bv32, ~len=0bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L574] #res.base, #res.offset := ~head~0.base, ~head~0.offset; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #res.base=1615373849bv32, #res.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=1615373849bv32, ~head~0.offset=0bv32, ~len=0bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L563-L575] ensures true; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #res.base=1615373849bv32, #res.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=1615373849bv32, ~head~0.offset=0bv32, ~len=0bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L596] RET call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, #t~ret9.base=1615373849bv32, #t~ret9.offset=0bv32, ~len~1=2bv32] [L596] ~s~0.base, ~s~0.offset := #t~ret9.base, #t~ret9.offset; [L596] havoc #t~ret9.base, #t~ret9.offset; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~len~1=2bv32, ~s~0.base=1615373849bv32, ~s~0.offset=0bv32] [L597] CALL call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32] [L576-L583] ~head.base, ~head.offset := #in~head.base, #in~head.offset; [L577] ~len~0 := 0bv32; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head.base=1615373849bv32, ~head.offset=0bv32, ~len~0=0bv32] [L578-L581] assume !!(~head.base != 0bv32 || ~head.offset != 0bv32); [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32); [L580] ~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset; [L580] havoc #t~mem5.base, #t~mem5.offset; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head.base=2696972873bv32, ~head.offset=0bv32, ~len~0=1bv32] [L578-L581] assume !!(~head.base != 0bv32 || ~head.offset != 0bv32); [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32); [L580] ~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset; [L580] havoc #t~mem5.base, #t~mem5.offset; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head.base=1427127328bv32, ~head.offset=0bv32, ~len~0=2bv32] [L578-L581] assume !!(~head.base != 0bv32 || ~head.offset != 0bv32); [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32); [L580] ~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset; [L580] havoc #t~mem5.base, #t~mem5.offset; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head.base=0bv32, ~head.offset=0bv32, ~len~0=3bv32] [L578-L581] assume !(~head.base != 0bv32 || ~head.offset != 0bv32); VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head.base=0bv32, ~head.offset=0bv32, ~len~0=3bv32] [L582] #res := ~len~0; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #res=3bv32, ~head.base=0bv32, ~head.offset=0bv32, ~len~0=3bv32] [L576-L583] ensures true; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #res=3bv32, ~head.base=0bv32, ~head.offset=0bv32, ~len~0=3bv32] [L597] RET call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, #t~ret10=3bv32, ~len~1=2bv32, ~s~0.base=1615373849bv32, ~s~0.offset=0bv32] [L597-L599] assume ~len~1 != #t~ret10; [L597] havoc #t~ret10; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~len~1=2bv32, ~s~0.base=1615373849bv32, ~s~0.offset=0bv32] [L602] assert false; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~len~1=2bv32, ~s~0.base=1615373849bv32, ~s~0.offset=0bv32] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.preprocessor.BoogiePreprocessorBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32] [?] #NULL.base, #NULL.offset := 0bv32, 0bv32; [?] #valid := #valid[0bv32 := 0bv1]; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32] [?] ensures true; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32] [?] RET call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32] [?] CALL call #t~ret11 := main(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32] [L592] ~len~1 := 2bv32; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~len~1=2bv32] [L593-L595] assume !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7); [L593] havoc #t~nondet7; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~len~1=2bv32] [L596] CALL call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32] [L563-L575] ~len := #in~len; [L564] ~head~0.base, ~head~0.offset := 0bv32, 0bv32; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head~0.base=0bv32, ~head~0.offset=0bv32, ~len=3bv32] [L565-L573] assume !!~bvsgt32(~len, 0bv32); [L566] call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32); [L566] ~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1427127328bv32, #t~malloc2.offset=0bv32, ~head~0.base=0bv32, ~head~0.offset=0bv32, ~len=3bv32, ~new_head~0.base=1427127328bv32, ~new_head~0.offset=0bv32] [L567-L569] assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1427127328bv32, #t~malloc2.offset=0bv32, ~head~0.base=0bv32, ~head~0.offset=0bv32, ~len=3bv32, ~new_head~0.base=1427127328bv32, ~new_head~0.offset=0bv32] [L570] call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32); [L571] ~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1427127328bv32, #t~malloc2.offset=0bv32, ~head~0.base=1427127328bv32, ~head~0.offset=0bv32, ~len=2bv32, ~new_head~0.base=1427127328bv32, ~new_head~0.offset=0bv32] [L565-L573] assume !!~bvsgt32(~len, 0bv32); [L566] call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32); [L566] ~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=2696972873bv32, #t~malloc2.offset=0bv32, ~head~0.base=1427127328bv32, ~head~0.offset=0bv32, ~len=2bv32, ~new_head~0.base=2696972873bv32, ~new_head~0.offset=0bv32] [L567-L569] assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=2696972873bv32, #t~malloc2.offset=0bv32, ~head~0.base=1427127328bv32, ~head~0.offset=0bv32, ~len=2bv32, ~new_head~0.base=2696972873bv32, ~new_head~0.offset=0bv32] [L570] call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32); [L571] ~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=2696972873bv32, #t~malloc2.offset=0bv32, ~head~0.base=2696972873bv32, ~head~0.offset=0bv32, ~len=1bv32, ~new_head~0.base=2696972873bv32, ~new_head~0.offset=0bv32] [L565-L573] assume !!~bvsgt32(~len, 0bv32); [L566] call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32); [L566] ~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=2696972873bv32, ~head~0.offset=0bv32, ~len=1bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L567-L569] assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=2696972873bv32, ~head~0.offset=0bv32, ~len=1bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L570] call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32); [L571] ~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=1615373849bv32, ~head~0.offset=0bv32, ~len=0bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L565-L573] assume !~bvsgt32(~len, 0bv32); VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=1615373849bv32, ~head~0.offset=0bv32, ~len=0bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L574] #res.base, #res.offset := ~head~0.base, ~head~0.offset; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #res.base=1615373849bv32, #res.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=1615373849bv32, ~head~0.offset=0bv32, ~len=0bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L563-L575] ensures true; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #res.base=1615373849bv32, #res.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=1615373849bv32, ~head~0.offset=0bv32, ~len=0bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L596] RET call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, #t~ret9.base=1615373849bv32, #t~ret9.offset=0bv32, ~len~1=2bv32] [L596] ~s~0.base, ~s~0.offset := #t~ret9.base, #t~ret9.offset; [L596] havoc #t~ret9.base, #t~ret9.offset; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~len~1=2bv32, ~s~0.base=1615373849bv32, ~s~0.offset=0bv32] [L597] CALL call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32] [L576-L583] ~head.base, ~head.offset := #in~head.base, #in~head.offset; [L577] ~len~0 := 0bv32; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head.base=1615373849bv32, ~head.offset=0bv32, ~len~0=0bv32] [L578-L581] assume !!(~head.base != 0bv32 || ~head.offset != 0bv32); [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32); [L580] ~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset; [L580] havoc #t~mem5.base, #t~mem5.offset; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head.base=2696972873bv32, ~head.offset=0bv32, ~len~0=1bv32] [L578-L581] assume !!(~head.base != 0bv32 || ~head.offset != 0bv32); [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32); [L580] ~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset; [L580] havoc #t~mem5.base, #t~mem5.offset; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head.base=1427127328bv32, ~head.offset=0bv32, ~len~0=2bv32] [L578-L581] assume !!(~head.base != 0bv32 || ~head.offset != 0bv32); [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32); [L580] ~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset; [L580] havoc #t~mem5.base, #t~mem5.offset; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head.base=0bv32, ~head.offset=0bv32, ~len~0=3bv32] [L578-L581] assume !(~head.base != 0bv32 || ~head.offset != 0bv32); VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head.base=0bv32, ~head.offset=0bv32, ~len~0=3bv32] [L582] #res := ~len~0; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #res=3bv32, ~head.base=0bv32, ~head.offset=0bv32, ~len~0=3bv32] [L576-L583] ensures true; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #res=3bv32, ~head.base=0bv32, ~head.offset=0bv32, ~len~0=3bv32] [L597] RET call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, #t~ret10=3bv32, ~len~1=2bv32, ~s~0.base=1615373849bv32, ~s~0.offset=0bv32] [L597-L599] assume ~len~1 != #t~ret10; [L597] havoc #t~ret10; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~len~1=2bv32, ~s~0.base=1615373849bv32, ~s~0.offset=0bv32] [L602] assert false; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~len~1=2bv32, ~s~0.base=1615373849bv32, ~s~0.offset=0bv32] [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32] [?] CALL call #t~ret11 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32] [L592] ~len~1 := 2bv32; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32] [L593-L595] COND TRUE !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7) [L593] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32] [L596] CALL call #t~ret9 := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32] [L563-L575] ~len := #in~len; [L564] ~head~0 := { base: 0bv32, offset: 0bv32 }; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L565-L573] COND TRUE !~bvsgt32(~len, 0bv32) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L574] #res := ~head~0; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #res!base=1615373849bv32, #res!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L596] RET call #t~ret9 := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~ret9!base=1615373849bv32, #t~ret9!offset=0bv32, ~len~1=2bv32] [L596] ~s~0 := #t~ret9; [L596] havoc #t~ret9; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L597] CALL call #t~ret10 := sll_length(~s~0); VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32] [L576-L583] ~head := #in~head; [L577] ~len~0 := 0bv32; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=1615373849bv32, ~head!offset=0bv32, ~len~0=0bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=2696972873bv32, ~head!offset=0bv32, ~len~0=1bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=1427127328bv32, ~head!offset=0bv32, ~len~0=2bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L578-L581] COND TRUE !(~head != { base: 0bv32, offset: 0bv32 }) VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L582] #res := ~len~0; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #res=3bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L597] RET call #t~ret10 := sll_length(~s~0); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~ret10=3bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L597] COND TRUE ~len~1 != #t~ret10 [L597] havoc #t~ret10; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L602] assert false; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.procedureinliner.backtranslation.InlinerBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32] [?] CALL call #t~ret11 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32] [L592] ~len~1 := 2bv32; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32] [L593-L595] COND TRUE !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7) [L593] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32] [L596] CALL call #t~ret9 := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32] [L563-L575] ~len := #in~len; [L564] ~head~0 := { base: 0bv32, offset: 0bv32 }; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L565-L573] COND TRUE !~bvsgt32(~len, 0bv32) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L574] #res := ~head~0; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #res!base=1615373849bv32, #res!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L596] RET call #t~ret9 := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~ret9!base=1615373849bv32, #t~ret9!offset=0bv32, ~len~1=2bv32] [L596] ~s~0 := #t~ret9; [L596] havoc #t~ret9; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L597] CALL call #t~ret10 := sll_length(~s~0); VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32] [L576-L583] ~head := #in~head; [L577] ~len~0 := 0bv32; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=1615373849bv32, ~head!offset=0bv32, ~len~0=0bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=2696972873bv32, ~head!offset=0bv32, ~len~0=1bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=1427127328bv32, ~head!offset=0bv32, ~len~0=2bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L578-L581] COND TRUE !(~head != { base: 0bv32, offset: 0bv32 }) VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L582] #res := ~len~0; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #res=3bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L597] RET call #t~ret10 := sll_length(~s~0); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~ret10=3bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L597] COND TRUE ~len~1 != #t~ret10 [L597] havoc #t~ret10; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L602] assert false; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32] [?] CALL call #t~ret11 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32] [L592] ~len~1 := 2bv32; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32] [L593-L595] COND TRUE !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7) [L593] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32] [L596] CALL call #t~ret9 := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32] [L563-L575] ~len := #in~len; [L564] ~head~0 := { base: 0bv32, offset: 0bv32 }; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L565-L573] COND TRUE !~bvsgt32(~len, 0bv32) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L574] #res := ~head~0; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #res!base=1615373849bv32, #res!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L596] RET call #t~ret9 := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~ret9!base=1615373849bv32, #t~ret9!offset=0bv32, ~len~1=2bv32] [L596] ~s~0 := #t~ret9; [L596] havoc #t~ret9; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L597] CALL call #t~ret10 := sll_length(~s~0); VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32] [L576-L583] ~head := #in~head; [L577] ~len~0 := 0bv32; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=1615373849bv32, ~head!offset=0bv32, ~len~0=0bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=2696972873bv32, ~head!offset=0bv32, ~len~0=1bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=1427127328bv32, ~head!offset=0bv32, ~len~0=2bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L578-L581] COND TRUE !(~head != { base: 0bv32, offset: 0bv32 }) VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L582] #res := ~len~0; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #res=3bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L597] RET call #t~ret10 := sll_length(~s~0); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~ret10=3bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L597] COND TRUE ~len~1 != #t~ret10 [L597] havoc #t~ret10; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L602] assert false; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] ----- ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.CACSL2BoogieBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32] [?] CALL call #t~ret11 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32] [L592] ~len~1 := 2bv32; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32] [L593-L595] COND TRUE !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7) [L593] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32] [L596] CALL call #t~ret9 := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32] [L563-L575] ~len := #in~len; [L564] ~head~0 := { base: 0bv32, offset: 0bv32 }; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L565-L573] COND TRUE !~bvsgt32(~len, 0bv32) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L574] #res := ~head~0; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #res!base=1615373849bv32, #res!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L596] RET call #t~ret9 := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~ret9!base=1615373849bv32, #t~ret9!offset=0bv32, ~len~1=2bv32] [L596] ~s~0 := #t~ret9; [L596] havoc #t~ret9; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L597] CALL call #t~ret10 := sll_length(~s~0); VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32] [L576-L583] ~head := #in~head; [L577] ~len~0 := 0bv32; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=1615373849bv32, ~head!offset=0bv32, ~len~0=0bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=2696972873bv32, ~head!offset=0bv32, ~len~0=1bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=1427127328bv32, ~head!offset=0bv32, ~len~0=2bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L578-L581] COND TRUE !(~head != { base: 0bv32, offset: 0bv32 }) VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L582] #res := ~len~0; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #res=3bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L597] RET call #t~ret10 := sll_length(~s~0); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~ret10=3bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L597] COND TRUE ~len~1 != #t~ret10 [L597] havoc #t~ret10; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L602] assert false; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L592] int len = 2; VAL [len=2] [L593] COND FALSE !(len < 32 && __VERIFIER_nondet_int()) [L596] CALL, EXPR sll_create(len + 1) VAL [\old(len)=3] [L564] SLL head = ((void *)0); VAL [\old(len)=3, head={0:0}, len=3] [L565] COND TRUE len > 0 [L566] SLL new_head = (SLL) malloc(sizeof(struct node)); VAL [\old(len)=3, head={0:0}, len=3, malloc(sizeof(struct node))={1427127328:0}, new_head={1427127328:0}] [L567] COND FALSE !(((void *)0) == new_head) VAL [\old(len)=3, head={0:0}, len=3, malloc(sizeof(struct node))={1427127328:0}, new_head={1427127328:0}] [L570] new_head->next = head [L571] head = new_head [L572] len-- VAL [\old(len)=3, head={1427127328:0}, len=2, malloc(sizeof(struct node))={1427127328:0}, new_head={1427127328:0}] [L565] COND TRUE len > 0 [L566] SLL new_head = (SLL) malloc(sizeof(struct node)); VAL [\old(len)=3, head={1427127328:0}, len=2, malloc(sizeof(struct node))={-1597994423:0}, new_head={-1597994423:0}] [L567] COND FALSE !(((void *)0) == new_head) VAL [\old(len)=3, head={1427127328:0}, len=2, malloc(sizeof(struct node))={-1597994423:0}, new_head={-1597994423:0}] [L570] new_head->next = head [L571] head = new_head [L572] len-- VAL [\old(len)=3, head={-1597994423:0}, len=1, malloc(sizeof(struct node))={-1597994423:0}, new_head={-1597994423:0}] [L565] COND TRUE len > 0 [L566] SLL new_head = (SLL) malloc(sizeof(struct node)); VAL [\old(len)=3, head={-1597994423:0}, len=1, malloc(sizeof(struct node))={1615373849:0}, new_head={1615373849:0}] [L567] COND FALSE !(((void *)0) == new_head) VAL [\old(len)=3, head={-1597994423:0}, len=1, malloc(sizeof(struct node))={1615373849:0}, new_head={1615373849:0}] [L570] new_head->next = head [L571] head = new_head [L572] len-- VAL [\old(len)=3, head={1615373849:0}, len=0, malloc(sizeof(struct node))={1615373849:0}, new_head={1615373849:0}] [L565] COND FALSE !(len > 0) VAL [\old(len)=3, head={1615373849:0}, len=0, malloc(sizeof(struct node))={1615373849:0}, new_head={1615373849:0}] [L574] return head; VAL [\old(len)=3, \result={1615373849:0}, head={1615373849:0}, len=0, malloc(sizeof(struct node))={1615373849:0}, new_head={1615373849:0}] [L596] RET, EXPR sll_create(len + 1) VAL [len=2, sll_create(len + 1)={1615373849:0}] [L596] SLL s = sll_create(len + 1); [L597] CALL, EXPR sll_length(s) VAL [head={1615373849:0}] [L577] int len = 0; VAL [head={1615373849:0}, head={1615373849:0}, len=0] [L578] COND TRUE \read(head) [L579] len++ [L580] EXPR head->next [L580] head = head->next [L578] COND TRUE \read(head) [L579] len++ [L580] EXPR head->next [L580] head = head->next [L578] COND TRUE \read(head) [L579] len++ [L580] EXPR head->next [L580] head = head->next [L578] COND FALSE !(\read(head)) VAL [head={1615373849:0}, head={0:0}, len=3] [L582] return len; VAL [\result=3, head={1615373849:0}, head={0:0}, len=3] [L597] RET, EXPR sll_length(s) VAL [len=2, s={1615373849:0}, sll_length(s)=3] [L597] COND TRUE len != sll_length(s) [L602] __VERIFIER_error() VAL [len=2, s={1615373849:0}] ----- [2018-11-23 11:21:21,129 WARN L170 areAnnotationChecker]: exitENTRY has no Hoare annotation [2018-11-23 11:21:21,129 WARN L170 areAnnotationChecker]: ULTIMATE.initENTRY has no Hoare annotation [2018-11-23 11:21:21,130 WARN L170 areAnnotationChecker]: sll_destroyENTRY has no Hoare annotation [2018-11-23 11:21:21,130 WARN L170 areAnnotationChecker]: sll_createENTRY has no Hoare annotation [2018-11-23 11:21:21,130 WARN L170 areAnnotationChecker]: ULTIMATE.startENTRY has no Hoare annotation [2018-11-23 11:21:21,130 WARN L170 areAnnotationChecker]: ULTIMATE.startENTRY has no Hoare annotation [2018-11-23 11:21:21,130 WARN L170 areAnnotationChecker]: mainENTRY has no Hoare annotation [2018-11-23 11:21:21,130 WARN L170 areAnnotationChecker]: sll_lengthENTRY has no Hoare annotation [2018-11-23 11:21:21,130 WARN L170 areAnnotationChecker]: L561 has no Hoare annotation [2018-11-23 11:21:21,130 WARN L170 areAnnotationChecker]: ULTIMATE.initFINAL has no Hoare annotation [2018-11-23 11:21:21,131 WARN L170 areAnnotationChecker]: L585-2 has no Hoare annotation [2018-11-23 11:21:21,131 WARN L170 areAnnotationChecker]: L585-2 has no Hoare annotation [2018-11-23 11:21:21,131 WARN L170 areAnnotationChecker]: L585-2 has no Hoare annotation [2018-11-23 11:21:21,131 WARN L170 areAnnotationChecker]: L565-2 has no Hoare annotation [2018-11-23 11:21:21,131 WARN L170 areAnnotationChecker]: L565-2 has no Hoare annotation [2018-11-23 11:21:21,131 WARN L170 areAnnotationChecker]: L565-2 has no Hoare annotation [2018-11-23 11:21:21,131 WARN L170 areAnnotationChecker]: L-1 has no Hoare annotation [2018-11-23 11:21:21,131 WARN L170 areAnnotationChecker]: L-1 has no Hoare annotation [2018-11-23 11:21:21,131 WARN L170 areAnnotationChecker]: L593-2 has no Hoare annotation [2018-11-23 11:21:21,132 WARN L170 areAnnotationChecker]: L593-2 has no Hoare annotation [2018-11-23 11:21:21,132 WARN L170 areAnnotationChecker]: L593-2 has no Hoare annotation [2018-11-23 11:21:21,132 WARN L170 areAnnotationChecker]: L578-2 has no Hoare annotation [2018-11-23 11:21:21,132 WARN L170 areAnnotationChecker]: L578-2 has no Hoare annotation [2018-11-23 11:21:21,132 WARN L170 areAnnotationChecker]: L578-2 has no Hoare annotation [2018-11-23 11:21:21,132 WARN L170 areAnnotationChecker]: ULTIMATE.initEXIT has no Hoare annotation [2018-11-23 11:21:21,132 WARN L170 areAnnotationChecker]: L585-3 has no Hoare annotation [2018-11-23 11:21:21,132 WARN L170 areAnnotationChecker]: L565-3 has no Hoare annotation [2018-11-23 11:21:21,132 WARN L170 areAnnotationChecker]: L567 has no Hoare annotation [2018-11-23 11:21:21,133 WARN L170 areAnnotationChecker]: L567 has no Hoare annotation [2018-11-23 11:21:21,133 WARN L170 areAnnotationChecker]: ULTIMATE.startFINAL has no Hoare annotation [2018-11-23 11:21:21,133 WARN L170 areAnnotationChecker]: L593-3 has no Hoare annotation [2018-11-23 11:21:21,133 WARN L170 areAnnotationChecker]: L593-3 has no Hoare annotation [2018-11-23 11:21:21,133 WARN L170 areAnnotationChecker]: L578-3 has no Hoare annotation [2018-11-23 11:21:21,133 WARN L170 areAnnotationChecker]: sll_destroyEXIT has no Hoare annotation [2018-11-23 11:21:21,133 WARN L170 areAnnotationChecker]: sll_createFINAL has no Hoare annotation [2018-11-23 11:21:21,133 WARN L170 areAnnotationChecker]: L568 has no Hoare annotation [2018-11-23 11:21:21,133 WARN L170 areAnnotationChecker]: L568 has no Hoare annotation [2018-11-23 11:21:21,134 WARN L170 areAnnotationChecker]: L567-1 has no Hoare annotation [2018-11-23 11:21:21,134 WARN L170 areAnnotationChecker]: L596 has no Hoare annotation [2018-11-23 11:21:21,134 WARN L170 areAnnotationChecker]: sll_lengthFINAL has no Hoare annotation [2018-11-23 11:21:21,134 WARN L170 areAnnotationChecker]: L600-1 has no Hoare annotation [2018-11-23 11:21:21,134 WARN L170 areAnnotationChecker]: sll_createEXIT has no Hoare annotation [2018-11-23 11:21:21,134 WARN L170 areAnnotationChecker]: L597 has no Hoare annotation [2018-11-23 11:21:21,134 WARN L170 areAnnotationChecker]: L597 has no Hoare annotation [2018-11-23 11:21:21,134 WARN L170 areAnnotationChecker]: sll_lengthEXIT has no Hoare annotation [2018-11-23 11:21:21,134 WARN L170 areAnnotationChecker]: mainFINAL has no Hoare annotation [2018-11-23 11:21:21,135 WARN L170 areAnnotationChecker]: L597-1 has no Hoare annotation [2018-11-23 11:21:21,135 WARN L170 areAnnotationChecker]: L597-1 has no Hoare annotation [2018-11-23 11:21:21,135 WARN L170 areAnnotationChecker]: mainEXIT has no Hoare annotation [2018-11-23 11:21:21,135 WARN L170 areAnnotationChecker]: L598 has no Hoare annotation [2018-11-23 11:21:21,135 WARN L170 areAnnotationChecker]: L598 has no Hoare annotation [2018-11-23 11:21:21,135 WARN L170 areAnnotationChecker]: L600 has no Hoare annotation [2018-11-23 11:21:21,135 WARN L170 areAnnotationChecker]: L600 has no Hoare annotation [2018-11-23 11:21:21,135 INFO L163 areAnnotationChecker]: CFG has 0 edges. 0 inductive. 0 not inductive. 0 times theorem prover too weak to decide inductivity. 0 times interpolants missing. [2018-11-23 11:21:21,137 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 23.11 11:21:21 BoogieIcfgContainer [2018-11-23 11:21:21,137 INFO L132 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2018-11-23 11:21:21,138 INFO L113 PluginConnector]: ------------------------Witness Printer---------------------------- [2018-11-23 11:21:21,138 INFO L271 PluginConnector]: Initializing Witness Printer... [2018-11-23 11:21:21,138 INFO L276 PluginConnector]: Witness Printer initialized [2018-11-23 11:21:21,139 INFO L185 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 11:20:53" (3/4) ... [2018-11-23 11:21:21,141 INFO L138 WitnessPrinter]: Generating witness for reachability counterexample ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder.RCFGBacktranslator [?] CALL call ULTIMATE.init(); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |old(#NULL.base)|=(_ bv0 32), |old(#NULL.offset)|=(_ bv0 32)] [?] #NULL.base, #NULL.offset := 0bv32, 0bv32;#valid := #valid[0bv32 := 0bv1]; VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |old(#NULL.base)|=(_ bv0 32), |old(#NULL.offset)|=(_ bv0 32)] [?] assume true; VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |old(#NULL.base)|=(_ bv0 32), |old(#NULL.offset)|=(_ bv0 32)] [?] RET #91#return; VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32)] [?] CALL call #t~ret11 := main(); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32)] [?] ~len~1 := 2bv32; VAL [main_~len~1=(_ bv2 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32)] [?] assume !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7);havoc #t~nondet7; VAL [main_~len~1=(_ bv2 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32)] [?] CALL call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32)] [?] ~len := #in~len;~head~0.base, ~head~0.offset := 0bv32, 0bv32; VAL [sll_create_~head~0.base=(_ bv0 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv3 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32)] [?] assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; VAL [sll_create_~head~0.base=(_ bv0 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv3 32), sll_create_~new_head~0.base=(_ bv1427127328 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#t~malloc2.base|=(_ bv1427127328 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); VAL [sll_create_~head~0.base=(_ bv0 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv3 32), sll_create_~new_head~0.base=(_ bv1427127328 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#t~malloc2.base|=(_ bv1427127328 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; VAL [sll_create_~head~0.base=(_ bv1427127328 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv2 32), sll_create_~new_head~0.base=(_ bv1427127328 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#t~malloc2.base|=(_ bv1427127328 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; VAL [sll_create_~head~0.base=(_ bv1427127328 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv2 32), sll_create_~new_head~0.base=(_ bv2696972873 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#t~malloc2.base|=(_ bv2696972873 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); VAL [sll_create_~head~0.base=(_ bv1427127328 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv2 32), sll_create_~new_head~0.base=(_ bv2696972873 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#t~malloc2.base|=(_ bv2696972873 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; VAL [sll_create_~head~0.base=(_ bv2696972873 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv1 32), sll_create_~new_head~0.base=(_ bv2696972873 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#t~malloc2.base|=(_ bv2696972873 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] assume !!~bvsgt32(~len, 0bv32);call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32);~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; VAL [sll_create_~head~0.base=(_ bv2696972873 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv1 32), sll_create_~new_head~0.base=(_ bv1615373849 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#t~malloc2.base|=(_ bv1615373849 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); VAL [sll_create_~head~0.base=(_ bv2696972873 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv1 32), sll_create_~new_head~0.base=(_ bv1615373849 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#t~malloc2.base|=(_ bv1615373849 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32);~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset;#t~post3 := ~len;~len := ~bvsub32(#t~post3, 1bv32);havoc #t~post3; VAL [sll_create_~head~0.base=(_ bv1615373849 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv0 32), sll_create_~new_head~0.base=(_ bv1615373849 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#t~malloc2.base|=(_ bv1615373849 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] assume !~bvsgt32(~len, 0bv32); VAL [sll_create_~head~0.base=(_ bv1615373849 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv0 32), sll_create_~new_head~0.base=(_ bv1615373849 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#t~malloc2.base|=(_ bv1615373849 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] #res.base, #res.offset := ~head~0.base, ~head~0.offset; VAL [sll_create_~head~0.base=(_ bv1615373849 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv0 32), sll_create_~new_head~0.base=(_ bv1615373849 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#res.base|=(_ bv1615373849 32), |sll_create_#res.offset|=(_ bv0 32), |sll_create_#t~malloc2.base|=(_ bv1615373849 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] assume true; VAL [sll_create_~head~0.base=(_ bv1615373849 32), sll_create_~head~0.offset=(_ bv0 32), sll_create_~len=(_ bv0 32), sll_create_~new_head~0.base=(_ bv1615373849 32), sll_create_~new_head~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_create_#in~len|=(_ bv3 32), |sll_create_#res.base|=(_ bv1615373849 32), |sll_create_#res.offset|=(_ bv0 32), |sll_create_#t~malloc2.base|=(_ bv1615373849 32), |sll_create_#t~malloc2.offset|=(_ bv0 32)] [?] RET #95#return; VAL [main_~len~1=(_ bv2 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |main_#t~ret9.base|=(_ bv1615373849 32), |main_#t~ret9.offset|=(_ bv0 32)] [?] ~s~0.base, ~s~0.offset := #t~ret9.base, #t~ret9.offset;havoc #t~ret9.base, #t~ret9.offset; VAL [main_~len~1=(_ bv2 32), main_~s~0.base=(_ bv1615373849 32), main_~s~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32)] [?] CALL call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); VAL [|#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_length_#in~head.base|=(_ bv1615373849 32), |sll_length_#in~head.offset|=(_ bv0 32)] [?] ~head.base, ~head.offset := #in~head.base, #in~head.offset;~len~0 := 0bv32; VAL [sll_length_~head.base=(_ bv1615373849 32), sll_length_~head.offset=(_ bv0 32), sll_length_~len~0=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_length_#in~head.base|=(_ bv1615373849 32), |sll_length_#in~head.offset|=(_ bv0 32)] [?] assume !!(~head.base != 0bv32 || ~head.offset != 0bv32);#t~post4 := ~len~0;~len~0 := ~bvadd32(1bv32, #t~post4);havoc #t~post4;call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32);~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset;havoc #t~mem5.base, #t~mem5.offset; VAL [sll_length_~head.base=(_ bv2696972873 32), sll_length_~head.offset=(_ bv0 32), sll_length_~len~0=(_ bv1 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_length_#in~head.base|=(_ bv1615373849 32), |sll_length_#in~head.offset|=(_ bv0 32)] [?] assume !!(~head.base != 0bv32 || ~head.offset != 0bv32);#t~post4 := ~len~0;~len~0 := ~bvadd32(1bv32, #t~post4);havoc #t~post4;call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32);~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset;havoc #t~mem5.base, #t~mem5.offset; VAL [sll_length_~head.base=(_ bv1427127328 32), sll_length_~head.offset=(_ bv0 32), sll_length_~len~0=(_ bv2 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_length_#in~head.base|=(_ bv1615373849 32), |sll_length_#in~head.offset|=(_ bv0 32)] [?] assume !!(~head.base != 0bv32 || ~head.offset != 0bv32);#t~post4 := ~len~0;~len~0 := ~bvadd32(1bv32, #t~post4);havoc #t~post4;call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32);~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset;havoc #t~mem5.base, #t~mem5.offset; VAL [sll_length_~head.base=(_ bv0 32), sll_length_~head.offset=(_ bv0 32), sll_length_~len~0=(_ bv3 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_length_#in~head.base|=(_ bv1615373849 32), |sll_length_#in~head.offset|=(_ bv0 32)] [?] assume !(~head.base != 0bv32 || ~head.offset != 0bv32); VAL [sll_length_~head.base=(_ bv0 32), sll_length_~head.offset=(_ bv0 32), sll_length_~len~0=(_ bv3 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_length_#in~head.base|=(_ bv1615373849 32), |sll_length_#in~head.offset|=(_ bv0 32)] [?] #res := ~len~0; VAL [sll_length_~head.base=(_ bv0 32), sll_length_~head.offset=(_ bv0 32), sll_length_~len~0=(_ bv3 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_length_#in~head.base|=(_ bv1615373849 32), |sll_length_#in~head.offset|=(_ bv0 32), |sll_length_#res|=(_ bv3 32)] [?] assume true; VAL [sll_length_~head.base=(_ bv0 32), sll_length_~head.offset=(_ bv0 32), sll_length_~len~0=(_ bv3 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |sll_length_#in~head.base|=(_ bv1615373849 32), |sll_length_#in~head.offset|=(_ bv0 32), |sll_length_#res|=(_ bv3 32)] [?] RET #97#return; VAL [main_~len~1=(_ bv2 32), main_~s~0.base=(_ bv1615373849 32), main_~s~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32), |main_#t~ret10|=(_ bv3 32)] [?] assume ~len~1 != #t~ret10;havoc #t~ret10; VAL [main_~len~1=(_ bv2 32), main_~s~0.base=(_ bv1615373849 32), main_~s~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32)] [?] assume !false; VAL [main_~len~1=(_ bv2 32), main_~s~0.base=(_ bv1615373849 32), main_~s~0.offset=(_ bv0 32), |#NULL.base|=(_ bv0 32), |#NULL.offset|=(_ bv0 32)] [?] CALL call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32] [?] #NULL.base, #NULL.offset := 0bv32, 0bv32; [?] #valid := #valid[0bv32 := 0bv1]; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32] [?] ensures true; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32] [?] RET call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32] [?] CALL call #t~ret11 := main(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32] [L592] ~len~1 := 2bv32; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~len~1=2bv32] [L593-L595] assume !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7); [L593] havoc #t~nondet7; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~len~1=2bv32] [L596] CALL call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32] [L563-L575] ~len := #in~len; [L564] ~head~0.base, ~head~0.offset := 0bv32, 0bv32; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head~0.base=0bv32, ~head~0.offset=0bv32, ~len=3bv32] [L565-L573] assume !!~bvsgt32(~len, 0bv32); [L566] call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32); [L566] ~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1427127328bv32, #t~malloc2.offset=0bv32, ~head~0.base=0bv32, ~head~0.offset=0bv32, ~len=3bv32, ~new_head~0.base=1427127328bv32, ~new_head~0.offset=0bv32] [L567-L569] assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1427127328bv32, #t~malloc2.offset=0bv32, ~head~0.base=0bv32, ~head~0.offset=0bv32, ~len=3bv32, ~new_head~0.base=1427127328bv32, ~new_head~0.offset=0bv32] [L570] call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32); [L571] ~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1427127328bv32, #t~malloc2.offset=0bv32, ~head~0.base=1427127328bv32, ~head~0.offset=0bv32, ~len=2bv32, ~new_head~0.base=1427127328bv32, ~new_head~0.offset=0bv32] [L565-L573] assume !!~bvsgt32(~len, 0bv32); [L566] call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32); [L566] ~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=2696972873bv32, #t~malloc2.offset=0bv32, ~head~0.base=1427127328bv32, ~head~0.offset=0bv32, ~len=2bv32, ~new_head~0.base=2696972873bv32, ~new_head~0.offset=0bv32] [L567-L569] assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=2696972873bv32, #t~malloc2.offset=0bv32, ~head~0.base=1427127328bv32, ~head~0.offset=0bv32, ~len=2bv32, ~new_head~0.base=2696972873bv32, ~new_head~0.offset=0bv32] [L570] call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32); [L571] ~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=2696972873bv32, #t~malloc2.offset=0bv32, ~head~0.base=2696972873bv32, ~head~0.offset=0bv32, ~len=1bv32, ~new_head~0.base=2696972873bv32, ~new_head~0.offset=0bv32] [L565-L573] assume !!~bvsgt32(~len, 0bv32); [L566] call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32); [L566] ~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=2696972873bv32, ~head~0.offset=0bv32, ~len=1bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L567-L569] assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=2696972873bv32, ~head~0.offset=0bv32, ~len=1bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L570] call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32); [L571] ~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=1615373849bv32, ~head~0.offset=0bv32, ~len=0bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L565-L573] assume !~bvsgt32(~len, 0bv32); VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=1615373849bv32, ~head~0.offset=0bv32, ~len=0bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L574] #res.base, #res.offset := ~head~0.base, ~head~0.offset; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #res.base=1615373849bv32, #res.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=1615373849bv32, ~head~0.offset=0bv32, ~len=0bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L563-L575] ensures true; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #res.base=1615373849bv32, #res.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=1615373849bv32, ~head~0.offset=0bv32, ~len=0bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L596] RET call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, #t~ret9.base=1615373849bv32, #t~ret9.offset=0bv32, ~len~1=2bv32] [L596] ~s~0.base, ~s~0.offset := #t~ret9.base, #t~ret9.offset; [L596] havoc #t~ret9.base, #t~ret9.offset; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~len~1=2bv32, ~s~0.base=1615373849bv32, ~s~0.offset=0bv32] [L597] CALL call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32] [L576-L583] ~head.base, ~head.offset := #in~head.base, #in~head.offset; [L577] ~len~0 := 0bv32; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head.base=1615373849bv32, ~head.offset=0bv32, ~len~0=0bv32] [L578-L581] assume !!(~head.base != 0bv32 || ~head.offset != 0bv32); [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32); [L580] ~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset; [L580] havoc #t~mem5.base, #t~mem5.offset; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head.base=2696972873bv32, ~head.offset=0bv32, ~len~0=1bv32] [L578-L581] assume !!(~head.base != 0bv32 || ~head.offset != 0bv32); [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32); [L580] ~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset; [L580] havoc #t~mem5.base, #t~mem5.offset; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head.base=1427127328bv32, ~head.offset=0bv32, ~len~0=2bv32] [L578-L581] assume !!(~head.base != 0bv32 || ~head.offset != 0bv32); [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32); [L580] ~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset; [L580] havoc #t~mem5.base, #t~mem5.offset; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head.base=0bv32, ~head.offset=0bv32, ~len~0=3bv32] [L578-L581] assume !(~head.base != 0bv32 || ~head.offset != 0bv32); VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head.base=0bv32, ~head.offset=0bv32, ~len~0=3bv32] [L582] #res := ~len~0; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #res=3bv32, ~head.base=0bv32, ~head.offset=0bv32, ~len~0=3bv32] [L576-L583] ensures true; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #res=3bv32, ~head.base=0bv32, ~head.offset=0bv32, ~len~0=3bv32] [L597] RET call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, #t~ret10=3bv32, ~len~1=2bv32, ~s~0.base=1615373849bv32, ~s~0.offset=0bv32] [L597-L599] assume ~len~1 != #t~ret10; [L597] havoc #t~ret10; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~len~1=2bv32, ~s~0.base=1615373849bv32, ~s~0.offset=0bv32] [L602] assert false; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~len~1=2bv32, ~s~0.base=1615373849bv32, ~s~0.offset=0bv32] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.preprocessor.BoogiePreprocessorBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32] [?] #NULL.base, #NULL.offset := 0bv32, 0bv32; [?] #valid := #valid[0bv32 := 0bv1]; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32] [?] ensures true; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, old(#NULL.base)=0bv32, old(#NULL.offset)=0bv32] [?] RET call ULTIMATE.init(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32] [?] CALL call #t~ret11 := main(); VAL [#NULL.base=0bv32, #NULL.offset=0bv32] [L592] ~len~1 := 2bv32; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~len~1=2bv32] [L593-L595] assume !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7); [L593] havoc #t~nondet7; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~len~1=2bv32] [L596] CALL call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32] [L563-L575] ~len := #in~len; [L564] ~head~0.base, ~head~0.offset := 0bv32, 0bv32; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head~0.base=0bv32, ~head~0.offset=0bv32, ~len=3bv32] [L565-L573] assume !!~bvsgt32(~len, 0bv32); [L566] call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32); [L566] ~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1427127328bv32, #t~malloc2.offset=0bv32, ~head~0.base=0bv32, ~head~0.offset=0bv32, ~len=3bv32, ~new_head~0.base=1427127328bv32, ~new_head~0.offset=0bv32] [L567-L569] assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1427127328bv32, #t~malloc2.offset=0bv32, ~head~0.base=0bv32, ~head~0.offset=0bv32, ~len=3bv32, ~new_head~0.base=1427127328bv32, ~new_head~0.offset=0bv32] [L570] call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32); [L571] ~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1427127328bv32, #t~malloc2.offset=0bv32, ~head~0.base=1427127328bv32, ~head~0.offset=0bv32, ~len=2bv32, ~new_head~0.base=1427127328bv32, ~new_head~0.offset=0bv32] [L565-L573] assume !!~bvsgt32(~len, 0bv32); [L566] call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32); [L566] ~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=2696972873bv32, #t~malloc2.offset=0bv32, ~head~0.base=1427127328bv32, ~head~0.offset=0bv32, ~len=2bv32, ~new_head~0.base=2696972873bv32, ~new_head~0.offset=0bv32] [L567-L569] assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=2696972873bv32, #t~malloc2.offset=0bv32, ~head~0.base=1427127328bv32, ~head~0.offset=0bv32, ~len=2bv32, ~new_head~0.base=2696972873bv32, ~new_head~0.offset=0bv32] [L570] call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32); [L571] ~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=2696972873bv32, #t~malloc2.offset=0bv32, ~head~0.base=2696972873bv32, ~head~0.offset=0bv32, ~len=1bv32, ~new_head~0.base=2696972873bv32, ~new_head~0.offset=0bv32] [L565-L573] assume !!~bvsgt32(~len, 0bv32); [L566] call #t~malloc2.base, #t~malloc2.offset := #Ultimate.alloc(4bv32); [L566] ~new_head~0.base, ~new_head~0.offset := #t~malloc2.base, #t~malloc2.offset; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=2696972873bv32, ~head~0.offset=0bv32, ~len=1bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L567-L569] assume !(0bv32 == ~new_head~0.base && 0bv32 == ~new_head~0.offset); VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=2696972873bv32, ~head~0.offset=0bv32, ~len=1bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L570] call write~$Pointer$(~head~0.base, ~head~0.offset, ~new_head~0.base, ~new_head~0.offset, 4bv32); [L571] ~head~0.base, ~head~0.offset := ~new_head~0.base, ~new_head~0.offset; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=1615373849bv32, ~head~0.offset=0bv32, ~len=0bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L565-L573] assume !~bvsgt32(~len, 0bv32); VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=1615373849bv32, ~head~0.offset=0bv32, ~len=0bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L574] #res.base, #res.offset := ~head~0.base, ~head~0.offset; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #res.base=1615373849bv32, #res.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=1615373849bv32, ~head~0.offset=0bv32, ~len=0bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L563-L575] ensures true; VAL [#in~len=3bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #res.base=1615373849bv32, #res.offset=0bv32, #t~malloc2.base=1615373849bv32, #t~malloc2.offset=0bv32, ~head~0.base=1615373849bv32, ~head~0.offset=0bv32, ~len=0bv32, ~new_head~0.base=1615373849bv32, ~new_head~0.offset=0bv32] [L596] RET call #t~ret9.base, #t~ret9.offset := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, #t~ret9.base=1615373849bv32, #t~ret9.offset=0bv32, ~len~1=2bv32] [L596] ~s~0.base, ~s~0.offset := #t~ret9.base, #t~ret9.offset; [L596] havoc #t~ret9.base, #t~ret9.offset; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~len~1=2bv32, ~s~0.base=1615373849bv32, ~s~0.offset=0bv32] [L597] CALL call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32] [L576-L583] ~head.base, ~head.offset := #in~head.base, #in~head.offset; [L577] ~len~0 := 0bv32; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head.base=1615373849bv32, ~head.offset=0bv32, ~len~0=0bv32] [L578-L581] assume !!(~head.base != 0bv32 || ~head.offset != 0bv32); [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32); [L580] ~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset; [L580] havoc #t~mem5.base, #t~mem5.offset; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head.base=2696972873bv32, ~head.offset=0bv32, ~len~0=1bv32] [L578-L581] assume !!(~head.base != 0bv32 || ~head.offset != 0bv32); [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32); [L580] ~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset; [L580] havoc #t~mem5.base, #t~mem5.offset; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head.base=1427127328bv32, ~head.offset=0bv32, ~len~0=2bv32] [L578-L581] assume !!(~head.base != 0bv32 || ~head.offset != 0bv32); [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] call #t~mem5.base, #t~mem5.offset := read~$Pointer$(~head.base, ~head.offset, 4bv32); [L580] ~head.base, ~head.offset := #t~mem5.base, #t~mem5.offset; [L580] havoc #t~mem5.base, #t~mem5.offset; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head.base=0bv32, ~head.offset=0bv32, ~len~0=3bv32] [L578-L581] assume !(~head.base != 0bv32 || ~head.offset != 0bv32); VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, ~head.base=0bv32, ~head.offset=0bv32, ~len~0=3bv32] [L582] #res := ~len~0; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #res=3bv32, ~head.base=0bv32, ~head.offset=0bv32, ~len~0=3bv32] [L576-L583] ensures true; VAL [#in~head.base=1615373849bv32, #in~head.offset=0bv32, #NULL.base=0bv32, #NULL.offset=0bv32, #res=3bv32, ~head.base=0bv32, ~head.offset=0bv32, ~len~0=3bv32] [L597] RET call #t~ret10 := sll_length(~s~0.base, ~s~0.offset); VAL [#NULL.base=0bv32, #NULL.offset=0bv32, #t~ret10=3bv32, ~len~1=2bv32, ~s~0.base=1615373849bv32, ~s~0.offset=0bv32] [L597-L599] assume ~len~1 != #t~ret10; [L597] havoc #t~ret10; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~len~1=2bv32, ~s~0.base=1615373849bv32, ~s~0.offset=0bv32] [L602] assert false; VAL [#NULL.base=0bv32, #NULL.offset=0bv32, ~len~1=2bv32, ~s~0.base=1615373849bv32, ~s~0.offset=0bv32] [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32] [?] CALL call #t~ret11 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32] [L592] ~len~1 := 2bv32; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32] [L593-L595] COND TRUE !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7) [L593] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32] [L596] CALL call #t~ret9 := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32] [L563-L575] ~len := #in~len; [L564] ~head~0 := { base: 0bv32, offset: 0bv32 }; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L565-L573] COND TRUE !~bvsgt32(~len, 0bv32) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L574] #res := ~head~0; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #res!base=1615373849bv32, #res!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L596] RET call #t~ret9 := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~ret9!base=1615373849bv32, #t~ret9!offset=0bv32, ~len~1=2bv32] [L596] ~s~0 := #t~ret9; [L596] havoc #t~ret9; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L597] CALL call #t~ret10 := sll_length(~s~0); VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32] [L576-L583] ~head := #in~head; [L577] ~len~0 := 0bv32; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=1615373849bv32, ~head!offset=0bv32, ~len~0=0bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=2696972873bv32, ~head!offset=0bv32, ~len~0=1bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=1427127328bv32, ~head!offset=0bv32, ~len~0=2bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L578-L581] COND TRUE !(~head != { base: 0bv32, offset: 0bv32 }) VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L582] #res := ~len~0; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #res=3bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L597] RET call #t~ret10 := sll_length(~s~0); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~ret10=3bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L597] COND TRUE ~len~1 != #t~ret10 [L597] havoc #t~ret10; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L602] assert false; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.procedureinliner.backtranslation.InlinerBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32] [?] CALL call #t~ret11 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32] [L592] ~len~1 := 2bv32; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32] [L593-L595] COND TRUE !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7) [L593] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32] [L596] CALL call #t~ret9 := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32] [L563-L575] ~len := #in~len; [L564] ~head~0 := { base: 0bv32, offset: 0bv32 }; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L565-L573] COND TRUE !~bvsgt32(~len, 0bv32) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L574] #res := ~head~0; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #res!base=1615373849bv32, #res!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L596] RET call #t~ret9 := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~ret9!base=1615373849bv32, #t~ret9!offset=0bv32, ~len~1=2bv32] [L596] ~s~0 := #t~ret9; [L596] havoc #t~ret9; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L597] CALL call #t~ret10 := sll_length(~s~0); VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32] [L576-L583] ~head := #in~head; [L577] ~len~0 := 0bv32; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=1615373849bv32, ~head!offset=0bv32, ~len~0=0bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=2696972873bv32, ~head!offset=0bv32, ~len~0=1bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=1427127328bv32, ~head!offset=0bv32, ~len~0=2bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L578-L581] COND TRUE !(~head != { base: 0bv32, offset: 0bv32 }) VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L582] #res := ~len~0; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #res=3bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L597] RET call #t~ret10 := sll_length(~s~0); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~ret10=3bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L597] COND TRUE ~len~1 != #t~ret10 [L597] havoc #t~ret10; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L602] assert false; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32] [?] CALL call #t~ret11 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32] [L592] ~len~1 := 2bv32; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32] [L593-L595] COND TRUE !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7) [L593] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32] [L596] CALL call #t~ret9 := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32] [L563-L575] ~len := #in~len; [L564] ~head~0 := { base: 0bv32, offset: 0bv32 }; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L565-L573] COND TRUE !~bvsgt32(~len, 0bv32) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L574] #res := ~head~0; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #res!base=1615373849bv32, #res!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L596] RET call #t~ret9 := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~ret9!base=1615373849bv32, #t~ret9!offset=0bv32, ~len~1=2bv32] [L596] ~s~0 := #t~ret9; [L596] havoc #t~ret9; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L597] CALL call #t~ret10 := sll_length(~s~0); VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32] [L576-L583] ~head := #in~head; [L577] ~len~0 := 0bv32; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=1615373849bv32, ~head!offset=0bv32, ~len~0=0bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=2696972873bv32, ~head!offset=0bv32, ~len~0=1bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=1427127328bv32, ~head!offset=0bv32, ~len~0=2bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L578-L581] COND TRUE !(~head != { base: 0bv32, offset: 0bv32 }) VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L582] #res := ~len~0; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #res=3bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L597] RET call #t~ret10 := sll_length(~s~0); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~ret10=3bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L597] COND TRUE ~len~1 != #t~ret10 [L597] havoc #t~ret10; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L602] assert false; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] ----- ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.CACSL2BoogieBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32] [?] #NULL := { base: 0bv32, offset: 0bv32 }; [?] #valid[0bv32] := 0bv1; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, old(#NULL!base)=0bv32, old(#NULL!offset)=0bv32] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32] [?] CALL call #t~ret11 := main(); VAL [#NULL!base=0bv32, #NULL!offset=0bv32] [L592] ~len~1 := 2bv32; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32] [L593-L595] COND TRUE !(~bvslt32(~len~1, 32bv32) && 0bv32 != #t~nondet7) [L593] havoc #t~nondet7; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32] [L596] CALL call #t~ret9 := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32] [L563-L575] ~len := #in~len; [L564] ~head~0 := { base: 0bv32, offset: 0bv32 }; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=0bv32, ~head~0!offset=0bv32, ~len=3bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1427127328bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=1427127328bv32, ~new_head~0!offset=0bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=1427127328bv32, ~head~0!offset=0bv32, ~len=2bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=2696972873bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=2696972873bv32, ~new_head~0!offset=0bv32] [L565-L573] COND FALSE !(!~bvsgt32(~len, 0bv32)) [L566] FCALL call #t~malloc2 := #Ultimate.alloc(4bv32); [L566] ~new_head~0 := #t~malloc2; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L567] COND FALSE !({ base: 0bv32, offset: 0bv32 } == ~new_head~0) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=2696972873bv32, ~head~0!offset=0bv32, ~len=1bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L570] FCALL call write~$Pointer$(~head~0, { base: ~new_head~0!base, offset: ~new_head~0!offset }, 4bv32); [L571] ~head~0 := ~new_head~0; [L572] #t~post3 := ~len; [L572] ~len := ~bvsub32(#t~post3, 1bv32); [L572] havoc #t~post3; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L565-L573] COND TRUE !~bvsgt32(~len, 0bv32) VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L574] #res := ~head~0; VAL [#in~len=3bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #res!base=1615373849bv32, #res!offset=0bv32, #t~malloc2!base=1615373849bv32, #t~malloc2!offset=0bv32, ~head~0!base=1615373849bv32, ~head~0!offset=0bv32, ~len=0bv32, ~new_head~0!base=1615373849bv32, ~new_head~0!offset=0bv32] [L596] RET call #t~ret9 := sll_create(~bvadd32(1bv32, ~len~1)); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~ret9!base=1615373849bv32, #t~ret9!offset=0bv32, ~len~1=2bv32] [L596] ~s~0 := #t~ret9; [L596] havoc #t~ret9; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L597] CALL call #t~ret10 := sll_length(~s~0); VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32] [L576-L583] ~head := #in~head; [L577] ~len~0 := 0bv32; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=1615373849bv32, ~head!offset=0bv32, ~len~0=0bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=2696972873bv32, ~head!offset=0bv32, ~len~0=1bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=1427127328bv32, ~head!offset=0bv32, ~len~0=2bv32] [L578-L581] COND FALSE !(!(~head != { base: 0bv32, offset: 0bv32 })) [L579] #t~post4 := ~len~0; [L579] ~len~0 := ~bvadd32(1bv32, #t~post4); [L579] havoc #t~post4; [L580] FCALL call #t~mem5 := read~$Pointer$({ base: ~head!base, offset: ~head!offset }, 4bv32); [L580] ~head := #t~mem5; [L580] havoc #t~mem5; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L578-L581] COND TRUE !(~head != { base: 0bv32, offset: 0bv32 }) VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L582] #res := ~len~0; VAL [#in~head!base=1615373849bv32, #in~head!offset=0bv32, #NULL!base=0bv32, #NULL!offset=0bv32, #res=3bv32, ~head!base=0bv32, ~head!offset=0bv32, ~len~0=3bv32] [L597] RET call #t~ret10 := sll_length(~s~0); VAL [#NULL!base=0bv32, #NULL!offset=0bv32, #t~ret10=3bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L597] COND TRUE ~len~1 != #t~ret10 [L597] havoc #t~ret10; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L602] assert false; VAL [#NULL!base=0bv32, #NULL!offset=0bv32, ~len~1=2bv32, ~s~0!base=1615373849bv32, ~s~0!offset=0bv32] [L592] int len = 2; VAL [len=2] [L593] COND FALSE !(len < 32 && __VERIFIER_nondet_int()) [L596] CALL, EXPR sll_create(len + 1) VAL [\old(len)=3] [L564] SLL head = ((void *)0); VAL [\old(len)=3, head={0:0}, len=3] [L565] COND TRUE len > 0 [L566] SLL new_head = (SLL) malloc(sizeof(struct node)); VAL [\old(len)=3, head={0:0}, len=3, malloc(sizeof(struct node))={1427127328:0}, new_head={1427127328:0}] [L567] COND FALSE !(((void *)0) == new_head) VAL [\old(len)=3, head={0:0}, len=3, malloc(sizeof(struct node))={1427127328:0}, new_head={1427127328:0}] [L570] new_head->next = head [L571] head = new_head [L572] len-- VAL [\old(len)=3, head={1427127328:0}, len=2, malloc(sizeof(struct node))={1427127328:0}, new_head={1427127328:0}] [L565] COND TRUE len > 0 [L566] SLL new_head = (SLL) malloc(sizeof(struct node)); VAL [\old(len)=3, head={1427127328:0}, len=2, malloc(sizeof(struct node))={-1597994423:0}, new_head={-1597994423:0}] [L567] COND FALSE !(((void *)0) == new_head) VAL [\old(len)=3, head={1427127328:0}, len=2, malloc(sizeof(struct node))={-1597994423:0}, new_head={-1597994423:0}] [L570] new_head->next = head [L571] head = new_head [L572] len-- VAL [\old(len)=3, head={-1597994423:0}, len=1, malloc(sizeof(struct node))={-1597994423:0}, new_head={-1597994423:0}] [L565] COND TRUE len > 0 [L566] SLL new_head = (SLL) malloc(sizeof(struct node)); VAL [\old(len)=3, head={-1597994423:0}, len=1, malloc(sizeof(struct node))={1615373849:0}, new_head={1615373849:0}] [L567] COND FALSE !(((void *)0) == new_head) VAL [\old(len)=3, head={-1597994423:0}, len=1, malloc(sizeof(struct node))={1615373849:0}, new_head={1615373849:0}] [L570] new_head->next = head [L571] head = new_head [L572] len-- VAL [\old(len)=3, head={1615373849:0}, len=0, malloc(sizeof(struct node))={1615373849:0}, new_head={1615373849:0}] [L565] COND FALSE !(len > 0) VAL [\old(len)=3, head={1615373849:0}, len=0, malloc(sizeof(struct node))={1615373849:0}, new_head={1615373849:0}] [L574] return head; VAL [\old(len)=3, \result={1615373849:0}, head={1615373849:0}, len=0, malloc(sizeof(struct node))={1615373849:0}, new_head={1615373849:0}] [L596] RET, EXPR sll_create(len + 1) VAL [len=2, sll_create(len + 1)={1615373849:0}] [L596] SLL s = sll_create(len + 1); [L597] CALL, EXPR sll_length(s) VAL [head={1615373849:0}] [L577] int len = 0; VAL [head={1615373849:0}, head={1615373849:0}, len=0] [L578] COND TRUE \read(head) [L579] len++ [L580] EXPR head->next [L580] head = head->next [L578] COND TRUE \read(head) [L579] len++ [L580] EXPR head->next [L580] head = head->next [L578] COND TRUE \read(head) [L579] len++ [L580] EXPR head->next [L580] head = head->next [L578] COND FALSE !(\read(head)) VAL [head={0:0}, head={1615373849:0}, len=3] [L582] return len; VAL [\result=3, head={0:0}, head={1615373849:0}, len=3] [L597] RET, EXPR sll_length(s) VAL [len=2, s={1615373849:0}, sll_length(s)=3] [L597] COND TRUE len != sll_length(s) [L602] __VERIFIER_error() VAL [len=2, s={1615373849:0}] ----- [2018-11-23 11:21:21,281 INFO L145 WitnessManager]: Wrote witness to /storage/repos/svcomp/c/list-ext3-properties/sll_length_check_false-unreach-call_false-valid-memcleanup.i-witness.graphml [2018-11-23 11:21:21,281 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2018-11-23 11:21:21,282 INFO L168 Benchmark]: Toolchain (without parser) took 29967.76 ms. Allocated memory was 1.5 GB in the beginning and 2.5 GB in the end (delta: 978.3 MB). Free memory was 1.4 GB in the beginning and 2.4 GB in the end (delta: -1.0 GB). There was no memory consumed. Max. memory is 7.1 GB. [2018-11-23 11:21:21,284 INFO L168 Benchmark]: CDTParser took 0.21 ms. Allocated memory is still 1.5 GB. Free memory is still 1.5 GB. There was no memory consumed. Max. memory is 7.1 GB. [2018-11-23 11:21:21,284 INFO L168 Benchmark]: CACSL2BoogieTranslator took 654.28 ms. Allocated memory is still 1.5 GB. Free memory was 1.4 GB in the beginning and 1.4 GB in the end (delta: 21.1 MB). Peak memory consumption was 21.1 MB. Max. memory is 7.1 GB. [2018-11-23 11:21:21,285 INFO L168 Benchmark]: Boogie Procedure Inliner took 118.44 ms. Allocated memory was 1.5 GB in the beginning and 2.3 GB in the end (delta: 738.2 MB). Free memory was 1.4 GB in the beginning and 2.2 GB in the end (delta: -801.8 MB). Peak memory consumption was 26.8 MB. Max. memory is 7.1 GB. [2018-11-23 11:21:21,285 INFO L168 Benchmark]: Boogie Preprocessor took 74.29 ms. Allocated memory is still 2.3 GB. Free memory is still 2.2 GB. There was no memory consumed. Max. memory is 7.1 GB. [2018-11-23 11:21:21,285 INFO L168 Benchmark]: RCFGBuilder took 877.97 ms. Allocated memory is still 2.3 GB. Free memory was 2.2 GB in the beginning and 2.2 GB in the end (delta: 36.3 MB). Peak memory consumption was 36.3 MB. Max. memory is 7.1 GB. [2018-11-23 11:21:21,286 INFO L168 Benchmark]: TraceAbstraction took 28094.42 ms. Allocated memory was 2.3 GB in the beginning and 2.5 GB in the end (delta: 240.1 MB). Free memory was 2.2 GB in the beginning and 2.4 GB in the end (delta: -256.9 MB). There was no memory consumed. Max. memory is 7.1 GB. [2018-11-23 11:21:21,286 INFO L168 Benchmark]: Witness Printer took 143.10 ms. Allocated memory is still 2.5 GB. Free memory was 2.4 GB in the beginning and 2.4 GB in the end (delta: 24 B). Peak memory consumption was 24 B. Max. memory is 7.1 GB. [2018-11-23 11:21:21,295 INFO L336 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - GenericResult: Assertions are enabled Assertions are enabled - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.21 ms. Allocated memory is still 1.5 GB. Free memory is still 1.5 GB. There was no memory consumed. Max. memory is 7.1 GB. * CACSL2BoogieTranslator took 654.28 ms. Allocated memory is still 1.5 GB. Free memory was 1.4 GB in the beginning and 1.4 GB in the end (delta: 21.1 MB). Peak memory consumption was 21.1 MB. Max. memory is 7.1 GB. * Boogie Procedure Inliner took 118.44 ms. Allocated memory was 1.5 GB in the beginning and 2.3 GB in the end (delta: 738.2 MB). Free memory was 1.4 GB in the beginning and 2.2 GB in the end (delta: -801.8 MB). Peak memory consumption was 26.8 MB. Max. memory is 7.1 GB. * Boogie Preprocessor took 74.29 ms. Allocated memory is still 2.3 GB. Free memory is still 2.2 GB. There was no memory consumed. Max. memory is 7.1 GB. * RCFGBuilder took 877.97 ms. Allocated memory is still 2.3 GB. Free memory was 2.2 GB in the beginning and 2.2 GB in the end (delta: 36.3 MB). Peak memory consumption was 36.3 MB. Max. memory is 7.1 GB. * TraceAbstraction took 28094.42 ms. Allocated memory was 2.3 GB in the beginning and 2.5 GB in the end (delta: 240.1 MB). Free memory was 2.2 GB in the beginning and 2.4 GB in the end (delta: -256.9 MB). There was no memory consumed. Max. memory is 7.1 GB. * Witness Printer took 143.10 ms. Allocated memory is still 2.5 GB. Free memory was 2.4 GB in the beginning and 2.4 GB in the end (delta: 24 B). Peak memory consumption was 24 B. Max. memory is 7.1 GB. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - CounterExampleResult [Line: 602]: a call of __VERIFIER_error() is reachable a call of __VERIFIER_error() is reachable We found a FailurePath: [L592] int len = 2; VAL [len=2] [L593] COND FALSE !(len < 32 && __VERIFIER_nondet_int()) [L596] CALL, EXPR sll_create(len + 1) VAL [\old(len)=3] [L564] SLL head = ((void *)0); VAL [\old(len)=3, head={0:0}, len=3] [L565] COND TRUE len > 0 [L566] SLL new_head = (SLL) malloc(sizeof(struct node)); VAL [\old(len)=3, head={0:0}, len=3, malloc(sizeof(struct node))={1427127328:0}, new_head={1427127328:0}] [L567] COND FALSE !(((void *)0) == new_head) VAL [\old(len)=3, head={0:0}, len=3, malloc(sizeof(struct node))={1427127328:0}, new_head={1427127328:0}] [L570] new_head->next = head [L571] head = new_head [L572] len-- VAL [\old(len)=3, head={1427127328:0}, len=2, malloc(sizeof(struct node))={1427127328:0}, new_head={1427127328:0}] [L565] COND TRUE len > 0 [L566] SLL new_head = (SLL) malloc(sizeof(struct node)); VAL [\old(len)=3, head={1427127328:0}, len=2, malloc(sizeof(struct node))={-1597994423:0}, new_head={-1597994423:0}] [L567] COND FALSE !(((void *)0) == new_head) VAL [\old(len)=3, head={1427127328:0}, len=2, malloc(sizeof(struct node))={-1597994423:0}, new_head={-1597994423:0}] [L570] new_head->next = head [L571] head = new_head [L572] len-- VAL [\old(len)=3, head={-1597994423:0}, len=1, malloc(sizeof(struct node))={-1597994423:0}, new_head={-1597994423:0}] [L565] COND TRUE len > 0 [L566] SLL new_head = (SLL) malloc(sizeof(struct node)); VAL [\old(len)=3, head={-1597994423:0}, len=1, malloc(sizeof(struct node))={1615373849:0}, new_head={1615373849:0}] [L567] COND FALSE !(((void *)0) == new_head) VAL [\old(len)=3, head={-1597994423:0}, len=1, malloc(sizeof(struct node))={1615373849:0}, new_head={1615373849:0}] [L570] new_head->next = head [L571] head = new_head [L572] len-- VAL [\old(len)=3, head={1615373849:0}, len=0, malloc(sizeof(struct node))={1615373849:0}, new_head={1615373849:0}] [L565] COND FALSE !(len > 0) VAL [\old(len)=3, head={1615373849:0}, len=0, malloc(sizeof(struct node))={1615373849:0}, new_head={1615373849:0}] [L574] return head; VAL [\old(len)=3, \result={1615373849:0}, head={1615373849:0}, len=0, malloc(sizeof(struct node))={1615373849:0}, new_head={1615373849:0}] [L596] RET, EXPR sll_create(len + 1) VAL [len=2, sll_create(len + 1)={1615373849:0}] [L596] SLL s = sll_create(len + 1); [L597] CALL, EXPR sll_length(s) VAL [head={1615373849:0}] [L577] int len = 0; VAL [head={1615373849:0}, head={1615373849:0}, len=0] [L578] COND TRUE \read(head) [L579] len++ [L580] EXPR head->next [L580] head = head->next [L578] COND TRUE \read(head) [L579] len++ [L580] EXPR head->next [L580] head = head->next [L578] COND TRUE \read(head) [L579] len++ [L580] EXPR head->next [L580] head = head->next [L578] COND FALSE !(\read(head)) VAL [head={1615373849:0}, head={0:0}, len=3] [L582] return len; VAL [\result=3, head={1615373849:0}, head={0:0}, len=3] [L597] RET, EXPR sll_length(s) VAL [len=2, s={1615373849:0}, sll_length(s)=3] [L597] COND TRUE len != sll_length(s) [L602] __VERIFIER_error() VAL [len=2, s={1615373849:0}] - StatisticsResult: Ultimate Automizer benchmark data CFG has 7 procedures, 40 locations, 1 error locations. UNSAFE Result, 28.0s OverallTime, 10 OverallIterations, 3 TraceHistogramMax, 20.3s AutomataDifference, 0.0s DeadEndRemovalTime, 0.0s HoareAnnotationTime, HoareTripleCheckerStatistics: 248 SDtfs, 170 SDslu, 1169 SDs, 0 SdLazy, 633 SolverSat, 51 SolverUnsat, 1 SolverUnknown, 0 SolverNotchecked, 3.8s Time, PredicateUnifierStatistics: 0 DeclaredPredicates, 429 GetRequests, 341 SyntacticMatches, 2 SemanticMatches, 86 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 62 ImplicationChecksByTransitivity, 2.1s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=42occurred in iteration=9, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s AbstIntTime, 0 AbstIntIterations, 0 AbstIntStrong, NaN AbsIntWeakeningRatio, NaN AbsIntAvgWeakeningVarsNumRemoved, NaN AbsIntAvgWeakenedConjuncts, 0.0s DumpTime, AutomataMinimizationStatistics: 0.6s AutomataMinimizationTime, 9 MinimizatonAttempts, 73 StatesRemovedByMinimization, 7 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TraceCheckStatistics: 0.1s SsaConstructionTime, 0.5s SatisfiabilityAnalysisTime, 4.8s InterpolantComputationTime, 277 NumberOfCodeBlocks, 277 NumberOfCodeBlocksAsserted, 17 NumberOfCheckSat, 402 ConstructedInterpolants, 6 QuantifiedInterpolants, 34522 SizeOfPredicates, 25 NumberOfNonLiveVariables, 732 ConjunctsInSsa, 63 ConjunctsInUnsatCore, 15 InterpolantComputations, 3 PerfectInterpolantSequences, 49/93 InterpolantCoveringCapability, InvariantSynthesisStatistics: No data available, InterpolantConsolidationStatistics: No data available, ReuseStatistics: No data available RESULT: Ultimate proved your program to be incorrect! Received shutdown request...