java -Xmx6000000000 -jar ./plugins/org.eclipse.equinox.launcher_1.3.100.v20150511-1540.jar -data ./data --generate-csv --csv-dir ../../../releaseScripts/default/UAutomizer-linux/csv -tc ../../../trunk/examples/toolchains/AbstractInterpretationC.xml -s ../../../trunk/examples/settings/ai/eq-bench/svcomp-DerefFreeMemtrack-32bit-Automizer_Camel+AI_EQ_imprecise.epf -i ../../../trunk/examples/svcomp/memsafety/test-0234_true-valid-memsafety.i -------------------------------------------------------------------------------- This is Ultimate 0.1.23-6b94a2f [2018-01-24 16:25:46,971 INFO L170 SettingsManager]: Resetting all preferences to default values... [2018-01-24 16:25:46,972 INFO L174 SettingsManager]: Resetting UltimateCore preferences to default values [2018-01-24 16:25:46,987 INFO L177 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2018-01-24 16:25:46,988 INFO L174 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2018-01-24 16:25:46,989 INFO L174 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2018-01-24 16:25:46,990 INFO L174 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2018-01-24 16:25:46,992 INFO L174 SettingsManager]: Resetting LassoRanker preferences to default values [2018-01-24 16:25:46,994 INFO L174 SettingsManager]: Resetting Reaching Definitions preferences to default values [2018-01-24 16:25:46,994 INFO L174 SettingsManager]: Resetting SyntaxChecker preferences to default values [2018-01-24 16:25:46,996 INFO L177 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2018-01-24 16:25:46,996 INFO L174 SettingsManager]: Resetting LTL2Aut preferences to default values [2018-01-24 16:25:46,997 INFO L174 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2018-01-24 16:25:46,998 INFO L174 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2018-01-24 16:25:46,999 INFO L174 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2018-01-24 16:25:47,002 INFO L174 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2018-01-24 16:25:47,004 INFO L174 SettingsManager]: Resetting CodeCheck preferences to default values [2018-01-24 16:25:47,006 INFO L174 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2018-01-24 16:25:47,007 INFO L174 SettingsManager]: Resetting RCFGBuilder preferences to default values [2018-01-24 16:25:47,008 INFO L174 SettingsManager]: Resetting TraceAbstraction preferences to default values [2018-01-24 16:25:47,011 INFO L177 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2018-01-24 16:25:47,011 INFO L177 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2018-01-24 16:25:47,011 INFO L174 SettingsManager]: Resetting IcfgTransformer preferences to default values [2018-01-24 16:25:47,013 INFO L174 SettingsManager]: Resetting Boogie Printer preferences to default values [2018-01-24 16:25:47,013 INFO L174 SettingsManager]: Resetting Witness Printer preferences to default values [2018-01-24 16:25:47,015 INFO L177 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2018-01-24 16:25:47,015 INFO L174 SettingsManager]: Resetting CDTParser preferences to default values [2018-01-24 16:25:47,016 INFO L177 SettingsManager]: PEA to Boogie provides no preferences, ignoring... [2018-01-24 16:25:47,016 INFO L177 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2018-01-24 16:25:47,016 INFO L174 SettingsManager]: Resetting Witness Parser preferences to default values [2018-01-24 16:25:47,016 INFO L181 SettingsManager]: Finished resetting all preferences to default values... [2018-01-24 16:25:47,017 INFO L98 SettingsManager]: Beginning loading settings from /storage/ultimate/releaseScripts/default/UAutomizer-linux/../../../trunk/examples/settings/ai/eq-bench/svcomp-DerefFreeMemtrack-32bit-Automizer_Camel+AI_EQ_imprecise.epf [2018-01-24 16:25:47,025 INFO L110 SettingsManager]: Loading preferences was successful [2018-01-24 16:25:47,025 INFO L112 SettingsManager]: Preferences different from defaults after loading the file: [2018-01-24 16:25:47,026 INFO L131 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2018-01-24 16:25:47,026 INFO L133 SettingsManager]: * to procedures, called more than once=true [2018-01-24 16:25:47,026 INFO L131 SettingsManager]: Preferences of Abstract Interpretation differ from their defaults: [2018-01-24 16:25:47,026 INFO L133 SettingsManager]: * Deactivate Weak Equivalences=true [2018-01-24 16:25:47,026 INFO L133 SettingsManager]: * Abstract domain for RCFG-of-the-future=VPDomain [2018-01-24 16:25:47,026 INFO L133 SettingsManager]: * Use the RCFG-of-the-future interface=true [2018-01-24 16:25:47,027 INFO L131 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2018-01-24 16:25:47,027 INFO L133 SettingsManager]: * sizeof long=4 [2018-01-24 16:25:47,027 INFO L133 SettingsManager]: * Check unreachability of error function in SV-COMP mode=false [2018-01-24 16:25:47,027 INFO L133 SettingsManager]: * Overapproximate operations on floating types=true [2018-01-24 16:25:47,027 INFO L133 SettingsManager]: * sizeof POINTER=4 [2018-01-24 16:25:47,028 INFO L133 SettingsManager]: * Check division by zero=IGNORE [2018-01-24 16:25:47,028 INFO L133 SettingsManager]: * Check for the main procedure if all allocated memory was freed=true [2018-01-24 16:25:47,028 INFO L133 SettingsManager]: * Bitprecise bitfields=true [2018-01-24 16:25:47,028 INFO L133 SettingsManager]: * SV-COMP memtrack compatibility mode=true [2018-01-24 16:25:47,028 INFO L133 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2018-01-24 16:25:47,028 INFO L133 SettingsManager]: * sizeof long double=12 [2018-01-24 16:25:47,028 INFO L131 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2018-01-24 16:25:47,029 INFO L133 SettingsManager]: * Size of a code block=SequenceOfStatements [2018-01-24 16:25:47,029 INFO L133 SettingsManager]: * To the following directory=./dump/ [2018-01-24 16:25:47,029 INFO L133 SettingsManager]: * Add additional assume for each assert=false [2018-01-24 16:25:47,029 INFO L133 SettingsManager]: * SMT solver=External_DefaultMode [2018-01-24 16:25:47,029 INFO L133 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-01-24 16:25:47,030 INFO L131 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2018-01-24 16:25:47,030 INFO L133 SettingsManager]: * Interpolant automaton=TWOTRACK [2018-01-24 16:25:47,030 INFO L133 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2018-01-24 16:25:47,030 INFO L133 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2018-01-24 16:25:47,030 INFO L133 SettingsManager]: * Trace refinement strategy=CAMEL [2018-01-24 16:25:47,030 INFO L133 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode [2018-01-24 16:25:47,031 INFO L133 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in [2018-01-24 16:25:47,031 INFO L133 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true [2018-01-24 16:25:47,031 INFO L131 SettingsManager]: Preferences of IcfgTransformer differ from their defaults: [2018-01-24 16:25:47,031 INFO L133 SettingsManager]: * TransformationType=HEAP_SEPARATOR [2018-01-24 16:25:47,065 INFO L81 nceAwareModelManager]: Repository-Root is: /tmp [2018-01-24 16:25:47,075 INFO L266 ainManager$Toolchain]: [Toolchain 1]: Parser(s) successfully initialized [2018-01-24 16:25:47,078 INFO L222 ainManager$Toolchain]: [Toolchain 1]: Toolchain data selected. [2018-01-24 16:25:47,080 INFO L271 PluginConnector]: Initializing CDTParser... [2018-01-24 16:25:47,080 INFO L276 PluginConnector]: CDTParser initialized [2018-01-24 16:25:47,080 INFO L431 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /storage/ultimate/releaseScripts/default/UAutomizer-linux/../../../trunk/examples/svcomp/memsafety/test-0234_true-valid-memsafety.i [2018-01-24 16:25:47,275 INFO L304 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2018-01-24 16:25:47,280 INFO L131 ToolchainWalker]: Walking toolchain with 4 elements. [2018-01-24 16:25:47,281 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2018-01-24 16:25:47,281 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2018-01-24 16:25:47,286 INFO L276 PluginConnector]: CACSL2BoogieTranslator initialized [2018-01-24 16:25:47,287 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 24.01 04:25:47" (1/1) ... [2018-01-24 16:25:47,290 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@28805b and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:25:47, skipping insertion in model container [2018-01-24 16:25:47,290 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 24.01 04:25:47" (1/1) ... [2018-01-24 16:25:47,303 INFO L153 Dispatcher]: Using SV-COMP mode [2018-01-24 16:25:47,348 INFO L153 Dispatcher]: Using SV-COMP mode [2018-01-24 16:25:47,477 INFO L450 PostProcessor]: Settings: Checked method=main [2018-01-24 16:25:47,502 INFO L450 PostProcessor]: Settings: Checked method=main [2018-01-24 16:25:47,513 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:25:47 WrapperNode [2018-01-24 16:25:47,514 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2018-01-24 16:25:47,515 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2018-01-24 16:25:47,515 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2018-01-24 16:25:47,515 INFO L276 PluginConnector]: Boogie Preprocessor initialized [2018-01-24 16:25:47,528 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:25:47" (1/1) ... [2018-01-24 16:25:47,528 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:25:47" (1/1) ... [2018-01-24 16:25:47,541 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:25:47" (1/1) ... [2018-01-24 16:25:47,541 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:25:47" (1/1) ... [2018-01-24 16:25:47,551 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:25:47" (1/1) ... [2018-01-24 16:25:47,555 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:25:47" (1/1) ... [2018-01-24 16:25:47,557 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:25:47" (1/1) ... [2018-01-24 16:25:47,559 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2018-01-24 16:25:47,560 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2018-01-24 16:25:47,560 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2018-01-24 16:25:47,560 INFO L276 PluginConnector]: RCFGBuilder initialized [2018-01-24 16:25:47,561 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:25:47" (1/1) ... No working directory specified, using /storage/ultimate/releaseScripts/default/UAutomizer-linux/z3 Starting monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-01-24 16:25:47,605 INFO L136 BoogieDeclarations]: Found implementation of procedure ULTIMATE.init [2018-01-24 16:25:47,605 INFO L136 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2018-01-24 16:25:47,606 INFO L136 BoogieDeclarations]: Found implementation of procedure calloc_model [2018-01-24 16:25:47,606 INFO L136 BoogieDeclarations]: Found implementation of procedure zalloc_or_die [2018-01-24 16:25:47,606 INFO L136 BoogieDeclarations]: Found implementation of procedure l4_insert [2018-01-24 16:25:47,606 INFO L136 BoogieDeclarations]: Found implementation of procedure l3_insert [2018-01-24 16:25:47,606 INFO L136 BoogieDeclarations]: Found implementation of procedure l2_insert [2018-01-24 16:25:47,606 INFO L136 BoogieDeclarations]: Found implementation of procedure l1_insert [2018-01-24 16:25:47,606 INFO L136 BoogieDeclarations]: Found implementation of procedure l0_insert [2018-01-24 16:25:47,606 INFO L136 BoogieDeclarations]: Found implementation of procedure l4_destroy [2018-01-24 16:25:47,606 INFO L136 BoogieDeclarations]: Found implementation of procedure l3_destroy [2018-01-24 16:25:47,607 INFO L136 BoogieDeclarations]: Found implementation of procedure l2_destroy [2018-01-24 16:25:47,607 INFO L136 BoogieDeclarations]: Found implementation of procedure l1_destroy [2018-01-24 16:25:47,607 INFO L136 BoogieDeclarations]: Found implementation of procedure l0_destroy [2018-01-24 16:25:47,607 INFO L136 BoogieDeclarations]: Found implementation of procedure main [2018-01-24 16:25:47,607 INFO L128 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2018-01-24 16:25:47,607 INFO L128 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2018-01-24 16:25:47,607 INFO L128 BoogieDeclarations]: Found specification of procedure ULTIMATE.free [2018-01-24 16:25:47,607 INFO L128 BoogieDeclarations]: Found specification of procedure ULTIMATE.dealloc [2018-01-24 16:25:47,607 INFO L128 BoogieDeclarations]: Found specification of procedure #Ultimate.alloc [2018-01-24 16:25:47,607 INFO L128 BoogieDeclarations]: Found specification of procedure #Ultimate.C_memset [2018-01-24 16:25:47,608 INFO L136 BoogieDeclarations]: Found implementation of procedure #Ultimate.C_memset [2018-01-24 16:25:47,608 INFO L128 BoogieDeclarations]: Found specification of procedure malloc [2018-01-24 16:25:47,608 INFO L128 BoogieDeclarations]: Found specification of procedure free [2018-01-24 16:25:47,608 INFO L128 BoogieDeclarations]: Found specification of procedure abort [2018-01-24 16:25:47,608 INFO L128 BoogieDeclarations]: Found specification of procedure memset [2018-01-24 16:25:47,608 INFO L128 BoogieDeclarations]: Found specification of procedure calloc_model [2018-01-24 16:25:47,609 INFO L128 BoogieDeclarations]: Found specification of procedure __VERIFIER_nondet_int [2018-01-24 16:25:47,609 INFO L128 BoogieDeclarations]: Found specification of procedure zalloc_or_die [2018-01-24 16:25:47,609 INFO L128 BoogieDeclarations]: Found specification of procedure l4_insert [2018-01-24 16:25:47,609 INFO L128 BoogieDeclarations]: Found specification of procedure l3_insert [2018-01-24 16:25:47,609 INFO L128 BoogieDeclarations]: Found specification of procedure l2_insert [2018-01-24 16:25:47,609 INFO L128 BoogieDeclarations]: Found specification of procedure l1_insert [2018-01-24 16:25:47,609 INFO L128 BoogieDeclarations]: Found specification of procedure l0_insert [2018-01-24 16:25:47,610 INFO L128 BoogieDeclarations]: Found specification of procedure l4_destroy [2018-01-24 16:25:47,610 INFO L128 BoogieDeclarations]: Found specification of procedure l3_destroy [2018-01-24 16:25:47,610 INFO L128 BoogieDeclarations]: Found specification of procedure l2_destroy [2018-01-24 16:25:47,610 INFO L128 BoogieDeclarations]: Found specification of procedure l1_destroy [2018-01-24 16:25:47,610 INFO L128 BoogieDeclarations]: Found specification of procedure l0_destroy [2018-01-24 16:25:47,610 INFO L128 BoogieDeclarations]: Found specification of procedure main [2018-01-24 16:25:47,611 INFO L128 BoogieDeclarations]: Found specification of procedure ULTIMATE.init [2018-01-24 16:25:47,611 INFO L128 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2018-01-24 16:25:47,946 WARN L455 $ProcedureCfgBuilder]: Label in the middle of a codeblock. [2018-01-24 16:25:48,250 INFO L257 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2018-01-24 16:25:48,250 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 24.01 04:25:48 BoogieIcfgContainer [2018-01-24 16:25:48,251 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2018-01-24 16:25:48,251 INFO L113 PluginConnector]: ------------------------Abstract Interpretation---------------------------- [2018-01-24 16:25:48,251 INFO L271 PluginConnector]: Initializing Abstract Interpretation... [2018-01-24 16:25:48,252 INFO L276 PluginConnector]: Abstract Interpretation initialized [2018-01-24 16:25:48,252 INFO L185 PluginConnector]: Executing the observer AbstractInterpretationRcfgObserver from plugin Abstract Interpretation for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 24.01 04:25:48" (1/1) ... [2018-01-24 16:25:48,297 INFO L101 FixpointEngine]: Starting fixpoint engine with domain VPDomain (maxUnwinding=3, maxParallelStates=2) [2018-01-24 16:26:08,519 INFO L259 AbstractInterpreter]: Some error location(s) were reachable [2018-01-24 16:26:08,533 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,534 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,534 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,534 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,534 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,535 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,541 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,541 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,541 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,541 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,542 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,542 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,546 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,546 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,547 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,547 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,547 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,547 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,552 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,552 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,552 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,552 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,553 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,553 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,556 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,557 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,557 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,557 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,557 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,557 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,561 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,561 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,561 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,561 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,562 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,562 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,565 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,565 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,566 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,566 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,566 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,566 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,570 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,571 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,571 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,571 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,571 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,571 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,574 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,575 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,575 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,575 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,575 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,576 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,578 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,579 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,579 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,579 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,579 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,579 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,582 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,582 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,582 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,582 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,583 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,583 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,586 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,586 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,586 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,586 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,587 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,587 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,589 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,589 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,590 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,590 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,590 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,590 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,592 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,592 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,592 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,592 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,592 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,593 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,595 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,595 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,595 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,596 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,596 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,596 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,598 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,598 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,598 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,599 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,599 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,599 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,601 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,601 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,601 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,601 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,601 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,601 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,604 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,604 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,605 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,605 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,605 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,605 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,607 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,607 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,607 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,608 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,608 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,608 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,609 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,610 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,610 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,610 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,610 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,610 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,612 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,612 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,612 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,613 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,613 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,613 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,615 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,615 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,616 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,616 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,616 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,616 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,618 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,618 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,618 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,618 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,618 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,618 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,620 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,620 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,620 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,621 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,621 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,621 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,622 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,622 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,623 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,623 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,623 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,623 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,625 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,625 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,625 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,625 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,625 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,625 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,627 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,627 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,627 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,627 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,627 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,627 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,629 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,629 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,629 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,630 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,630 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,630 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,632 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,632 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,632 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,632 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,632 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,632 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,634 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,634 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,634 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,634 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,634 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,635 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,637 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,637 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,637 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,637 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,637 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,637 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,639 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,639 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,639 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,639 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,639 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,639 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,641 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,641 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,641 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,641 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,641 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,642 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,644 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,644 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,644 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,644 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,644 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,644 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,646 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,646 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,646 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,646 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,647 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,647 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,648 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,649 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,649 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,649 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,649 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,649 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,651 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,651 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,652 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,652 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,652 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,652 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,654 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,654 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,654 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,654 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,654 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,654 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,657 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,658 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,658 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,658 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,658 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,658 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,661 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,662 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,662 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,662 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,662 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,662 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,665 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,665 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,666 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,666 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,666 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,666 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,669 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,669 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,669 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,669 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,669 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,669 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,671 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,671 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,671 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,672 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,672 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,672 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,674 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,674 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,674 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,674 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,674 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,674 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,676 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,676 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,677 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,677 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,677 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,677 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,680 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,680 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,680 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,680 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,680 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,681 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,683 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,683 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,683 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,683 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,683 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,683 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,685 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,685 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,685 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,685 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,685 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,686 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,687 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,687 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,688 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,688 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,688 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,688 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,690 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,690 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,690 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,691 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,691 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,691 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,691 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification ensures #valid == old(#valid); is not ensure(true) [2018-01-24 16:26:08,693 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,693 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,693 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,693 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,693 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,693 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) [2018-01-24 16:26:08,697 INFO L268 AbstractInterpreter]: Visited 257 different actions 4268 times. Merged at 116 different actions 1458 times. Never widened. Found 220 fixpoints after 25 different actions. Largest state had 28 variables. [2018-01-24 16:26:08,699 INFO L132 PluginConnector]: ------------------------ END Abstract Interpretation---------------------------- [2018-01-24 16:26:08,700 INFO L168 Benchmark]: Toolchain (without parser) took 21423.96 ms. Allocated memory was 306.7 MB in the beginning and 2.0 GB in the end (delta: 1.7 GB). Free memory was 265.7 MB in the beginning and 833.0 MB in the end (delta: -567.2 MB). Peak memory consumption was 1.1 GB. Max. memory is 5.3 GB. [2018-01-24 16:26:08,701 INFO L168 Benchmark]: CDTParser took 0.12 ms. Allocated memory is still 306.7 MB. Free memory is still 272.7 MB. There was no memory consumed. Max. memory is 5.3 GB. [2018-01-24 16:26:08,701 INFO L168 Benchmark]: CACSL2BoogieTranslator took 233.24 ms. Allocated memory is still 306.7 MB. Free memory was 265.7 MB in the beginning and 253.7 MB in the end (delta: 12.1 MB). Peak memory consumption was 12.1 MB. Max. memory is 5.3 GB. [2018-01-24 16:26:08,701 INFO L168 Benchmark]: Boogie Preprocessor took 44.94 ms. Allocated memory is still 306.7 MB. Free memory was 253.7 MB in the beginning and 250.7 MB in the end (delta: 3.0 MB). Peak memory consumption was 3.0 MB. Max. memory is 5.3 GB. [2018-01-24 16:26:08,702 INFO L168 Benchmark]: RCFGBuilder took 690.97 ms. Allocated memory is still 306.7 MB. Free memory was 250.7 MB in the beginning and 201.6 MB in the end (delta: 49.1 MB). Peak memory consumption was 49.1 MB. Max. memory is 5.3 GB. [2018-01-24 16:26:08,702 INFO L168 Benchmark]: Abstract Interpretation took 20447.49 ms. Allocated memory was 306.7 MB in the beginning and 2.0 GB in the end (delta: 1.7 GB). Free memory was 201.6 MB in the beginning and 833.0 MB in the end (delta: -631.4 MB). Peak memory consumption was 1.1 GB. Max. memory is 5.3 GB. [2018-01-24 16:26:08,704 INFO L344 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.12 ms. Allocated memory is still 306.7 MB. Free memory is still 272.7 MB. There was no memory consumed. Max. memory is 5.3 GB. * CACSL2BoogieTranslator took 233.24 ms. Allocated memory is still 306.7 MB. Free memory was 265.7 MB in the beginning and 253.7 MB in the end (delta: 12.1 MB). Peak memory consumption was 12.1 MB. Max. memory is 5.3 GB. * Boogie Preprocessor took 44.94 ms. Allocated memory is still 306.7 MB. Free memory was 253.7 MB in the beginning and 250.7 MB in the end (delta: 3.0 MB). Peak memory consumption was 3.0 MB. Max. memory is 5.3 GB. * RCFGBuilder took 690.97 ms. Allocated memory is still 306.7 MB. Free memory was 250.7 MB in the beginning and 201.6 MB in the end (delta: 49.1 MB). Peak memory consumption was 49.1 MB. Max. memory is 5.3 GB. * Abstract Interpretation took 20447.49 ms. Allocated memory was 306.7 MB in the beginning and 2.0 GB in the end (delta: 1.7 GB). Free memory was 201.6 MB in the beginning and 833.0 MB in the end (delta: -631.4 MB). Peak memory consumption was 1.1 GB. Max. memory is 5.3 GB. * Results from de.uni_freiburg.informatik.ultimate.plugins.analysis.abstractinterpretationv2: - StatisticsResult: ArrayEqualityDomainStatistics #Locations : 212 LocStat_MAX_WEQGRAPH_SIZE : 0 LocStat_MAX_SIZEOF_WEQEDGELABEL : 0 LocStat_NO_SUPPORTING_EQUALITIES : 3123 LocStat_NO_SUPPORTING_DISEQUALITIES : 1029 LocStat_NO_DISJUNCTIONS : -424 LocStat_MAX_NO_DISJUNCTIONS : -1 #Transitions : 287 TransStat_MAX_WEQGRAPH_SIZE : 0 TransStat_MAX_SIZEOF_WEQEDGELABEL : 0 TransStat_NO_SUPPORTING_EQUALITIES : 467 TransStat_NO_SUPPORTING_DISEQUALITIES : 83 TransStat_NO_DISJUNCTIONS : 329 TransStat_MAX_NO_DISJUNCTIONS : 4 - StatisticsResult: EqConstraintFactoryStatistics CONJOIN_DISJUNCTIVE(MILLISECONDS) : 0.835934 RENAME_VARIABLES(MILLISECONDS) : 0.002240 UNFREEZE(MILLISECONDS) : 0.000000 CONJOIN(MILLISECONDS) : 0.189659 PROJECTAWAY(MILLISECONDS) : 0.615968 ADD_WEAK_EQUALITY(MILLISECONDS) : 0.003126 DISJOIN(MILLISECONDS) : 0.675817 RENAME_VARIABLES_DISJUNCTIVE(MILLISECONDS) : 0.007888 ADD_EQUALITY(MILLISECONDS) : 0.018552 DISJOIN_DISJUNCTIVE(MILLISECONDS) : 0.000000 ADD_DISEQUALITY(MILLISECONDS) : 0.010053 #CONJOIN_DISJUNCTIVE : 6639 #RENAME_VARIABLES : 16853 #UNFREEZE : 0 #CONJOIN : 11379 #PROJECTAWAY : 10253 #ADD_WEAK_EQUALITY : 63 #DISJOIN : 3323 #RENAME_VARIABLES_DISJUNCTIVE : 15394 #ADD_EQUALITY : 443 #DISJOIN_DISJUNCTIVE : 0 #ADD_DISEQUALITY : 73 - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; - UnprovableResult [Line: -1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL zalloc_or_die(sizeof *item) [L767] CALL calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] FCALL memset(ptr, 0, nmemb * size) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] FCALL \read(**list) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] FCALL \read(**list) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] FCALL *list = item - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] FCALL \read(**list) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] FCALL \read(**list) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] FCALL *list = item - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] FCALL \read(**list) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] FCALL \read(**list) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] FCALL *list = item - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] FCALL \read(**list) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] FCALL \read(**list) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] FCALL *list = item - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] FCALL \read(**list) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] FCALL \read(**list) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] FCALL *list = item - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] FCALL \read(*list) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] FCALL list->down - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] FCALL list->down - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] FCALL list->down - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] FCALL list->down - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] FCALL list->down - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] FCALL list->down - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] FCALL list->down - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] FCALL list->down - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] FCALL list->down - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] EXPR, FCALL list->down [L818] FCALL free(list->down) - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] EXPR, FCALL list->down [L818] FCALL free(list->down) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] EXPR, FCALL list->down [L818] FCALL free(list->down) [L819] FCALL list->next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] EXPR, FCALL list->down [L818] FCALL free(list->down) [L819] FCALL list->next - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] EXPR, FCALL list->down [L818] FCALL free(list->down) [L819] EXPR, FCALL list->next [L819] struct L4 *next = list->next; [L820] FCALL free(list) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] EXPR, FCALL list->down [L818] FCALL free(list->down) [L819] EXPR, FCALL list->next [L819] struct L4 *next = list->next; [L820] FCALL free(list) [L821] list = next [L823] COND FALSE, RET !(\read(*list)) [L828] l4_destroy(list->down) [L829] FCALL list->next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] EXPR, FCALL list->down [L818] FCALL free(list->down) [L819] EXPR, FCALL list->next [L819] struct L4 *next = list->next; [L820] FCALL free(list) [L821] list = next [L823] COND FALSE, RET !(\read(*list)) [L828] l4_destroy(list->down) [L829] FCALL list->next - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] EXPR, FCALL list->down [L818] FCALL free(list->down) [L819] EXPR, FCALL list->next [L819] struct L4 *next = list->next; [L820] FCALL free(list) [L821] list = next [L823] COND FALSE, RET !(\read(*list)) [L828] l4_destroy(list->down) [L829] EXPR, FCALL list->next [L829] struct L3 *next = list->next; [L830] FCALL free(list) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] EXPR, FCALL list->down [L818] FCALL free(list->down) [L819] EXPR, FCALL list->next [L819] struct L4 *next = list->next; [L820] FCALL free(list) [L821] list = next [L823] COND FALSE, RET !(\read(*list)) [L828] l4_destroy(list->down) [L829] EXPR, FCALL list->next [L829] struct L3 *next = list->next; [L830] FCALL free(list) [L831] list = next [L833] COND FALSE, RET !(\read(*list)) [L838] l3_destroy(list->down) [L839] FCALL list->next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] EXPR, FCALL list->down [L818] FCALL free(list->down) [L819] EXPR, FCALL list->next [L819] struct L4 *next = list->next; [L820] FCALL free(list) [L821] list = next [L823] COND FALSE, RET !(\read(*list)) [L828] l4_destroy(list->down) [L829] EXPR, FCALL list->next [L829] struct L3 *next = list->next; [L830] FCALL free(list) [L831] list = next [L833] COND FALSE, RET !(\read(*list)) [L838] l3_destroy(list->down) [L839] FCALL list->next - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] EXPR, FCALL list->down [L818] FCALL free(list->down) [L819] EXPR, FCALL list->next [L819] struct L4 *next = list->next; [L820] FCALL free(list) [L821] list = next [L823] COND FALSE, RET !(\read(*list)) [L828] l4_destroy(list->down) [L829] EXPR, FCALL list->next [L829] struct L3 *next = list->next; [L830] FCALL free(list) [L831] list = next [L833] COND FALSE, RET !(\read(*list)) [L838] l3_destroy(list->down) [L839] EXPR, FCALL list->next [L839] struct L2 *next = list->next; [L840] FCALL free(list) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] EXPR, FCALL list->down [L818] FCALL free(list->down) [L819] EXPR, FCALL list->next [L819] struct L4 *next = list->next; [L820] FCALL free(list) [L821] list = next [L823] COND FALSE, RET !(\read(*list)) [L828] l4_destroy(list->down) [L829] EXPR, FCALL list->next [L829] struct L3 *next = list->next; [L830] FCALL free(list) [L831] list = next [L833] COND FALSE, RET !(\read(*list)) [L838] l3_destroy(list->down) [L839] EXPR, FCALL list->next [L839] struct L2 *next = list->next; [L840] FCALL free(list) [L841] list = next [L843] COND FALSE, RET !(\read(*list)) [L848] l2_destroy(list->down) [L849] FCALL list->next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] EXPR, FCALL list->down [L818] FCALL free(list->down) [L819] EXPR, FCALL list->next [L819] struct L4 *next = list->next; [L820] FCALL free(list) [L821] list = next [L823] COND FALSE, RET !(\read(*list)) [L828] l4_destroy(list->down) [L829] EXPR, FCALL list->next [L829] struct L3 *next = list->next; [L830] FCALL free(list) [L831] list = next [L833] COND FALSE, RET !(\read(*list)) [L838] l3_destroy(list->down) [L839] EXPR, FCALL list->next [L839] struct L2 *next = list->next; [L840] FCALL free(list) [L841] list = next [L843] COND FALSE, RET !(\read(*list)) [L848] l2_destroy(list->down) [L849] FCALL list->next - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] EXPR, FCALL list->down [L818] FCALL free(list->down) [L819] EXPR, FCALL list->next [L819] struct L4 *next = list->next; [L820] FCALL free(list) [L821] list = next [L823] COND FALSE, RET !(\read(*list)) [L828] l4_destroy(list->down) [L829] EXPR, FCALL list->next [L829] struct L3 *next = list->next; [L830] FCALL free(list) [L831] list = next [L833] COND FALSE, RET !(\read(*list)) [L838] l3_destroy(list->down) [L839] EXPR, FCALL list->next [L839] struct L2 *next = list->next; [L840] FCALL free(list) [L841] list = next [L843] COND FALSE, RET !(\read(*list)) [L848] l2_destroy(list->down) [L849] EXPR, FCALL list->next [L849] struct L1 *next = list->next; [L850] FCALL free(list) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] EXPR, FCALL list->down [L818] FCALL free(list->down) [L819] EXPR, FCALL list->next [L819] struct L4 *next = list->next; [L820] FCALL free(list) [L821] list = next [L823] COND FALSE, RET !(\read(*list)) [L828] l4_destroy(list->down) [L829] EXPR, FCALL list->next [L829] struct L3 *next = list->next; [L830] FCALL free(list) [L831] list = next [L833] COND FALSE, RET !(\read(*list)) [L838] l3_destroy(list->down) [L839] EXPR, FCALL list->next [L839] struct L2 *next = list->next; [L840] FCALL free(list) [L841] list = next [L843] COND FALSE, RET !(\read(*list)) [L848] l2_destroy(list->down) [L849] EXPR, FCALL list->next [L849] struct L1 *next = list->next; [L850] FCALL free(list) [L851] list = next [L853] COND FALSE, RET !(\read(*list)) [L858] l1_destroy(list->down) [L859] FCALL list->next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] EXPR, FCALL list->down [L818] FCALL free(list->down) [L819] EXPR, FCALL list->next [L819] struct L4 *next = list->next; [L820] FCALL free(list) [L821] list = next [L823] COND FALSE, RET !(\read(*list)) [L828] l4_destroy(list->down) [L829] EXPR, FCALL list->next [L829] struct L3 *next = list->next; [L830] FCALL free(list) [L831] list = next [L833] COND FALSE, RET !(\read(*list)) [L838] l3_destroy(list->down) [L839] EXPR, FCALL list->next [L839] struct L2 *next = list->next; [L840] FCALL free(list) [L841] list = next [L843] COND FALSE, RET !(\read(*list)) [L848] l2_destroy(list->down) [L849] EXPR, FCALL list->next [L849] struct L1 *next = list->next; [L850] FCALL free(list) [L851] list = next [L853] COND FALSE, RET !(\read(*list)) [L858] l1_destroy(list->down) [L859] FCALL list->next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] EXPR, FCALL list->down [L818] FCALL free(list->down) [L819] EXPR, FCALL list->next [L819] struct L4 *next = list->next; [L820] FCALL free(list) [L821] list = next [L823] COND FALSE, RET !(\read(*list)) [L828] l4_destroy(list->down) [L829] EXPR, FCALL list->next [L829] struct L3 *next = list->next; [L830] FCALL free(list) [L831] list = next [L833] COND FALSE, RET !(\read(*list)) [L838] l3_destroy(list->down) [L839] EXPR, FCALL list->next [L839] struct L2 *next = list->next; [L840] FCALL free(list) [L841] list = next [L843] COND FALSE, RET !(\read(*list)) [L848] l2_destroy(list->down) [L849] EXPR, FCALL list->next [L849] struct L1 *next = list->next; [L850] FCALL free(list) [L851] list = next [L853] COND FALSE, RET !(\read(*list)) [L858] l1_destroy(list->down) [L859] EXPR, FCALL list->next [L859] struct L0 *next = list->next; [L860] FCALL free(list) [L861] list = next [L863] COND TRUE \read(*list) [L858] FCALL list->down - UnprovableResult [Line: 865]: Unable to prove that all allocated memory was freed Unable to prove that all allocated memory was freed Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] EXPR, FCALL list->down [L818] FCALL free(list->down) [L819] EXPR, FCALL list->next [L819] struct L4 *next = list->next; [L820] FCALL free(list) [L821] list = next [L823] COND FALSE, RET !(\read(*list)) [L828] l4_destroy(list->down) [L829] EXPR, FCALL list->next [L829] struct L3 *next = list->next; [L830] FCALL free(list) [L831] list = next [L833] COND FALSE, RET !(\read(*list)) [L838] l3_destroy(list->down) [L839] EXPR, FCALL list->next [L839] struct L2 *next = list->next; [L840] FCALL free(list) [L841] list = next [L843] COND FALSE, RET !(\read(*list)) [L848] l2_destroy(list->down) [L849] EXPR, FCALL list->next [L849] struct L1 *next = list->next; [L850] FCALL free(list) [L851] list = next [L853] COND FALSE, RET !(\read(*list)) [L858] l1_destroy(list->down) [L859] EXPR, FCALL list->next [L859] struct L0 *next = list->next; [L860] FCALL free(list) [L861] list = next [L863] COND FALSE, RET !(\read(*list)) [L871] l0_destroy(list) - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L867] FCALL static struct L0 *list; [L869] CALL l0_insert(&list) [L808] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L808] EXPR zalloc_or_die(sizeof *item) [L808] struct L0 *item = zalloc_or_die(sizeof *item); [L810] CALL l1_insert(&item->down) [L799] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L799] EXPR zalloc_or_die(sizeof *item) [L799] struct L1 *item = zalloc_or_die(sizeof *item); [L801] CALL l2_insert(&item->down) [L790] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L790] EXPR zalloc_or_die(sizeof *item) [L790] struct L2 *item = zalloc_or_die(sizeof *item); [L792] CALL l3_insert(&item->down) [L781] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L781] EXPR zalloc_or_die(sizeof *item) [L781] struct L3 *item = zalloc_or_die(sizeof *item); [L783] CALL l4_insert(&item->down) [L774] CALL, EXPR zalloc_or_die(sizeof *item) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L774] EXPR zalloc_or_die(sizeof *item) [L774] struct L4 *item = zalloc_or_die(sizeof *item); [L775] CALL, EXPR zalloc_or_die(119U) [L767] CALL, EXPR calloc_model(1U, size) [L741] EXPR, FCALL malloc(nmemb * size) [L741] void *ptr = malloc(nmemb * size); [L742] EXPR, FCALL memset(ptr, 0, nmemb * size) [L742] RET return memset(ptr, 0, nmemb * size); [L767] EXPR calloc_model(1U, size) [L767] void *ptr = calloc_model(1U, size); [L768] COND TRUE \read(*ptr) [L769] RET return ptr; [L775] EXPR zalloc_or_die(119U) [L775] FCALL item->down = zalloc_or_die(119U) [L776] EXPR, FCALL \read(**list) [L776] FCALL item->next = *list [L777] RET, FCALL *list = item [L783] l4_insert(&item->down) [L784] COND FALSE !(__VERIFIER_nondet_int()) [L785] EXPR, FCALL \read(**list) [L785] FCALL item->next = *list [L786] RET, FCALL *list = item [L792] l3_insert(&item->down) [L793] COND FALSE !(__VERIFIER_nondet_int()) [L794] EXPR, FCALL \read(**list) [L794] FCALL item->next = *list [L795] RET, FCALL *list = item [L801] l2_insert(&item->down) [L802] COND FALSE !(__VERIFIER_nondet_int()) [L803] EXPR, FCALL \read(**list) [L803] FCALL item->next = *list [L804] RET, FCALL *list = item [L810] l1_insert(&item->down) [L811] COND FALSE !(__VERIFIER_nondet_int()) [L812] EXPR, FCALL \read(**list) [L812] FCALL item->next = *list [L813] RET, FCALL *list = item [L869] l0_insert(&list) [L870] COND FALSE !(__VERIFIER_nondet_int()) [L871] EXPR, FCALL \read(*list) [L871] CALL l0_destroy(list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] EXPR, FCALL list->down [L818] FCALL free(list->down) [L819] EXPR, FCALL list->next [L819] struct L4 *next = list->next; [L820] FCALL free(list) [L821] list = next [L823] COND FALSE, RET !(\read(*list)) [L828] l4_destroy(list->down) [L829] EXPR, FCALL list->next [L829] struct L3 *next = list->next; [L830] FCALL free(list) [L831] list = next [L833] COND FALSE, RET !(\read(*list)) [L838] l3_destroy(list->down) [L839] EXPR, FCALL list->next [L839] struct L2 *next = list->next; [L840] FCALL free(list) [L841] list = next [L843] COND FALSE, RET !(\read(*list)) [L848] l2_destroy(list->down) [L849] EXPR, FCALL list->next [L849] struct L1 *next = list->next; [L850] FCALL free(list) [L851] list = next [L853] COND FALSE, RET !(\read(*list)) [L858] l1_destroy(list->down) [L859] EXPR, FCALL list->next [L859] struct L0 *next = list->next; [L860] FCALL free(list) [L861] list = next [L863] COND TRUE \read(*list) [L858] EXPR, FCALL list->down [L858] CALL l1_destroy(list->down) [L848] EXPR, FCALL list->down [L848] CALL l2_destroy(list->down) [L838] EXPR, FCALL list->down [L838] CALL l3_destroy(list->down) [L828] EXPR, FCALL list->down [L828] CALL l4_destroy(list->down) [L818] EXPR, FCALL list->down [L818] FCALL free(list->down) [L819] EXPR, FCALL list->next [L819] struct L4 *next = list->next; [L820] FCALL free(list) [L821] list = next [L823] COND FALSE, RET !(\read(*list)) [L828] l4_destroy(list->down) [L829] EXPR, FCALL list->next [L829] struct L3 *next = list->next; [L830] FCALL free(list) [L831] list = next [L833] COND FALSE, RET !(\read(*list)) [L838] l3_destroy(list->down) [L839] EXPR, FCALL list->next [L839] struct L2 *next = list->next; [L840] FCALL free(list) [L841] list = next [L843] COND FALSE, RET !(\read(*list)) [L848] l2_destroy(list->down) [L849] EXPR, FCALL list->next [L849] struct L1 *next = list->next; [L850] FCALL free(list) [L851] list = next [L853] COND FALSE, RET !(\read(*list)) [L858] l1_destroy(list->down) [L859] EXPR, FCALL list->next [L859] struct L0 *next = list->next; [L860] FCALL free(list) - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: -1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location * Results from de.uni_freiburg.informatik.ultimate.boogie.preprocessor: - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification ensures #valid == old(#valid); is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == #ptr.base && #res.offset == #ptr.offset; is not ensure(true) RESULT: Ultimate could not prove your program: unable to determine feasibility of some traces Written .csv to /storage/ultimate/releaseScripts/default/UAutomizer-linux/../../../releaseScripts/default/UAutomizer-linux/csv/test-0234_true-valid-memsafety.i_svcomp-DerefFreeMemtrack-32bit-Automizer_Camel+AI_EQ_imprecise.epf_AbstractInterpretationC.xml/Csv-Benchmark-0-2018-01-24_16-26-08-730.csv Written .csv to /storage/ultimate/releaseScripts/default/UAutomizer-linux/../../../releaseScripts/default/UAutomizer-linux/csv/test-0234_true-valid-memsafety.i_svcomp-DerefFreeMemtrack-32bit-Automizer_Camel+AI_EQ_imprecise.epf_AbstractInterpretationC.xml/Csv-VPDomainBenchmark-0-2018-01-24_16-26-08-730.csv Written .csv to /storage/ultimate/releaseScripts/default/UAutomizer-linux/../../../releaseScripts/default/UAutomizer-linux/csv/test-0234_true-valid-memsafety.i_svcomp-DerefFreeMemtrack-32bit-Automizer_Camel+AI_EQ_imprecise.epf_AbstractInterpretationC.xml/Csv-BenchmarkWithCounters-0-2018-01-24_16-26-08-730.csv Received shutdown request...