java -Xmx6000000000 -jar ./plugins/org.eclipse.equinox.launcher_1.3.100.v20150511-1540.jar -data ./data --generate-csv --csv-dir ../../../releaseScripts/default/UAutomizer-linux/csv -tc ../../../trunk/examples/toolchains/AbstractInterpretationC.xml -s ../../../trunk/examples/settings/ai/eq-bench/svcomp-DerefFreeMemtrack-32bit-Automizer_Camel+AI_EQ_imprecise.epf -i ../../../trunk/examples/svcomp/memsafety-ext/tree_dsw_true-valid-memsafety_false-termination.i


--------------------------------------------------------------------------------


This is Ultimate 0.1.23-6b94a2f
[2018-01-24 16:27:08,968 INFO  L170        SettingsManager]: Resetting all preferences to default values...
[2018-01-24 16:27:08,970 INFO  L174        SettingsManager]: Resetting UltimateCore preferences to default values
[2018-01-24 16:27:08,986 INFO  L177        SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring...
[2018-01-24 16:27:08,986 INFO  L174        SettingsManager]: Resetting Boogie Preprocessor preferences to default values
[2018-01-24 16:27:08,987 INFO  L174        SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values
[2018-01-24 16:27:08,989 INFO  L174        SettingsManager]: Resetting Abstract Interpretation preferences to default values
[2018-01-24 16:27:08,990 INFO  L174        SettingsManager]: Resetting LassoRanker preferences to default values
[2018-01-24 16:27:08,992 INFO  L174        SettingsManager]: Resetting Reaching Definitions preferences to default values
[2018-01-24 16:27:08,993 INFO  L174        SettingsManager]: Resetting SyntaxChecker preferences to default values
[2018-01-24 16:27:08,993 INFO  L177        SettingsManager]: Büchi Program Product provides no preferences, ignoring...
[2018-01-24 16:27:08,994 INFO  L174        SettingsManager]: Resetting LTL2Aut preferences to default values
[2018-01-24 16:27:08,994 INFO  L174        SettingsManager]: Resetting BlockEncodingV2 preferences to default values
[2018-01-24 16:27:08,995 INFO  L174        SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values
[2018-01-24 16:27:08,996 INFO  L174        SettingsManager]: Resetting BuchiAutomizer preferences to default values
[2018-01-24 16:27:08,999 INFO  L174        SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values
[2018-01-24 16:27:09,001 INFO  L174        SettingsManager]: Resetting CodeCheck preferences to default values
[2018-01-24 16:27:09,003 INFO  L174        SettingsManager]: Resetting InvariantSynthesis preferences to default values
[2018-01-24 16:27:09,004 INFO  L174        SettingsManager]: Resetting RCFGBuilder preferences to default values
[2018-01-24 16:27:09,005 INFO  L174        SettingsManager]: Resetting TraceAbstraction preferences to default values
[2018-01-24 16:27:09,008 INFO  L177        SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring...
[2018-01-24 16:27:09,008 INFO  L177        SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring...
[2018-01-24 16:27:09,008 INFO  L174        SettingsManager]: Resetting IcfgTransformer preferences to default values
[2018-01-24 16:27:09,009 INFO  L174        SettingsManager]: Resetting Boogie Printer preferences to default values
[2018-01-24 16:27:09,010 INFO  L174        SettingsManager]: Resetting Witness Printer preferences to default values
[2018-01-24 16:27:09,012 INFO  L177        SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring...
[2018-01-24 16:27:09,012 INFO  L174        SettingsManager]: Resetting CDTParser preferences to default values
[2018-01-24 16:27:09,013 INFO  L177        SettingsManager]: PEA to Boogie provides no preferences, ignoring...
[2018-01-24 16:27:09,013 INFO  L177        SettingsManager]: AutomataScriptParser provides no preferences, ignoring...
[2018-01-24 16:27:09,013 INFO  L174        SettingsManager]: Resetting Witness Parser preferences to default values
[2018-01-24 16:27:09,014 INFO  L181        SettingsManager]: Finished resetting all preferences to default values...
[2018-01-24 16:27:09,014 INFO  L98         SettingsManager]: Beginning loading settings from /storage/ultimate/releaseScripts/default/UAutomizer-linux/../../../trunk/examples/settings/ai/eq-bench/svcomp-DerefFreeMemtrack-32bit-Automizer_Camel+AI_EQ_imprecise.epf
[2018-01-24 16:27:09,024 INFO  L110        SettingsManager]: Loading preferences was successful
[2018-01-24 16:27:09,024 INFO  L112        SettingsManager]: Preferences different from defaults after loading the file:
[2018-01-24 16:27:09,025 INFO  L131        SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults:
[2018-01-24 16:27:09,025 INFO  L133        SettingsManager]:  * to procedures, called more than once=true
[2018-01-24 16:27:09,025 INFO  L131        SettingsManager]: Preferences of Abstract Interpretation differ from their defaults:
[2018-01-24 16:27:09,026 INFO  L133        SettingsManager]:  * Deactivate Weak Equivalences=true
[2018-01-24 16:27:09,026 INFO  L133        SettingsManager]:  * Abstract domain for RCFG-of-the-future=VPDomain
[2018-01-24 16:27:09,026 INFO  L133        SettingsManager]:  * Use the RCFG-of-the-future interface=true
[2018-01-24 16:27:09,027 INFO  L131        SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults:
[2018-01-24 16:27:09,027 INFO  L133        SettingsManager]:  * sizeof long=4
[2018-01-24 16:27:09,027 INFO  L133        SettingsManager]:  * Check unreachability of error function in SV-COMP mode=false
[2018-01-24 16:27:09,027 INFO  L133        SettingsManager]:  * Overapproximate operations on floating types=true
[2018-01-24 16:27:09,028 INFO  L133        SettingsManager]:  * sizeof POINTER=4
[2018-01-24 16:27:09,028 INFO  L133        SettingsManager]:  * Check division by zero=IGNORE
[2018-01-24 16:27:09,028 INFO  L133        SettingsManager]:  * Check for the main procedure if all allocated memory was freed=true
[2018-01-24 16:27:09,028 INFO  L133        SettingsManager]:  * Bitprecise bitfields=true
[2018-01-24 16:27:09,028 INFO  L133        SettingsManager]:  * SV-COMP memtrack compatibility mode=true
[2018-01-24 16:27:09,029 INFO  L133        SettingsManager]:  * If two pointers are subtracted or compared they have the same base address=IGNORE
[2018-01-24 16:27:09,029 INFO  L133        SettingsManager]:  * sizeof long double=12
[2018-01-24 16:27:09,029 INFO  L131        SettingsManager]: Preferences of RCFGBuilder differ from their defaults:
[2018-01-24 16:27:09,029 INFO  L133        SettingsManager]:  * Size of a code block=SequenceOfStatements
[2018-01-24 16:27:09,029 INFO  L133        SettingsManager]:  * To the following directory=./dump/
[2018-01-24 16:27:09,030 INFO  L133        SettingsManager]:  * Add additional assume for each assert=false
[2018-01-24 16:27:09,030 INFO  L133        SettingsManager]:  * SMT solver=External_DefaultMode
[2018-01-24 16:27:09,030 INFO  L133        SettingsManager]:  * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000
[2018-01-24 16:27:09,030 INFO  L131        SettingsManager]: Preferences of TraceAbstraction differ from their defaults:
[2018-01-24 16:27:09,030 INFO  L133        SettingsManager]:  * Interpolant automaton=TWOTRACK
[2018-01-24 16:27:09,031 INFO  L133        SettingsManager]:  * Compute Interpolants along a Counterexample=FPandBP
[2018-01-24 16:27:09,031 INFO  L133        SettingsManager]:  * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles
[2018-01-24 16:27:09,031 INFO  L133        SettingsManager]:  * Trace refinement strategy=CAMEL
[2018-01-24 16:27:09,031 INFO  L133        SettingsManager]:  * SMT solver=External_ModelsAndUnsatCoreMode
[2018-01-24 16:27:09,031 INFO  L133        SettingsManager]:  * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in
[2018-01-24 16:27:09,031 INFO  L133        SettingsManager]:  * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true
[2018-01-24 16:27:09,032 INFO  L131        SettingsManager]: Preferences of IcfgTransformer differ from their defaults:
[2018-01-24 16:27:09,032 INFO  L133        SettingsManager]:  * TransformationType=HEAP_SEPARATOR
[2018-01-24 16:27:09,069 INFO  L81    nceAwareModelManager]: Repository-Root is: /tmp
[2018-01-24 16:27:09,082 INFO  L266   ainManager$Toolchain]: [Toolchain 1]: Parser(s) successfully initialized
[2018-01-24 16:27:09,086 INFO  L222   ainManager$Toolchain]: [Toolchain 1]: Toolchain data selected.
[2018-01-24 16:27:09,088 INFO  L271        PluginConnector]: Initializing CDTParser...
[2018-01-24 16:27:09,088 INFO  L276        PluginConnector]: CDTParser initialized
[2018-01-24 16:27:09,089 INFO  L431   ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /storage/ultimate/releaseScripts/default/UAutomizer-linux/../../../trunk/examples/svcomp/memsafety-ext/tree_dsw_true-valid-memsafety_false-termination.i
[2018-01-24 16:27:09,273 INFO  L304   ainManager$Toolchain]: ####################### [Toolchain 1] #######################
[2018-01-24 16:27:09,279 INFO  L131        ToolchainWalker]: Walking toolchain with 4 elements.
[2018-01-24 16:27:09,280 INFO  L113        PluginConnector]: ------------------------CACSL2BoogieTranslator----------------------------
[2018-01-24 16:27:09,280 INFO  L271        PluginConnector]: Initializing CACSL2BoogieTranslator...
[2018-01-24 16:27:09,285 INFO  L276        PluginConnector]: CACSL2BoogieTranslator initialized
[2018-01-24 16:27:09,286 INFO  L185        PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 24.01 04:27:09" (1/1) ...
[2018-01-24 16:27:09,288 INFO  L205        PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@1eaa2765 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:27:09, skipping insertion in model container
[2018-01-24 16:27:09,288 INFO  L185        PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 24.01 04:27:09" (1/1) ...
[2018-01-24 16:27:09,302 INFO  L153             Dispatcher]: Using SV-COMP mode
[2018-01-24 16:27:09,342 INFO  L153             Dispatcher]: Using SV-COMP mode
[2018-01-24 16:27:09,477 INFO  L450          PostProcessor]: Settings: Checked method=main
[2018-01-24 16:27:09,506 INFO  L450          PostProcessor]: Settings: Checked method=main
[2018-01-24 16:27:09,514 INFO  L202        PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:27:09 WrapperNode
[2018-01-24 16:27:09,514 INFO  L132        PluginConnector]: ------------------------ END CACSL2BoogieTranslator----------------------------
[2018-01-24 16:27:09,515 INFO  L113        PluginConnector]: ------------------------Boogie Preprocessor----------------------------
[2018-01-24 16:27:09,515 INFO  L271        PluginConnector]: Initializing Boogie Preprocessor...
[2018-01-24 16:27:09,515 INFO  L276        PluginConnector]: Boogie Preprocessor initialized
[2018-01-24 16:27:09,526 INFO  L185        PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:27:09" (1/1) ...
[2018-01-24 16:27:09,526 INFO  L185        PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:27:09" (1/1) ...
[2018-01-24 16:27:09,539 INFO  L185        PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:27:09" (1/1) ...
[2018-01-24 16:27:09,539 INFO  L185        PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:27:09" (1/1) ...
[2018-01-24 16:27:09,546 INFO  L185        PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:27:09" (1/1) ...
[2018-01-24 16:27:09,550 INFO  L185        PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:27:09" (1/1) ...
[2018-01-24 16:27:09,552 INFO  L185        PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:27:09" (1/1) ...
[2018-01-24 16:27:09,554 INFO  L132        PluginConnector]: ------------------------ END Boogie Preprocessor----------------------------
[2018-01-24 16:27:09,554 INFO  L113        PluginConnector]: ------------------------RCFGBuilder----------------------------
[2018-01-24 16:27:09,554 INFO  L271        PluginConnector]: Initializing RCFGBuilder...
[2018-01-24 16:27:09,555 INFO  L276        PluginConnector]: RCFGBuilder initialized
[2018-01-24 16:27:09,555 INFO  L185        PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:27:09" (1/1) ...
No working directory specified, using /storage/ultimate/releaseScripts/default/UAutomizer-linux/z3
Starting monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null)
Waiting until toolchain timeout for monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000
[2018-01-24 16:27:09,601 INFO  L136     BoogieDeclarations]: Found implementation of procedure ULTIMATE.init
[2018-01-24 16:27:09,601 INFO  L136     BoogieDeclarations]: Found implementation of procedure ULTIMATE.start
[2018-01-24 16:27:09,601 INFO  L136     BoogieDeclarations]: Found implementation of procedure main
[2018-01-24 16:27:09,601 INFO  L128     BoogieDeclarations]: Found specification of procedure write~$Pointer$
[2018-01-24 16:27:09,601 INFO  L128     BoogieDeclarations]: Found specification of procedure read~$Pointer$
[2018-01-24 16:27:09,602 INFO  L128     BoogieDeclarations]: Found specification of procedure ULTIMATE.free
[2018-01-24 16:27:09,602 INFO  L128     BoogieDeclarations]: Found specification of procedure ULTIMATE.dealloc
[2018-01-24 16:27:09,602 INFO  L128     BoogieDeclarations]: Found specification of procedure #Ultimate.alloc
[2018-01-24 16:27:09,602 INFO  L128     BoogieDeclarations]: Found specification of procedure __VERIFIER_nondet_int
[2018-01-24 16:27:09,602 INFO  L128     BoogieDeclarations]: Found specification of procedure malloc
[2018-01-24 16:27:09,602 INFO  L128     BoogieDeclarations]: Found specification of procedure free
[2018-01-24 16:27:09,602 INFO  L128     BoogieDeclarations]: Found specification of procedure main
[2018-01-24 16:27:09,603 INFO  L128     BoogieDeclarations]: Found specification of procedure ULTIMATE.init
[2018-01-24 16:27:09,603 INFO  L128     BoogieDeclarations]: Found specification of procedure ULTIMATE.start
[2018-01-24 16:27:10,188 INFO  L257             CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start)
[2018-01-24 16:27:10,188 INFO  L202        PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 24.01 04:27:10 BoogieIcfgContainer
[2018-01-24 16:27:10,188 INFO  L132        PluginConnector]: ------------------------ END RCFGBuilder----------------------------
[2018-01-24 16:27:10,189 INFO  L113        PluginConnector]: ------------------------Abstract Interpretation----------------------------
[2018-01-24 16:27:10,189 INFO  L271        PluginConnector]: Initializing Abstract Interpretation...
[2018-01-24 16:27:10,190 INFO  L276        PluginConnector]: Abstract Interpretation initialized
[2018-01-24 16:27:10,191 INFO  L185        PluginConnector]: Executing the observer AbstractInterpretationRcfgObserver from plugin Abstract Interpretation for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 24.01 04:27:10" (1/1) ...
[2018-01-24 16:27:10,243 INFO  L101         FixpointEngine]: Starting fixpoint engine with domain VPDomain (maxUnwinding=3, maxParallelStates=2)
[2018-01-24 16:27:15,333 INFO  L259    AbstractInterpreter]: Some error location(s) were reachable
[2018-01-24 16:27:15,395 WARN  L343   cessorBacktranslator]: Generated EnsuresSpecification ensures #valid == old(#valid); is not ensure(true)
[2018-01-24 16:27:15,401 INFO  L268    AbstractInterpreter]: Visited 190 different actions 1211 times. Merged at 149 different actions 741 times. Widened at 4 different actions 6 times. Found 98 fixpoints after 42 different actions. Largest state had 82 variables.
[2018-01-24 16:27:15,403 INFO  L132        PluginConnector]: ------------------------ END Abstract Interpretation----------------------------
[2018-01-24 16:27:15,404 INFO  L168              Benchmark]: Toolchain (without parser) took 6130.68 ms. Allocated memory was 307.2 MB in the beginning and 940.6 MB in the end (delta: 633.3 MB). Free memory was 267.3 MB in the beginning and 837.1 MB in the end (delta: -569.8 MB). Peak memory consumption was 63.5 MB. Max. memory is 5.3 GB.
[2018-01-24 16:27:15,405 INFO  L168              Benchmark]: CDTParser took 0.21 ms. Allocated memory is still 307.2 MB. Free memory is still 273.2 MB. There was no memory consumed. Max. memory is 5.3 GB.
[2018-01-24 16:27:15,405 INFO  L168              Benchmark]: CACSL2BoogieTranslator took 234.40 ms. Allocated memory is still 307.2 MB. Free memory was 266.3 MB in the beginning and 255.3 MB in the end (delta: 11.0 MB). Peak memory consumption was 11.0 MB. Max. memory is 5.3 GB.
[2018-01-24 16:27:15,406 INFO  L168              Benchmark]: Boogie Preprocessor took 39.31 ms. Allocated memory is still 307.2 MB. Free memory was 255.3 MB in the beginning and 253.3 MB in the end (delta: 2.0 MB). Peak memory consumption was 2.0 MB. Max. memory is 5.3 GB.
[2018-01-24 16:27:15,406 INFO  L168              Benchmark]: RCFGBuilder took 634.14 ms. Allocated memory is still 307.2 MB. Free memory was 253.3 MB in the beginning and 210.0 MB in the end (delta: 43.3 MB). Peak memory consumption was 43.3 MB. Max. memory is 5.3 GB.
[2018-01-24 16:27:15,406 INFO  L168              Benchmark]: Abstract Interpretation took 5214.54 ms. Allocated memory was 307.2 MB in the beginning and 940.6 MB in the end (delta: 633.3 MB). Free memory was 210.0 MB in the beginning and 837.1 MB in the end (delta: -627.1 MB). Peak memory consumption was 6.2 MB. Max. memory is 5.3 GB.
[2018-01-24 16:27:15,408 INFO  L344   ainManager$Toolchain]: #######################  End [Toolchain 1] #######################
 --- Results ---
 * Results from de.uni_freiburg.informatik.ultimate.core:
  - StatisticsResult: Toolchain Benchmarks
    Benchmark results are:
 * CDTParser took 0.21 ms. Allocated memory is still 307.2 MB. Free memory is still 273.2 MB. There was no memory consumed. Max. memory is 5.3 GB.
 * CACSL2BoogieTranslator took 234.40 ms. Allocated memory is still 307.2 MB. Free memory was 266.3 MB in the beginning and 255.3 MB in the end (delta: 11.0 MB). Peak memory consumption was 11.0 MB. Max. memory is 5.3 GB.
 * Boogie Preprocessor took 39.31 ms. Allocated memory is still 307.2 MB. Free memory was 255.3 MB in the beginning and 253.3 MB in the end (delta: 2.0 MB). Peak memory consumption was 2.0 MB. Max. memory is 5.3 GB.
 * RCFGBuilder took 634.14 ms. Allocated memory is still 307.2 MB. Free memory was 253.3 MB in the beginning and 210.0 MB in the end (delta: 43.3 MB). Peak memory consumption was 43.3 MB. Max. memory is 5.3 GB.
 * Abstract Interpretation took 5214.54 ms. Allocated memory was 307.2 MB in the beginning and 940.6 MB in the end (delta: 633.3 MB). Free memory was 210.0 MB in the beginning and 837.1 MB in the end (delta: -627.1 MB). Peak memory consumption was 6.2 MB. Max. memory is 5.3 GB.
 * Results from de.uni_freiburg.informatik.ultimate.plugins.analysis.abstractinterpretationv2:
  - StatisticsResult: ArrayEqualityDomainStatistics
    
#Locations                               :     146 
LocStat_MAX_WEQGRAPH_SIZE                :       0 
LocStat_MAX_SIZEOF_WEQEDGELABEL          :       0 
LocStat_NO_SUPPORTING_EQUALITIES         :    1909 
LocStat_NO_SUPPORTING_DISEQUALITIES      :     572 
LocStat_NO_DISJUNCTIONS                  :    -292 
LocStat_MAX_NO_DISJUNCTIONS              :      -1 
#Transitions                             :     194 
TransStat_MAX_WEQGRAPH_SIZE              :       0 
TransStat_MAX_SIZEOF_WEQEDGELABEL        :       0 
TransStat_NO_SUPPORTING_EQUALITIES       :     349 
TransStat_NO_SUPPORTING_DISEQUALITIES    :     100 
TransStat_NO_DISJUNCTIONS                :     246 
TransStat_MAX_NO_DISJUNCTIONS            :       4 

  - StatisticsResult: EqConstraintFactoryStatistics
    
CONJOIN_DISJUNCTIVE(MILLISECONDS)        : 0.332845 
RENAME_VARIABLES(MILLISECONDS)           : 0.328767 
UNFREEZE(MILLISECONDS)                   : 0.000000 
CONJOIN(MILLISECONDS)                    : 0.312366 
PROJECTAWAY(MILLISECONDS)                : 0.328224 
ADD_WEAK_EQUALITY(MILLISECONDS)          : 0.000923 
DISJOIN(MILLISECONDS)                    : 0.349673 
RENAME_VARIABLES_DISJUNCTIVE(MILLISECONDS) : 0.358483 
ADD_EQUALITY(MILLISECONDS)               : 0.012744 
DISJOIN_DISJUNCTIVE(MILLISECONDS)        : 0.000000 
ADD_DISEQUALITY(MILLISECONDS)            : 0.020842 
#CONJOIN_DISJUNCTIVE                     :    1910 
#RENAME_VARIABLES                        :    4241 
#UNFREEZE                                :       0 
#CONJOIN                                 :    2758 
#PROJECTAWAY                             :    2227 
#ADD_WEAK_EQUALITY                       :      86 
#DISJOIN                                 :     479 
#RENAME_VARIABLES_DISJUNCTIVE            :    3658 
#ADD_EQUALITY                            :     359 
#DISJOIN_DISJUNCTIVE                     :       0 
#ADD_DISEQUALITY                         :      75 

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND TRUE    __VERIFIER_nondet_int()
[L633]               n = root
[L634]  FCALL        n->left

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  FCALL        n->left

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  FCALL        n->left

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND TRUE    __VERIFIER_nondet_int()
[L633]               n = root
[L634]  EXPR, FCALL  n->left
[L634]               n->left && n->right
[L634]  FCALL        n->right

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND TRUE    __VERIFIER_nondet_int()
[L633]               n = root
[L634]  EXPR, FCALL  n->left
[L634]               n->left && n->right
[L634]  COND FALSE   !(n->left && n->right)
[L640]  FCALL        n->left

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  FCALL        n->right

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND TRUE    __VERIFIER_nondet_int()
[L633]               n = root
[L634]  EXPR, FCALL  n->left
[L634]               n->left && n->right
[L634]  EXPR, FCALL  n->right
[L634]               n->left && n->right
[L634]  COND TRUE    n->left && n->right
[L635]  COND TRUE    __VERIFIER_nondet_int()
[L636]  FCALL        n->left

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND TRUE    __VERIFIER_nondet_int()
[L633]               n = root
[L634]  EXPR, FCALL  n->left
[L634]               n->left && n->right
[L634]  EXPR, FCALL  n->right
[L634]               n->left && n->right
[L634]  COND TRUE    n->left && n->right
[L635]  COND FALSE   !(__VERIFIER_nondet_int())
[L638]  FCALL        n->right

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND TRUE    __VERIFIER_nondet_int()
[L633]               n = root
[L634]  EXPR, FCALL  n->left
[L634]               n->left && n->right
[L634]  COND FALSE   !(n->left && n->right)
[L640]  EXPR, FCALL  n->left
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]  COND FALSE   !(!n->left && __VERIFIER_nondet_int())
[L645]  FCALL        n->right

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND TRUE    __VERIFIER_nondet_int()
[L633]               n = root
[L634]  EXPR, FCALL  n->left
[L634]               n->left && n->right
[L634]  COND FALSE   !(n->left && n->right)
[L640]  EXPR, FCALL  n->left
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]  COND TRUE    !n->left && __VERIFIER_nondet_int()
[L641]  EXPR, FCALL  malloc(sizeof(*n))
[L641]  FCALL        n->left = malloc(sizeof(*n))

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND TRUE    __VERIFIER_nondet_int()
[L633]               n = root
[L634]  EXPR, FCALL  n->left
[L634]               n->left && n->right
[L634]  COND FALSE   !(n->left && n->right)
[L640]  EXPR, FCALL  n->left
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]  COND TRUE    !n->left && __VERIFIER_nondet_int()
[L641]  EXPR, FCALL  malloc(sizeof(*n))
[L641]  FCALL        n->left = malloc(sizeof(*n))

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND TRUE    __VERIFIER_nondet_int()
[L633]               n = root
[L634]  EXPR, FCALL  n->left
[L634]               n->left && n->right
[L634]  EXPR, FCALL  n->right
[L634]               n->left && n->right
[L634]  COND TRUE    n->left && n->right
[L635]  COND TRUE    __VERIFIER_nondet_int()
[L636]  EXPR, FCALL  n->left
[L636]               n = n->left
[L634]  FCALL        n->left

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND TRUE    __VERIFIER_nondet_int()
[L633]               n = root
[L634]  EXPR, FCALL  n->left
[L634]               n->left && n->right
[L634]  COND FALSE   !(n->left && n->right)
[L640]  EXPR, FCALL  n->left
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]  COND TRUE    !n->left && __VERIFIER_nondet_int()
[L641]  EXPR, FCALL  malloc(sizeof(*n))
[L641]  FCALL        n->left = malloc(sizeof(*n))
[L642]  FCALL        n->left

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND TRUE    __VERIFIER_nondet_int()
[L633]               n = root
[L634]  EXPR, FCALL  n->left
[L634]               n->left && n->right
[L634]  COND FALSE   !(n->left && n->right)
[L640]  EXPR, FCALL  n->left
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]  COND TRUE    !n->left && __VERIFIER_nondet_int()
[L641]  EXPR, FCALL  malloc(sizeof(*n))
[L641]  FCALL        n->left = malloc(sizeof(*n))
[L642]  EXPR, FCALL  n->left
[L642]  FCALL        n->left->left = ((void *)0)

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND TRUE    __VERIFIER_nondet_int()
[L633]               n = root
[L634]  EXPR, FCALL  n->left
[L634]               n->left && n->right
[L634]  COND FALSE   !(n->left && n->right)
[L640]  EXPR, FCALL  n->left
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]  COND FALSE   !(!n->left && __VERIFIER_nondet_int())
[L645]  EXPR, FCALL  n->right
[L645]               !n->right && __VERIFIER_nondet_int()
[L645]               !n->right && __VERIFIER_nondet_int()
[L645]  COND TRUE    !n->right && __VERIFIER_nondet_int()
[L646]  EXPR, FCALL  malloc(sizeof(*n))
[L646]  FCALL        n->right = malloc(sizeof(*n))

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND TRUE    __VERIFIER_nondet_int()
[L633]               n = root
[L634]  EXPR, FCALL  n->left
[L634]               n->left && n->right
[L634]  COND FALSE   !(n->left && n->right)
[L640]  EXPR, FCALL  n->left
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]  COND FALSE   !(!n->left && __VERIFIER_nondet_int())
[L645]  EXPR, FCALL  n->right
[L645]               !n->right && __VERIFIER_nondet_int()
[L645]               !n->right && __VERIFIER_nondet_int()
[L645]  COND TRUE    !n->right && __VERIFIER_nondet_int()
[L646]  EXPR, FCALL  malloc(sizeof(*n))
[L646]  FCALL        n->right = malloc(sizeof(*n))

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND TRUE    __VERIFIER_nondet_int()
[L633]               n = root
[L634]  EXPR, FCALL  n->left
[L634]               n->left && n->right
[L634]  COND FALSE   !(n->left && n->right)
[L640]  EXPR, FCALL  n->left
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]  COND TRUE    !n->left && __VERIFIER_nondet_int()
[L641]  EXPR, FCALL  malloc(sizeof(*n))
[L641]  FCALL        n->left = malloc(sizeof(*n))
[L642]  EXPR, FCALL  n->left
[L642]  FCALL        n->left->left = ((void *)0)
[L643]  FCALL        n->left

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND TRUE    __VERIFIER_nondet_int()
[L633]               n = root
[L634]  EXPR, FCALL  n->left
[L634]               n->left && n->right
[L634]  COND FALSE   !(n->left && n->right)
[L640]  EXPR, FCALL  n->left
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]  COND FALSE   !(!n->left && __VERIFIER_nondet_int())
[L645]  EXPR, FCALL  n->right
[L645]               !n->right && __VERIFIER_nondet_int()
[L645]               !n->right && __VERIFIER_nondet_int()
[L645]  COND TRUE    !n->right && __VERIFIER_nondet_int()
[L646]  EXPR, FCALL  malloc(sizeof(*n))
[L646]  FCALL        n->right = malloc(sizeof(*n))
[L647]  FCALL        n->right

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND TRUE    __VERIFIER_nondet_int()
[L633]               n = root
[L634]  EXPR, FCALL  n->left
[L634]               n->left && n->right
[L634]  COND FALSE   !(n->left && n->right)
[L640]  EXPR, FCALL  n->left
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]  COND TRUE    !n->left && __VERIFIER_nondet_int()
[L641]  EXPR, FCALL  malloc(sizeof(*n))
[L641]  FCALL        n->left = malloc(sizeof(*n))
[L642]  EXPR, FCALL  n->left
[L642]  FCALL        n->left->left = ((void *)0)
[L643]  EXPR, FCALL  n->left
[L643]  FCALL        n->left->right = ((void *)0)

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND TRUE    __VERIFIER_nondet_int()
[L633]               n = root
[L634]  EXPR, FCALL  n->left
[L634]               n->left && n->right
[L634]  COND FALSE   !(n->left && n->right)
[L640]  EXPR, FCALL  n->left
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]  COND TRUE    !n->left && __VERIFIER_nondet_int()
[L641]  EXPR, FCALL  malloc(sizeof(*n))
[L641]  FCALL        n->left = malloc(sizeof(*n))
[L642]  EXPR, FCALL  n->left
[L642]  FCALL        n->left->left = ((void *)0)
[L643]  EXPR, FCALL  n->left
[L643]  FCALL        n->left->right = ((void *)0)

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND TRUE    __VERIFIER_nondet_int()
[L633]               n = root
[L634]  EXPR, FCALL  n->left
[L634]               n->left && n->right
[L634]  COND FALSE   !(n->left && n->right)
[L640]  EXPR, FCALL  n->left
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]  COND FALSE   !(!n->left && __VERIFIER_nondet_int())
[L645]  EXPR, FCALL  n->right
[L645]               !n->right && __VERIFIER_nondet_int()
[L645]               !n->right && __VERIFIER_nondet_int()
[L645]  COND TRUE    !n->right && __VERIFIER_nondet_int()
[L646]  EXPR, FCALL  malloc(sizeof(*n))
[L646]  FCALL        n->right = malloc(sizeof(*n))
[L647]  EXPR, FCALL  n->right
[L647]  FCALL        n->right->left = ((void *)0)

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND FALSE   !(!n)
[L655]  COND FALSE   !(n != &sentinel)
[L666]  COND FALSE   !(pred != root)
[L668]               n = ((void *)0)
[L669]  EXPR, FCALL  malloc(sizeof(*s))
[L669]               struct StackItem* s = malloc(sizeof(*s)), *st;
[L670]  FCALL        s->next = ((void *)0)

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND TRUE    __VERIFIER_nondet_int()
[L633]               n = root
[L634]  EXPR, FCALL  n->left
[L634]               n->left && n->right
[L634]  COND FALSE   !(n->left && n->right)
[L640]  EXPR, FCALL  n->left
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]  COND FALSE   !(!n->left && __VERIFIER_nondet_int())
[L645]  EXPR, FCALL  n->right
[L645]               !n->right && __VERIFIER_nondet_int()
[L645]               !n->right && __VERIFIER_nondet_int()
[L645]  COND TRUE    !n->right && __VERIFIER_nondet_int()
[L646]  EXPR, FCALL  malloc(sizeof(*n))
[L646]  FCALL        n->right = malloc(sizeof(*n))
[L647]  EXPR, FCALL  n->right
[L647]  FCALL        n->right->left = ((void *)0)
[L648]  FCALL        n->right

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND FALSE   !(!n)
[L655]  COND FALSE   !(n != &sentinel)
[L666]  COND FALSE   !(pred != root)
[L668]               n = ((void *)0)
[L669]  EXPR, FCALL  malloc(sizeof(*s))
[L669]               struct StackItem* s = malloc(sizeof(*s)), *st;
[L670]  FCALL        s->next = ((void *)0)
[L671]  FCALL        s->node = root

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND TRUE    __VERIFIER_nondet_int()
[L633]               n = root
[L634]  EXPR, FCALL  n->left
[L634]               n->left && n->right
[L634]  COND FALSE   !(n->left && n->right)
[L640]  EXPR, FCALL  n->left
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]  COND FALSE   !(!n->left && __VERIFIER_nondet_int())
[L645]  EXPR, FCALL  n->right
[L645]               !n->right && __VERIFIER_nondet_int()
[L645]               !n->right && __VERIFIER_nondet_int()
[L645]  COND TRUE    !n->right && __VERIFIER_nondet_int()
[L646]  EXPR, FCALL  malloc(sizeof(*n))
[L646]  FCALL        n->right = malloc(sizeof(*n))
[L647]  EXPR, FCALL  n->right
[L647]  FCALL        n->right->left = ((void *)0)
[L648]  EXPR, FCALL  n->right
[L648]  FCALL        n->right->right = ((void *)0)

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND TRUE    __VERIFIER_nondet_int()
[L633]               n = root
[L634]  EXPR, FCALL  n->left
[L634]               n->left && n->right
[L634]  COND FALSE   !(n->left && n->right)
[L640]  EXPR, FCALL  n->left
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]               !n->left && __VERIFIER_nondet_int()
[L640]  COND FALSE   !(!n->left && __VERIFIER_nondet_int())
[L645]  EXPR, FCALL  n->right
[L645]               !n->right && __VERIFIER_nondet_int()
[L645]               !n->right && __VERIFIER_nondet_int()
[L645]  COND TRUE    !n->right && __VERIFIER_nondet_int()
[L646]  EXPR, FCALL  malloc(sizeof(*n))
[L646]  FCALL        n->right = malloc(sizeof(*n))
[L647]  EXPR, FCALL  n->right
[L647]  FCALL        n->right->left = ((void *)0)
[L648]  EXPR, FCALL  n->right
[L648]  FCALL        n->right->right = ((void *)0)

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND FALSE   !(!n)
[L655]  COND FALSE   !(n != &sentinel)
[L666]  COND FALSE   !(pred != root)
[L668]               n = ((void *)0)
[L669]  EXPR, FCALL  malloc(sizeof(*s))
[L669]               struct StackItem* s = malloc(sizeof(*s)), *st;
[L670]  FCALL        s->next = ((void *)0)
[L671]  FCALL        s->node = root
[L672]  COND TRUE    s != ((void *)0)
[L673]               st = s
[L674]  FCALL        s->next

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND FALSE   !(!n)
[L655]  COND FALSE   !(n != &sentinel)
[L666]  COND FALSE   !(pred != root)
[L668]               n = ((void *)0)
[L669]  EXPR, FCALL  malloc(sizeof(*s))
[L669]               struct StackItem* s = malloc(sizeof(*s)), *st;
[L670]  FCALL        s->next = ((void *)0)
[L671]  FCALL        s->node = root
[L672]  COND TRUE    s != ((void *)0)
[L673]               st = s
[L674]  EXPR, FCALL  s->next
[L674]               s = s->next
[L675]  FCALL        st->node

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND TRUE    !n
[L662]               n = pred
[L663]               pred = ((void *)0)
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND FALSE   !(!n)
[L655]  COND FALSE   !(n != &sentinel)
[L666]  COND TRUE    pred != root
[L667]  FCALL        ((struct TreeNode*)((void *)0))->left = ((void *)0)

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND TRUE    !n
[L662]               n = pred
[L663]               pred = ((void *)0)
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND FALSE   !(!n)
[L655]  COND FALSE   !(n != &sentinel)
[L666]  COND TRUE    pred != root
[L667]  FCALL        ((struct TreeNode*)((void *)0))->left = ((void *)0)

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND FALSE   !(!n)
[L655]  COND FALSE   !(n != &sentinel)
[L666]  COND FALSE   !(pred != root)
[L668]               n = ((void *)0)
[L669]  EXPR, FCALL  malloc(sizeof(*s))
[L669]               struct StackItem* s = malloc(sizeof(*s)), *st;
[L670]  FCALL        s->next = ((void *)0)
[L671]  FCALL        s->node = root
[L672]  COND TRUE    s != ((void *)0)
[L673]               st = s
[L674]  EXPR, FCALL  s->next
[L674]               s = s->next
[L675]  EXPR, FCALL  st->node
[L675]               n = st->node
[L676]  FCALL        free(st)
[L677]  FCALL        n->left

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND FALSE   !(!n)
[L655]  COND FALSE   !(n != &sentinel)
[L666]  COND FALSE   !(pred != root)
[L668]               n = ((void *)0)
[L669]  EXPR, FCALL  malloc(sizeof(*s))
[L669]               struct StackItem* s = malloc(sizeof(*s)), *st;
[L670]  FCALL        s->next = ((void *)0)
[L671]  FCALL        s->node = root
[L672]  COND TRUE    s != ((void *)0)
[L673]               st = s
[L674]  EXPR, FCALL  s->next
[L674]               s = s->next
[L675]  EXPR, FCALL  st->node
[L675]               n = st->node
[L676]  FCALL        free(st)
[L677]  FCALL        n->left

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND FALSE   !(!n)
[L655]  COND FALSE   !(n != &sentinel)
[L666]  COND FALSE   !(pred != root)
[L668]               n = ((void *)0)
[L669]  EXPR, FCALL  malloc(sizeof(*s))
[L669]               struct StackItem* s = malloc(sizeof(*s)), *st;
[L670]  FCALL        s->next = ((void *)0)
[L671]  FCALL        s->node = root
[L672]  COND TRUE    s != ((void *)0)
[L673]               st = s
[L674]  EXPR, FCALL  s->next
[L674]               s = s->next
[L675]  EXPR, FCALL  st->node
[L675]               n = st->node
[L676]  FCALL        free(st)
[L677]  FCALL        n->left
[L677]  COND FALSE   !(n->left)
[L683]  FCALL        n->right

  - UnprovableResult [Line: 1]: Unable to prove that free always succeeds
    Unable to prove that free always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND FALSE   !(!n)
[L655]  COND FALSE   !(n != &sentinel)
[L666]  COND FALSE   !(pred != root)
[L668]               n = ((void *)0)
[L669]  EXPR, FCALL  malloc(sizeof(*s))
[L669]               struct StackItem* s = malloc(sizeof(*s)), *st;
[L670]  FCALL        s->next = ((void *)0)
[L671]  FCALL        s->node = root
[L672]  COND TRUE    s != ((void *)0)
[L673]               st = s
[L674]  EXPR, FCALL  s->next
[L674]               s = s->next
[L675]  EXPR, FCALL  st->node
[L675]               n = st->node
[L676]  FCALL        free(st)
[L677]  FCALL        n->left
[L677]  COND FALSE   !(n->left)
[L683]  FCALL        n->right
[L683]  COND FALSE   !(n->right)
[L689]  FCALL        free(n)

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND FALSE   !(!n)
[L655]  COND FALSE   !(n != &sentinel)
[L666]  COND FALSE   !(pred != root)
[L668]               n = ((void *)0)
[L669]  EXPR, FCALL  malloc(sizeof(*s))
[L669]               struct StackItem* s = malloc(sizeof(*s)), *st;
[L670]  FCALL        s->next = ((void *)0)
[L671]  FCALL        s->node = root
[L672]  COND TRUE    s != ((void *)0)
[L673]               st = s
[L674]  EXPR, FCALL  s->next
[L674]               s = s->next
[L675]  EXPR, FCALL  st->node
[L675]               n = st->node
[L676]  FCALL        free(st)
[L677]  FCALL        n->left
[L677]  COND TRUE    n->left
[L678]  EXPR, FCALL  malloc(sizeof(*st))
[L678]               st = malloc(sizeof(*st))
[L679]  FCALL        st->next = s

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND FALSE   !(!n)
[L655]  COND FALSE   !(n != &sentinel)
[L666]  COND FALSE   !(pred != root)
[L668]               n = ((void *)0)
[L669]  EXPR, FCALL  malloc(sizeof(*s))
[L669]               struct StackItem* s = malloc(sizeof(*s)), *st;
[L670]  FCALL        s->next = ((void *)0)
[L671]  FCALL        s->node = root
[L672]  COND TRUE    s != ((void *)0)
[L673]               st = s
[L674]  EXPR, FCALL  s->next
[L674]               s = s->next
[L675]  EXPR, FCALL  st->node
[L675]               n = st->node
[L676]  FCALL        free(st)
[L677]  FCALL        n->left
[L677]  COND TRUE    n->left
[L678]  EXPR, FCALL  malloc(sizeof(*st))
[L678]               st = malloc(sizeof(*st))
[L679]  FCALL        st->next = s
[L680]  FCALL        n->left

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND FALSE   !(!n)
[L655]  COND FALSE   !(n != &sentinel)
[L666]  COND FALSE   !(pred != root)
[L668]               n = ((void *)0)
[L669]  EXPR, FCALL  malloc(sizeof(*s))
[L669]               struct StackItem* s = malloc(sizeof(*s)), *st;
[L670]  FCALL        s->next = ((void *)0)
[L671]  FCALL        s->node = root
[L672]  COND TRUE    s != ((void *)0)
[L673]               st = s
[L674]  EXPR, FCALL  s->next
[L674]               s = s->next
[L675]  EXPR, FCALL  st->node
[L675]               n = st->node
[L676]  FCALL        free(st)
[L677]  FCALL        n->left
[L677]  COND TRUE    n->left
[L678]  EXPR, FCALL  malloc(sizeof(*st))
[L678]               st = malloc(sizeof(*st))
[L679]  FCALL        st->next = s
[L680]  FCALL        n->left

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND FALSE   !(!n)
[L655]  COND FALSE   !(n != &sentinel)
[L666]  COND FALSE   !(pred != root)
[L668]               n = ((void *)0)
[L669]  EXPR, FCALL  malloc(sizeof(*s))
[L669]               struct StackItem* s = malloc(sizeof(*s)), *st;
[L670]  FCALL        s->next = ((void *)0)
[L671]  FCALL        s->node = root
[L672]  COND TRUE    s != ((void *)0)
[L673]               st = s
[L674]  EXPR, FCALL  s->next
[L674]               s = s->next
[L675]  EXPR, FCALL  st->node
[L675]               n = st->node
[L676]  FCALL        free(st)
[L677]  FCALL        n->left
[L677]  COND FALSE   !(n->left)
[L683]  FCALL        n->right
[L683]  COND TRUE    n->right
[L684]  EXPR, FCALL  malloc(sizeof(*st))
[L684]               st = malloc(sizeof(*st))
[L685]  FCALL        st->next = s

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND FALSE   !(!n)
[L655]  COND FALSE   !(n != &sentinel)
[L666]  COND FALSE   !(pred != root)
[L668]               n = ((void *)0)
[L669]  EXPR, FCALL  malloc(sizeof(*s))
[L669]               struct StackItem* s = malloc(sizeof(*s)), *st;
[L670]  FCALL        s->next = ((void *)0)
[L671]  FCALL        s->node = root
[L672]  COND TRUE    s != ((void *)0)
[L673]               st = s
[L674]  EXPR, FCALL  s->next
[L674]               s = s->next
[L675]  EXPR, FCALL  st->node
[L675]               n = st->node
[L676]  FCALL        free(st)
[L677]  FCALL        n->left
[L677]  COND TRUE    n->left
[L678]  EXPR, FCALL  malloc(sizeof(*st))
[L678]               st = malloc(sizeof(*st))
[L679]  FCALL        st->next = s
[L680]  EXPR, FCALL  n->left
[L680]  FCALL        st->node = n->left

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND FALSE   !(!n)
[L655]  COND FALSE   !(n != &sentinel)
[L666]  COND FALSE   !(pred != root)
[L668]               n = ((void *)0)
[L669]  EXPR, FCALL  malloc(sizeof(*s))
[L669]               struct StackItem* s = malloc(sizeof(*s)), *st;
[L670]  FCALL        s->next = ((void *)0)
[L671]  FCALL        s->node = root
[L672]  COND TRUE    s != ((void *)0)
[L673]               st = s
[L674]  EXPR, FCALL  s->next
[L674]               s = s->next
[L675]  EXPR, FCALL  st->node
[L675]               n = st->node
[L676]  FCALL        free(st)
[L677]  FCALL        n->left
[L677]  COND FALSE   !(n->left)
[L683]  FCALL        n->right
[L683]  COND FALSE   !(n->right)
[L689]  FCALL        free(n)
[L672]  COND TRUE    s != ((void *)0)
[L673]               st = s
[L674]  FCALL        s->next

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND FALSE   !(!n)
[L655]  COND FALSE   !(n != &sentinel)
[L666]  COND FALSE   !(pred != root)
[L668]               n = ((void *)0)
[L669]  EXPR, FCALL  malloc(sizeof(*s))
[L669]               struct StackItem* s = malloc(sizeof(*s)), *st;
[L670]  FCALL        s->next = ((void *)0)
[L671]  FCALL        s->node = root
[L672]  COND TRUE    s != ((void *)0)
[L673]               st = s
[L674]  EXPR, FCALL  s->next
[L674]               s = s->next
[L675]  EXPR, FCALL  st->node
[L675]               n = st->node
[L676]  FCALL        free(st)
[L677]  FCALL        n->left
[L677]  COND FALSE   !(n->left)
[L683]  FCALL        n->right
[L683]  COND TRUE    n->right
[L684]  EXPR, FCALL  malloc(sizeof(*st))
[L684]               st = malloc(sizeof(*st))
[L685]  FCALL        st->next = s
[L686]  FCALL        n->right

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND FALSE   !(!n)
[L655]  COND FALSE   !(n != &sentinel)
[L666]  COND FALSE   !(pred != root)
[L668]               n = ((void *)0)
[L669]  EXPR, FCALL  malloc(sizeof(*s))
[L669]               struct StackItem* s = malloc(sizeof(*s)), *st;
[L670]  FCALL        s->next = ((void *)0)
[L671]  FCALL        s->node = root
[L672]  COND TRUE    s != ((void *)0)
[L673]               st = s
[L674]  EXPR, FCALL  s->next
[L674]               s = s->next
[L675]  EXPR, FCALL  st->node
[L675]               n = st->node
[L676]  FCALL        free(st)
[L677]  FCALL        n->left
[L677]  COND FALSE   !(n->left)
[L683]  FCALL        n->right
[L683]  COND TRUE    n->right
[L684]  EXPR, FCALL  malloc(sizeof(*st))
[L684]               st = malloc(sizeof(*st))
[L685]  FCALL        st->next = s
[L686]  FCALL        n->right

  - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds
    Unable to prove that pointer dereference always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND FALSE   !(!n)
[L655]  COND FALSE   !(n != &sentinel)
[L666]  COND FALSE   !(pred != root)
[L668]               n = ((void *)0)
[L669]  EXPR, FCALL  malloc(sizeof(*s))
[L669]               struct StackItem* s = malloc(sizeof(*s)), *st;
[L670]  FCALL        s->next = ((void *)0)
[L671]  FCALL        s->node = root
[L672]  COND TRUE    s != ((void *)0)
[L673]               st = s
[L674]  EXPR, FCALL  s->next
[L674]               s = s->next
[L675]  EXPR, FCALL  st->node
[L675]               n = st->node
[L676]  FCALL        free(st)
[L677]  FCALL        n->left
[L677]  COND FALSE   !(n->left)
[L683]  FCALL        n->right
[L683]  COND TRUE    n->right
[L684]  EXPR, FCALL  malloc(sizeof(*st))
[L684]               st = malloc(sizeof(*st))
[L685]  FCALL        st->next = s
[L686]  EXPR, FCALL  n->right
[L686]  FCALL        st->node = n->right

  - UnprovableResult [Line: 620]: Unable to prove that all allocated memory was freed
    Unable to prove that all allocated memory was freed
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND FALSE   !(!n)
[L655]  COND FALSE   !(n != &sentinel)
[L666]  COND FALSE   !(pred != root)
[L668]               n = ((void *)0)
[L669]  EXPR, FCALL  malloc(sizeof(*s))
[L669]               struct StackItem* s = malloc(sizeof(*s)), *st;
[L670]  FCALL        s->next = ((void *)0)
[L671]  FCALL        s->node = root
[L672]  COND TRUE    s != ((void *)0)
[L673]               st = s
[L674]  EXPR, FCALL  s->next
[L674]               s = s->next
[L675]  EXPR, FCALL  st->node
[L675]               n = st->node
[L676]  FCALL        free(st)
[L677]  FCALL        n->left
[L677]  COND FALSE   !(n->left)
[L683]  FCALL        n->right
[L683]  COND FALSE   !(n->right)
[L689]  FCALL        free(n)
[L672]  COND FALSE   !(s != ((void *)0))
[L691]               return 0;
[L691]               return 0;

  - UnprovableResult [Line: 1]: Unable to prove that free always succeeds
    Unable to prove that free always succeeds
 Reason: abstract domain could reach this error location. 
Possible FailurePath: 
[L629]  EXPR, FCALL  malloc(sizeof(*root))
[L629]               struct TreeNode* root = malloc(sizeof(*root)), *n;
[L630]  FCALL        root->left = ((void *)0)
[L631]  FCALL        root->right = ((void *)0)
[L632]  COND FALSE   !(__VERIFIER_nondet_int())
[L651]  FCALL        struct TreeNode sentinel;
[L652]               n = root
[L653]               struct TreeNode* pred = &sentinel;
[L654]               struct TreeNode* succ = ((void *)0);
[L655]  COND TRUE    n != &sentinel
[L656]  EXPR, FCALL  n->left
[L656]               succ = n->left
[L657]  EXPR, FCALL  n->right
[L657]  FCALL        n->left = n->right
[L658]  FCALL        n->right = pred
[L659]               pred = n
[L660]               n = succ
[L661]  COND FALSE   !(!n)
[L655]  COND FALSE   !(n != &sentinel)
[L666]  COND FALSE   !(pred != root)
[L668]               n = ((void *)0)
[L669]  EXPR, FCALL  malloc(sizeof(*s))
[L669]               struct StackItem* s = malloc(sizeof(*s)), *st;
[L670]  FCALL        s->next = ((void *)0)
[L671]  FCALL        s->node = root
[L672]  COND TRUE    s != ((void *)0)
[L673]               st = s
[L674]  EXPR, FCALL  s->next
[L674]               s = s->next
[L675]  EXPR, FCALL  st->node
[L675]               n = st->node
[L676]  FCALL        free(st)
[L677]  FCALL        n->left
[L677]  COND FALSE   !(n->left)
[L683]  FCALL        n->right
[L683]  COND FALSE   !(n->right)
[L689]  FCALL        free(n)
[L672]  COND TRUE    s != ((void *)0)
[L673]               st = s
[L674]  EXPR, FCALL  s->next
[L674]               s = s->next
[L675]  EXPR, FCALL  st->node
[L675]               n = st->node
[L676]  FCALL        free(st)

  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: free always succeeds
    For all program executions holds that free always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
  - PositiveResult [Line: 1]: free always succeeds
    For all program executions holds that free always succeeds at this location
  - PositiveResult [Line: 1]: pointer dereference always succeeds
    For all program executions holds that pointer dereference always succeeds at this location
 * Results from de.uni_freiburg.informatik.ultimate.boogie.preprocessor:
  - GenericResult: Unfinished Backtranslation
    Generated EnsuresSpecification ensures #valid == old(#valid); is not ensure(true)
RESULT: Ultimate could not prove your program: unable to determine feasibility of some traces
Written .csv to /storage/ultimate/releaseScripts/default/UAutomizer-linux/../../../releaseScripts/default/UAutomizer-linux/csv/tree_dsw_true-valid-memsafety_false-termination.i_svcomp-DerefFreeMemtrack-32bit-Automizer_Camel+AI_EQ_imprecise.epf_AbstractInterpretationC.xml/Csv-Benchmark-0-2018-01-24_16-27-15-421.csv
Written .csv to /storage/ultimate/releaseScripts/default/UAutomizer-linux/../../../releaseScripts/default/UAutomizer-linux/csv/tree_dsw_true-valid-memsafety_false-termination.i_svcomp-DerefFreeMemtrack-32bit-Automizer_Camel+AI_EQ_imprecise.epf_AbstractInterpretationC.xml/Csv-VPDomainBenchmark-0-2018-01-24_16-27-15-421.csv
Written .csv to /storage/ultimate/releaseScripts/default/UAutomizer-linux/../../../releaseScripts/default/UAutomizer-linux/csv/tree_dsw_true-valid-memsafety_false-termination.i_svcomp-DerefFreeMemtrack-32bit-Automizer_Camel+AI_EQ_imprecise.epf_AbstractInterpretationC.xml/Csv-BenchmarkWithCounters-0-2018-01-24_16-27-15-421.csv
Received shutdown request...