./Ultimate.py --spec ../sv-benchmarks/c/properties/unreach-call.prp --file ../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i --full-output --architecture 64bit -------------------------------------------------------------------------------- Checking for ERROR reachability Using default analysis Version 35987657 Calling Ultimate with: /usr/bin/java -Dosgi.configuration.area=/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/config -Xmx15G -Xms4m -jar /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/org.eclipse.equinox.launcher_1.5.800.v20200727-1323.jar -data @noDefault -ultimatedata /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data -tc /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/AutomizerReach.xml -i ../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i -s /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Default.epf --cacsl2boogietranslator.entry.function main --witnessprinter.witness.directory /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux --witnessprinter.witness.filename witness.graphml --witnessprinter.write.witness.besides.input.file false --witnessprinter.graph.data.specification CHECK( init(main()), LTL(G ! call(reach_error())) ) --witnessprinter.graph.data.producer Automizer --witnessprinter.graph.data.architecture 64bit --witnessprinter.graph.data.programhash aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 --- Real Ultimate output --- This is Ultimate 0.2.2-?-3598765 [2022-07-21 11:10:26,424 INFO L177 SettingsManager]: Resetting all preferences to default values... [2022-07-21 11:10:26,425 INFO L181 SettingsManager]: Resetting UltimateCore preferences to default values [2022-07-21 11:10:26,463 INFO L184 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2022-07-21 11:10:26,465 INFO L181 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2022-07-21 11:10:26,466 INFO L181 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2022-07-21 11:10:26,474 INFO L181 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2022-07-21 11:10:26,478 INFO L181 SettingsManager]: Resetting LassoRanker preferences to default values [2022-07-21 11:10:26,480 INFO L181 SettingsManager]: Resetting Reaching Definitions preferences to default values [2022-07-21 11:10:26,484 INFO L181 SettingsManager]: Resetting SyntaxChecker preferences to default values [2022-07-21 11:10:26,486 INFO L181 SettingsManager]: Resetting Sifa preferences to default values [2022-07-21 11:10:26,491 INFO L184 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2022-07-21 11:10:26,491 INFO L181 SettingsManager]: Resetting LTL2Aut preferences to default values [2022-07-21 11:10:26,493 INFO L181 SettingsManager]: Resetting PEA to Boogie preferences to default values [2022-07-21 11:10:26,496 INFO L181 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2022-07-21 11:10:26,498 INFO L181 SettingsManager]: Resetting ChcToBoogie preferences to default values [2022-07-21 11:10:26,499 INFO L181 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2022-07-21 11:10:26,500 INFO L181 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2022-07-21 11:10:26,504 INFO L181 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2022-07-21 11:10:26,507 INFO L181 SettingsManager]: Resetting CodeCheck preferences to default values [2022-07-21 11:10:26,511 INFO L181 SettingsManager]: Resetting HornVerifier preferences to default values [2022-07-21 11:10:26,512 INFO L181 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2022-07-21 11:10:26,513 INFO L181 SettingsManager]: Resetting RCFGBuilder preferences to default values [2022-07-21 11:10:26,515 INFO L181 SettingsManager]: Resetting Referee preferences to default values [2022-07-21 11:10:26,517 INFO L181 SettingsManager]: Resetting TraceAbstraction preferences to default values [2022-07-21 11:10:26,520 INFO L184 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2022-07-21 11:10:26,524 INFO L184 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2022-07-21 11:10:26,524 INFO L181 SettingsManager]: Resetting TreeAutomizer preferences to default values [2022-07-21 11:10:26,525 INFO L181 SettingsManager]: Resetting IcfgToChc preferences to default values [2022-07-21 11:10:26,526 INFO L181 SettingsManager]: Resetting IcfgTransformer preferences to default values [2022-07-21 11:10:26,527 INFO L184 SettingsManager]: ReqToTest provides no preferences, ignoring... [2022-07-21 11:10:26,527 INFO L181 SettingsManager]: Resetting Boogie Printer preferences to default values [2022-07-21 11:10:26,528 INFO L181 SettingsManager]: Resetting ChcSmtPrinter preferences to default values [2022-07-21 11:10:26,529 INFO L181 SettingsManager]: Resetting ReqPrinter preferences to default values [2022-07-21 11:10:26,531 INFO L181 SettingsManager]: Resetting Witness Printer preferences to default values [2022-07-21 11:10:26,531 INFO L184 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2022-07-21 11:10:26,532 INFO L181 SettingsManager]: Resetting CDTParser preferences to default values [2022-07-21 11:10:26,532 INFO L184 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2022-07-21 11:10:26,532 INFO L184 SettingsManager]: ReqParser provides no preferences, ignoring... [2022-07-21 11:10:26,533 INFO L181 SettingsManager]: Resetting SmtParser preferences to default values [2022-07-21 11:10:26,533 INFO L181 SettingsManager]: Resetting Witness Parser preferences to default values [2022-07-21 11:10:26,534 INFO L188 SettingsManager]: Finished resetting all preferences to default values... [2022-07-21 11:10:26,539 INFO L101 SettingsManager]: Beginning loading settings from /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Default.epf [2022-07-21 11:10:26,568 INFO L113 SettingsManager]: Loading preferences was successful [2022-07-21 11:10:26,569 INFO L115 SettingsManager]: Preferences different from defaults after loading the file: [2022-07-21 11:10:26,569 INFO L136 SettingsManager]: Preferences of UltimateCore differ from their defaults: [2022-07-21 11:10:26,569 INFO L138 SettingsManager]: * Log level for class=de.uni_freiburg.informatik.ultimate.lib.smtlibutils.quantifier.QuantifierPusher=ERROR; [2022-07-21 11:10:26,570 INFO L136 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2022-07-21 11:10:26,570 INFO L138 SettingsManager]: * Ignore calls to procedures called more than once=ONLY_FOR_SEQUENTIAL_PROGRAMS [2022-07-21 11:10:26,571 INFO L136 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2022-07-21 11:10:26,571 INFO L138 SettingsManager]: * Create parallel compositions if possible=false [2022-07-21 11:10:26,571 INFO L138 SettingsManager]: * Use SBE=true [2022-07-21 11:10:26,572 INFO L136 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2022-07-21 11:10:26,572 INFO L138 SettingsManager]: * Overapproximate operations on floating types=true [2022-07-21 11:10:26,572 INFO L138 SettingsManager]: * Check division by zero=IGNORE [2022-07-21 11:10:26,573 INFO L138 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2022-07-21 11:10:26,573 INFO L138 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2022-07-21 11:10:26,573 INFO L138 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2022-07-21 11:10:26,573 INFO L138 SettingsManager]: * Check if freed pointer was valid=false [2022-07-21 11:10:26,573 INFO L138 SettingsManager]: * Use constant arrays=true [2022-07-21 11:10:26,574 INFO L138 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2022-07-21 11:10:26,574 INFO L136 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2022-07-21 11:10:26,574 INFO L138 SettingsManager]: * Size of a code block=SequenceOfStatements [2022-07-21 11:10:26,574 INFO L138 SettingsManager]: * SMT solver=External_DefaultMode [2022-07-21 11:10:26,574 INFO L138 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2022-07-21 11:10:26,575 INFO L136 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2022-07-21 11:10:26,575 INFO L138 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2022-07-21 11:10:26,575 INFO L138 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2022-07-21 11:10:26,575 INFO L138 SettingsManager]: * Trace refinement strategy=CAMEL [2022-07-21 11:10:26,575 INFO L138 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in [2022-07-21 11:10:26,575 INFO L138 SettingsManager]: * Apply one-shot large block encoding in concurrent analysis=false [2022-07-21 11:10:26,576 INFO L138 SettingsManager]: * Automaton type used in concurrency analysis=PETRI_NET [2022-07-21 11:10:26,576 INFO L138 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true [2022-07-21 11:10:26,576 INFO L138 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode WARNING: An illegal reflective access operation has occurred WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 (file:/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/com.sun.xml.bind_2.2.0.v201505121915.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int) WARNING: Please consider reporting this to the maintainers of com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations WARNING: All illegal access operations will be denied in a future release Applying setting for plugin de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: Entry function -> main Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness directory -> /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness filename -> witness.graphml Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Write witness besides input file -> false Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data specification -> CHECK( init(main()), LTL(G ! call(reach_error())) ) Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data producer -> Automizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data architecture -> 64bit Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data programhash -> aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 [2022-07-21 11:10:26,910 INFO L75 nceAwareModelManager]: Repository-Root is: /tmp [2022-07-21 11:10:26,932 INFO L261 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2022-07-21 11:10:26,934 INFO L217 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2022-07-21 11:10:26,935 INFO L271 PluginConnector]: Initializing CDTParser... [2022-07-21 11:10:26,936 INFO L275 PluginConnector]: CDTParser initialized [2022-07-21 11:10:26,938 INFO L432 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2022-07-21 11:10:27,001 INFO L220 CDTParser]: Created temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/6d861abd0/e920b6bac80046738cf0c8c5ab2ea3cd/FLAG9b4ff5896 [2022-07-21 11:10:27,757 INFO L306 CDTParser]: Found 1 translation units. [2022-07-21 11:10:27,758 INFO L160 CDTParser]: Scanning /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2022-07-21 11:10:27,793 INFO L349 CDTParser]: About to delete temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/6d861abd0/e920b6bac80046738cf0c8c5ab2ea3cd/FLAG9b4ff5896 [2022-07-21 11:10:27,864 INFO L357 CDTParser]: Successfully deleted /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/6d861abd0/e920b6bac80046738cf0c8c5ab2ea3cd [2022-07-21 11:10:27,867 INFO L299 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2022-07-21 11:10:27,868 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2022-07-21 11:10:27,870 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2022-07-21 11:10:27,870 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2022-07-21 11:10:27,873 INFO L275 PluginConnector]: CACSL2BoogieTranslator initialized [2022-07-21 11:10:27,874 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 21.07 11:10:27" (1/1) ... [2022-07-21 11:10:27,875 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@45cbcca and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:27, skipping insertion in model container [2022-07-21 11:10:27,875 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 21.07 11:10:27" (1/1) ... [2022-07-21 11:10:27,881 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2022-07-21 11:10:27,971 INFO L178 MainTranslator]: Built tables and reachable declarations [2022-07-21 11:10:28,731 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2022-07-21 11:10:28,969 INFO L210 PostProcessor]: Analyzing one entry point: main [2022-07-21 11:10:28,980 INFO L203 MainTranslator]: Completed pre-run [2022-07-21 11:10:29,130 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2022-07-21 11:10:29,253 INFO L210 PostProcessor]: Analyzing one entry point: main [2022-07-21 11:10:29,291 INFO L208 MainTranslator]: Completed translation [2022-07-21 11:10:29,293 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:29 WrapperNode [2022-07-21 11:10:29,293 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2022-07-21 11:10:29,295 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2022-07-21 11:10:29,295 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2022-07-21 11:10:29,295 INFO L275 PluginConnector]: Boogie Procedure Inliner initialized [2022-07-21 11:10:29,300 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:29" (1/1) ... [2022-07-21 11:10:29,345 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:29" (1/1) ... [2022-07-21 11:10:29,402 INFO L137 Inliner]: procedures = 146, calls = 357, calls flagged for inlining = 63, calls inlined = 60, statements flattened = 1425 [2022-07-21 11:10:29,403 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2022-07-21 11:10:29,404 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2022-07-21 11:10:29,404 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2022-07-21 11:10:29,404 INFO L275 PluginConnector]: Boogie Preprocessor initialized [2022-07-21 11:10:29,411 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:29" (1/1) ... [2022-07-21 11:10:29,411 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:29" (1/1) ... [2022-07-21 11:10:29,419 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:29" (1/1) ... [2022-07-21 11:10:29,420 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:29" (1/1) ... [2022-07-21 11:10:29,450 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:29" (1/1) ... [2022-07-21 11:10:29,458 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:29" (1/1) ... [2022-07-21 11:10:29,465 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:29" (1/1) ... [2022-07-21 11:10:29,475 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2022-07-21 11:10:29,476 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2022-07-21 11:10:29,476 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2022-07-21 11:10:29,476 INFO L275 PluginConnector]: RCFGBuilder initialized [2022-07-21 11:10:29,477 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:29" (1/1) ... [2022-07-21 11:10:29,486 INFO L173 SolverBuilder]: Constructing external solver with command: z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2022-07-21 11:10:29,497 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 [2022-07-21 11:10:29,507 INFO L229 MonitoredProcess]: Starting monitored process 1 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) [2022-07-21 11:10:29,527 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Waiting until timeout for monitored process [2022-07-21 11:10:29,553 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab32 [2022-07-21 11:10:29,553 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab32 [2022-07-21 11:10:29,553 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~int [2022-07-21 11:10:29,554 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~$Pointer$ [2022-07-21 11:10:29,554 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$ [2022-07-21 11:10:29,554 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_stop [2022-07-21 11:10:29,554 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_stop [2022-07-21 11:10:29,554 INFO L130 BoogieDeclarations]: Found specification of procedure read~int [2022-07-21 11:10:29,554 INFO L130 BoogieDeclarations]: Found specification of procedure state [2022-07-21 11:10:29,554 INFO L138 BoogieDeclarations]: Found implementation of procedure state [2022-07-21 11:10:29,555 INFO L130 BoogieDeclarations]: Found specification of procedure dev_to_hdlc [2022-07-21 11:10:29,555 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_to_hdlc [2022-07-21 11:10:29,555 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_ioctl [2022-07-21 11:10:29,555 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_ioctl [2022-07-21 11:10:29,555 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_rx [2022-07-21 11:10:29,555 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_rx [2022-07-21 11:10:29,555 INFO L130 BoogieDeclarations]: Found specification of procedure debug_lockdep_rcu_enabled [2022-07-21 11:10:29,556 INFO L138 BoogieDeclarations]: Found implementation of procedure debug_lockdep_rcu_enabled [2022-07-21 11:10:29,556 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_type_trans [2022-07-21 11:10:29,556 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_type_trans [2022-07-21 11:10:29,556 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_malloc [2022-07-21 11:10:29,556 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_malloc [2022-07-21 11:10:29,556 INFO L130 BoogieDeclarations]: Found specification of procedure netif_dormant_on [2022-07-21 11:10:29,556 INFO L138 BoogieDeclarations]: Found implementation of procedure netif_dormant_on [2022-07-21 11:10:29,556 INFO L130 BoogieDeclarations]: Found specification of procedure rcu_is_watching [2022-07-21 11:10:29,557 INFO L138 BoogieDeclarations]: Found implementation of procedure rcu_is_watching [2022-07-21 11:10:29,557 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_skb_alloc [2022-07-21 11:10:29,557 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_skb_alloc [2022-07-21 11:10:29,557 INFO L130 BoogieDeclarations]: Found specification of procedure write~int [2022-07-21 11:10:29,557 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_error [2022-07-21 11:10:29,557 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_error [2022-07-21 11:10:29,557 INFO L130 BoogieDeclarations]: Found specification of procedure ldv__builtin_expect [2022-07-21 11:10:29,558 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv__builtin_expect [2022-07-21 11:10:29,558 INFO L130 BoogieDeclarations]: Found specification of procedure assume_abort_if_not [2022-07-21 11:10:29,558 INFO L138 BoogieDeclarations]: Found implementation of procedure assume_abort_if_not [2022-07-21 11:10:29,558 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnHeap [2022-07-21 11:10:29,558 INFO L130 BoogieDeclarations]: Found specification of procedure spinlock_check [2022-07-21 11:10:29,558 INFO L138 BoogieDeclarations]: Found implementation of procedure spinlock_check [2022-07-21 11:10:29,559 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_hard_header [2022-07-21 11:10:29,559 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_hard_header [2022-07-21 11:10:29,559 INFO L130 BoogieDeclarations]: Found specification of procedure dev_kfree_skb_any [2022-07-21 11:10:29,559 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_kfree_skb_any [2022-07-21 11:10:29,559 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocInit [2022-07-21 11:10:29,559 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnStack [2022-07-21 11:10:29,560 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2022-07-21 11:10:29,560 INFO L130 BoogieDeclarations]: Found specification of procedure lockdep_rcu_suspicious [2022-07-21 11:10:29,571 INFO L138 BoogieDeclarations]: Found implementation of procedure lockdep_rcu_suspicious [2022-07-21 11:10:29,571 INFO L130 BoogieDeclarations]: Found specification of procedure __bad_percpu_size [2022-07-21 11:10:29,571 INFO L130 BoogieDeclarations]: Found specification of procedure reg_timer_1 [2022-07-21 11:10:29,572 INFO L138 BoogieDeclarations]: Found implementation of procedure reg_timer_1 [2022-07-21 11:10:29,572 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_to_user [2022-07-21 11:10:29,572 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_to_user [2022-07-21 11:10:29,572 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2022-07-21 11:10:29,572 INFO L130 BoogieDeclarations]: Found specification of procedure add_timer [2022-07-21 11:10:29,573 INFO L138 BoogieDeclarations]: Found implementation of procedure add_timer [2022-07-21 11:10:29,573 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock_irqrestore [2022-07-21 11:10:29,574 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock_irqrestore [2022-07-21 11:10:29,574 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.dealloc [2022-07-21 11:10:29,574 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$ [2022-07-21 11:10:29,575 INFO L130 BoogieDeclarations]: Found specification of procedure might_fault [2022-07-21 11:10:29,576 INFO L138 BoogieDeclarations]: Found implementation of procedure might_fault [2022-07-21 11:10:29,576 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_keepalive_send [2022-07-21 11:10:29,576 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_keepalive_send [2022-07-21 11:10:29,576 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab16 [2022-07-21 11:10:29,576 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab16 [2022-07-21 11:10:29,576 INFO L130 BoogieDeclarations]: Found specification of procedure _raw_spin_lock_irqsave [2022-07-21 11:10:29,576 INFO L138 BoogieDeclarations]: Found implementation of procedure _raw_spin_lock_irqsave [2022-07-21 11:10:29,576 INFO L130 BoogieDeclarations]: Found specification of procedure spin_lock [2022-07-21 11:10:29,577 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_lock [2022-07-21 11:10:29,577 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock [2022-07-21 11:10:29,577 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock [2022-07-21 11:10:29,577 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int [2022-07-21 11:10:29,577 INFO L130 BoogieDeclarations]: Found specification of procedure linkwatch_fire_event [2022-07-21 11:10:29,578 INFO L138 BoogieDeclarations]: Found implementation of procedure linkwatch_fire_event [2022-07-21 11:10:29,578 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~int [2022-07-21 11:10:29,578 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_zalloc [2022-07-21 11:10:29,578 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_zalloc [2022-07-21 11:10:29,578 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_from_user [2022-07-21 11:10:29,578 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_from_user [2022-07-21 11:10:29,578 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2022-07-21 11:10:29,579 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2022-07-21 11:10:29,933 INFO L234 CfgBuilder]: Building ICFG [2022-07-21 11:10:29,934 INFO L260 CfgBuilder]: Building CFG for each procedure with an implementation [2022-07-21 11:10:30,259 INFO L764 $ProcedureCfgBuilder]: dead code at ProgramPoint ldv_stopFINAL: assume true; [2022-07-21 11:10:30,912 INFO L275 CfgBuilder]: Performing block encoding [2022-07-21 11:10:30,923 INFO L294 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2022-07-21 11:10:30,923 INFO L299 CfgBuilder]: Removed 1 assume(true) statements. [2022-07-21 11:10:30,927 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 21.07 11:10:30 BoogieIcfgContainer [2022-07-21 11:10:30,927 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2022-07-21 11:10:30,928 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2022-07-21 11:10:30,929 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2022-07-21 11:10:30,931 INFO L275 PluginConnector]: TraceAbstraction initialized [2022-07-21 11:10:30,932 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 21.07 11:10:27" (1/3) ... [2022-07-21 11:10:30,932 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@767f22b8 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 21.07 11:10:30, skipping insertion in model container [2022-07-21 11:10:30,932 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:29" (2/3) ... [2022-07-21 11:10:30,933 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@767f22b8 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 21.07 11:10:30, skipping insertion in model container [2022-07-21 11:10:30,933 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 21.07 11:10:30" (3/3) ... [2022-07-21 11:10:30,934 INFO L111 eAbstractionObserver]: Analyzing ICFG 205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2022-07-21 11:10:30,948 INFO L201 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2022-07-21 11:10:30,948 INFO L160 ceAbstractionStarter]: Applying trace abstraction to program that has 1 error locations. [2022-07-21 11:10:31,021 INFO L356 AbstractCegarLoop]: ======== Iteration 0 == of CEGAR loop == AllErrorsAtOnce ======== [2022-07-21 11:10:31,027 INFO L357 AbstractCegarLoop]: Settings: SEPARATE_VIOLATION_CHECK=true, mInterprocedural=true, mMaxIterations=1000000, mWatchIteration=1000000, mArtifact=RCFG, mInterpolation=FPandBP, mInterpolantAutomaton=STRAIGHT_LINE, mDumpAutomata=false, mAutomataFormat=ATS_NUMERATE, mDumpPath=., mDeterminiation=PREDICATE_ABSTRACTION, mMinimize=MINIMIZE_SEVPA, mHoare=true, mAutomataTypeConcurrency=PETRI_NET, mHoareTripleChecks=INCREMENTAL, mHoareAnnotationPositions=LoopsAndPotentialCycles, mDumpOnlyReuseAutomata=false, mLimitTraceHistogram=0, mErrorLocTimeLimit=0, mLimitPathProgramCount=0, mCollectInterpolantStatistics=true, mHeuristicEmptinessCheck=false, mHeuristicEmptinessCheckAStarHeuristic=ZERO, mHeuristicEmptinessCheckAStarHeuristicRandomSeed=1337, mHeuristicEmptinessCheckSmtFeatureScoringMethod=DAGSIZE, mSMTFeatureExtraction=false, mSMTFeatureExtractionDumpPath=., mOverrideInterpolantAutomaton=false, mMcrInterpolantMethod=WP, mPorIndependenceSettings=de.uni_freiburg.informatik.ultimate.lib.tracecheckerutils.partialorder.independence.IndependenceSettings@75d6b724, mLbeIndependenceSettings=de.uni_freiburg.informatik.ultimate.lib.tracecheckerutils.partialorder.independence.IndependenceSettings@6d459bd7 [2022-07-21 11:10:31,028 INFO L358 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2022-07-21 11:10:31,040 INFO L276 IsEmpty]: Start isEmpty. Operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) [2022-07-21 11:10:31,054 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 48 [2022-07-21 11:10:31,054 INFO L187 NwaCegarLoop]: Found error trace [2022-07-21 11:10:31,055 INFO L195 NwaCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-21 11:10:31,056 INFO L420 AbstractCegarLoop]: === Iteration 1 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-21 11:10:31,062 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-21 11:10:31,062 INFO L85 PathProgramCache]: Analyzing trace with hash 742124414, now seen corresponding path program 1 times [2022-07-21 11:10:31,070 INFO L118 FreeRefinementEngine]: Executing refinement strategy CAMEL [2022-07-21 11:10:31,071 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [720593405] [2022-07-21 11:10:31,071 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-21 11:10:31,072 INFO L127 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2022-07-21 11:10:31,230 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:31,423 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2022-07-21 11:10:31,426 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:31,446 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2022-07-21 11:10:31,458 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:31,468 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2022-07-21 11:10:31,475 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:31,481 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2022-07-21 11:10:31,493 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:31,502 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2022-07-21 11:10:31,506 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:31,512 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2022-07-21 11:10:31,515 INFO L136 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2022-07-21 11:10:31,516 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [720593405] [2022-07-21 11:10:31,520 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [720593405] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-21 11:10:31,520 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-21 11:10:31,520 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2022-07-21 11:10:31,522 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1861604518] [2022-07-21 11:10:31,523 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-21 11:10:31,527 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 4 states [2022-07-21 11:10:31,527 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2022-07-21 11:10:31,552 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2022-07-21 11:10:31,553 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2022-07-21 11:10:31,556 INFO L87 Difference]: Start difference. First operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) Second operand has 4 states, 4 states have (on average 6.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-21 11:10:32,802 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-21 11:10:32,802 INFO L93 Difference]: Finished difference Result 1541 states and 2218 transitions. [2022-07-21 11:10:32,804 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2022-07-21 11:10:32,805 INFO L78 Accepts]: Start accepts. Automaton has has 4 states, 4 states have (on average 6.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 47 [2022-07-21 11:10:32,805 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-21 11:10:32,832 INFO L225 Difference]: With dead ends: 1541 [2022-07-21 11:10:32,832 INFO L226 Difference]: Without dead ends: 1042 [2022-07-21 11:10:32,841 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 15 GetRequests, 12 SyntacticMatches, 0 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2022-07-21 11:10:32,849 INFO L413 NwaCegarLoop]: 705 mSDtfsCounter, 1084 mSDsluCounter, 751 mSDsCounter, 0 mSdLazyCounter, 467 mSolverCounterSat, 282 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.8s Time, 0 mProtectedPredicate, 0 mProtectedAction, 1162 SdHoareTripleChecker+Valid, 1456 SdHoareTripleChecker+Invalid, 749 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 282 IncrementalHoareTripleChecker+Valid, 467 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 1.0s IncrementalHoareTripleChecker+Time [2022-07-21 11:10:32,852 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [1162 Valid, 1456 Invalid, 749 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [282 Valid, 467 Invalid, 0 Unknown, 0 Unchecked, 1.0s Time] [2022-07-21 11:10:32,870 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1042 states. [2022-07-21 11:10:32,985 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1042 to 924. [2022-07-21 11:10:32,989 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 924 states, 685 states have (on average 1.3562043795620438) internal successors, (929), 699 states have internal predecessors, (929), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2022-07-21 11:10:32,996 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 924 states to 924 states and 1284 transitions. [2022-07-21 11:10:32,999 INFO L78 Accepts]: Start accepts. Automaton has 924 states and 1284 transitions. Word has length 47 [2022-07-21 11:10:32,999 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-21 11:10:33,000 INFO L495 AbstractCegarLoop]: Abstraction has 924 states and 1284 transitions. [2022-07-21 11:10:33,001 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 4 states, 4 states have (on average 6.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-21 11:10:33,001 INFO L276 IsEmpty]: Start isEmpty. Operand 924 states and 1284 transitions. [2022-07-21 11:10:33,008 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 51 [2022-07-21 11:10:33,008 INFO L187 NwaCegarLoop]: Found error trace [2022-07-21 11:10:33,008 INFO L195 NwaCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-21 11:10:33,009 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable0 [2022-07-21 11:10:33,009 INFO L420 AbstractCegarLoop]: === Iteration 2 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-21 11:10:33,010 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-21 11:10:33,010 INFO L85 PathProgramCache]: Analyzing trace with hash -2097093995, now seen corresponding path program 1 times [2022-07-21 11:10:33,010 INFO L118 FreeRefinementEngine]: Executing refinement strategy CAMEL [2022-07-21 11:10:33,010 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [506454201] [2022-07-21 11:10:33,010 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-21 11:10:33,011 INFO L127 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2022-07-21 11:10:33,065 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:33,141 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2022-07-21 11:10:33,143 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:33,147 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2022-07-21 11:10:33,149 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:33,152 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2022-07-21 11:10:33,154 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:33,158 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2022-07-21 11:10:33,160 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:33,164 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2022-07-21 11:10:33,165 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:33,169 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2022-07-21 11:10:33,171 INFO L136 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2022-07-21 11:10:33,171 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [506454201] [2022-07-21 11:10:33,171 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [506454201] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-21 11:10:33,171 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-21 11:10:33,172 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [] total 5 [2022-07-21 11:10:33,172 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [846740252] [2022-07-21 11:10:33,172 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-21 11:10:33,174 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2022-07-21 11:10:33,174 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2022-07-21 11:10:33,175 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2022-07-21 11:10:33,175 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2022-07-21 11:10:33,175 INFO L87 Difference]: Start difference. First operand 924 states and 1284 transitions. Second operand has 5 states, 5 states have (on average 5.4) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-21 11:10:33,972 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-21 11:10:33,973 INFO L93 Difference]: Finished difference Result 1951 states and 2732 transitions. [2022-07-21 11:10:33,973 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2022-07-21 11:10:33,973 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 5.4) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 50 [2022-07-21 11:10:33,974 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-21 11:10:33,979 INFO L225 Difference]: With dead ends: 1951 [2022-07-21 11:10:33,979 INFO L226 Difference]: Without dead ends: 1041 [2022-07-21 11:10:33,982 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 18 GetRequests, 13 SyntacticMatches, 0 SemanticMatches, 5 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 1 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=15, Invalid=27, Unknown=0, NotChecked=0, Total=42 [2022-07-21 11:10:33,983 INFO L413 NwaCegarLoop]: 740 mSDtfsCounter, 987 mSDsluCounter, 829 mSDsCounter, 0 mSdLazyCounter, 441 mSolverCounterSat, 246 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.6s Time, 0 mProtectedPredicate, 0 mProtectedAction, 1049 SdHoareTripleChecker+Valid, 1569 SdHoareTripleChecker+Invalid, 687 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 246 IncrementalHoareTripleChecker+Valid, 441 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.7s IncrementalHoareTripleChecker+Time [2022-07-21 11:10:33,983 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [1049 Valid, 1569 Invalid, 687 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [246 Valid, 441 Invalid, 0 Unknown, 0 Unchecked, 0.7s Time] [2022-07-21 11:10:33,985 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1041 states. [2022-07-21 11:10:34,018 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1041 to 923. [2022-07-21 11:10:34,020 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 923 states, 684 states have (on average 1.3523391812865497) internal successors, (925), 698 states have internal predecessors, (925), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2022-07-21 11:10:34,024 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 923 states to 923 states and 1280 transitions. [2022-07-21 11:10:34,025 INFO L78 Accepts]: Start accepts. Automaton has 923 states and 1280 transitions. Word has length 50 [2022-07-21 11:10:34,025 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-21 11:10:34,026 INFO L495 AbstractCegarLoop]: Abstraction has 923 states and 1280 transitions. [2022-07-21 11:10:34,026 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 5.4) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-21 11:10:34,026 INFO L276 IsEmpty]: Start isEmpty. Operand 923 states and 1280 transitions. [2022-07-21 11:10:34,029 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 72 [2022-07-21 11:10:34,029 INFO L187 NwaCegarLoop]: Found error trace [2022-07-21 11:10:34,030 INFO L195 NwaCegarLoop]: trace histogram [7, 7, 7, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-21 11:10:34,030 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable1 [2022-07-21 11:10:34,030 INFO L420 AbstractCegarLoop]: === Iteration 3 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-21 11:10:34,031 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-21 11:10:34,031 INFO L85 PathProgramCache]: Analyzing trace with hash 171125928, now seen corresponding path program 1 times [2022-07-21 11:10:34,031 INFO L118 FreeRefinementEngine]: Executing refinement strategy CAMEL [2022-07-21 11:10:34,031 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [531776617] [2022-07-21 11:10:34,031 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-21 11:10:34,032 INFO L127 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2022-07-21 11:10:34,057 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:34,115 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2022-07-21 11:10:34,117 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:34,120 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2022-07-21 11:10:34,122 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:34,125 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2022-07-21 11:10:34,127 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:34,130 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2022-07-21 11:10:34,131 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:34,134 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2022-07-21 11:10:34,135 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:34,138 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 44 [2022-07-21 11:10:34,141 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:34,164 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 50 [2022-07-21 11:10:34,167 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:34,172 INFO L134 CoverageAnalysis]: Checked inductivity of 89 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 89 trivial. 0 not checked. [2022-07-21 11:10:34,172 INFO L136 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2022-07-21 11:10:34,172 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [531776617] [2022-07-21 11:10:34,173 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [531776617] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-21 11:10:34,173 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-21 11:10:34,173 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [6] imperfect sequences [] total 6 [2022-07-21 11:10:34,173 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [533760672] [2022-07-21 11:10:34,173 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-21 11:10:34,174 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 6 states [2022-07-21 11:10:34,174 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2022-07-21 11:10:34,175 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 6 interpolants. [2022-07-21 11:10:34,175 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=9, Invalid=21, Unknown=0, NotChecked=0, Total=30 [2022-07-21 11:10:34,175 INFO L87 Difference]: Start difference. First operand 923 states and 1280 transitions. Second operand has 6 states, 6 states have (on average 5.666666666666667) internal successors, (34), 5 states have internal predecessors, (34), 3 states have call successors, (8), 2 states have call predecessors, (8), 1 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2022-07-21 11:10:35,512 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-21 11:10:35,512 INFO L93 Difference]: Finished difference Result 2974 states and 4185 transitions. [2022-07-21 11:10:35,513 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 7 states. [2022-07-21 11:10:35,513 INFO L78 Accepts]: Start accepts. Automaton has has 6 states, 6 states have (on average 5.666666666666667) internal successors, (34), 5 states have internal predecessors, (34), 3 states have call successors, (8), 2 states have call predecessors, (8), 1 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) Word has length 71 [2022-07-21 11:10:35,514 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-21 11:10:35,524 INFO L225 Difference]: With dead ends: 2974 [2022-07-21 11:10:35,524 INFO L226 Difference]: Without dead ends: 2060 [2022-07-21 11:10:35,528 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 23 GetRequests, 16 SyntacticMatches, 0 SemanticMatches, 7 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 2 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=23, Invalid=49, Unknown=0, NotChecked=0, Total=72 [2022-07-21 11:10:35,529 INFO L413 NwaCegarLoop]: 691 mSDtfsCounter, 1091 mSDsluCounter, 1740 mSDsCounter, 0 mSdLazyCounter, 1000 mSolverCounterSat, 273 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 1.0s Time, 0 mProtectedPredicate, 0 mProtectedAction, 1173 SdHoareTripleChecker+Valid, 2431 SdHoareTripleChecker+Invalid, 1273 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 273 IncrementalHoareTripleChecker+Valid, 1000 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 1.2s IncrementalHoareTripleChecker+Time [2022-07-21 11:10:35,529 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [1173 Valid, 2431 Invalid, 1273 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [273 Valid, 1000 Invalid, 0 Unknown, 0 Unchecked, 1.2s Time] [2022-07-21 11:10:35,532 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 2060 states. [2022-07-21 11:10:35,589 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 2060 to 1924. [2022-07-21 11:10:35,592 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1924 states, 1437 states have (on average 1.3625608907446067) internal successors, (1958), 1469 states have internal predecessors, (1958), 358 states have call successors, (358), 121 states have call predecessors, (358), 128 states have return successors, (381), 363 states have call predecessors, (381), 357 states have call successors, (381) [2022-07-21 11:10:35,601 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1924 states to 1924 states and 2697 transitions. [2022-07-21 11:10:35,602 INFO L78 Accepts]: Start accepts. Automaton has 1924 states and 2697 transitions. Word has length 71 [2022-07-21 11:10:35,602 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-21 11:10:35,602 INFO L495 AbstractCegarLoop]: Abstraction has 1924 states and 2697 transitions. [2022-07-21 11:10:35,603 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 6 states, 6 states have (on average 5.666666666666667) internal successors, (34), 5 states have internal predecessors, (34), 3 states have call successors, (8), 2 states have call predecessors, (8), 1 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2022-07-21 11:10:35,603 INFO L276 IsEmpty]: Start isEmpty. Operand 1924 states and 2697 transitions. [2022-07-21 11:10:35,609 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 142 [2022-07-21 11:10:35,609 INFO L187 NwaCegarLoop]: Found error trace [2022-07-21 11:10:35,609 INFO L195 NwaCegarLoop]: trace histogram [8, 8, 8, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-21 11:10:35,610 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable2 [2022-07-21 11:10:35,610 INFO L420 AbstractCegarLoop]: === Iteration 4 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-21 11:10:35,610 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-21 11:10:35,610 INFO L85 PathProgramCache]: Analyzing trace with hash 1729160309, now seen corresponding path program 1 times [2022-07-21 11:10:35,610 INFO L118 FreeRefinementEngine]: Executing refinement strategy CAMEL [2022-07-21 11:10:35,611 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [231183936] [2022-07-21 11:10:35,611 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-21 11:10:35,611 INFO L127 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2022-07-21 11:10:35,688 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:35,735 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2022-07-21 11:10:35,737 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:35,741 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2022-07-21 11:10:35,748 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:35,752 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2022-07-21 11:10:35,753 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:35,756 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2022-07-21 11:10:35,757 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:35,760 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2022-07-21 11:10:35,762 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:35,770 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 37 [2022-07-21 11:10:35,773 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:35,780 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 43 [2022-07-21 11:10:35,781 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:35,784 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 48 [2022-07-21 11:10:35,785 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:35,790 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 57 [2022-07-21 11:10:35,791 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:35,795 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 63 [2022-07-21 11:10:35,796 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:35,809 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 69 [2022-07-21 11:10:35,820 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:35,829 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2022-07-21 11:10:35,836 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:35,884 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2022-07-21 11:10:35,887 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:35,909 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 91 [2022-07-21 11:10:35,910 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:35,914 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 97 [2022-07-21 11:10:35,915 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:35,918 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 114 [2022-07-21 11:10:35,919 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:35,923 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 120 [2022-07-21 11:10:35,925 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:35,929 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 14 proven. 4 refuted. 0 times theorem prover too weak. 107 trivial. 0 not checked. [2022-07-21 11:10:35,929 INFO L136 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2022-07-21 11:10:35,929 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [231183936] [2022-07-21 11:10:35,929 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [231183936] provided 0 perfect and 1 imperfect interpolant sequences [2022-07-21 11:10:35,930 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleZ3 [304395038] [2022-07-21 11:10:35,930 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-21 11:10:35,930 INFO L173 SolverBuilder]: Constructing external solver with command: z3 -smt2 -in SMTLIB2_COMPLIANT=true [2022-07-21 11:10:35,930 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 [2022-07-21 11:10:35,935 INFO L229 MonitoredProcess]: Starting monitored process 2 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true (exit command is (exit), workingDir is null) [2022-07-21 11:10:35,943 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true (2)] Waiting until timeout for monitored process [2022-07-21 11:10:36,266 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:36,273 INFO L263 TraceCheckSpWp]: Trace formula consists of 961 conjuncts, 17 conjunts are in the unsatisfiable core [2022-07-21 11:10:36,282 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2022-07-21 11:10:36,417 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 62 proven. 0 refuted. 0 times theorem prover too weak. 63 trivial. 0 not checked. [2022-07-21 11:10:36,417 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2022-07-21 11:10:36,417 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleZ3 [304395038] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-21 11:10:36,417 INFO L184 FreeRefinementEngine]: Found 1 perfect and 1 imperfect interpolant sequences. [2022-07-21 11:10:36,418 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [7] total 7 [2022-07-21 11:10:36,418 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [2029390487] [2022-07-21 11:10:36,418 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-21 11:10:36,418 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2022-07-21 11:10:36,419 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2022-07-21 11:10:36,419 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2022-07-21 11:10:36,419 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=12, Invalid=30, Unknown=0, NotChecked=0, Total=42 [2022-07-21 11:10:36,419 INFO L87 Difference]: Start difference. First operand 1924 states and 2697 transitions. Second operand has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2022-07-21 11:10:36,544 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-21 11:10:36,544 INFO L93 Difference]: Finished difference Result 3838 states and 5422 transitions. [2022-07-21 11:10:36,547 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2022-07-21 11:10:36,547 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) Word has length 141 [2022-07-21 11:10:36,548 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-21 11:10:36,557 INFO L225 Difference]: With dead ends: 3838 [2022-07-21 11:10:36,557 INFO L226 Difference]: Without dead ends: 1928 [2022-07-21 11:10:36,566 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 181 GetRequests, 173 SyntacticMatches, 3 SemanticMatches, 5 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 6 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=12, Invalid=30, Unknown=0, NotChecked=0, Total=42 [2022-07-21 11:10:36,569 INFO L413 NwaCegarLoop]: 658 mSDtfsCounter, 2 mSDsluCounter, 1961 mSDsCounter, 0 mSdLazyCounter, 19 mSolverCounterSat, 1 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.0s Time, 0 mProtectedPredicate, 0 mProtectedAction, 2 SdHoareTripleChecker+Valid, 2619 SdHoareTripleChecker+Invalid, 20 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 1 IncrementalHoareTripleChecker+Valid, 19 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.0s IncrementalHoareTripleChecker+Time [2022-07-21 11:10:36,570 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [2 Valid, 2619 Invalid, 20 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [1 Valid, 19 Invalid, 0 Unknown, 0 Unchecked, 0.0s Time] [2022-07-21 11:10:36,573 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1928 states. [2022-07-21 11:10:36,636 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1928 to 1924. [2022-07-21 11:10:36,640 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1924 states, 1433 states have (on average 1.357990230286113) internal successors, (1946), 1467 states have internal predecessors, (1946), 358 states have call successors, (358), 121 states have call predecessors, (358), 132 states have return successors, (392), 365 states have call predecessors, (392), 357 states have call successors, (392) [2022-07-21 11:10:36,655 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1924 states to 1924 states and 2696 transitions. [2022-07-21 11:10:36,657 INFO L78 Accepts]: Start accepts. Automaton has 1924 states and 2696 transitions. Word has length 141 [2022-07-21 11:10:36,657 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-21 11:10:36,657 INFO L495 AbstractCegarLoop]: Abstraction has 1924 states and 2696 transitions. [2022-07-21 11:10:36,658 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2022-07-21 11:10:36,658 INFO L276 IsEmpty]: Start isEmpty. Operand 1924 states and 2696 transitions. [2022-07-21 11:10:36,668 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 149 [2022-07-21 11:10:36,668 INFO L187 NwaCegarLoop]: Found error trace [2022-07-21 11:10:36,669 INFO L195 NwaCegarLoop]: trace histogram [8, 8, 7, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-21 11:10:36,701 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true (2)] Forceful destruction successful, exit code 0 [2022-07-21 11:10:36,884 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable3,2 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true [2022-07-21 11:10:36,884 INFO L420 AbstractCegarLoop]: === Iteration 5 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-21 11:10:36,885 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-21 11:10:36,885 INFO L85 PathProgramCache]: Analyzing trace with hash 568539780, now seen corresponding path program 1 times [2022-07-21 11:10:36,885 INFO L118 FreeRefinementEngine]: Executing refinement strategy CAMEL [2022-07-21 11:10:36,885 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [813172528] [2022-07-21 11:10:36,885 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-21 11:10:36,885 INFO L127 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2022-07-21 11:10:37,009 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:37,060 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2022-07-21 11:10:37,062 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:37,066 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2022-07-21 11:10:37,067 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:37,070 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2022-07-21 11:10:37,072 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:37,075 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2022-07-21 11:10:37,076 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:37,079 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2022-07-21 11:10:37,081 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:37,084 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 44 [2022-07-21 11:10:37,085 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:37,089 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 50 [2022-07-21 11:10:37,090 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:37,094 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 61 [2022-07-21 11:10:37,095 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:37,098 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 67 [2022-07-21 11:10:37,099 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:37,103 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 72 [2022-07-21 11:10:37,104 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:37,107 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 81 [2022-07-21 11:10:37,108 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:37,111 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 87 [2022-07-21 11:10:37,113 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:37,125 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 93 [2022-07-21 11:10:37,152 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:37,248 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2022-07-21 11:10:37,262 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:37,359 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2022-07-21 11:10:37,371 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:37,479 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 3 [2022-07-21 11:10:37,483 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:37,519 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 122 [2022-07-21 11:10:37,520 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:37,523 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 128 [2022-07-21 11:10:37,524 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:37,527 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 104 trivial. 0 not checked. [2022-07-21 11:10:37,527 INFO L136 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2022-07-21 11:10:37,527 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [813172528] [2022-07-21 11:10:37,528 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [813172528] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-21 11:10:37,528 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-21 11:10:37,528 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [16] imperfect sequences [] total 16 [2022-07-21 11:10:37,528 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [811448928] [2022-07-21 11:10:37,528 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-21 11:10:37,529 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 16 states [2022-07-21 11:10:37,529 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2022-07-21 11:10:37,529 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 16 interpolants. [2022-07-21 11:10:37,529 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=31, Invalid=209, Unknown=0, NotChecked=0, Total=240 [2022-07-21 11:10:37,529 INFO L87 Difference]: Start difference. First operand 1924 states and 2696 transitions. Second operand has 16 states, 15 states have (on average 5.866666666666666) internal successors, (88), 11 states have internal predecessors, (88), 3 states have call successors, (19), 4 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 3 states have call successors, (18) [2022-07-21 11:10:39,886 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-21 11:10:39,886 INFO L93 Difference]: Finished difference Result 3994 states and 5630 transitions. [2022-07-21 11:10:39,887 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 15 states. [2022-07-21 11:10:39,887 INFO L78 Accepts]: Start accepts. Automaton has has 16 states, 15 states have (on average 5.866666666666666) internal successors, (88), 11 states have internal predecessors, (88), 3 states have call successors, (19), 4 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 3 states have call successors, (18) Word has length 148 [2022-07-21 11:10:39,888 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-21 11:10:39,902 INFO L225 Difference]: With dead ends: 3994 [2022-07-21 11:10:39,903 INFO L226 Difference]: Without dead ends: 2084 [2022-07-21 11:10:39,910 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 58 GetRequests, 37 SyntacticMatches, 0 SemanticMatches, 21 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 41 ImplicationChecksByTransitivity, 0.3s TimeCoverageRelationStatistics Valid=69, Invalid=437, Unknown=0, NotChecked=0, Total=506 [2022-07-21 11:10:39,910 INFO L413 NwaCegarLoop]: 620 mSDtfsCounter, 511 mSDsluCounter, 5439 mSDsCounter, 0 mSdLazyCounter, 2558 mSolverCounterSat, 228 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 1.7s Time, 0 mProtectedPredicate, 0 mProtectedAction, 532 SdHoareTripleChecker+Valid, 6059 SdHoareTripleChecker+Invalid, 2786 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 228 IncrementalHoareTripleChecker+Valid, 2558 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 2.0s IncrementalHoareTripleChecker+Time [2022-07-21 11:10:39,911 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [532 Valid, 6059 Invalid, 2786 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [228 Valid, 2558 Invalid, 0 Unknown, 0 Unchecked, 2.0s Time] [2022-07-21 11:10:39,913 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 2084 states. [2022-07-21 11:10:39,997 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 2084 to 1954. [2022-07-21 11:10:40,000 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1954 states, 1455 states have (on average 1.3484536082474228) internal successors, (1962), 1489 states have internal predecessors, (1962), 364 states have call successors, (364), 121 states have call predecessors, (364), 134 states have return successors, (402), 373 states have call predecessors, (402), 363 states have call successors, (402) [2022-07-21 11:10:40,007 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1954 states to 1954 states and 2728 transitions. [2022-07-21 11:10:40,008 INFO L78 Accepts]: Start accepts. Automaton has 1954 states and 2728 transitions. Word has length 148 [2022-07-21 11:10:40,010 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-21 11:10:40,010 INFO L495 AbstractCegarLoop]: Abstraction has 1954 states and 2728 transitions. [2022-07-21 11:10:40,010 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 16 states, 15 states have (on average 5.866666666666666) internal successors, (88), 11 states have internal predecessors, (88), 3 states have call successors, (19), 4 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 3 states have call successors, (18) [2022-07-21 11:10:40,010 INFO L276 IsEmpty]: Start isEmpty. Operand 1954 states and 2728 transitions. [2022-07-21 11:10:40,016 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 184 [2022-07-21 11:10:40,017 INFO L187 NwaCegarLoop]: Found error trace [2022-07-21 11:10:40,017 INFO L195 NwaCegarLoop]: trace histogram [8, 8, 7, 4, 4, 4, 3, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-21 11:10:40,017 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable4 [2022-07-21 11:10:40,018 INFO L420 AbstractCegarLoop]: === Iteration 6 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-21 11:10:40,018 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-21 11:10:40,018 INFO L85 PathProgramCache]: Analyzing trace with hash -799997024, now seen corresponding path program 1 times [2022-07-21 11:10:40,018 INFO L118 FreeRefinementEngine]: Executing refinement strategy CAMEL [2022-07-21 11:10:40,020 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [1667166614] [2022-07-21 11:10:40,020 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-21 11:10:40,020 INFO L127 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2022-07-21 11:10:40,663 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2022-07-21 11:10:40,664 INFO L352 TraceCheck]: Trace is feasible, we will do another trace check, this time with branch encoders. [2022-07-21 11:10:40,918 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2022-07-21 11:10:41,027 INFO L130 FreeRefinementEngine]: Strategy CAMEL found a feasible trace [2022-07-21 11:10:41,027 INFO L271 BasicCegarLoop]: Counterexample is feasible [2022-07-21 11:10:41,028 INFO L805 garLoopResultBuilder]: Registering result UNSAFE for location ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION (0 of 1 remaining) [2022-07-21 11:10:41,030 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable5 [2022-07-21 11:10:41,033 INFO L356 BasicCegarLoop]: Path program histogram: [1, 1, 1, 1, 1, 1] [2022-07-21 11:10:41,037 INFO L176 ceAbstractionStarter]: Computing trace abstraction results [2022-07-21 11:10:41,086 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:10:41,087 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:10:41,088 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:10:41,088 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:10:41,088 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:10:41,088 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:10:41,089 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:10:41,089 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:10:41,089 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:10:41,089 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:10:41,219 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 21.07 11:10:41 BoogieIcfgContainer [2022-07-21 11:10:41,219 INFO L132 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2022-07-21 11:10:41,220 INFO L113 PluginConnector]: ------------------------Witness Printer---------------------------- [2022-07-21 11:10:41,220 INFO L271 PluginConnector]: Initializing Witness Printer... [2022-07-21 11:10:41,220 INFO L275 PluginConnector]: Witness Printer initialized [2022-07-21 11:10:41,221 INFO L185 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 21.07 11:10:30" (3/4) ... [2022-07-21 11:10:41,223 INFO L140 WitnessPrinter]: No result that supports witness generation found [2022-07-21 11:10:41,223 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2022-07-21 11:10:41,224 INFO L158 Benchmark]: Toolchain (without parser) took 13355.72ms. Allocated memory was 52.4MB in the beginning and 272.6MB in the end (delta: 220.2MB). Free memory was 32.7MB in the beginning and 78.4MB in the end (delta: -45.7MB). Peak memory consumption was 173.6MB. Max. memory is 16.1GB. [2022-07-21 11:10:41,224 INFO L158 Benchmark]: CDTParser took 0.25ms. Allocated memory is still 52.4MB. Free memory was 34.8MB in the beginning and 34.8MB in the end (delta: 44.7kB). There was no memory consumed. Max. memory is 16.1GB. [2022-07-21 11:10:41,224 INFO L158 Benchmark]: CACSL2BoogieTranslator took 1423.95ms. Allocated memory was 52.4MB in the beginning and 94.4MB in the end (delta: 41.9MB). Free memory was 32.6MB in the beginning and 41.1MB in the end (delta: -8.5MB). Peak memory consumption was 38.6MB. Max. memory is 16.1GB. [2022-07-21 11:10:41,224 INFO L158 Benchmark]: Boogie Procedure Inliner took 108.45ms. Allocated memory is still 94.4MB. Free memory was 41.1MB in the beginning and 48.7MB in the end (delta: -7.6MB). Peak memory consumption was 6.7MB. Max. memory is 16.1GB. [2022-07-21 11:10:41,225 INFO L158 Benchmark]: Boogie Preprocessor took 71.92ms. Allocated memory is still 94.4MB. Free memory was 48.7MB in the beginning and 40.7MB in the end (delta: 8.0MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. [2022-07-21 11:10:41,225 INFO L158 Benchmark]: RCFGBuilder took 1450.74ms. Allocated memory was 94.4MB in the beginning and 123.7MB in the end (delta: 29.4MB). Free memory was 40.7MB in the beginning and 54.1MB in the end (delta: -13.4MB). Peak memory consumption was 21.2MB. Max. memory is 16.1GB. [2022-07-21 11:10:41,225 INFO L158 Benchmark]: TraceAbstraction took 10291.09ms. Allocated memory was 123.7MB in the beginning and 272.6MB in the end (delta: 148.9MB). Free memory was 53.7MB in the beginning and 79.4MB in the end (delta: -25.8MB). Peak memory consumption was 123.1MB. Max. memory is 16.1GB. [2022-07-21 11:10:41,226 INFO L158 Benchmark]: Witness Printer took 3.38ms. Allocated memory is still 272.6MB. Free memory was 79.4MB in the beginning and 78.4MB in the end (delta: 1.1MB). Peak memory consumption was 2.1MB. Max. memory is 16.1GB. [2022-07-21 11:10:41,227 INFO L339 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.25ms. Allocated memory is still 52.4MB. Free memory was 34.8MB in the beginning and 34.8MB in the end (delta: 44.7kB). There was no memory consumed. Max. memory is 16.1GB. * CACSL2BoogieTranslator took 1423.95ms. Allocated memory was 52.4MB in the beginning and 94.4MB in the end (delta: 41.9MB). Free memory was 32.6MB in the beginning and 41.1MB in the end (delta: -8.5MB). Peak memory consumption was 38.6MB. Max. memory is 16.1GB. * Boogie Procedure Inliner took 108.45ms. Allocated memory is still 94.4MB. Free memory was 41.1MB in the beginning and 48.7MB in the end (delta: -7.6MB). Peak memory consumption was 6.7MB. Max. memory is 16.1GB. * Boogie Preprocessor took 71.92ms. Allocated memory is still 94.4MB. Free memory was 48.7MB in the beginning and 40.7MB in the end (delta: 8.0MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. * RCFGBuilder took 1450.74ms. Allocated memory was 94.4MB in the beginning and 123.7MB in the end (delta: 29.4MB). Free memory was 40.7MB in the beginning and 54.1MB in the end (delta: -13.4MB). Peak memory consumption was 21.2MB. Max. memory is 16.1GB. * TraceAbstraction took 10291.09ms. Allocated memory was 123.7MB in the beginning and 272.6MB in the end (delta: 148.9MB). Free memory was 53.7MB in the beginning and 79.4MB in the end (delta: -25.8MB). Peak memory consumption was 123.1MB. Max. memory is 16.1GB. * Witness Printer took 3.38ms. Allocated memory is still 272.6MB. Free memory was 79.4MB in the beginning and 78.4MB in the end (delta: 1.1MB). Peak memory consumption was 2.1MB. Max. memory is 16.1GB. * Results from de.uni_freiburg.informatik.ultimate.boogie.preprocessor: - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: - GenericResult: Unfinished Backtranslation The program execution was not completely translated back. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - StatisticsResult: ErrorAutomatonStatistics NumberErrorTraces: 0, NumberStatementsAllTraces: 0, NumberRelevantStatements: 0, 0.0s ErrorAutomatonConstructionTimeTotal, 0.0s FaulLocalizationTime, NumberStatementsFirstTrace: -1, TraceLengthAvg: 0, 0.0s ErrorAutomatonConstructionTimeAvg, 0.0s ErrorAutomatonDifferenceTimeAvg, 0.0s ErrorAutomatonDifferenceTimeTotal, NumberOfNoEnhancement: 0, NumberOfFiniteEnhancement: 0, NumberOfInfiniteEnhancement: 0 - UnprovableResult [Line: 5554]: Unable to prove that call to reach_error is unreachable Unable to prove that call to reach_error is unreachable Reason: overapproximation of bitwiseOr at line 5123. Possible FailurePath: [L5577] int LDV_IN_INTERRUPT = 1; [L5578] struct sk_buff *proto_group1 ; [L5579] int ldv_state_variable_0 ; [L5580] int ldv_state_variable_3 ; [L5581] int ldv_timer_state_1 = 0; [L5582] int ldv_state_variable_2 ; [L5583] struct net_device *proto_group0 ; [L5584] int ref_cnt ; [L5585] int ldv_state_variable_1 ; [L5586] struct timer_list *ldv_timer_list_1 ; [L5964-L5966] static struct hdlc_proto proto = {0, 0, & cisco_start, & cisco_stop, 0, & cisco_ioctl, & cisco_type_trans, & cisco_rx, 0, & __this_module, 0}; [L5967] static struct header_ops const cisco_header_ops = {& cisco_hard_header, 0, 0, 0, 0}; [L6078] int ldv_retval_0 ; [L6374] Element set_impl[15] ; [L6375] int last_index = 0; [L6509] Set LDV_SKBS ; VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6142] struct ifreq *ldvarg0 ; [L6143] void *tmp ; [L6144] unsigned int ldvarg1 ; [L6145] unsigned int tmp___0 ; [L6146] unsigned short ldvarg4 ; [L6147] unsigned short tmp___1 ; [L6148] struct sk_buff *ldvarg3 ; [L6149] void *tmp___2 ; [L6150] struct net_device *ldvarg5 ; [L6151] void *tmp___3 ; [L6152] void *ldvarg2 ; [L6153] void *tmp___4 ; [L6154] void *ldvarg6 ; [L6155] void *tmp___5 ; [L6156] int tmp___6 ; [L6157] int tmp___7 ; [L6158] int tmp___8 ; [L6159] int tmp___9 ; VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6161] CALL, EXPR ldv_zalloc(40UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=40, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=40, tmp___0=-2] [L6161] RET, EXPR ldv_zalloc(40UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(40UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6161] tmp = ldv_zalloc(40UL) [L6162] ldvarg0 = (struct ifreq *)tmp [L6163] tmp___0 = __VERIFIER_nondet_uint() [L6164] ldvarg1 = tmp___0 [L6165] tmp___1 = __VERIFIER_nondet_ushort() [L6166] ldvarg4 = tmp___1 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg4=48351, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351] [L6167] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=232, tmp___0=-3] [L6167] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg4=48351, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351] [L6167] tmp___2 = ldv_zalloc(232UL) [L6168] ldvarg3 = (struct sk_buff *)tmp___2 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg3={0:0}, ldvarg4=48351, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}] [L6169] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=3264, tmp___0=-5] [L6169] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg3={0:0}, ldvarg4=48351, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}] [L6169] tmp___3 = ldv_zalloc(3264UL) [L6170] ldvarg5 = (struct net_device *)tmp___3 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}] [L6171] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=-6] [L6171] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}] [L6171] tmp___4 = ldv_zalloc(1UL) [L6172] ldvarg2 = tmp___4 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=-8] [L6173] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] tmp___5 = ldv_zalloc(1UL) [L6174] ldvarg6 = tmp___5 [L6175] CALL ldv_initialize() [L6528] CALL ldv_set_init(LDV_SKBS) [L6380] set = set_impl [L6381] last_index = 0 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={18:0}, set_impl={18:0}] [L6528] RET ldv_set_init(LDV_SKBS) [L6175] RET ldv_initialize() [L6176] ldv_state_variable_1 = 1 [L6177] ref_cnt = 0 [L6178] ldv_state_variable_0 = 1 [L6179] ldv_state_variable_3 = 0 [L6180] ldv_state_variable_2 = 0 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: [L6202] case 1: VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6203] COND TRUE ldv_state_variable_0 == 1 [L6204] CALL, EXPR mod_init() [L6067] FCALL register_hdlc_protocol(& proto) [L6068] return (0); VAL [\result=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6204] RET, EXPR mod_init() [L6204] ldv_retval_0 = mod_init() [L6205] COND TRUE ldv_retval_0 == 0 [L6206] ldv_state_variable_0 = 3 [L6207] ldv_state_variable_2 = 1 [L6208] ldv_state_variable_3 = 1 [L6209] CALL ldv_initialize_hdlc_proto_3() [L6101] void *tmp ; [L6102] void *tmp___0 ; VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6104] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=232, tmp___0=-9] [L6104] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6104] tmp = ldv_zalloc(232UL) [L6105] proto_group1 = (struct sk_buff *)tmp VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L6106] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=3264, tmp___0=-10] [L6106] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L6106] tmp___0 = ldv_zalloc(3264UL) [L6107] proto_group0 = (struct net_device *)tmp___0 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0={0:0}] [L6209] RET ldv_initialize_hdlc_proto_3() [L6212] COND FALSE !(ldv_retval_0 != 0) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=0, tmp___7=1] [L6185] COND TRUE ldv_state_variable_1 != 0 [L6186] CALL choose_timer_1(ldv_timer_list_1) [L6114] LDV_IN_INTERRUPT = 2 [L6115] EXPR timer->data [L6115] EXPR timer->function [L6115] CALL (*(timer->function))(timer->data) [L5877] struct net_device *dev ; [L5878] hdlc_device *hdlc ; [L5879] struct hdlc_device *tmp ; [L5880] struct cisco_state *st ; [L5881] struct cisco_state *tmp___0 ; [L5882] __u32 tmp___1 ; [L5883] __u32 tmp___2 ; [L5885] dev = (struct net_device *)arg VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5886] CALL, EXPR dev_to_hdlc(dev) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5638] void *tmp ; [L5640] CALL, EXPR netdev_priv((struct net_device const *)dev) [L5595] return ((void *)dev + 3264U); VAL [\result={0:21}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, dev={0:-3243}, dev={0:-3243}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5640] RET, EXPR netdev_priv((struct net_device const *)dev) [L5640] tmp = netdev_priv((struct net_device const *)dev) [L5641] return ((struct hdlc_device *)tmp); VAL [\result={0:21}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, dev={0:-3243}, dev={0:-3243}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:21}] [L5886] RET, EXPR dev_to_hdlc(dev) VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, dev_to_hdlc(dev)={0:21}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5886] tmp = dev_to_hdlc(dev) [L5887] hdlc = tmp VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:21}] [L5888] CALL, EXPR state(hdlc) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, hdlc={0:21}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5670] EXPR hdlc->state [L5670] return ((struct cisco_state *)hdlc->state); [L5888] RET, EXPR state(hdlc) VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, state(hdlc)={18:-212}, tmp={0:21}] [L5888] tmp___0 = state(hdlc) [L5889] st = tmp___0 VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, tmp={0:21}, tmp___0={18:-212}] [L5890] CALL spin_lock(& st->lock) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5263] FCALL _raw_spin_lock(& lock->ldv_6338.rlock) [L5890] RET spin_lock(& st->lock) VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, tmp={0:21}, tmp___0={18:-212}] [L5891] EXPR st->up [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L [L5891] EXPR st->last_poll [L5891] EXPR st->settings.timeout [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, st->last_poll=1383413571807847823359175, st->settings.timeout=31, st->up=1383413571807847823359185, st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L=0, tmp={0:21}, tmp___0={18:-212}] [L5891] COND FALSE !(st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L) [L5897] EXPR st->rxseq VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, st->rxseq=19, tmp={0:21}, tmp___0={18:-212}] [L5897] CALL, EXPR __fswab32(st->rxseq) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=19, \result=19, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=19] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=19, \result=19, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=19, val=19] [L5897] RET, EXPR __fswab32(st->rxseq) VAL [\old(arg)=18446744073709548373, __fswab32(st->rxseq)=19, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, st->rxseq=19, tmp={0:21}, tmp___0={18:-212}] [L5897] tmp___1 = __fswab32(st->rxseq) [L5898] EXPR st->txseq [L5898] st->txseq = st->txseq + 1U [L5899] EXPR st->txseq VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, st->txseq=-15, tmp={0:21}, tmp___0={18:-212}, tmp___1=19] [L5899] CALL, EXPR __fswab32(st->txseq) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=-15, \result=-15, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=-15] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=-15, \result=-15, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=4294967281, val=-15] [L5899] RET, EXPR __fswab32(st->txseq) VAL [\old(arg)=18446744073709548373, __fswab32(st->txseq)=-15, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, st->txseq=-15, tmp={0:21}, tmp___0={18:-212}, tmp___1=19] [L5899] tmp___2 = __fswab32(st->txseq) [L5900] CALL cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5695] struct sk_buff *skb ; [L5696] struct cisco_packet *data ; [L5697] __u32 tmp ; [L5698] __u32 tmp___0 ; [L5700] CALL, EXPR ldv_dev_alloc_skb_12(22U) [L6356] struct sk_buff *tmp ; VAL [\old(last_index)=0, \old(length)=22, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6358] CALL, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6512] void *skb ; [L6513] void *tmp___7 ; VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6515] CALL, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND FALSE !(tmp___0 != 0) [L5527] EXPR, FCALL calloc(1UL, size) [L5527] tmp = calloc(1UL, size) [L5528] p = tmp VAL [\old(last_index)=0, \old(size)=248, __this_module={1383413571807847823359192:1383413571807847823359210}, calloc(1UL, size)={-1:0}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={-1:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={-1:0}, tmp___0=0] [L5529] CALL assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(cond)=1, \old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5498] COND FALSE !(!cond) VAL [\old(cond)=1, \old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, cond=1, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5529] RET assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(last_index)=0, \old(size)=248, __this_module={1383413571807847823359192:1383413571807847823359210}, calloc(1UL, size)={-1:0}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={-1:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={-1:0}, tmp___0=0] [L5530] return (p); VAL [\old(last_index)=0, \old(size)=248, \result={-1:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, calloc(1UL, size)={-1:0}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={-1:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={-1:0}, tmp___0=0] [L6515] RET, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(sizeof(struct sk_buff___0 ))={-1:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6515] tmp___7 = ldv_zalloc(sizeof(struct sk_buff___0 )) [L6516] skb = (struct sk_buff___0 *)tmp___7 VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-1:0}, tmp___7={-1:0}] [L6517] COND FALSE !(! skb) [L6520] CALL ldv_set_add(LDV_SKBS, skb) [L6388] int i ; [L6390] i = 0 VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, e={-1:0}, e={-1:0}, i=0, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6391] COND TRUE 1 VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, e={-1:0}, e={-1:0}, i=0, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6392] COND FALSE !(i < last_index) VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, e={-1:0}, e={-1:0}, i=0, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6402] COND TRUE last_index < 15 [L6403] set_impl[last_index] = e [L6404] last_index = last_index + 1 VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, e={-1:0}, e={-1:0}, i=0, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6520] RET ldv_set_add(LDV_SKBS, skb) [L6521] return (skb); VAL [\old(last_index)=0, \result={-1:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-1:0}, tmp___7={-1:0}] [L6358] RET, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, \old(length)=22, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, ldv_skb_alloc()={-1:0}, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6358] tmp = ldv_skb_alloc() [L6359] return (tmp); VAL [\old(last_index)=0, \old(length)=22, \result={-1:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={-1:0}] [L5700] RET, EXPR ldv_dev_alloc_skb_12(22U) [L5700] skb = ldv_dev_alloc_skb_12(22U) [L5701] COND FALSE !((unsigned long )skb == (unsigned long )((struct sk_buff *)0)) [L5706] CALL skb_reserve(skb, 4) [L5475] EXPR skb->data [L5475] skb->data = skb->data + (unsigned long )len [L5476] EXPR skb->tail [L5476] skb->tail = skb->tail + (sk_buff_data_t )len [L5706] RET skb_reserve(skb, 4) [L5707] CALL cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5676] struct hdlc_header *data ; [L5677] __u16 tmp ; [L5679] CALL skb_push(skb, 4U) [L6687] CALL, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(last_index)=0, \old(size)=1, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5502] void *p ; [L5503] void *tmp ; [L5504] int tmp___0 ; [L5506] tmp___0 = __VERIFIER_nondet_int() [L5507] COND TRUE tmp___0 != 0 [L5508] return ((void *)0); VAL [\old(last_index)=0, \old(size)=1, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=-14] [L6687] RET, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(arg1)=4, \old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, arg0={-1:0}, arg0={-1:0}, arg1=4, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_malloc(sizeof(unsigned char))={0:0}, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6687] return ldv_malloc(sizeof(unsigned char)); [L5679] RET skb_push(skb, 4U) [L5680] EXPR skb->data [L5680] data = (struct hdlc_header *)skb->data [L5681] COND TRUE (unsigned int )type == 32821U [L5682] data->address = 143U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={-1:136}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-1:0}, skb={-1:0}, type=32821] [L5686] data->control = 0U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={-1:136}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-1:0}, skb={-1:0}, type=32821] [L5687] CALL, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(val)=32821, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5123] return ((__u16 )((int )((short )((int )val << 8)) | (int )((short )((int )val >> 8)))); VAL [\old(last_index)=0, \old(val)=32821, \result=128, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=32821] [L5687] RET, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __fswab16((int )type)=128, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={-1:136}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-1:0}, skb={-1:0}, type=32821] [L5687] tmp = __fswab16((int )type) [L5688] data->protocol = tmp [L5689] return (4); VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, \result=4, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={-1:136}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-1:0}, skb={-1:0}, tmp=128, type=32821] [L5707] RET cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, \old(par1)=4294967281, \old(par2)=19, \old(type)=2, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U)=4, cisco_header_ops={17:0}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967281, par2=19, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-1:0}, type=2] [L5708] EXPR skb->data [L5708] data = (struct cisco_packet *)skb->data + 4U [L5709] CALL, EXPR __fswab32(type) VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=2] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=2, val=2] [L5709] RET, EXPR __fswab32(type) VAL [\old(last_index)=0, \old(par1)=4294967281, \old(par2)=19, \old(type)=2, __fswab32(type)=2, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, data={-1:208}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967281, par2=19, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-1:0}, type=2] [L5709] tmp = __fswab32(type) [L5710] data->type = tmp [L5711] data->par1 = par1 [L5712] data->par2 = par2 [L5713] data->rel = 65535U VAL [\old(last_index)=0, \old(par1)=4294967281, \old(par2)=19, \old(type)=2, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, data={-1:208}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967281, par2=19, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-1:0}, tmp=2, type=2] [L5714] CALL, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=20, \result=20, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=20] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=20, \result=20, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=20, val=20] [L5714] RET, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, \old(par1)=4294967281, \old(par2)=19, \old(type)=2, __fswab32(((__u32 )jiffies + 75000U) * 4U)=20, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, data={-1:208}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967281, par2=19, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-1:0}, tmp=2, type=2] [L5714] tmp___0 = __fswab32(((__u32 )jiffies + 75000U) * 4U) [L5715] data->time = tmp___0 [L5716] CALL skb_put(skb, 18U) [L6690] EXPR arg0->data [L6690] EXPR arg0->tail [L6690] unsigned char *ret_val = arg0->data + arg0->tail; [L6691] EXPR arg0->tail [L6691] arg0->tail += arg1 [L6692] return ret_val; VAL [\old(arg1)=18, \old(last_index)=0, \result={-1:155}, __this_module={1383413571807847823359192:1383413571807847823359210}, arg0={-1:0}, arg0={-1:0}, arg1=18, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, ret_val={-1:155}, set_impl={18:0}] [L5716] RET skb_put(skb, 18U) [L5717] skb->priority = 7U [L5718] skb->dev = dev [L5719] CALL skb_reset_network_header(skb) [L5483] EXPR skb->data [L5483] EXPR skb->head [L5483] skb->network_header = (int )((__u16 )((long )skb->data)) - (int )((__u16 )((long )skb->head)) [L5719] RET skb_reset_network_header(skb) [L5720] CALL dev_queue_xmit(skb) [L6643] return __VERIFIER_nondet_int(); [L5720] RET dev_queue_xmit(skb) [L5900] RET cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, tmp={0:21}, tmp___0={18:-212}, tmp___1=19, tmp___2=4294967281] [L5901] CALL spin_unlock(& st->lock) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5270] FCALL _raw_spin_unlock(& lock->ldv_6338.rlock) [L5901] RET spin_unlock(& st->lock) VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, tmp={0:21}, tmp___0={18:-212}, tmp___1=19, tmp___2=4294967281] [L5902] EXPR st->settings.interval [L5902] st->timer.expires = (unsigned long )(st->settings.interval * 250U) + (unsigned long )jiffies [L5903] st->timer.function = & cisco_timer [L5904] st->timer.data = arg VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, tmp={0:21}, tmp___0={18:-212}, tmp___1=19, tmp___2=4294967281] [L5905] FCALL add_timer(& st->timer) VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, tmp={0:21}, tmp___0={18:-212}, tmp___1=19, tmp___2=4294967281] [L6115] RET (*(timer->function))(timer->data) [L6116] LDV_IN_INTERRUPT = 1 [L6117] ldv_timer_state_1 = 2 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, timer={0:0}, timer={0:0}] [L6186] RET choose_timer_1(ldv_timer_list_1) [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6195] COND TRUE ldv_state_variable_0 == 3 && ref_cnt == 0 [L6196] CALL mod_exit() [L6074] FCALL unregister_hdlc_protocol(& proto) [L6196] RET mod_exit() [L6197] ldv_state_variable_0 = 2 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6315] CALL ldv_check_final_state() [L6579] int tmp___7 ; [L6581] CALL, EXPR ldv_set_is_empty(LDV_SKBS) [L6470] return (last_index == 0); VAL [\result=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6581] RET, EXPR ldv_set_is_empty(LDV_SKBS) [L6581] tmp___7 = ldv_set_is_empty(LDV_SKBS) [L6582] COND FALSE !(\read(tmp___7)) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp___7=0] [L6584] CALL ldv_error() VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5554] reach_error() VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] - StatisticsResult: Ultimate Automizer benchmark data CFG has 33 procedures, 489 locations, 1 error locations. Started 1 CEGAR loops. OverallTime: 10.0s, OverallIterations: 6, TraceHistogramMax: 8, PathProgramHistogramMax: 1, EmptinessCheckTime: 0.1s, AutomataDifference: 6.0s, DeadEndRemovalTime: 0.0s, HoareAnnotationTime: 0.0s, InitialAbstractionConstructionTime: 0.0s, HoareTripleCheckerStatistics: 0 mSolverCounterUnknown, 3918 SdHoareTripleChecker+Valid, 5.0s IncrementalHoareTripleChecker+Time, 0 mSdLazyCounter, 3675 mSDsluCounter, 14134 SdHoareTripleChecker+Invalid, 4.1s Time, 0 mProtectedAction, 0 SdHoareTripleChecker+Unchecked, 0 IncrementalHoareTripleChecker+Unchecked, 10720 mSDsCounter, 1030 IncrementalHoareTripleChecker+Valid, 0 mProtectedPredicate, 4485 IncrementalHoareTripleChecker+Invalid, 5515 SdHoareTripleChecker+Unknown, 0 mSolverCounterNotChecked, 1030 mSolverCounterUnsat, 3414 mSDtfsCounter, 4485 mSolverCounterSat, 0.1s SdHoareTripleChecker+Time, 0 IncrementalHoareTripleChecker+Unknown, PredicateUnifierStatistics: 0 DeclaredPredicates, 295 GetRequests, 251 SyntacticMatches, 3 SemanticMatches, 41 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 50 ImplicationChecksByTransitivity, 0.4s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=1954occurred in iteration=5, InterpolantAutomatonStates: 37, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s DumpTime, AutomataMinimizationStatistics: 0.4s AutomataMinimizationTime, 5 MinimizatonAttempts, 506 StatesRemovedByMinimization, 5 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TRACE_CHECK: 0.1s SsaConstructionTime, 0.9s SatisfiabilityAnalysisTime, 1.4s InterpolantComputationTime, 781 NumberOfCodeBlocks, 781 NumberOfCodeBlocksAsserted, 7 NumberOfCheckSat, 592 ConstructedInterpolants, 0 QuantifiedInterpolants, 1364 SizeOfPredicates, 2 NumberOfNonLiveVariables, 961 ConjunctsInSsa, 17 ConjunctsInUnsatCore, 6 InterpolantComputations, 5 PerfectInterpolantSequences, 540/544 InterpolantCoveringCapability, INVARIANT_SYNTHESIS: No data available, INTERPOLANT_CONSOLIDATION: No data available, ABSTRACT_INTERPRETATION: No data available, PDR: No data available, ACCELERATED_INTERPOLATION: No data available, SIFA: No data available, ReuseStatistics: No data available RESULT: Ultimate could not prove your program: unable to determine feasibility of some traces [2022-07-21 11:10:41,258 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Forceful destruction successful, exit code 0 Received shutdown request... --- End real Ultimate output --- Execution finished normally Using bit-precise analysis Retrying with bit-precise analysis ### Bit-precise run ### Calling Ultimate with: /usr/bin/java -Dosgi.configuration.area=/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/config -Xmx15G -Xms4m -jar /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/org.eclipse.equinox.launcher_1.5.800.v20200727-1323.jar -data @noDefault -ultimatedata /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data -tc /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/AutomizerReach.xml -i ../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i -s /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Bitvector.epf --cacsl2boogietranslator.entry.function main --witnessprinter.witness.directory /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux --witnessprinter.witness.filename witness.graphml --witnessprinter.write.witness.besides.input.file false --witnessprinter.graph.data.specification CHECK( init(main()), LTL(G ! call(reach_error())) ) --witnessprinter.graph.data.producer Automizer --witnessprinter.graph.data.architecture 64bit --witnessprinter.graph.data.programhash aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 --- Real Ultimate output --- This is Ultimate 0.2.2-?-3598765 [2022-07-21 11:10:43,173 INFO L177 SettingsManager]: Resetting all preferences to default values... [2022-07-21 11:10:43,177 INFO L181 SettingsManager]: Resetting UltimateCore preferences to default values [2022-07-21 11:10:43,216 INFO L184 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2022-07-21 11:10:43,217 INFO L181 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2022-07-21 11:10:43,218 INFO L181 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2022-07-21 11:10:43,226 INFO L181 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2022-07-21 11:10:43,230 INFO L181 SettingsManager]: Resetting LassoRanker preferences to default values [2022-07-21 11:10:43,232 INFO L181 SettingsManager]: Resetting Reaching Definitions preferences to default values [2022-07-21 11:10:43,235 INFO L181 SettingsManager]: Resetting SyntaxChecker preferences to default values [2022-07-21 11:10:43,236 INFO L181 SettingsManager]: Resetting Sifa preferences to default values [2022-07-21 11:10:43,241 INFO L184 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2022-07-21 11:10:43,242 INFO L181 SettingsManager]: Resetting LTL2Aut preferences to default values [2022-07-21 11:10:43,247 INFO L181 SettingsManager]: Resetting PEA to Boogie preferences to default values [2022-07-21 11:10:43,248 INFO L181 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2022-07-21 11:10:43,250 INFO L181 SettingsManager]: Resetting ChcToBoogie preferences to default values [2022-07-21 11:10:43,251 INFO L181 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2022-07-21 11:10:43,253 INFO L181 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2022-07-21 11:10:43,257 INFO L181 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2022-07-21 11:10:43,259 INFO L181 SettingsManager]: Resetting CodeCheck preferences to default values [2022-07-21 11:10:43,263 INFO L181 SettingsManager]: Resetting HornVerifier preferences to default values [2022-07-21 11:10:43,264 INFO L181 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2022-07-21 11:10:43,266 INFO L181 SettingsManager]: Resetting RCFGBuilder preferences to default values [2022-07-21 11:10:43,267 INFO L181 SettingsManager]: Resetting Referee preferences to default values [2022-07-21 11:10:43,268 INFO L181 SettingsManager]: Resetting TraceAbstraction preferences to default values [2022-07-21 11:10:43,271 INFO L184 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2022-07-21 11:10:43,273 INFO L184 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2022-07-21 11:10:43,273 INFO L181 SettingsManager]: Resetting TreeAutomizer preferences to default values [2022-07-21 11:10:43,274 INFO L181 SettingsManager]: Resetting IcfgToChc preferences to default values [2022-07-21 11:10:43,274 INFO L181 SettingsManager]: Resetting IcfgTransformer preferences to default values [2022-07-21 11:10:43,275 INFO L184 SettingsManager]: ReqToTest provides no preferences, ignoring... [2022-07-21 11:10:43,275 INFO L181 SettingsManager]: Resetting Boogie Printer preferences to default values [2022-07-21 11:10:43,277 INFO L181 SettingsManager]: Resetting ChcSmtPrinter preferences to default values [2022-07-21 11:10:43,278 INFO L181 SettingsManager]: Resetting ReqPrinter preferences to default values [2022-07-21 11:10:43,279 INFO L181 SettingsManager]: Resetting Witness Printer preferences to default values [2022-07-21 11:10:43,280 INFO L184 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2022-07-21 11:10:43,280 INFO L181 SettingsManager]: Resetting CDTParser preferences to default values [2022-07-21 11:10:43,281 INFO L184 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2022-07-21 11:10:43,281 INFO L184 SettingsManager]: ReqParser provides no preferences, ignoring... [2022-07-21 11:10:43,281 INFO L181 SettingsManager]: Resetting SmtParser preferences to default values [2022-07-21 11:10:43,282 INFO L181 SettingsManager]: Resetting Witness Parser preferences to default values [2022-07-21 11:10:43,284 INFO L188 SettingsManager]: Finished resetting all preferences to default values... [2022-07-21 11:10:43,287 INFO L101 SettingsManager]: Beginning loading settings from /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Bitvector.epf [2022-07-21 11:10:43,314 INFO L113 SettingsManager]: Loading preferences was successful [2022-07-21 11:10:43,314 INFO L115 SettingsManager]: Preferences different from defaults after loading the file: [2022-07-21 11:10:43,314 INFO L136 SettingsManager]: Preferences of UltimateCore differ from their defaults: [2022-07-21 11:10:43,314 INFO L138 SettingsManager]: * Log level for class=de.uni_freiburg.informatik.ultimate.lib.smtlibutils.quantifier.QuantifierPusher=ERROR; [2022-07-21 11:10:43,315 INFO L136 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2022-07-21 11:10:43,315 INFO L138 SettingsManager]: * Ignore calls to procedures called more than once=ONLY_FOR_SEQUENTIAL_PROGRAMS [2022-07-21 11:10:43,316 INFO L136 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2022-07-21 11:10:43,316 INFO L138 SettingsManager]: * Create parallel compositions if possible=false [2022-07-21 11:10:43,316 INFO L138 SettingsManager]: * Use SBE=true [2022-07-21 11:10:43,316 INFO L136 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2022-07-21 11:10:43,316 INFO L138 SettingsManager]: * Check division by zero=IGNORE [2022-07-21 11:10:43,316 INFO L138 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2022-07-21 11:10:43,316 INFO L138 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2022-07-21 11:10:43,317 INFO L138 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2022-07-21 11:10:43,323 INFO L138 SettingsManager]: * Adapt memory model on pointer casts if necessary=true [2022-07-21 11:10:43,323 INFO L138 SettingsManager]: * Use bitvectors instead of ints=true [2022-07-21 11:10:43,323 INFO L138 SettingsManager]: * Memory model=HoenickeLindenmann_4ByteResolution [2022-07-21 11:10:43,323 INFO L138 SettingsManager]: * Check if freed pointer was valid=false [2022-07-21 11:10:43,324 INFO L138 SettingsManager]: * Use constant arrays=true [2022-07-21 11:10:43,324 INFO L138 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2022-07-21 11:10:43,324 INFO L136 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2022-07-21 11:10:43,324 INFO L138 SettingsManager]: * Size of a code block=SequenceOfStatements [2022-07-21 11:10:43,325 INFO L138 SettingsManager]: * SMT solver=External_DefaultMode [2022-07-21 11:10:43,325 INFO L138 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2022-07-21 11:10:43,325 INFO L136 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2022-07-21 11:10:43,325 INFO L138 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2022-07-21 11:10:43,325 INFO L138 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2022-07-21 11:10:43,326 INFO L138 SettingsManager]: * Trace refinement strategy=WOLF [2022-07-21 11:10:43,326 INFO L138 SettingsManager]: * Command for external solver=cvc4 --incremental --print-success --lang smt [2022-07-21 11:10:43,326 INFO L138 SettingsManager]: * Apply one-shot large block encoding in concurrent analysis=false [2022-07-21 11:10:43,326 INFO L138 SettingsManager]: * Automaton type used in concurrency analysis=PETRI_NET [2022-07-21 11:10:43,327 INFO L138 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true [2022-07-21 11:10:43,327 INFO L138 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode [2022-07-21 11:10:43,327 INFO L138 SettingsManager]: * Logic for external solver=AUFBV WARNING: An illegal reflective access operation has occurred WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 (file:/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/com.sun.xml.bind_2.2.0.v201505121915.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int) WARNING: Please consider reporting this to the maintainers of com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations WARNING: All illegal access operations will be denied in a future release Applying setting for plugin de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: Entry function -> main Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness directory -> /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness filename -> witness.graphml Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Write witness besides input file -> false Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data specification -> CHECK( init(main()), LTL(G ! call(reach_error())) ) Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data producer -> Automizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data architecture -> 64bit Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data programhash -> aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 [2022-07-21 11:10:43,659 INFO L75 nceAwareModelManager]: Repository-Root is: /tmp [2022-07-21 11:10:43,690 INFO L261 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2022-07-21 11:10:43,693 INFO L217 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2022-07-21 11:10:43,694 INFO L271 PluginConnector]: Initializing CDTParser... [2022-07-21 11:10:43,694 INFO L275 PluginConnector]: CDTParser initialized [2022-07-21 11:10:43,696 INFO L432 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2022-07-21 11:10:43,758 INFO L220 CDTParser]: Created temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/b6bccfb3d/9ca83a45c92c41cca4b4516ba54f5d62/FLAGf95b1518a [2022-07-21 11:10:44,477 INFO L306 CDTParser]: Found 1 translation units. [2022-07-21 11:10:44,478 INFO L160 CDTParser]: Scanning /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2022-07-21 11:10:44,513 INFO L349 CDTParser]: About to delete temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/b6bccfb3d/9ca83a45c92c41cca4b4516ba54f5d62/FLAGf95b1518a [2022-07-21 11:10:44,626 INFO L357 CDTParser]: Successfully deleted /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/b6bccfb3d/9ca83a45c92c41cca4b4516ba54f5d62 [2022-07-21 11:10:44,628 INFO L299 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2022-07-21 11:10:44,629 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2022-07-21 11:10:44,630 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2022-07-21 11:10:44,630 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2022-07-21 11:10:44,633 INFO L275 PluginConnector]: CACSL2BoogieTranslator initialized [2022-07-21 11:10:44,633 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 21.07 11:10:44" (1/1) ... [2022-07-21 11:10:44,634 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@46555cab and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:44, skipping insertion in model container [2022-07-21 11:10:44,634 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 21.07 11:10:44" (1/1) ... [2022-07-21 11:10:44,641 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2022-07-21 11:10:44,730 INFO L178 MainTranslator]: Built tables and reachable declarations [2022-07-21 11:10:45,724 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2022-07-21 11:10:46,236 INFO L210 PostProcessor]: Analyzing one entry point: main [2022-07-21 11:10:46,275 INFO L200 MainTranslator]: Restarting translation with changed settings: SettingsChange [mNewPreferredMemoryModel=HoenickeLindenmann_1ByteResolution] [2022-07-21 11:10:46,304 INFO L178 MainTranslator]: Built tables and reachable declarations [2022-07-21 11:10:46,418 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2022-07-21 11:10:46,495 INFO L210 PostProcessor]: Analyzing one entry point: main [2022-07-21 11:10:46,505 INFO L203 MainTranslator]: Completed pre-run [2022-07-21 11:10:46,640 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2022-07-21 11:10:46,731 INFO L210 PostProcessor]: Analyzing one entry point: main [2022-07-21 11:10:46,775 INFO L208 MainTranslator]: Completed translation [2022-07-21 11:10:46,776 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:46 WrapperNode [2022-07-21 11:10:46,776 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2022-07-21 11:10:46,777 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2022-07-21 11:10:46,778 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2022-07-21 11:10:46,778 INFO L275 PluginConnector]: Boogie Procedure Inliner initialized [2022-07-21 11:10:46,783 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:46" (1/1) ... [2022-07-21 11:10:46,844 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:46" (1/1) ... [2022-07-21 11:10:46,956 INFO L137 Inliner]: procedures = 158, calls = 357, calls flagged for inlining = 63, calls inlined = 60, statements flattened = 1390 [2022-07-21 11:10:46,957 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2022-07-21 11:10:46,958 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2022-07-21 11:10:46,958 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2022-07-21 11:10:46,958 INFO L275 PluginConnector]: Boogie Preprocessor initialized [2022-07-21 11:10:46,966 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:46" (1/1) ... [2022-07-21 11:10:46,966 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:46" (1/1) ... [2022-07-21 11:10:46,988 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:46" (1/1) ... [2022-07-21 11:10:46,989 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:46" (1/1) ... [2022-07-21 11:10:47,046 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:46" (1/1) ... [2022-07-21 11:10:47,060 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:46" (1/1) ... [2022-07-21 11:10:47,078 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:46" (1/1) ... [2022-07-21 11:10:47,098 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2022-07-21 11:10:47,104 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2022-07-21 11:10:47,106 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2022-07-21 11:10:47,106 INFO L275 PluginConnector]: RCFGBuilder initialized [2022-07-21 11:10:47,107 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:46" (1/1) ... [2022-07-21 11:10:47,113 INFO L173 SolverBuilder]: Constructing external solver with command: z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2022-07-21 11:10:47,122 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 [2022-07-21 11:10:47,137 INFO L229 MonitoredProcess]: Starting monitored process 1 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) [2022-07-21 11:10:47,160 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Waiting until timeout for monitored process [2022-07-21 11:10:47,176 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab32 [2022-07-21 11:10:47,176 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab32 [2022-07-21 11:10:47,176 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE1 [2022-07-21 11:10:47,176 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE8 [2022-07-21 11:10:47,177 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE4 [2022-07-21 11:10:47,177 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~$Pointer$ [2022-07-21 11:10:47,177 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE2 [2022-07-21 11:10:47,177 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$ [2022-07-21 11:10:47,177 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_stop [2022-07-21 11:10:47,177 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_stop [2022-07-21 11:10:47,177 INFO L130 BoogieDeclarations]: Found specification of procedure state [2022-07-21 11:10:47,178 INFO L138 BoogieDeclarations]: Found implementation of procedure state [2022-07-21 11:10:47,178 INFO L130 BoogieDeclarations]: Found specification of procedure dev_to_hdlc [2022-07-21 11:10:47,178 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_to_hdlc [2022-07-21 11:10:47,178 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_ioctl [2022-07-21 11:10:47,178 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_ioctl [2022-07-21 11:10:47,178 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_rx [2022-07-21 11:10:47,178 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_rx [2022-07-21 11:10:47,202 INFO L130 BoogieDeclarations]: Found specification of procedure debug_lockdep_rcu_enabled [2022-07-21 11:10:47,203 INFO L138 BoogieDeclarations]: Found implementation of procedure debug_lockdep_rcu_enabled [2022-07-21 11:10:47,203 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_type_trans [2022-07-21 11:10:47,203 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_type_trans [2022-07-21 11:10:47,203 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_malloc [2022-07-21 11:10:47,203 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_malloc [2022-07-21 11:10:47,203 INFO L130 BoogieDeclarations]: Found specification of procedure netif_dormant_on [2022-07-21 11:10:47,204 INFO L138 BoogieDeclarations]: Found implementation of procedure netif_dormant_on [2022-07-21 11:10:47,204 INFO L130 BoogieDeclarations]: Found specification of procedure rcu_is_watching [2022-07-21 11:10:47,204 INFO L138 BoogieDeclarations]: Found implementation of procedure rcu_is_watching [2022-07-21 11:10:47,204 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_skb_alloc [2022-07-21 11:10:47,205 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_skb_alloc [2022-07-21 11:10:47,205 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_error [2022-07-21 11:10:47,205 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_error [2022-07-21 11:10:47,205 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE4 [2022-07-21 11:10:47,206 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE2 [2022-07-21 11:10:47,206 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE1 [2022-07-21 11:10:47,206 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE8 [2022-07-21 11:10:47,206 INFO L130 BoogieDeclarations]: Found specification of procedure ldv__builtin_expect [2022-07-21 11:10:47,206 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv__builtin_expect [2022-07-21 11:10:47,207 INFO L130 BoogieDeclarations]: Found specification of procedure assume_abort_if_not [2022-07-21 11:10:47,207 INFO L138 BoogieDeclarations]: Found implementation of procedure assume_abort_if_not [2022-07-21 11:10:47,207 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnHeap [2022-07-21 11:10:47,207 INFO L130 BoogieDeclarations]: Found specification of procedure spinlock_check [2022-07-21 11:10:47,207 INFO L138 BoogieDeclarations]: Found implementation of procedure spinlock_check [2022-07-21 11:10:47,207 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_hard_header [2022-07-21 11:10:47,207 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_hard_header [2022-07-21 11:10:47,208 INFO L130 BoogieDeclarations]: Found specification of procedure dev_kfree_skb_any [2022-07-21 11:10:47,208 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_kfree_skb_any [2022-07-21 11:10:47,208 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocInit [2022-07-21 11:10:47,208 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnStack [2022-07-21 11:10:47,209 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2022-07-21 11:10:47,210 INFO L130 BoogieDeclarations]: Found specification of procedure lockdep_rcu_suspicious [2022-07-21 11:10:47,210 INFO L138 BoogieDeclarations]: Found implementation of procedure lockdep_rcu_suspicious [2022-07-21 11:10:47,210 INFO L130 BoogieDeclarations]: Found specification of procedure __bad_percpu_size [2022-07-21 11:10:47,211 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE8 [2022-07-21 11:10:47,212 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE2 [2022-07-21 11:10:47,212 INFO L130 BoogieDeclarations]: Found specification of procedure reg_timer_1 [2022-07-21 11:10:47,212 INFO L138 BoogieDeclarations]: Found implementation of procedure reg_timer_1 [2022-07-21 11:10:47,212 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE4 [2022-07-21 11:10:47,213 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_to_user [2022-07-21 11:10:47,213 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_to_user [2022-07-21 11:10:47,213 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2022-07-21 11:10:47,213 INFO L130 BoogieDeclarations]: Found specification of procedure add_timer [2022-07-21 11:10:47,213 INFO L138 BoogieDeclarations]: Found implementation of procedure add_timer [2022-07-21 11:10:47,213 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock_irqrestore [2022-07-21 11:10:47,213 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock_irqrestore [2022-07-21 11:10:47,214 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE8 [2022-07-21 11:10:47,214 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE1 [2022-07-21 11:10:47,214 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE2 [2022-07-21 11:10:47,215 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.dealloc [2022-07-21 11:10:47,215 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE4 [2022-07-21 11:10:47,215 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$ [2022-07-21 11:10:47,215 INFO L130 BoogieDeclarations]: Found specification of procedure might_fault [2022-07-21 11:10:47,215 INFO L138 BoogieDeclarations]: Found implementation of procedure might_fault [2022-07-21 11:10:47,216 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~intINTTYPE1 [2022-07-21 11:10:47,231 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_keepalive_send [2022-07-21 11:10:47,231 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_keepalive_send [2022-07-21 11:10:47,232 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab16 [2022-07-21 11:10:47,232 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab16 [2022-07-21 11:10:47,232 INFO L130 BoogieDeclarations]: Found specification of procedure _raw_spin_lock_irqsave [2022-07-21 11:10:47,232 INFO L138 BoogieDeclarations]: Found implementation of procedure _raw_spin_lock_irqsave [2022-07-21 11:10:47,232 INFO L130 BoogieDeclarations]: Found specification of procedure spin_lock [2022-07-21 11:10:47,232 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_lock [2022-07-21 11:10:47,232 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock [2022-07-21 11:10:47,233 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock [2022-07-21 11:10:47,233 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE1 [2022-07-21 11:10:47,234 INFO L130 BoogieDeclarations]: Found specification of procedure linkwatch_fire_event [2022-07-21 11:10:47,234 INFO L138 BoogieDeclarations]: Found implementation of procedure linkwatch_fire_event [2022-07-21 11:10:47,234 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_zalloc [2022-07-21 11:10:47,234 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_zalloc [2022-07-21 11:10:47,235 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_from_user [2022-07-21 11:10:47,235 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_from_user [2022-07-21 11:10:47,235 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2022-07-21 11:10:47,236 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2022-07-21 11:10:47,698 INFO L234 CfgBuilder]: Building ICFG [2022-07-21 11:10:47,700 INFO L260 CfgBuilder]: Building CFG for each procedure with an implementation [2022-07-21 11:10:47,773 INFO L764 $ProcedureCfgBuilder]: dead code at ProgramPoint ldv_stopFINAL: assume true; [2022-07-21 11:10:56,860 INFO L275 CfgBuilder]: Performing block encoding [2022-07-21 11:10:56,873 INFO L294 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2022-07-21 11:10:56,873 INFO L299 CfgBuilder]: Removed 1 assume(true) statements. [2022-07-21 11:10:56,876 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 21.07 11:10:56 BoogieIcfgContainer [2022-07-21 11:10:56,876 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2022-07-21 11:10:56,878 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2022-07-21 11:10:56,878 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2022-07-21 11:10:56,880 INFO L275 PluginConnector]: TraceAbstraction initialized [2022-07-21 11:10:56,881 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 21.07 11:10:44" (1/3) ... [2022-07-21 11:10:56,881 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@65a9b22d and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 21.07 11:10:56, skipping insertion in model container [2022-07-21 11:10:56,881 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 21.07 11:10:46" (2/3) ... [2022-07-21 11:10:56,882 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@65a9b22d and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 21.07 11:10:56, skipping insertion in model container [2022-07-21 11:10:56,882 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 21.07 11:10:56" (3/3) ... [2022-07-21 11:10:56,883 INFO L111 eAbstractionObserver]: Analyzing ICFG 205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2022-07-21 11:10:56,896 INFO L201 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2022-07-21 11:10:56,896 INFO L160 ceAbstractionStarter]: Applying trace abstraction to program that has 1 error locations. [2022-07-21 11:10:56,965 INFO L356 AbstractCegarLoop]: ======== Iteration 0 == of CEGAR loop == AllErrorsAtOnce ======== [2022-07-21 11:10:56,970 INFO L357 AbstractCegarLoop]: Settings: SEPARATE_VIOLATION_CHECK=true, mInterprocedural=true, mMaxIterations=1000000, mWatchIteration=1000000, mArtifact=RCFG, mInterpolation=FPandBP, mInterpolantAutomaton=STRAIGHT_LINE, mDumpAutomata=false, mAutomataFormat=ATS_NUMERATE, mDumpPath=., mDeterminiation=PREDICATE_ABSTRACTION, mMinimize=MINIMIZE_SEVPA, mHoare=true, mAutomataTypeConcurrency=PETRI_NET, mHoareTripleChecks=INCREMENTAL, mHoareAnnotationPositions=LoopsAndPotentialCycles, mDumpOnlyReuseAutomata=false, mLimitTraceHistogram=0, mErrorLocTimeLimit=0, mLimitPathProgramCount=0, mCollectInterpolantStatistics=true, mHeuristicEmptinessCheck=false, mHeuristicEmptinessCheckAStarHeuristic=ZERO, mHeuristicEmptinessCheckAStarHeuristicRandomSeed=1337, mHeuristicEmptinessCheckSmtFeatureScoringMethod=DAGSIZE, mSMTFeatureExtraction=false, mSMTFeatureExtractionDumpPath=., mOverrideInterpolantAutomaton=false, mMcrInterpolantMethod=WP, mPorIndependenceSettings=de.uni_freiburg.informatik.ultimate.lib.tracecheckerutils.partialorder.independence.IndependenceSettings@23388cfb, mLbeIndependenceSettings=de.uni_freiburg.informatik.ultimate.lib.tracecheckerutils.partialorder.independence.IndependenceSettings@6194a0ca [2022-07-21 11:10:56,970 INFO L358 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2022-07-21 11:10:56,976 INFO L276 IsEmpty]: Start isEmpty. Operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) [2022-07-21 11:10:56,986 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 48 [2022-07-21 11:10:56,987 INFO L187 NwaCegarLoop]: Found error trace [2022-07-21 11:10:56,987 INFO L195 NwaCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-21 11:10:56,988 INFO L420 AbstractCegarLoop]: === Iteration 1 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-21 11:10:56,992 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-21 11:10:56,992 INFO L85 PathProgramCache]: Analyzing trace with hash -796223239, now seen corresponding path program 1 times [2022-07-21 11:10:57,005 INFO L118 FreeRefinementEngine]: Executing refinement strategy WOLF [2022-07-21 11:10:57,006 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [134232020] [2022-07-21 11:10:57,006 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-21 11:10:57,007 INFO L173 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2022-07-21 11:10:57,007 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2022-07-21 11:10:57,013 INFO L229 MonitoredProcess]: Starting monitored process 2 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2022-07-21 11:10:57,015 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (2)] Waiting until timeout for monitored process [2022-07-21 11:10:57,306 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:57,316 INFO L263 TraceCheckSpWp]: Trace formula consists of 242 conjuncts, 2 conjunts are in the unsatisfiable core [2022-07-21 11:10:57,321 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2022-07-21 11:10:57,386 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2022-07-21 11:10:57,387 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2022-07-21 11:10:57,387 INFO L136 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2022-07-21 11:10:57,388 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [134232020] [2022-07-21 11:10:57,388 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleMathsat [134232020] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-21 11:10:57,388 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-21 11:10:57,388 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2022-07-21 11:10:57,390 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1834685698] [2022-07-21 11:10:57,391 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-21 11:10:57,395 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 3 states [2022-07-21 11:10:57,395 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2022-07-21 11:10:57,417 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2022-07-21 11:10:57,418 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2022-07-21 11:10:57,421 INFO L87 Difference]: Start difference. First operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) Second operand has 3 states, 3 states have (on average 8.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-21 11:10:57,663 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-21 11:10:57,664 INFO L93 Difference]: Finished difference Result 1423 states and 2029 transitions. [2022-07-21 11:10:57,665 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2022-07-21 11:10:57,666 INFO L78 Accepts]: Start accepts. Automaton has has 3 states, 3 states have (on average 8.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 47 [2022-07-21 11:10:57,667 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-21 11:10:57,683 INFO L225 Difference]: With dead ends: 1423 [2022-07-21 11:10:57,683 INFO L226 Difference]: Without dead ends: 924 [2022-07-21 11:10:57,692 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 46 GetRequests, 45 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2022-07-21 11:10:57,695 INFO L413 NwaCegarLoop]: 767 mSDtfsCounter, 628 mSDsluCounter, 661 mSDsCounter, 0 mSdLazyCounter, 12 mSolverCounterSat, 3 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.0s Time, 0 mProtectedPredicate, 0 mProtectedAction, 628 SdHoareTripleChecker+Valid, 1428 SdHoareTripleChecker+Invalid, 15 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 3 IncrementalHoareTripleChecker+Valid, 12 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.1s IncrementalHoareTripleChecker+Time [2022-07-21 11:10:57,696 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [628 Valid, 1428 Invalid, 15 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [3 Valid, 12 Invalid, 0 Unknown, 0 Unchecked, 0.1s Time] [2022-07-21 11:10:57,712 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 924 states. [2022-07-21 11:10:57,790 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 924 to 924. [2022-07-21 11:10:57,794 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 924 states, 685 states have (on average 1.3562043795620438) internal successors, (929), 699 states have internal predecessors, (929), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2022-07-21 11:10:57,799 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 924 states to 924 states and 1284 transitions. [2022-07-21 11:10:57,801 INFO L78 Accepts]: Start accepts. Automaton has 924 states and 1284 transitions. Word has length 47 [2022-07-21 11:10:57,802 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-21 11:10:57,802 INFO L495 AbstractCegarLoop]: Abstraction has 924 states and 1284 transitions. [2022-07-21 11:10:57,802 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 3 states, 3 states have (on average 8.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-21 11:10:57,803 INFO L276 IsEmpty]: Start isEmpty. Operand 924 states and 1284 transitions. [2022-07-21 11:10:57,805 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 51 [2022-07-21 11:10:57,806 INFO L187 NwaCegarLoop]: Found error trace [2022-07-21 11:10:57,806 INFO L195 NwaCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-21 11:10:57,819 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (2)] Forceful destruction successful, exit code 0 [2022-07-21 11:10:58,006 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 2 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2022-07-21 11:10:58,007 INFO L420 AbstractCegarLoop]: === Iteration 2 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-21 11:10:58,007 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-21 11:10:58,008 INFO L85 PathProgramCache]: Analyzing trace with hash 566714884, now seen corresponding path program 1 times [2022-07-21 11:10:58,008 INFO L118 FreeRefinementEngine]: Executing refinement strategy WOLF [2022-07-21 11:10:58,008 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [595125425] [2022-07-21 11:10:58,008 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-21 11:10:58,009 INFO L173 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2022-07-21 11:10:58,009 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2022-07-21 11:10:58,011 INFO L229 MonitoredProcess]: Starting monitored process 3 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2022-07-21 11:10:58,013 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (3)] Waiting until timeout for monitored process [2022-07-21 11:10:58,296 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:58,302 INFO L263 TraceCheckSpWp]: Trace formula consists of 246 conjuncts, 3 conjunts are in the unsatisfiable core [2022-07-21 11:10:58,305 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2022-07-21 11:10:58,354 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2022-07-21 11:10:58,355 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2022-07-21 11:10:58,355 INFO L136 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2022-07-21 11:10:58,355 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [595125425] [2022-07-21 11:10:58,355 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleMathsat [595125425] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-21 11:10:58,356 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-21 11:10:58,356 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2022-07-21 11:10:58,356 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [637096682] [2022-07-21 11:10:58,356 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-21 11:10:58,357 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 4 states [2022-07-21 11:10:58,358 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2022-07-21 11:10:58,358 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2022-07-21 11:10:58,358 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2022-07-21 11:10:58,359 INFO L87 Difference]: Start difference. First operand 924 states and 1284 transitions. Second operand has 4 states, 4 states have (on average 6.75) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-21 11:10:58,631 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-21 11:10:58,631 INFO L93 Difference]: Finished difference Result 1833 states and 2547 transitions. [2022-07-21 11:10:58,632 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2022-07-21 11:10:58,632 INFO L78 Accepts]: Start accepts. Automaton has has 4 states, 4 states have (on average 6.75) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 50 [2022-07-21 11:10:58,633 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-21 11:10:58,639 INFO L225 Difference]: With dead ends: 1833 [2022-07-21 11:10:58,639 INFO L226 Difference]: Without dead ends: 923 [2022-07-21 11:10:58,643 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 51 GetRequests, 48 SyntacticMatches, 0 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2022-07-21 11:10:58,644 INFO L413 NwaCegarLoop]: 782 mSDtfsCounter, 794 mSDsluCounter, 671 mSDsCounter, 0 mSdLazyCounter, 36 mSolverCounterSat, 37 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.2s Time, 0 mProtectedPredicate, 0 mProtectedAction, 794 SdHoareTripleChecker+Valid, 1453 SdHoareTripleChecker+Invalid, 73 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 37 IncrementalHoareTripleChecker+Valid, 36 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.2s IncrementalHoareTripleChecker+Time [2022-07-21 11:10:58,645 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [794 Valid, 1453 Invalid, 73 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [37 Valid, 36 Invalid, 0 Unknown, 0 Unchecked, 0.2s Time] [2022-07-21 11:10:58,647 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 923 states. [2022-07-21 11:10:58,687 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 923 to 923. [2022-07-21 11:10:58,690 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 923 states, 684 states have (on average 1.3523391812865497) internal successors, (925), 698 states have internal predecessors, (925), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2022-07-21 11:10:58,694 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 923 states to 923 states and 1280 transitions. [2022-07-21 11:10:58,695 INFO L78 Accepts]: Start accepts. Automaton has 923 states and 1280 transitions. Word has length 50 [2022-07-21 11:10:58,695 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-21 11:10:58,696 INFO L495 AbstractCegarLoop]: Abstraction has 923 states and 1280 transitions. [2022-07-21 11:10:58,696 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 4 states, 4 states have (on average 6.75) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-21 11:10:58,696 INFO L276 IsEmpty]: Start isEmpty. Operand 923 states and 1280 transitions. [2022-07-21 11:10:58,699 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 72 [2022-07-21 11:10:58,700 INFO L187 NwaCegarLoop]: Found error trace [2022-07-21 11:10:58,700 INFO L195 NwaCegarLoop]: trace histogram [7, 7, 7, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-21 11:10:58,716 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (3)] Forceful destruction successful, exit code 0 [2022-07-21 11:10:58,916 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 3 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2022-07-21 11:10:58,916 INFO L420 AbstractCegarLoop]: === Iteration 3 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-21 11:10:58,917 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-21 11:10:58,917 INFO L85 PathProgramCache]: Analyzing trace with hash -965053755, now seen corresponding path program 1 times [2022-07-21 11:10:58,917 INFO L118 FreeRefinementEngine]: Executing refinement strategy WOLF [2022-07-21 11:10:58,917 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [406629859] [2022-07-21 11:10:58,918 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-21 11:10:58,918 INFO L173 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2022-07-21 11:10:58,918 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2022-07-21 11:10:58,919 INFO L229 MonitoredProcess]: Starting monitored process 4 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2022-07-21 11:10:58,920 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (4)] Waiting until timeout for monitored process [2022-07-21 11:10:59,236 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:10:59,246 INFO L263 TraceCheckSpWp]: Trace formula consists of 304 conjuncts, 4 conjunts are in the unsatisfiable core [2022-07-21 11:10:59,249 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2022-07-21 11:10:59,458 INFO L134 CoverageAnalysis]: Checked inductivity of 89 backedges. 40 proven. 0 refuted. 0 times theorem prover too weak. 49 trivial. 0 not checked. [2022-07-21 11:10:59,458 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2022-07-21 11:10:59,458 INFO L136 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2022-07-21 11:10:59,459 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [406629859] [2022-07-21 11:10:59,459 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleMathsat [406629859] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-21 11:10:59,459 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-21 11:10:59,459 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [] total 5 [2022-07-21 11:10:59,459 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1541726933] [2022-07-21 11:10:59,459 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-21 11:10:59,460 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2022-07-21 11:10:59,460 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2022-07-21 11:10:59,460 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2022-07-21 11:10:59,460 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2022-07-21 11:10:59,461 INFO L87 Difference]: Start difference. First operand 923 states and 1280 transitions. Second operand has 5 states, 5 states have (on average 7.4) internal successors, (37), 5 states have internal predecessors, (37), 3 states have call successors, (8), 3 states have call predecessors, (8), 2 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2022-07-21 11:10:59,677 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-21 11:10:59,680 INFO L93 Difference]: Finished difference Result 2738 states and 3820 transitions. [2022-07-21 11:10:59,682 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2022-07-21 11:10:59,682 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 7.4) internal successors, (37), 5 states have internal predecessors, (37), 3 states have call successors, (8), 3 states have call predecessors, (8), 2 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) Word has length 71 [2022-07-21 11:10:59,683 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-21 11:10:59,695 INFO L225 Difference]: With dead ends: 2738 [2022-07-21 11:10:59,695 INFO L226 Difference]: Without dead ends: 1824 [2022-07-21 11:10:59,700 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 72 GetRequests, 67 SyntacticMatches, 0 SemanticMatches, 5 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=17, Invalid=25, Unknown=0, NotChecked=0, Total=42 [2022-07-21 11:10:59,703 INFO L413 NwaCegarLoop]: 752 mSDtfsCounter, 627 mSDsluCounter, 2144 mSDsCounter, 0 mSdLazyCounter, 21 mSolverCounterSat, 2 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.1s Time, 0 mProtectedPredicate, 0 mProtectedAction, 627 SdHoareTripleChecker+Valid, 2896 SdHoareTripleChecker+Invalid, 23 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 2 IncrementalHoareTripleChecker+Valid, 21 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.1s IncrementalHoareTripleChecker+Time [2022-07-21 11:10:59,704 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [627 Valid, 2896 Invalid, 23 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [2 Valid, 21 Invalid, 0 Unknown, 0 Unchecked, 0.1s Time] [2022-07-21 11:10:59,708 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1824 states. [2022-07-21 11:10:59,779 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1824 to 1824. [2022-07-21 11:10:59,783 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1824 states, 1353 states have (on average 1.3540280857354028) internal successors, (1832), 1381 states have internal predecessors, (1832), 350 states have call successors, (350), 121 states have call predecessors, (350), 120 states have return successors, (359), 349 states have call predecessors, (359), 349 states have call successors, (359) [2022-07-21 11:10:59,793 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1824 states to 1824 states and 2541 transitions. [2022-07-21 11:10:59,793 INFO L78 Accepts]: Start accepts. Automaton has 1824 states and 2541 transitions. Word has length 71 [2022-07-21 11:10:59,794 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-21 11:10:59,794 INFO L495 AbstractCegarLoop]: Abstraction has 1824 states and 2541 transitions. [2022-07-21 11:10:59,794 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 7.4) internal successors, (37), 5 states have internal predecessors, (37), 3 states have call successors, (8), 3 states have call predecessors, (8), 2 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2022-07-21 11:10:59,794 INFO L276 IsEmpty]: Start isEmpty. Operand 1824 states and 2541 transitions. [2022-07-21 11:10:59,801 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 142 [2022-07-21 11:10:59,801 INFO L187 NwaCegarLoop]: Found error trace [2022-07-21 11:10:59,802 INFO L195 NwaCegarLoop]: trace histogram [8, 8, 8, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-21 11:10:59,814 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (4)] Forceful destruction successful, exit code 0 [2022-07-21 11:11:00,014 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 4 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2022-07-21 11:11:00,015 INFO L420 AbstractCegarLoop]: === Iteration 4 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-21 11:11:00,015 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-21 11:11:00,015 INFO L85 PathProgramCache]: Analyzing trace with hash -574025911, now seen corresponding path program 1 times [2022-07-21 11:11:00,016 INFO L118 FreeRefinementEngine]: Executing refinement strategy WOLF [2022-07-21 11:11:00,016 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [1281931315] [2022-07-21 11:11:00,016 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-21 11:11:00,016 INFO L173 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2022-07-21 11:11:00,016 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2022-07-21 11:11:00,019 INFO L229 MonitoredProcess]: Starting monitored process 5 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2022-07-21 11:11:00,019 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (5)] Waiting until timeout for monitored process [2022-07-21 11:11:00,535 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:11:00,572 INFO L263 TraceCheckSpWp]: Trace formula consists of 608 conjuncts, 9 conjunts are in the unsatisfiable core [2022-07-21 11:11:00,577 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2022-07-21 11:11:00,691 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 104 trivial. 0 not checked. [2022-07-21 11:11:00,691 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2022-07-21 11:11:00,691 INFO L136 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2022-07-21 11:11:00,691 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [1281931315] [2022-07-21 11:11:00,692 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleMathsat [1281931315] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-21 11:11:00,692 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-21 11:11:00,692 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [] total 5 [2022-07-21 11:11:00,692 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [57079187] [2022-07-21 11:11:00,692 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-21 11:11:00,693 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2022-07-21 11:11:00,693 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2022-07-21 11:11:00,693 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2022-07-21 11:11:00,694 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2022-07-21 11:11:00,694 INFO L87 Difference]: Start difference. First operand 1824 states and 2541 transitions. Second operand has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2022-07-21 11:11:00,834 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-21 11:11:00,835 INFO L93 Difference]: Finished difference Result 3658 states and 5130 transitions. [2022-07-21 11:11:00,835 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2022-07-21 11:11:00,836 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) Word has length 141 [2022-07-21 11:11:00,836 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-21 11:11:00,846 INFO L225 Difference]: With dead ends: 3658 [2022-07-21 11:11:00,846 INFO L226 Difference]: Without dead ends: 1848 [2022-07-21 11:11:00,854 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 140 GetRequests, 137 SyntacticMatches, 0 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2022-07-21 11:11:00,855 INFO L413 NwaCegarLoop]: 658 mSDtfsCounter, 2 mSDsluCounter, 1961 mSDsCounter, 0 mSdLazyCounter, 19 mSolverCounterSat, 1 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.1s Time, 0 mProtectedPredicate, 0 mProtectedAction, 2 SdHoareTripleChecker+Valid, 2619 SdHoareTripleChecker+Invalid, 20 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 1 IncrementalHoareTripleChecker+Valid, 19 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.1s IncrementalHoareTripleChecker+Time [2022-07-21 11:11:00,856 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [2 Valid, 2619 Invalid, 20 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [1 Valid, 19 Invalid, 0 Unknown, 0 Unchecked, 0.1s Time] [2022-07-21 11:11:00,858 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1848 states. [2022-07-21 11:11:00,950 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1848 to 1844. [2022-07-21 11:11:00,953 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1844 states, 1367 states have (on average 1.3504023408924652) internal successors, (1846), 1397 states have internal predecessors, (1846), 350 states have call successors, (350), 121 states have call predecessors, (350), 126 states have return successors, (374), 353 states have call predecessors, (374), 349 states have call successors, (374) [2022-07-21 11:11:00,962 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1844 states to 1844 states and 2570 transitions. [2022-07-21 11:11:00,963 INFO L78 Accepts]: Start accepts. Automaton has 1844 states and 2570 transitions. Word has length 141 [2022-07-21 11:11:00,963 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-21 11:11:00,964 INFO L495 AbstractCegarLoop]: Abstraction has 1844 states and 2570 transitions. [2022-07-21 11:11:00,964 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2022-07-21 11:11:00,964 INFO L276 IsEmpty]: Start isEmpty. Operand 1844 states and 2570 transitions. [2022-07-21 11:11:00,970 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 149 [2022-07-21 11:11:00,970 INFO L187 NwaCegarLoop]: Found error trace [2022-07-21 11:11:00,971 INFO L195 NwaCegarLoop]: trace histogram [8, 8, 7, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-21 11:11:00,991 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (5)] Forceful destruction successful, exit code 0 [2022-07-21 11:11:01,191 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 5 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2022-07-21 11:11:01,192 INFO L420 AbstractCegarLoop]: === Iteration 5 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-21 11:11:01,192 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-21 11:11:01,192 INFO L85 PathProgramCache]: Analyzing trace with hash -1293113785, now seen corresponding path program 1 times [2022-07-21 11:11:01,193 INFO L118 FreeRefinementEngine]: Executing refinement strategy WOLF [2022-07-21 11:11:01,193 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [648912298] [2022-07-21 11:11:01,193 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-21 11:11:01,193 INFO L173 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2022-07-21 11:11:01,194 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2022-07-21 11:11:01,195 INFO L229 MonitoredProcess]: Starting monitored process 6 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2022-07-21 11:11:01,197 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (6)] Waiting until timeout for monitored process [2022-07-21 11:11:01,675 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-21 11:11:01,720 INFO L263 TraceCheckSpWp]: Trace formula consists of 634 conjuncts, 22 conjunts are in the unsatisfiable core [2022-07-21 11:11:01,724 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2022-07-21 11:11:02,330 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 104 trivial. 0 not checked. [2022-07-21 11:11:02,330 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2022-07-21 11:11:02,330 INFO L136 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2022-07-21 11:11:02,330 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [648912298] [2022-07-21 11:11:02,330 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleMathsat [648912298] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-21 11:11:02,330 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-21 11:11:02,330 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [12] imperfect sequences [] total 12 [2022-07-21 11:11:02,331 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [2131420545] [2022-07-21 11:11:02,331 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-21 11:11:02,331 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 12 states [2022-07-21 11:11:02,331 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2022-07-21 11:11:02,332 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 12 interpolants. [2022-07-21 11:11:02,332 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=21, Invalid=111, Unknown=0, NotChecked=0, Total=132 [2022-07-21 11:11:02,332 INFO L87 Difference]: Start difference. First operand 1844 states and 2570 transitions. Second operand has 12 states, 12 states have (on average 7.333333333333333) internal successors, (88), 9 states have internal predecessors, (88), 2 states have call successors, (19), 2 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 2 states have call successors, (18) [2022-07-21 11:11:05,955 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-21 11:11:05,956 INFO L93 Difference]: Finished difference Result 3746 states and 5240 transitions. [2022-07-21 11:11:05,957 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 13 states. [2022-07-21 11:11:05,957 INFO L78 Accepts]: Start accepts. Automaton has has 12 states, 12 states have (on average 7.333333333333333) internal successors, (88), 9 states have internal predecessors, (88), 2 states have call successors, (19), 2 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 2 states have call successors, (18) Word has length 148 [2022-07-21 11:11:05,958 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-21 11:11:05,967 INFO L225 Difference]: With dead ends: 3746 [2022-07-21 11:11:05,968 INFO L226 Difference]: Without dead ends: 1916 [2022-07-21 11:11:05,975 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 152 GetRequests, 138 SyntacticMatches, 0 SemanticMatches, 14 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 6 ImplicationChecksByTransitivity, 0.7s TimeCoverageRelationStatistics Valid=37, Invalid=203, Unknown=0, NotChecked=0, Total=240 [2022-07-21 11:11:05,976 INFO L413 NwaCegarLoop]: 669 mSDtfsCounter, 36 mSDsluCounter, 6606 mSDsCounter, 0 mSdLazyCounter, 187 mSolverCounterSat, 8 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 3.0s Time, 0 mProtectedPredicate, 0 mProtectedAction, 39 SdHoareTripleChecker+Valid, 7275 SdHoareTripleChecker+Invalid, 195 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 8 IncrementalHoareTripleChecker+Valid, 187 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 3.3s IncrementalHoareTripleChecker+Time [2022-07-21 11:11:05,976 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [39 Valid, 7275 Invalid, 195 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [8 Valid, 187 Invalid, 0 Unknown, 0 Unchecked, 3.3s Time] [2022-07-21 11:11:05,979 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1916 states. [2022-07-21 11:11:06,035 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1916 to 1884. [2022-07-21 11:11:06,038 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1884 states, 1397 states have (on average 1.340014316392269) internal successors, (1872), 1427 states have internal predecessors, (1872), 356 states have call successors, (356), 121 states have call predecessors, (356), 130 states have return successors, (386), 363 states have call predecessors, (386), 355 states have call successors, (386) [2022-07-21 11:11:06,049 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1884 states to 1884 states and 2614 transitions. [2022-07-21 11:11:06,050 INFO L78 Accepts]: Start accepts. Automaton has 1884 states and 2614 transitions. Word has length 148 [2022-07-21 11:11:06,050 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-21 11:11:06,050 INFO L495 AbstractCegarLoop]: Abstraction has 1884 states and 2614 transitions. [2022-07-21 11:11:06,050 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 12 states, 12 states have (on average 7.333333333333333) internal successors, (88), 9 states have internal predecessors, (88), 2 states have call successors, (19), 2 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 2 states have call successors, (18) [2022-07-21 11:11:06,051 INFO L276 IsEmpty]: Start isEmpty. Operand 1884 states and 2614 transitions. [2022-07-21 11:11:06,057 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 184 [2022-07-21 11:11:06,057 INFO L187 NwaCegarLoop]: Found error trace [2022-07-21 11:11:06,057 INFO L195 NwaCegarLoop]: trace histogram [8, 8, 7, 4, 4, 4, 3, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-21 11:11:06,079 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (6)] Forceful destruction successful, exit code 0 [2022-07-21 11:11:06,278 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 6 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2022-07-21 11:11:06,279 INFO L420 AbstractCegarLoop]: === Iteration 6 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-21 11:11:06,279 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-21 11:11:06,279 INFO L85 PathProgramCache]: Analyzing trace with hash -669328497, now seen corresponding path program 1 times [2022-07-21 11:11:06,280 INFO L118 FreeRefinementEngine]: Executing refinement strategy WOLF [2022-07-21 11:11:06,281 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [1046256668] [2022-07-21 11:11:06,281 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-21 11:11:06,281 INFO L173 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2022-07-21 11:11:06,281 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2022-07-21 11:11:06,282 INFO L229 MonitoredProcess]: Starting monitored process 7 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2022-07-21 11:11:06,284 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (7)] Waiting until timeout for monitored process [2022-07-21 11:11:08,302 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2022-07-21 11:11:08,303 INFO L352 TraceCheck]: Trace is feasible, we will do another trace check, this time with branch encoders. [2022-07-21 11:11:09,851 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2022-07-21 11:11:10,295 INFO L130 FreeRefinementEngine]: Strategy WOLF found a feasible trace [2022-07-21 11:11:10,295 INFO L271 BasicCegarLoop]: Counterexample is feasible [2022-07-21 11:11:10,296 INFO L805 garLoopResultBuilder]: Registering result UNSAFE for location ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION (0 of 1 remaining) [2022-07-21 11:11:10,363 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (7)] Forceful destruction successful, exit code 0 [2022-07-21 11:11:10,511 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 7 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2022-07-21 11:11:10,515 INFO L356 BasicCegarLoop]: Path program histogram: [1, 1, 1, 1, 1, 1] [2022-07-21 11:11:10,519 INFO L176 ceAbstractionStarter]: Computing trace abstraction results [2022-07-21 11:11:10,564 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:11:10,565 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:11:10,565 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:11:10,565 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:11:10,565 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:11:10,566 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:11:10,566 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:11:10,566 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:11:10,566 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:11:10,566 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:11:10,714 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 21.07 11:11:10 BoogieIcfgContainer [2022-07-21 11:11:10,714 INFO L132 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2022-07-21 11:11:10,715 INFO L113 PluginConnector]: ------------------------Witness Printer---------------------------- [2022-07-21 11:11:10,715 INFO L271 PluginConnector]: Initializing Witness Printer... [2022-07-21 11:11:10,715 INFO L275 PluginConnector]: Witness Printer initialized [2022-07-21 11:11:10,716 INFO L185 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 21.07 11:10:56" (3/4) ... [2022-07-21 11:11:10,717 INFO L131 WitnessPrinter]: Generating witness for reachability counterexample [2022-07-21 11:11:10,737 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:11:10,738 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:11:10,738 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:11:10,738 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:11:10,738 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:11:10,739 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:11:10,739 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:11:10,739 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:11:10,739 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:11:10,739 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-21 11:11:10,891 INFO L141 WitnessManager]: Wrote witness to /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/witness.graphml [2022-07-21 11:11:10,891 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2022-07-21 11:11:10,892 INFO L158 Benchmark]: Toolchain (without parser) took 26262.17ms. Allocated memory was 58.7MB in the beginning and 224.4MB in the end (delta: 165.7MB). Free memory was 29.2MB in the beginning and 72.5MB in the end (delta: -43.3MB). Peak memory consumption was 122.7MB. Max. memory is 16.1GB. [2022-07-21 11:11:10,892 INFO L158 Benchmark]: CDTParser took 0.25ms. Allocated memory is still 58.7MB. Free memory was 40.5MB in the beginning and 40.4MB in the end (delta: 73.4kB). There was no memory consumed. Max. memory is 16.1GB. [2022-07-21 11:11:10,892 INFO L158 Benchmark]: CACSL2BoogieTranslator took 2146.36ms. Allocated memory was 58.7MB in the beginning and 107.0MB in the end (delta: 48.2MB). Free memory was 29.0MB in the beginning and 38.4MB in the end (delta: -9.4MB). Peak memory consumption was 46.0MB. Max. memory is 16.1GB. [2022-07-21 11:11:10,893 INFO L158 Benchmark]: Boogie Procedure Inliner took 179.74ms. Allocated memory is still 107.0MB. Free memory was 38.4MB in the beginning and 48.9MB in the end (delta: -10.5MB). Peak memory consumption was 4.6MB. Max. memory is 16.1GB. [2022-07-21 11:11:10,893 INFO L158 Benchmark]: Boogie Preprocessor took 145.90ms. Allocated memory is still 107.0MB. Free memory was 48.5MB in the beginning and 39.7MB in the end (delta: 8.8MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. [2022-07-21 11:11:10,893 INFO L158 Benchmark]: RCFGBuilder took 9771.97ms. Allocated memory was 107.0MB in the beginning and 134.2MB in the end (delta: 27.3MB). Free memory was 39.7MB in the beginning and 54.2MB in the end (delta: -14.5MB). Peak memory consumption was 30.8MB. Max. memory is 16.1GB. [2022-07-21 11:11:10,893 INFO L158 Benchmark]: TraceAbstraction took 13836.37ms. Allocated memory was 134.2MB in the beginning and 224.4MB in the end (delta: 90.2MB). Free memory was 53.7MB in the beginning and 111.3MB in the end (delta: -57.6MB). Peak memory consumption was 92.3MB. Max. memory is 16.1GB. [2022-07-21 11:11:10,894 INFO L158 Benchmark]: Witness Printer took 176.37ms. Allocated memory is still 224.4MB. Free memory was 110.2MB in the beginning and 72.5MB in the end (delta: 37.7MB). Peak memory consumption was 37.7MB. Max. memory is 16.1GB. [2022-07-21 11:11:10,895 INFO L339 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.25ms. Allocated memory is still 58.7MB. Free memory was 40.5MB in the beginning and 40.4MB in the end (delta: 73.4kB). There was no memory consumed. Max. memory is 16.1GB. * CACSL2BoogieTranslator took 2146.36ms. Allocated memory was 58.7MB in the beginning and 107.0MB in the end (delta: 48.2MB). Free memory was 29.0MB in the beginning and 38.4MB in the end (delta: -9.4MB). Peak memory consumption was 46.0MB. Max. memory is 16.1GB. * Boogie Procedure Inliner took 179.74ms. Allocated memory is still 107.0MB. Free memory was 38.4MB in the beginning and 48.9MB in the end (delta: -10.5MB). Peak memory consumption was 4.6MB. Max. memory is 16.1GB. * Boogie Preprocessor took 145.90ms. Allocated memory is still 107.0MB. Free memory was 48.5MB in the beginning and 39.7MB in the end (delta: 8.8MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. * RCFGBuilder took 9771.97ms. Allocated memory was 107.0MB in the beginning and 134.2MB in the end (delta: 27.3MB). Free memory was 39.7MB in the beginning and 54.2MB in the end (delta: -14.5MB). Peak memory consumption was 30.8MB. Max. memory is 16.1GB. * TraceAbstraction took 13836.37ms. Allocated memory was 134.2MB in the beginning and 224.4MB in the end (delta: 90.2MB). Free memory was 53.7MB in the beginning and 111.3MB in the end (delta: -57.6MB). Peak memory consumption was 92.3MB. Max. memory is 16.1GB. * Witness Printer took 176.37ms. Allocated memory is still 224.4MB. Free memory was 110.2MB in the beginning and 72.5MB in the end (delta: 37.7MB). Peak memory consumption was 37.7MB. Max. memory is 16.1GB. * Results from de.uni_freiburg.informatik.ultimate.boogie.preprocessor: - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: - GenericResult: Unfinished Backtranslation The program execution was not completely translated back. - GenericResult: Unfinished Backtranslation The program execution was not completely translated back. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - StatisticsResult: ErrorAutomatonStatistics NumberErrorTraces: 0, NumberStatementsAllTraces: 0, NumberRelevantStatements: 0, 0.0s ErrorAutomatonConstructionTimeTotal, 0.0s FaulLocalizationTime, NumberStatementsFirstTrace: -1, TraceLengthAvg: 0, 0.0s ErrorAutomatonConstructionTimeAvg, 0.0s ErrorAutomatonDifferenceTimeAvg, 0.0s ErrorAutomatonDifferenceTimeTotal, NumberOfNoEnhancement: 0, NumberOfFiniteEnhancement: 0, NumberOfInfiniteEnhancement: 0 - CounterExampleResult [Line: 5554]: a call to reach_error is reachable a call to reach_error is reachable We found a FailurePath: [L5577] int LDV_IN_INTERRUPT = 1; [L5578] struct sk_buff *proto_group1 ; [L5579] int ldv_state_variable_0 ; [L5580] int ldv_state_variable_3 ; [L5581] int ldv_timer_state_1 = 0; [L5582] int ldv_state_variable_2 ; [L5583] struct net_device *proto_group0 ; [L5584] int ref_cnt ; [L5585] int ldv_state_variable_1 ; [L5586] struct timer_list *ldv_timer_list_1 ; [L5964-L5966] static struct hdlc_proto proto = {0, 0, & cisco_start, & cisco_stop, 0, & cisco_ioctl, & cisco_type_trans, & cisco_rx, 0, & __this_module, 0}; [L5967] static struct header_ops const cisco_header_ops = {& cisco_hard_header, 0, 0, 0, 0}; [L6078] int ldv_retval_0 ; [L6374] Element set_impl[15] ; [L6375] int last_index = 0; [L6509] Set LDV_SKBS ; VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6142] struct ifreq *ldvarg0 ; [L6143] void *tmp ; [L6144] unsigned int ldvarg1 ; [L6145] unsigned int tmp___0 ; [L6146] unsigned short ldvarg4 ; [L6147] unsigned short tmp___1 ; [L6148] struct sk_buff *ldvarg3 ; [L6149] void *tmp___2 ; [L6150] struct net_device *ldvarg5 ; [L6151] void *tmp___3 ; [L6152] void *ldvarg2 ; [L6153] void *tmp___4 ; [L6154] void *ldvarg6 ; [L6155] void *tmp___5 ; [L6156] int tmp___6 ; [L6157] int tmp___7 ; [L6158] int tmp___8 ; [L6159] int tmp___9 ; VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6161] CALL, EXPR ldv_zalloc(40UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=40, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=40, tmp___0=2147483648] [L6161] RET, EXPR ldv_zalloc(40UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(40UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6161] tmp = ldv_zalloc(40UL) [L6162] ldvarg0 = (struct ifreq *)tmp [L6163] tmp___0 = __VERIFIER_nondet_uint() [L6164] ldvarg1 = tmp___0 [L6165] tmp___1 = __VERIFIER_nondet_ushort() [L6166] ldvarg4 = tmp___1 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg4=5, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5] [L6167] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=232, tmp___0=2147483648] [L6167] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg4=5, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5] [L6167] tmp___2 = ldv_zalloc(232UL) [L6168] ldvarg3 = (struct sk_buff *)tmp___2 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}] [L6169] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=3264, tmp___0=2147483648] [L6169] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}] [L6169] tmp___3 = ldv_zalloc(3264UL) [L6170] ldvarg5 = (struct net_device *)tmp___3 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}] [L6171] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=2147483648] [L6171] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}] [L6171] tmp___4 = ldv_zalloc(1UL) [L6172] ldvarg2 = tmp___4 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=2147483648] [L6173] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] tmp___5 = ldv_zalloc(1UL) [L6174] ldvarg6 = tmp___5 [L6175] CALL ldv_initialize() [L6528] CALL ldv_set_init(LDV_SKBS) [L6380] set = set_impl [L6381] last_index = 0 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={18:0}, set={0:0}, set_impl={18:0}] [L6528] RET ldv_set_init(LDV_SKBS) [L6175] RET ldv_initialize() [L6176] ldv_state_variable_1 = 1 [L6177] ref_cnt = 0 [L6178] ldv_state_variable_0 = 1 [L6179] ldv_state_variable_3 = 0 [L6180] ldv_state_variable_2 = 0 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: [L6202] case 1: VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6203] COND TRUE ldv_state_variable_0 == 1 [L6204] CALL, EXPR mod_init() [L6067] FCALL register_hdlc_protocol(& proto) [L6068] return (0); VAL [\result=0, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6204] RET, EXPR mod_init() [L6204] ldv_retval_0 = mod_init() [L6205] COND TRUE ldv_retval_0 == 0 [L6206] ldv_state_variable_0 = 3 [L6207] ldv_state_variable_2 = 1 [L6208] ldv_state_variable_3 = 1 [L6209] CALL ldv_initialize_hdlc_proto_3() [L6101] void *tmp ; [L6102] void *tmp___0 ; VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6104] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=232, tmp___0=2147483648] [L6104] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6104] tmp = ldv_zalloc(232UL) [L6105] proto_group1 = (struct sk_buff *)tmp VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L6106] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=3264, tmp___0=2147483648] [L6106] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L6106] tmp___0 = ldv_zalloc(3264UL) [L6107] proto_group0 = (struct net_device *)tmp___0 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0={0:0}] [L6209] RET ldv_initialize_hdlc_proto_3() [L6212] COND FALSE !(ldv_retval_0 != 0) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=0, tmp___7=1] [L6185] COND TRUE ldv_state_variable_1 != 0 [L6186] CALL choose_timer_1(ldv_timer_list_1) [L6114] LDV_IN_INTERRUPT = 2 [L6115] EXPR timer->data [L6115] EXPR timer->function [L6115] CALL (*(timer->function))(timer->data) [L5877] struct net_device *dev ; [L5878] hdlc_device *hdlc ; [L5879] struct hdlc_device *tmp ; [L5880] struct cisco_state *st ; [L5881] struct cisco_state *tmp___0 ; [L5882] __u32 tmp___1 ; [L5883] __u32 tmp___2 ; [L5885] dev = (struct net_device *)arg VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5886] CALL, EXPR dev_to_hdlc(dev) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5638] void *tmp ; [L5640] CALL, EXPR netdev_priv((struct net_device const *)dev) [L5595] return ((void *)dev + 3264U); VAL [\result={0:3264}, __this_module={0:0}, cisco_header_ops={17:0}, dev={0:0}, dev={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5640] RET, EXPR netdev_priv((struct net_device const *)dev) [L5640] tmp = netdev_priv((struct net_device const *)dev) [L5641] return ((struct hdlc_device *)tmp); VAL [\result={0:3264}, __this_module={0:0}, cisco_header_ops={17:0}, dev={0:0}, dev={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:3264}] [L5886] RET, EXPR dev_to_hdlc(dev) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, dev_to_hdlc(dev)={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5886] tmp = dev_to_hdlc(dev) [L5887] hdlc = tmp VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:3264}] [L5888] CALL, EXPR state(hdlc) VAL [__this_module={0:0}, cisco_header_ops={17:0}, hdlc={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5670] EXPR hdlc->state [L5670] return ((struct cisco_state *)hdlc->state); [L5888] RET, EXPR state(hdlc) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, state(hdlc)={0:0}, tmp={0:3264}] [L5888] tmp___0 = state(hdlc) [L5889] st = tmp___0 VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}] [L5890] CALL spin_lock(& st->lock) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5263] FCALL _raw_spin_lock(& lock->ldv_6338.rlock) [L5890] RET spin_lock(& st->lock) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}] [L5891] EXPR st->up [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L [L5891] EXPR st->last_poll [L5891] EXPR st->settings.timeout [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->last_poll=0, st->settings.timeout=0, st->up=2, st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L=0, tmp={0:3264}, tmp___0={0:0}] [L5891] COND FALSE !(st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L) [L5897] EXPR st->rxseq VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->rxseq=0, tmp={0:3264}, tmp___0={0:0}] [L5897] CALL, EXPR __fswab32(st->rxseq) VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=0] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=0, val=0] [L5897] RET, EXPR __fswab32(st->rxseq) VAL [\old(arg)=0, __fswab32(st->rxseq)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->rxseq=0, tmp={0:3264}, tmp___0={0:0}] [L5897] tmp___1 = __fswab32(st->rxseq) [L5898] EXPR st->txseq [L5898] st->txseq = st->txseq + 1U [L5899] EXPR st->txseq VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->txseq=0, tmp={0:3264}, tmp___0={0:0}, tmp___1=0] [L5899] CALL, EXPR __fswab32(st->txseq) VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=0] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=0, val=0] [L5899] RET, EXPR __fswab32(st->txseq) VAL [\old(arg)=0, __fswab32(st->txseq)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->txseq=0, tmp={0:3264}, tmp___0={0:0}, tmp___1=0] [L5899] tmp___2 = __fswab32(st->txseq) [L5900] CALL cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5695] struct sk_buff *skb ; [L5696] struct cisco_packet *data ; [L5697] __u32 tmp ; [L5698] __u32 tmp___0 ; [L5700] CALL, EXPR ldv_dev_alloc_skb_12(22U) [L6356] struct sk_buff *tmp ; VAL [\old(last_index)=0, \old(length)=22, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6358] CALL, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6512] void *skb ; [L6513] void *tmp___7 ; VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6515] CALL, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND FALSE !(tmp___0 != 0) [L5527] EXPR, FCALL calloc(1UL, size) [L5527] tmp = calloc(1UL, size) [L5528] p = tmp VAL [\old(last_index)=0, \old(size)=248, __this_module={0:0}, calloc(1UL, size)={4611686018427387905:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={4611686018427387905:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={4611686018427387905:0}, tmp___0=0] [L5529] CALL assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(cond)=1, \old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5498] COND FALSE !(!cond) VAL [\old(cond)=1, \old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, cond=1, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5529] RET assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(last_index)=0, \old(size)=248, __this_module={0:0}, calloc(1UL, size)={4611686018427387905:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={4611686018427387905:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={4611686018427387905:0}, tmp___0=0] [L5530] return (p); VAL [\old(last_index)=0, \old(size)=248, \result={4611686018427387905:0}, __this_module={0:0}, calloc(1UL, size)={4611686018427387905:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={4611686018427387905:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={4611686018427387905:0}, tmp___0=0] [L6515] RET, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(sizeof(struct sk_buff___0 ))={4611686018427387905:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6515] tmp___7 = ldv_zalloc(sizeof(struct sk_buff___0 )) [L6516] skb = (struct sk_buff___0 *)tmp___7 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, tmp___7={4611686018427387905:0}] [L6517] COND FALSE !(! skb) [L6520] CALL ldv_set_add(LDV_SKBS, skb) [L6388] int i ; [L6390] i = 0 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, e={4611686018427387905:0}, e={4611686018427387905:0}, i=0, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6391] COND TRUE 1 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, e={4611686018427387905:0}, e={4611686018427387905:0}, i=0, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6392] COND FALSE !(i < last_index) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, e={4611686018427387905:0}, e={4611686018427387905:0}, i=0, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6402] COND TRUE last_index < 15 [L6403] set_impl[last_index] = e [L6404] last_index = last_index + 1 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, e={4611686018427387905:0}, e={4611686018427387905:0}, i=0, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6520] RET ldv_set_add(LDV_SKBS, skb) [L6521] return (skb); VAL [\old(last_index)=0, \result={4611686018427387905:0}, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, tmp___7={4611686018427387905:0}] [L6358] RET, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, \old(length)=22, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, ldv_skb_alloc()={4611686018427387905:0}, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6358] tmp = ldv_skb_alloc() [L6359] return (tmp); VAL [\old(last_index)=0, \old(length)=22, \result={4611686018427387905:0}, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={4611686018427387905:0}] [L5700] RET, EXPR ldv_dev_alloc_skb_12(22U) [L5700] skb = ldv_dev_alloc_skb_12(22U) [L5701] COND FALSE !((unsigned long )skb == (unsigned long )((struct sk_buff *)0)) [L5706] CALL skb_reserve(skb, 4) [L5475] EXPR skb->data [L5475] skb->data = skb->data + (unsigned long )len [L5476] EXPR skb->tail [L5476] skb->tail = skb->tail + (sk_buff_data_t )len [L5706] RET skb_reserve(skb, 4) [L5707] CALL cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5676] struct hdlc_header *data ; [L5677] __u16 tmp ; [L5679] CALL skb_push(skb, 4U) [L6687] CALL, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(last_index)=0, \old(size)=1, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5502] void *p ; [L5503] void *tmp ; [L5504] int tmp___0 ; [L5506] tmp___0 = __VERIFIER_nondet_int() [L5507] COND TRUE tmp___0 != 0 [L5508] return ((void *)0); VAL [\old(last_index)=0, \old(size)=1, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=2147483648] [L6687] RET, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(arg1)=4, \old(last_index)=0, __this_module={0:0}, arg0={4611686018427387905:0}, arg0={4611686018427387905:0}, arg1=4, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_malloc(sizeof(unsigned char))={0:0}, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6687] return ldv_malloc(sizeof(unsigned char)); [L5679] RET skb_push(skb, 4U) [L5680] EXPR skb->data [L5680] data = (struct hdlc_header *)skb->data [L5681] COND TRUE (unsigned int )type == 32821U [L5682] data->address = 143U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={0:0}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={0:0}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={4611686018427387905:0}, skb={4611686018427387905:0}, type=32821] [L5686] data->control = 0U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={0:0}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={0:0}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={4611686018427387905:0}, skb={4611686018427387905:0}, type=32821] [L5687] CALL, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(val)=32821, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5123] return ((__u16 )((int )((short )((int )val << 8)) | (int )((short )((int )val >> 8)))); VAL [\old(last_index)=0, \old(val)=32821, \result=13696, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=32821] [L5687] RET, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __fswab16((int )type)=13696, __this_module={0:0}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={0:0}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={4611686018427387905:0}, skb={4611686018427387905:0}, type=32821] [L5687] tmp = __fswab16((int )type) [L5688] data->protocol = tmp [L5689] return (4); VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, \result=4, __this_module={0:0}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={0:0}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={4611686018427387905:0}, skb={4611686018427387905:0}, tmp=13696, type=32821] [L5707] RET cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, \old(par1)=0, \old(par2)=0, \old(type)=2, __this_module={0:0}, cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U)=4, cisco_header_ops={17:0}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=0, par2=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, type=2] [L5708] EXPR skb->data [L5708] data = (struct cisco_packet *)skb->data + 4U [L5709] CALL, EXPR __fswab32(type) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=2] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=2, val=2] [L5709] RET, EXPR __fswab32(type) VAL [\old(last_index)=0, \old(par1)=0, \old(par2)=0, \old(type)=2, __fswab32(type)=2, __this_module={0:0}, cisco_header_ops={17:0}, data={0:72}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=0, par2=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, type=2] [L5709] tmp = __fswab32(type) [L5710] data->type = tmp [L5711] data->par1 = par1 [L5712] data->par2 = par2 [L5713] data->rel = 65535U VAL [\old(last_index)=0, \old(par1)=0, \old(par2)=0, \old(type)=2, __this_module={0:0}, cisco_header_ops={17:0}, data={0:72}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=0, par2=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, tmp=2, type=2] [L5714] CALL, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=300000, \result=300000, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=300000] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=300000, \result=300000, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=300000, val=300000] [L5714] RET, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, \old(par1)=0, \old(par2)=0, \old(type)=2, __fswab32(((__u32 )jiffies + 75000U) * 4U)=300000, __this_module={0:0}, cisco_header_ops={17:0}, data={0:72}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=0, par2=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, tmp=2, type=2] [L5714] tmp___0 = __fswab32(((__u32 )jiffies + 75000U) * 4U) [L5715] data->time = tmp___0 [L5716] CALL skb_put(skb, 18U) [L6690] EXPR arg0->data [L6690] EXPR arg0->tail [L6690] unsigned char *ret_val = arg0->data + arg0->tail; [L6691] EXPR arg0->tail [L6691] arg0->tail += arg1 [L6692] return ret_val; VAL [\old(arg1)=18, \old(last_index)=0, \result={0:4}, __this_module={0:0}, arg0={4611686018427387905:0}, arg0={4611686018427387905:0}, arg1=18, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, ret_val={0:4}, set_impl={18:0}] [L5716] RET skb_put(skb, 18U) [L5717] skb->priority = 7U [L5718] skb->dev = dev [L5719] CALL skb_reset_network_header(skb) [L5483] EXPR skb->data [L5483] EXPR skb->head [L5483] skb->network_header = (int )((__u16 )((long )skb->data)) - (int )((__u16 )((long )skb->head)) [L5719] RET skb_reset_network_header(skb) [L5720] CALL dev_queue_xmit(skb) [L6643] return __VERIFIER_nondet_int(); [L5720] RET dev_queue_xmit(skb) [L5900] RET cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}, tmp___1=0, tmp___2=0] [L5901] CALL spin_unlock(& st->lock) VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5270] FCALL _raw_spin_unlock(& lock->ldv_6338.rlock) [L5901] RET spin_unlock(& st->lock) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}, tmp___1=0, tmp___2=0] [L5902] EXPR st->settings.interval [L5902] st->timer.expires = (unsigned long )(st->settings.interval * 250U) + (unsigned long )jiffies [L5903] st->timer.function = & cisco_timer [L5904] st->timer.data = arg VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}, tmp___1=0, tmp___2=0] [L5905] FCALL add_timer(& st->timer) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}, tmp___1=0, tmp___2=0] [L6115] RET (*(timer->function))(timer->data) [L6116] LDV_IN_INTERRUPT = 1 [L6117] ldv_timer_state_1 = 2 VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, timer={0:0}, timer={0:0}] [L6186] RET choose_timer_1(ldv_timer_list_1) [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6195] COND TRUE ldv_state_variable_0 == 3 && ref_cnt == 0 [L6196] CALL mod_exit() [L6074] FCALL unregister_hdlc_protocol(& proto) [L6196] RET mod_exit() [L6197] ldv_state_variable_0 = 2 VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6315] CALL ldv_check_final_state() [L6579] int tmp___7 ; [L6581] CALL, EXPR ldv_set_is_empty(LDV_SKBS) [L6470] return (last_index == 0); VAL [\result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6581] RET, EXPR ldv_set_is_empty(LDV_SKBS) [L6581] tmp___7 = ldv_set_is_empty(LDV_SKBS) [L6582] COND FALSE !(\read(tmp___7)) VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp___7=0] [L6584] CALL ldv_error() VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5554] reach_error() VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] - StatisticsResult: Ultimate Automizer benchmark data CFG has 33 procedures, 489 locations, 1 error locations. Started 1 CEGAR loops. OverallTime: 13.6s, OverallIterations: 6, TraceHistogramMax: 8, PathProgramHistogramMax: 1, EmptinessCheckTime: 0.0s, AutomataDifference: 4.6s, DeadEndRemovalTime: 0.0s, HoareAnnotationTime: 0.0s, InitialAbstractionConstructionTime: 0.0s, HoareTripleCheckerStatistics: 0 mSolverCounterUnknown, 2090 SdHoareTripleChecker+Valid, 3.7s IncrementalHoareTripleChecker+Time, 0 mSdLazyCounter, 2087 mSDsluCounter, 15671 SdHoareTripleChecker+Invalid, 3.4s Time, 0 mProtectedAction, 0 SdHoareTripleChecker+Unchecked, 0 IncrementalHoareTripleChecker+Unchecked, 12043 mSDsCounter, 51 IncrementalHoareTripleChecker+Valid, 0 mProtectedPredicate, 275 IncrementalHoareTripleChecker+Invalid, 326 SdHoareTripleChecker+Unknown, 0 mSolverCounterNotChecked, 51 mSolverCounterUnsat, 3628 mSDtfsCounter, 275 mSolverCounterSat, 0.1s SdHoareTripleChecker+Time, 0 IncrementalHoareTripleChecker+Unknown, PredicateUnifierStatistics: 0 DeclaredPredicates, 461 GetRequests, 435 SyntacticMatches, 0 SemanticMatches, 26 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 6 ImplicationChecksByTransitivity, 0.9s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=1884occurred in iteration=5, InterpolantAutomatonStates: 30, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s DumpTime, AutomataMinimizationStatistics: 0.4s AutomataMinimizationTime, 5 MinimizatonAttempts, 36 StatesRemovedByMinimization, 2 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TRACE_CHECK: 0.3s SsaConstructionTime, 2.5s SatisfiabilityAnalysisTime, 1.2s InterpolantComputationTime, 640 NumberOfCodeBlocks, 640 NumberOfCodeBlocksAsserted, 6 NumberOfCheckSat, 452 ConstructedInterpolants, 0 QuantifiedInterpolants, 646 SizeOfPredicates, 16 NumberOfNonLiveVariables, 2034 ConjunctsInSsa, 40 ConjunctsInUnsatCore, 5 InterpolantComputations, 5 PerfectInterpolantSequences, 419/419 InterpolantCoveringCapability, INVARIANT_SYNTHESIS: No data available, INTERPOLANT_CONSOLIDATION: No data available, ABSTRACT_INTERPRETATION: No data available, PDR: No data available, ACCELERATED_INTERPOLATION: No data available, SIFA: No data available, ReuseStatistics: No data available RESULT: Ultimate proved your program to be incorrect! [2022-07-21 11:11:10,945 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Forceful destruction successful, exit code 0 Received shutdown request... --- End real Ultimate output --- Execution finished normally Writing output log to file Ultimate.log Writing human readable error path to file UltimateCounterExample.errorpath Result: FALSE