./Ultimate.py --spec ../sv-benchmarks/c/properties/unreach-call.prp --file ../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i --full-output --architecture 64bit -------------------------------------------------------------------------------- Checking for ERROR reachability Using default analysis Version 791161d1 Calling Ultimate with: /usr/bin/java -Dosgi.configuration.area=/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/config -Xmx15G -Xms4m -jar /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/org.eclipse.equinox.launcher_1.5.800.v20200727-1323.jar -data @noDefault -ultimatedata /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data -tc /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/AutomizerReach.xml -i ../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i -s /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Default.epf --cacsl2boogietranslator.entry.function main --witnessprinter.witness.directory /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux --witnessprinter.witness.filename witness.graphml --witnessprinter.write.witness.besides.input.file false --witnessprinter.graph.data.specification CHECK( init(main()), LTL(G ! call(reach_error())) ) --witnessprinter.graph.data.producer Automizer --witnessprinter.graph.data.architecture 64bit --witnessprinter.graph.data.programhash aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 --- Real Ultimate output --- This is Ultimate 0.2.2-?-791161d [2022-07-22 23:52:58,528 INFO L177 SettingsManager]: Resetting all preferences to default values... [2022-07-22 23:52:58,532 INFO L181 SettingsManager]: Resetting UltimateCore preferences to default values [2022-07-22 23:52:58,568 INFO L184 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2022-07-22 23:52:58,569 INFO L181 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2022-07-22 23:52:58,570 INFO L181 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2022-07-22 23:52:58,572 INFO L181 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2022-07-22 23:52:58,577 INFO L181 SettingsManager]: Resetting LassoRanker preferences to default values [2022-07-22 23:52:58,579 INFO L181 SettingsManager]: Resetting Reaching Definitions preferences to default values [2022-07-22 23:52:58,582 INFO L181 SettingsManager]: Resetting SyntaxChecker preferences to default values [2022-07-22 23:52:58,583 INFO L181 SettingsManager]: Resetting Sifa preferences to default values [2022-07-22 23:52:58,585 INFO L184 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2022-07-22 23:52:58,586 INFO L181 SettingsManager]: Resetting LTL2Aut preferences to default values [2022-07-22 23:52:58,588 INFO L181 SettingsManager]: Resetting PEA to Boogie preferences to default values [2022-07-22 23:52:58,589 INFO L181 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2022-07-22 23:52:58,592 INFO L181 SettingsManager]: Resetting ChcToBoogie preferences to default values [2022-07-22 23:52:58,593 INFO L181 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2022-07-22 23:52:58,595 INFO L181 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2022-07-22 23:52:58,596 INFO L181 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2022-07-22 23:52:58,600 INFO L181 SettingsManager]: Resetting CodeCheck preferences to default values [2022-07-22 23:52:58,602 INFO L181 SettingsManager]: Resetting HornVerifier preferences to default values [2022-07-22 23:52:58,603 INFO L181 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2022-07-22 23:52:58,604 INFO L181 SettingsManager]: Resetting RCFGBuilder preferences to default values [2022-07-22 23:52:58,605 INFO L181 SettingsManager]: Resetting Referee preferences to default values [2022-07-22 23:52:58,606 INFO L181 SettingsManager]: Resetting TraceAbstraction preferences to default values [2022-07-22 23:52:58,612 INFO L184 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2022-07-22 23:52:58,613 INFO L184 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2022-07-22 23:52:58,613 INFO L181 SettingsManager]: Resetting TreeAutomizer preferences to default values [2022-07-22 23:52:58,614 INFO L181 SettingsManager]: Resetting IcfgToChc preferences to default values [2022-07-22 23:52:58,615 INFO L181 SettingsManager]: Resetting IcfgTransformer preferences to default values [2022-07-22 23:52:58,615 INFO L184 SettingsManager]: ReqToTest provides no preferences, ignoring... [2022-07-22 23:52:58,616 INFO L181 SettingsManager]: Resetting Boogie Printer preferences to default values [2022-07-22 23:52:58,618 INFO L181 SettingsManager]: Resetting ChcSmtPrinter preferences to default values [2022-07-22 23:52:58,618 INFO L181 SettingsManager]: Resetting ReqPrinter preferences to default values [2022-07-22 23:52:58,619 INFO L181 SettingsManager]: Resetting Witness Printer preferences to default values [2022-07-22 23:52:58,620 INFO L184 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2022-07-22 23:52:58,620 INFO L181 SettingsManager]: Resetting CDTParser preferences to default values [2022-07-22 23:52:58,620 INFO L184 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2022-07-22 23:52:58,620 INFO L184 SettingsManager]: ReqParser provides no preferences, ignoring... [2022-07-22 23:52:58,621 INFO L181 SettingsManager]: Resetting SmtParser preferences to default values [2022-07-22 23:52:58,621 INFO L181 SettingsManager]: Resetting Witness Parser preferences to default values [2022-07-22 23:52:58,623 INFO L188 SettingsManager]: Finished resetting all preferences to default values... [2022-07-22 23:52:58,624 INFO L101 SettingsManager]: Beginning loading settings from /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Default.epf [2022-07-22 23:52:58,649 INFO L113 SettingsManager]: Loading preferences was successful [2022-07-22 23:52:58,650 INFO L115 SettingsManager]: Preferences different from defaults after loading the file: [2022-07-22 23:52:58,650 INFO L136 SettingsManager]: Preferences of UltimateCore differ from their defaults: [2022-07-22 23:52:58,650 INFO L138 SettingsManager]: * Log level for class=de.uni_freiburg.informatik.ultimate.lib.smtlibutils.quantifier.QuantifierPusher=ERROR; [2022-07-22 23:52:58,651 INFO L136 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2022-07-22 23:52:58,651 INFO L138 SettingsManager]: * Ignore calls to procedures called more than once=ONLY_FOR_SEQUENTIAL_PROGRAMS [2022-07-22 23:52:58,651 INFO L136 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2022-07-22 23:52:58,652 INFO L138 SettingsManager]: * Create parallel compositions if possible=false [2022-07-22 23:52:58,652 INFO L138 SettingsManager]: * Use SBE=true [2022-07-22 23:52:58,653 INFO L136 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2022-07-22 23:52:58,653 INFO L138 SettingsManager]: * Overapproximate operations on floating types=true [2022-07-22 23:52:58,653 INFO L138 SettingsManager]: * Check division by zero=IGNORE [2022-07-22 23:52:58,653 INFO L138 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2022-07-22 23:52:58,653 INFO L138 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2022-07-22 23:52:58,654 INFO L138 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2022-07-22 23:52:58,654 INFO L138 SettingsManager]: * Check if freed pointer was valid=false [2022-07-22 23:52:58,654 INFO L138 SettingsManager]: * Use constant arrays=true [2022-07-22 23:52:58,654 INFO L138 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2022-07-22 23:52:58,654 INFO L136 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2022-07-22 23:52:58,654 INFO L138 SettingsManager]: * Size of a code block=SequenceOfStatements [2022-07-22 23:52:58,655 INFO L138 SettingsManager]: * SMT solver=External_DefaultMode [2022-07-22 23:52:58,655 INFO L138 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2022-07-22 23:52:58,655 INFO L136 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2022-07-22 23:52:58,655 INFO L138 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2022-07-22 23:52:58,655 INFO L138 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2022-07-22 23:52:58,655 INFO L138 SettingsManager]: * Trace refinement strategy=CAMEL [2022-07-22 23:52:58,656 INFO L138 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in [2022-07-22 23:52:58,656 INFO L138 SettingsManager]: * Apply one-shot large block encoding in concurrent analysis=false [2022-07-22 23:52:58,656 INFO L138 SettingsManager]: * Automaton type used in concurrency analysis=PETRI_NET [2022-07-22 23:52:58,656 INFO L138 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true [2022-07-22 23:52:58,656 INFO L138 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode WARNING: An illegal reflective access operation has occurred WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 (file:/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/com.sun.xml.bind_2.2.0.v201505121915.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int) WARNING: Please consider reporting this to the maintainers of com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations WARNING: All illegal access operations will be denied in a future release Applying setting for plugin de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: Entry function -> main Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness directory -> /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness filename -> witness.graphml Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Write witness besides input file -> false Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data specification -> CHECK( init(main()), LTL(G ! call(reach_error())) ) Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data producer -> Automizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data architecture -> 64bit Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data programhash -> aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 [2022-07-22 23:52:58,838 INFO L75 nceAwareModelManager]: Repository-Root is: /tmp [2022-07-22 23:52:58,872 INFO L261 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2022-07-22 23:52:58,874 INFO L217 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2022-07-22 23:52:58,875 INFO L271 PluginConnector]: Initializing CDTParser... [2022-07-22 23:52:58,875 INFO L275 PluginConnector]: CDTParser initialized [2022-07-22 23:52:58,877 INFO L432 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2022-07-22 23:52:58,936 INFO L220 CDTParser]: Created temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/943f91791/8f91975136cc44639885ba6cccbaad14/FLAGa8eae7e62 [2022-07-22 23:52:59,635 INFO L306 CDTParser]: Found 1 translation units. [2022-07-22 23:52:59,636 INFO L160 CDTParser]: Scanning /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2022-07-22 23:52:59,667 INFO L349 CDTParser]: About to delete temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/943f91791/8f91975136cc44639885ba6cccbaad14/FLAGa8eae7e62 [2022-07-22 23:52:59,857 INFO L357 CDTParser]: Successfully deleted /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/943f91791/8f91975136cc44639885ba6cccbaad14 [2022-07-22 23:52:59,859 INFO L299 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2022-07-22 23:52:59,860 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2022-07-22 23:52:59,862 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2022-07-22 23:52:59,863 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2022-07-22 23:52:59,865 INFO L275 PluginConnector]: CACSL2BoogieTranslator initialized [2022-07-22 23:52:59,865 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 22.07 11:52:59" (1/1) ... [2022-07-22 23:52:59,866 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@3245ec27 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:52:59, skipping insertion in model container [2022-07-22 23:52:59,866 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 22.07 11:52:59" (1/1) ... [2022-07-22 23:52:59,871 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2022-07-22 23:52:59,925 INFO L178 MainTranslator]: Built tables and reachable declarations [2022-07-22 23:53:00,747 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2022-07-22 23:53:01,042 INFO L210 PostProcessor]: Analyzing one entry point: main [2022-07-22 23:53:01,055 INFO L203 MainTranslator]: Completed pre-run [2022-07-22 23:53:01,180 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2022-07-22 23:53:01,281 INFO L210 PostProcessor]: Analyzing one entry point: main [2022-07-22 23:53:01,310 INFO L208 MainTranslator]: Completed translation [2022-07-22 23:53:01,311 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:01 WrapperNode [2022-07-22 23:53:01,312 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2022-07-22 23:53:01,313 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2022-07-22 23:53:01,313 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2022-07-22 23:53:01,313 INFO L275 PluginConnector]: Boogie Procedure Inliner initialized [2022-07-22 23:53:01,317 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:01" (1/1) ... [2022-07-22 23:53:01,357 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:01" (1/1) ... [2022-07-22 23:53:01,424 INFO L137 Inliner]: procedures = 146, calls = 357, calls flagged for inlining = 63, calls inlined = 60, statements flattened = 1425 [2022-07-22 23:53:01,428 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2022-07-22 23:53:01,429 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2022-07-22 23:53:01,429 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2022-07-22 23:53:01,429 INFO L275 PluginConnector]: Boogie Preprocessor initialized [2022-07-22 23:53:01,435 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:01" (1/1) ... [2022-07-22 23:53:01,435 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:01" (1/1) ... [2022-07-22 23:53:01,451 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:01" (1/1) ... [2022-07-22 23:53:01,451 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:01" (1/1) ... [2022-07-22 23:53:01,501 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:01" (1/1) ... [2022-07-22 23:53:01,520 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:01" (1/1) ... [2022-07-22 23:53:01,526 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:01" (1/1) ... [2022-07-22 23:53:01,537 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2022-07-22 23:53:01,538 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2022-07-22 23:53:01,538 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2022-07-22 23:53:01,538 INFO L275 PluginConnector]: RCFGBuilder initialized [2022-07-22 23:53:01,539 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:01" (1/1) ... [2022-07-22 23:53:01,544 INFO L173 SolverBuilder]: Constructing external solver with command: z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2022-07-22 23:53:01,553 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 [2022-07-22 23:53:01,576 INFO L229 MonitoredProcess]: Starting monitored process 1 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) [2022-07-22 23:53:01,593 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Waiting until timeout for monitored process [2022-07-22 23:53:01,610 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab32 [2022-07-22 23:53:01,611 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab32 [2022-07-22 23:53:01,611 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~int [2022-07-22 23:53:01,611 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~$Pointer$ [2022-07-22 23:53:01,611 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$ [2022-07-22 23:53:01,611 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_stop [2022-07-22 23:53:01,611 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_stop [2022-07-22 23:53:01,611 INFO L130 BoogieDeclarations]: Found specification of procedure read~int [2022-07-22 23:53:01,611 INFO L130 BoogieDeclarations]: Found specification of procedure state [2022-07-22 23:53:01,611 INFO L138 BoogieDeclarations]: Found implementation of procedure state [2022-07-22 23:53:01,612 INFO L130 BoogieDeclarations]: Found specification of procedure dev_to_hdlc [2022-07-22 23:53:01,612 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_to_hdlc [2022-07-22 23:53:01,612 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_ioctl [2022-07-22 23:53:01,612 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_ioctl [2022-07-22 23:53:01,612 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_rx [2022-07-22 23:53:01,612 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_rx [2022-07-22 23:53:01,612 INFO L130 BoogieDeclarations]: Found specification of procedure debug_lockdep_rcu_enabled [2022-07-22 23:53:01,612 INFO L138 BoogieDeclarations]: Found implementation of procedure debug_lockdep_rcu_enabled [2022-07-22 23:53:01,612 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_type_trans [2022-07-22 23:53:01,613 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_type_trans [2022-07-22 23:53:01,613 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_malloc [2022-07-22 23:53:01,613 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_malloc [2022-07-22 23:53:01,613 INFO L130 BoogieDeclarations]: Found specification of procedure netif_dormant_on [2022-07-22 23:53:01,613 INFO L138 BoogieDeclarations]: Found implementation of procedure netif_dormant_on [2022-07-22 23:53:01,613 INFO L130 BoogieDeclarations]: Found specification of procedure rcu_is_watching [2022-07-22 23:53:01,613 INFO L138 BoogieDeclarations]: Found implementation of procedure rcu_is_watching [2022-07-22 23:53:01,613 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_skb_alloc [2022-07-22 23:53:01,613 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_skb_alloc [2022-07-22 23:53:01,614 INFO L130 BoogieDeclarations]: Found specification of procedure write~int [2022-07-22 23:53:01,614 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_error [2022-07-22 23:53:01,614 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_error [2022-07-22 23:53:01,614 INFO L130 BoogieDeclarations]: Found specification of procedure ldv__builtin_expect [2022-07-22 23:53:01,614 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv__builtin_expect [2022-07-22 23:53:01,614 INFO L130 BoogieDeclarations]: Found specification of procedure assume_abort_if_not [2022-07-22 23:53:01,614 INFO L138 BoogieDeclarations]: Found implementation of procedure assume_abort_if_not [2022-07-22 23:53:01,614 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnHeap [2022-07-22 23:53:01,615 INFO L130 BoogieDeclarations]: Found specification of procedure spinlock_check [2022-07-22 23:53:01,615 INFO L138 BoogieDeclarations]: Found implementation of procedure spinlock_check [2022-07-22 23:53:01,615 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_hard_header [2022-07-22 23:53:01,615 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_hard_header [2022-07-22 23:53:01,615 INFO L130 BoogieDeclarations]: Found specification of procedure dev_kfree_skb_any [2022-07-22 23:53:01,615 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_kfree_skb_any [2022-07-22 23:53:01,615 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocInit [2022-07-22 23:53:01,616 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnStack [2022-07-22 23:53:01,616 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2022-07-22 23:53:01,616 INFO L130 BoogieDeclarations]: Found specification of procedure lockdep_rcu_suspicious [2022-07-22 23:53:01,616 INFO L138 BoogieDeclarations]: Found implementation of procedure lockdep_rcu_suspicious [2022-07-22 23:53:01,616 INFO L130 BoogieDeclarations]: Found specification of procedure __bad_percpu_size [2022-07-22 23:53:01,616 INFO L130 BoogieDeclarations]: Found specification of procedure reg_timer_1 [2022-07-22 23:53:01,616 INFO L138 BoogieDeclarations]: Found implementation of procedure reg_timer_1 [2022-07-22 23:53:01,616 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_to_user [2022-07-22 23:53:01,617 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_to_user [2022-07-22 23:53:01,617 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2022-07-22 23:53:01,617 INFO L130 BoogieDeclarations]: Found specification of procedure add_timer [2022-07-22 23:53:01,617 INFO L138 BoogieDeclarations]: Found implementation of procedure add_timer [2022-07-22 23:53:01,617 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock_irqrestore [2022-07-22 23:53:01,618 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock_irqrestore [2022-07-22 23:53:01,618 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.dealloc [2022-07-22 23:53:01,618 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$ [2022-07-22 23:53:01,619 INFO L130 BoogieDeclarations]: Found specification of procedure might_fault [2022-07-22 23:53:01,619 INFO L138 BoogieDeclarations]: Found implementation of procedure might_fault [2022-07-22 23:53:01,619 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_keepalive_send [2022-07-22 23:53:01,619 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_keepalive_send [2022-07-22 23:53:01,619 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab16 [2022-07-22 23:53:01,620 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab16 [2022-07-22 23:53:01,620 INFO L130 BoogieDeclarations]: Found specification of procedure _raw_spin_lock_irqsave [2022-07-22 23:53:01,620 INFO L138 BoogieDeclarations]: Found implementation of procedure _raw_spin_lock_irqsave [2022-07-22 23:53:01,620 INFO L130 BoogieDeclarations]: Found specification of procedure spin_lock [2022-07-22 23:53:01,620 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_lock [2022-07-22 23:53:01,620 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock [2022-07-22 23:53:01,620 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock [2022-07-22 23:53:01,620 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int [2022-07-22 23:53:01,621 INFO L130 BoogieDeclarations]: Found specification of procedure linkwatch_fire_event [2022-07-22 23:53:01,621 INFO L138 BoogieDeclarations]: Found implementation of procedure linkwatch_fire_event [2022-07-22 23:53:01,621 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~int [2022-07-22 23:53:01,621 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_zalloc [2022-07-22 23:53:01,621 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_zalloc [2022-07-22 23:53:01,621 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_from_user [2022-07-22 23:53:01,621 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_from_user [2022-07-22 23:53:01,622 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2022-07-22 23:53:01,622 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2022-07-22 23:53:01,933 INFO L234 CfgBuilder]: Building ICFG [2022-07-22 23:53:01,934 INFO L260 CfgBuilder]: Building CFG for each procedure with an implementation [2022-07-22 23:53:02,110 INFO L764 $ProcedureCfgBuilder]: dead code at ProgramPoint ldv_stopFINAL: assume true; [2022-07-22 23:53:02,616 INFO L275 CfgBuilder]: Performing block encoding [2022-07-22 23:53:02,629 INFO L294 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2022-07-22 23:53:02,629 INFO L299 CfgBuilder]: Removed 1 assume(true) statements. [2022-07-22 23:53:02,632 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 22.07 11:53:02 BoogieIcfgContainer [2022-07-22 23:53:02,632 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2022-07-22 23:53:02,634 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2022-07-22 23:53:02,635 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2022-07-22 23:53:02,637 INFO L275 PluginConnector]: TraceAbstraction initialized [2022-07-22 23:53:02,637 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 22.07 11:52:59" (1/3) ... [2022-07-22 23:53:02,638 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@49e747f8 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 22.07 11:53:02, skipping insertion in model container [2022-07-22 23:53:02,638 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:01" (2/3) ... [2022-07-22 23:53:02,638 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@49e747f8 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 22.07 11:53:02, skipping insertion in model container [2022-07-22 23:53:02,639 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 22.07 11:53:02" (3/3) ... [2022-07-22 23:53:02,640 INFO L111 eAbstractionObserver]: Analyzing ICFG 205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2022-07-22 23:53:02,649 INFO L201 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2022-07-22 23:53:02,650 INFO L160 ceAbstractionStarter]: Applying trace abstraction to program that has 1 error locations. [2022-07-22 23:53:02,707 INFO L356 AbstractCegarLoop]: ======== Iteration 0 == of CEGAR loop == AllErrorsAtOnce ======== [2022-07-22 23:53:02,712 INFO L357 AbstractCegarLoop]: Settings: SEPARATE_VIOLATION_CHECK=true, mInterprocedural=true, mMaxIterations=1000000, mWatchIteration=1000000, mArtifact=RCFG, mInterpolation=FPandBP, mInterpolantAutomaton=STRAIGHT_LINE, mDumpAutomata=false, mAutomataFormat=ATS_NUMERATE, mDumpPath=., mDeterminiation=PREDICATE_ABSTRACTION, mMinimize=MINIMIZE_SEVPA, mHoare=true, mAutomataTypeConcurrency=PETRI_NET, mHoareTripleChecks=INCREMENTAL, mHoareAnnotationPositions=LoopsAndPotentialCycles, mDumpOnlyReuseAutomata=false, mLimitTraceHistogram=0, mErrorLocTimeLimit=0, mLimitPathProgramCount=0, mCollectInterpolantStatistics=true, mHeuristicEmptinessCheck=false, mHeuristicEmptinessCheckAStarHeuristic=ZERO, mHeuristicEmptinessCheckAStarHeuristicRandomSeed=1337, mHeuristicEmptinessCheckSmtFeatureScoringMethod=DAGSIZE, mSMTFeatureExtraction=false, mSMTFeatureExtractionDumpPath=., mOverrideInterpolantAutomaton=false, mMcrInterpolantMethod=WP, mPorIndependenceSettings=de.uni_freiburg.informatik.ultimate.lib.tracecheckerutils.partialorder.independence.IndependenceSettings@31accf39, mLbeIndependenceSettings=de.uni_freiburg.informatik.ultimate.lib.tracecheckerutils.partialorder.independence.IndependenceSettings@17a9eadd [2022-07-22 23:53:02,712 INFO L358 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2022-07-22 23:53:02,716 INFO L276 IsEmpty]: Start isEmpty. Operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) [2022-07-22 23:53:02,723 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 48 [2022-07-22 23:53:02,723 INFO L187 NwaCegarLoop]: Found error trace [2022-07-22 23:53:02,724 INFO L195 NwaCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-22 23:53:02,724 INFO L420 AbstractCegarLoop]: === Iteration 1 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-22 23:53:02,727 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-22 23:53:02,727 INFO L85 PathProgramCache]: Analyzing trace with hash 742124414, now seen corresponding path program 1 times [2022-07-22 23:53:02,733 INFO L118 FreeRefinementEngine]: Executing refinement strategy CAMEL [2022-07-22 23:53:02,733 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [644805845] [2022-07-22 23:53:02,733 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-22 23:53:02,734 INFO L127 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2022-07-22 23:53:02,839 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:02,949 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2022-07-22 23:53:02,952 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:02,973 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2022-07-22 23:53:02,975 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:02,982 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2022-07-22 23:53:02,983 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:02,989 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2022-07-22 23:53:02,990 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:02,995 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2022-07-22 23:53:02,999 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:03,005 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2022-07-22 23:53:03,005 INFO L136 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2022-07-22 23:53:03,006 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [644805845] [2022-07-22 23:53:03,006 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [644805845] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-22 23:53:03,006 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-22 23:53:03,007 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2022-07-22 23:53:03,008 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1690198195] [2022-07-22 23:53:03,008 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-22 23:53:03,011 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 4 states [2022-07-22 23:53:03,011 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2022-07-22 23:53:03,027 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2022-07-22 23:53:03,028 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2022-07-22 23:53:03,031 INFO L87 Difference]: Start difference. First operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) Second operand has 4 states, 4 states have (on average 6.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-22 23:53:03,975 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-22 23:53:03,976 INFO L93 Difference]: Finished difference Result 1541 states and 2218 transitions. [2022-07-22 23:53:03,977 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2022-07-22 23:53:03,978 INFO L78 Accepts]: Start accepts. Automaton has has 4 states, 4 states have (on average 6.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 47 [2022-07-22 23:53:03,979 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-22 23:53:03,997 INFO L225 Difference]: With dead ends: 1541 [2022-07-22 23:53:03,997 INFO L226 Difference]: Without dead ends: 1042 [2022-07-22 23:53:04,006 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 15 GetRequests, 12 SyntacticMatches, 0 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2022-07-22 23:53:04,014 INFO L413 NwaCegarLoop]: 705 mSDtfsCounter, 1084 mSDsluCounter, 751 mSDsCounter, 0 mSdLazyCounter, 466 mSolverCounterSat, 283 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.7s Time, 0 mProtectedPredicate, 0 mProtectedAction, 1162 SdHoareTripleChecker+Valid, 1456 SdHoareTripleChecker+Invalid, 749 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 283 IncrementalHoareTripleChecker+Valid, 466 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.8s IncrementalHoareTripleChecker+Time [2022-07-22 23:53:04,015 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [1162 Valid, 1456 Invalid, 749 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [283 Valid, 466 Invalid, 0 Unknown, 0 Unchecked, 0.8s Time] [2022-07-22 23:53:04,028 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1042 states. [2022-07-22 23:53:04,104 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1042 to 924. [2022-07-22 23:53:04,106 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 924 states, 685 states have (on average 1.3562043795620438) internal successors, (929), 699 states have internal predecessors, (929), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2022-07-22 23:53:04,117 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 924 states to 924 states and 1284 transitions. [2022-07-22 23:53:04,119 INFO L78 Accepts]: Start accepts. Automaton has 924 states and 1284 transitions. Word has length 47 [2022-07-22 23:53:04,119 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-22 23:53:04,120 INFO L495 AbstractCegarLoop]: Abstraction has 924 states and 1284 transitions. [2022-07-22 23:53:04,120 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 4 states, 4 states have (on average 6.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-22 23:53:04,120 INFO L276 IsEmpty]: Start isEmpty. Operand 924 states and 1284 transitions. [2022-07-22 23:53:04,123 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 51 [2022-07-22 23:53:04,123 INFO L187 NwaCegarLoop]: Found error trace [2022-07-22 23:53:04,123 INFO L195 NwaCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-22 23:53:04,123 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable0 [2022-07-22 23:53:04,124 INFO L420 AbstractCegarLoop]: === Iteration 2 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-22 23:53:04,124 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-22 23:53:04,124 INFO L85 PathProgramCache]: Analyzing trace with hash -2097093995, now seen corresponding path program 1 times [2022-07-22 23:53:04,125 INFO L118 FreeRefinementEngine]: Executing refinement strategy CAMEL [2022-07-22 23:53:04,125 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [1002685822] [2022-07-22 23:53:04,125 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-22 23:53:04,125 INFO L127 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2022-07-22 23:53:04,171 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:04,256 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2022-07-22 23:53:04,258 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:04,262 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2022-07-22 23:53:04,263 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:04,282 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2022-07-22 23:53:04,283 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:04,287 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2022-07-22 23:53:04,288 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:04,292 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2022-07-22 23:53:04,303 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:04,306 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2022-07-22 23:53:04,307 INFO L136 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2022-07-22 23:53:04,307 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [1002685822] [2022-07-22 23:53:04,307 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [1002685822] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-22 23:53:04,307 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-22 23:53:04,308 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [] total 5 [2022-07-22 23:53:04,308 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [687130197] [2022-07-22 23:53:04,308 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-22 23:53:04,309 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2022-07-22 23:53:04,309 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2022-07-22 23:53:04,310 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2022-07-22 23:53:04,310 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2022-07-22 23:53:04,310 INFO L87 Difference]: Start difference. First operand 924 states and 1284 transitions. Second operand has 5 states, 5 states have (on average 5.4) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-22 23:53:05,072 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-22 23:53:05,072 INFO L93 Difference]: Finished difference Result 1951 states and 2732 transitions. [2022-07-22 23:53:05,072 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2022-07-22 23:53:05,073 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 5.4) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 50 [2022-07-22 23:53:05,073 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-22 23:53:05,077 INFO L225 Difference]: With dead ends: 1951 [2022-07-22 23:53:05,078 INFO L226 Difference]: Without dead ends: 1041 [2022-07-22 23:53:05,080 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 18 GetRequests, 13 SyntacticMatches, 0 SemanticMatches, 5 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 1 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=15, Invalid=27, Unknown=0, NotChecked=0, Total=42 [2022-07-22 23:53:05,081 INFO L413 NwaCegarLoop]: 740 mSDtfsCounter, 987 mSDsluCounter, 829 mSDsCounter, 0 mSdLazyCounter, 441 mSolverCounterSat, 246 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.6s Time, 0 mProtectedPredicate, 0 mProtectedAction, 1049 SdHoareTripleChecker+Valid, 1569 SdHoareTripleChecker+Invalid, 687 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 246 IncrementalHoareTripleChecker+Valid, 441 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.7s IncrementalHoareTripleChecker+Time [2022-07-22 23:53:05,081 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [1049 Valid, 1569 Invalid, 687 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [246 Valid, 441 Invalid, 0 Unknown, 0 Unchecked, 0.7s Time] [2022-07-22 23:53:05,083 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1041 states. [2022-07-22 23:53:05,118 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1041 to 923. [2022-07-22 23:53:05,120 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 923 states, 684 states have (on average 1.3523391812865497) internal successors, (925), 698 states have internal predecessors, (925), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2022-07-22 23:53:05,124 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 923 states to 923 states and 1280 transitions. [2022-07-22 23:53:05,125 INFO L78 Accepts]: Start accepts. Automaton has 923 states and 1280 transitions. Word has length 50 [2022-07-22 23:53:05,125 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-22 23:53:05,126 INFO L495 AbstractCegarLoop]: Abstraction has 923 states and 1280 transitions. [2022-07-22 23:53:05,126 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 5.4) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-22 23:53:05,126 INFO L276 IsEmpty]: Start isEmpty. Operand 923 states and 1280 transitions. [2022-07-22 23:53:05,129 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 72 [2022-07-22 23:53:05,130 INFO L187 NwaCegarLoop]: Found error trace [2022-07-22 23:53:05,130 INFO L195 NwaCegarLoop]: trace histogram [7, 7, 7, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-22 23:53:05,130 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable1 [2022-07-22 23:53:05,130 INFO L420 AbstractCegarLoop]: === Iteration 3 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-22 23:53:05,131 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-22 23:53:05,131 INFO L85 PathProgramCache]: Analyzing trace with hash 171125928, now seen corresponding path program 1 times [2022-07-22 23:53:05,131 INFO L118 FreeRefinementEngine]: Executing refinement strategy CAMEL [2022-07-22 23:53:05,131 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [875014905] [2022-07-22 23:53:05,132 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-22 23:53:05,132 INFO L127 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2022-07-22 23:53:05,154 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:05,200 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2022-07-22 23:53:05,202 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:05,205 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2022-07-22 23:53:05,206 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:05,209 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2022-07-22 23:53:05,210 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:05,213 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2022-07-22 23:53:05,214 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:05,216 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2022-07-22 23:53:05,218 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:05,220 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 44 [2022-07-22 23:53:05,222 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:05,226 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 50 [2022-07-22 23:53:05,228 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:05,232 INFO L134 CoverageAnalysis]: Checked inductivity of 89 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 89 trivial. 0 not checked. [2022-07-22 23:53:05,232 INFO L136 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2022-07-22 23:53:05,232 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [875014905] [2022-07-22 23:53:05,232 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [875014905] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-22 23:53:05,232 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-22 23:53:05,233 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [6] imperfect sequences [] total 6 [2022-07-22 23:53:05,233 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [2039459895] [2022-07-22 23:53:05,233 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-22 23:53:05,233 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 6 states [2022-07-22 23:53:05,234 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2022-07-22 23:53:05,234 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 6 interpolants. [2022-07-22 23:53:05,234 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=9, Invalid=21, Unknown=0, NotChecked=0, Total=30 [2022-07-22 23:53:05,234 INFO L87 Difference]: Start difference. First operand 923 states and 1280 transitions. Second operand has 6 states, 6 states have (on average 5.666666666666667) internal successors, (34), 5 states have internal predecessors, (34), 3 states have call successors, (8), 2 states have call predecessors, (8), 1 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2022-07-22 23:53:06,272 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-22 23:53:06,272 INFO L93 Difference]: Finished difference Result 2974 states and 4185 transitions. [2022-07-22 23:53:06,272 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 7 states. [2022-07-22 23:53:06,273 INFO L78 Accepts]: Start accepts. Automaton has has 6 states, 6 states have (on average 5.666666666666667) internal successors, (34), 5 states have internal predecessors, (34), 3 states have call successors, (8), 2 states have call predecessors, (8), 1 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) Word has length 71 [2022-07-22 23:53:06,273 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-22 23:53:06,281 INFO L225 Difference]: With dead ends: 2974 [2022-07-22 23:53:06,281 INFO L226 Difference]: Without dead ends: 2060 [2022-07-22 23:53:06,284 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 23 GetRequests, 16 SyntacticMatches, 0 SemanticMatches, 7 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 2 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=23, Invalid=49, Unknown=0, NotChecked=0, Total=72 [2022-07-22 23:53:06,285 INFO L413 NwaCegarLoop]: 691 mSDtfsCounter, 1091 mSDsluCounter, 1783 mSDsCounter, 0 mSdLazyCounter, 1001 mSolverCounterSat, 270 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.8s Time, 0 mProtectedPredicate, 0 mProtectedAction, 1173 SdHoareTripleChecker+Valid, 2474 SdHoareTripleChecker+Invalid, 1271 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 270 IncrementalHoareTripleChecker+Valid, 1001 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.9s IncrementalHoareTripleChecker+Time [2022-07-22 23:53:06,286 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [1173 Valid, 2474 Invalid, 1271 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [270 Valid, 1001 Invalid, 0 Unknown, 0 Unchecked, 0.9s Time] [2022-07-22 23:53:06,288 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 2060 states. [2022-07-22 23:53:06,336 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 2060 to 1924. [2022-07-22 23:53:06,339 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1924 states, 1437 states have (on average 1.3625608907446067) internal successors, (1958), 1469 states have internal predecessors, (1958), 358 states have call successors, (358), 121 states have call predecessors, (358), 128 states have return successors, (381), 363 states have call predecessors, (381), 357 states have call successors, (381) [2022-07-22 23:53:06,347 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1924 states to 1924 states and 2697 transitions. [2022-07-22 23:53:06,348 INFO L78 Accepts]: Start accepts. Automaton has 1924 states and 2697 transitions. Word has length 71 [2022-07-22 23:53:06,348 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-22 23:53:06,348 INFO L495 AbstractCegarLoop]: Abstraction has 1924 states and 2697 transitions. [2022-07-22 23:53:06,348 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 6 states, 6 states have (on average 5.666666666666667) internal successors, (34), 5 states have internal predecessors, (34), 3 states have call successors, (8), 2 states have call predecessors, (8), 1 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2022-07-22 23:53:06,349 INFO L276 IsEmpty]: Start isEmpty. Operand 1924 states and 2697 transitions. [2022-07-22 23:53:06,354 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 142 [2022-07-22 23:53:06,355 INFO L187 NwaCegarLoop]: Found error trace [2022-07-22 23:53:06,355 INFO L195 NwaCegarLoop]: trace histogram [8, 8, 8, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-22 23:53:06,355 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable2 [2022-07-22 23:53:06,355 INFO L420 AbstractCegarLoop]: === Iteration 4 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-22 23:53:06,356 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-22 23:53:06,356 INFO L85 PathProgramCache]: Analyzing trace with hash 1729160309, now seen corresponding path program 1 times [2022-07-22 23:53:06,356 INFO L118 FreeRefinementEngine]: Executing refinement strategy CAMEL [2022-07-22 23:53:06,356 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [2027767372] [2022-07-22 23:53:06,356 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-22 23:53:06,357 INFO L127 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2022-07-22 23:53:06,386 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:06,446 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2022-07-22 23:53:06,448 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:06,452 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2022-07-22 23:53:06,454 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:06,460 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2022-07-22 23:53:06,461 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:06,465 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2022-07-22 23:53:06,466 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:06,472 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2022-07-22 23:53:06,473 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:06,476 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 37 [2022-07-22 23:53:06,477 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:06,482 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 43 [2022-07-22 23:53:06,483 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:06,486 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 48 [2022-07-22 23:53:06,487 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:06,489 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 57 [2022-07-22 23:53:06,490 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:06,493 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 63 [2022-07-22 23:53:06,494 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:06,504 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 69 [2022-07-22 23:53:06,517 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:06,523 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2022-07-22 23:53:06,529 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:06,578 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2022-07-22 23:53:06,581 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:06,622 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 91 [2022-07-22 23:53:06,623 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:06,626 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 97 [2022-07-22 23:53:06,627 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:06,629 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 114 [2022-07-22 23:53:06,667 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:06,669 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 120 [2022-07-22 23:53:06,670 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:06,673 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 14 proven. 4 refuted. 0 times theorem prover too weak. 107 trivial. 0 not checked. [2022-07-22 23:53:06,673 INFO L136 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2022-07-22 23:53:06,673 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [2027767372] [2022-07-22 23:53:06,673 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [2027767372] provided 0 perfect and 1 imperfect interpolant sequences [2022-07-22 23:53:06,673 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleZ3 [526757755] [2022-07-22 23:53:06,674 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-22 23:53:06,674 INFO L173 SolverBuilder]: Constructing external solver with command: z3 -smt2 -in SMTLIB2_COMPLIANT=true [2022-07-22 23:53:06,674 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 [2022-07-22 23:53:06,684 INFO L229 MonitoredProcess]: Starting monitored process 2 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true (exit command is (exit), workingDir is null) [2022-07-22 23:53:06,703 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true (2)] Waiting until timeout for monitored process [2022-07-22 23:53:06,965 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:06,969 INFO L263 TraceCheckSpWp]: Trace formula consists of 961 conjuncts, 17 conjunts are in the unsatisfiable core [2022-07-22 23:53:06,976 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2022-07-22 23:53:07,063 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 62 proven. 0 refuted. 0 times theorem prover too weak. 63 trivial. 0 not checked. [2022-07-22 23:53:07,064 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2022-07-22 23:53:07,064 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleZ3 [526757755] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-22 23:53:07,064 INFO L184 FreeRefinementEngine]: Found 1 perfect and 1 imperfect interpolant sequences. [2022-07-22 23:53:07,064 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [7] total 7 [2022-07-22 23:53:07,065 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [458553307] [2022-07-22 23:53:07,065 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-22 23:53:07,065 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2022-07-22 23:53:07,065 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2022-07-22 23:53:07,066 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2022-07-22 23:53:07,066 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=12, Invalid=30, Unknown=0, NotChecked=0, Total=42 [2022-07-22 23:53:07,066 INFO L87 Difference]: Start difference. First operand 1924 states and 2697 transitions. Second operand has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2022-07-22 23:53:07,152 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-22 23:53:07,152 INFO L93 Difference]: Finished difference Result 3838 states and 5422 transitions. [2022-07-22 23:53:07,152 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2022-07-22 23:53:07,153 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) Word has length 141 [2022-07-22 23:53:07,153 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-22 23:53:07,159 INFO L225 Difference]: With dead ends: 3838 [2022-07-22 23:53:07,160 INFO L226 Difference]: Without dead ends: 1928 [2022-07-22 23:53:07,166 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 181 GetRequests, 173 SyntacticMatches, 3 SemanticMatches, 5 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 6 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=12, Invalid=30, Unknown=0, NotChecked=0, Total=42 [2022-07-22 23:53:07,170 INFO L413 NwaCegarLoop]: 658 mSDtfsCounter, 2 mSDsluCounter, 1961 mSDsCounter, 0 mSdLazyCounter, 19 mSolverCounterSat, 1 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.0s Time, 0 mProtectedPredicate, 0 mProtectedAction, 2 SdHoareTripleChecker+Valid, 2619 SdHoareTripleChecker+Invalid, 20 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 1 IncrementalHoareTripleChecker+Valid, 19 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.0s IncrementalHoareTripleChecker+Time [2022-07-22 23:53:07,171 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [2 Valid, 2619 Invalid, 20 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [1 Valid, 19 Invalid, 0 Unknown, 0 Unchecked, 0.0s Time] [2022-07-22 23:53:07,174 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1928 states. [2022-07-22 23:53:07,216 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1928 to 1924. [2022-07-22 23:53:07,219 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1924 states, 1433 states have (on average 1.357990230286113) internal successors, (1946), 1467 states have internal predecessors, (1946), 358 states have call successors, (358), 121 states have call predecessors, (358), 132 states have return successors, (392), 365 states have call predecessors, (392), 357 states have call successors, (392) [2022-07-22 23:53:07,226 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1924 states to 1924 states and 2696 transitions. [2022-07-22 23:53:07,227 INFO L78 Accepts]: Start accepts. Automaton has 1924 states and 2696 transitions. Word has length 141 [2022-07-22 23:53:07,228 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-22 23:53:07,228 INFO L495 AbstractCegarLoop]: Abstraction has 1924 states and 2696 transitions. [2022-07-22 23:53:07,228 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2022-07-22 23:53:07,228 INFO L276 IsEmpty]: Start isEmpty. Operand 1924 states and 2696 transitions. [2022-07-22 23:53:07,234 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 149 [2022-07-22 23:53:07,234 INFO L187 NwaCegarLoop]: Found error trace [2022-07-22 23:53:07,234 INFO L195 NwaCegarLoop]: trace histogram [8, 8, 7, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-22 23:53:07,256 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true (2)] Forceful destruction successful, exit code 0 [2022-07-22 23:53:07,455 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable3,2 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true [2022-07-22 23:53:07,456 INFO L420 AbstractCegarLoop]: === Iteration 5 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-22 23:53:07,456 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-22 23:53:07,456 INFO L85 PathProgramCache]: Analyzing trace with hash 568539780, now seen corresponding path program 1 times [2022-07-22 23:53:07,456 INFO L118 FreeRefinementEngine]: Executing refinement strategy CAMEL [2022-07-22 23:53:07,456 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [1442258083] [2022-07-22 23:53:07,456 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-22 23:53:07,456 INFO L127 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2022-07-22 23:53:07,563 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:07,596 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2022-07-22 23:53:07,597 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:07,600 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2022-07-22 23:53:07,600 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:07,602 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2022-07-22 23:53:07,603 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:07,605 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2022-07-22 23:53:07,606 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:07,608 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2022-07-22 23:53:07,609 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:07,611 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 44 [2022-07-22 23:53:07,611 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:07,613 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 50 [2022-07-22 23:53:07,614 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:07,616 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 61 [2022-07-22 23:53:07,617 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:07,618 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 67 [2022-07-22 23:53:07,619 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:07,621 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 72 [2022-07-22 23:53:07,621 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:07,623 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 81 [2022-07-22 23:53:07,624 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:07,625 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 87 [2022-07-22 23:53:07,626 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:07,636 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 93 [2022-07-22 23:53:07,645 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:07,712 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2022-07-22 23:53:07,721 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:07,805 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2022-07-22 23:53:07,822 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:07,925 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 3 [2022-07-22 23:53:07,928 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:07,959 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 122 [2022-07-22 23:53:07,960 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:07,963 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 128 [2022-07-22 23:53:07,965 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:07,968 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 104 trivial. 0 not checked. [2022-07-22 23:53:07,968 INFO L136 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2022-07-22 23:53:07,968 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [1442258083] [2022-07-22 23:53:07,968 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [1442258083] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-22 23:53:07,969 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-22 23:53:07,969 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [16] imperfect sequences [] total 16 [2022-07-22 23:53:07,969 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1242680795] [2022-07-22 23:53:07,969 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-22 23:53:07,969 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 16 states [2022-07-22 23:53:07,970 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2022-07-22 23:53:07,970 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 16 interpolants. [2022-07-22 23:53:07,970 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=31, Invalid=209, Unknown=0, NotChecked=0, Total=240 [2022-07-22 23:53:07,970 INFO L87 Difference]: Start difference. First operand 1924 states and 2696 transitions. Second operand has 16 states, 15 states have (on average 5.866666666666666) internal successors, (88), 11 states have internal predecessors, (88), 3 states have call successors, (19), 4 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 3 states have call successors, (18) [2022-07-22 23:53:10,101 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-22 23:53:10,101 INFO L93 Difference]: Finished difference Result 3994 states and 5630 transitions. [2022-07-22 23:53:10,102 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 15 states. [2022-07-22 23:53:10,102 INFO L78 Accepts]: Start accepts. Automaton has has 16 states, 15 states have (on average 5.866666666666666) internal successors, (88), 11 states have internal predecessors, (88), 3 states have call successors, (19), 4 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 3 states have call successors, (18) Word has length 148 [2022-07-22 23:53:10,103 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-22 23:53:10,113 INFO L225 Difference]: With dead ends: 3994 [2022-07-22 23:53:10,113 INFO L226 Difference]: Without dead ends: 2084 [2022-07-22 23:53:10,120 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 58 GetRequests, 37 SyntacticMatches, 0 SemanticMatches, 21 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 41 ImplicationChecksByTransitivity, 0.3s TimeCoverageRelationStatistics Valid=69, Invalid=437, Unknown=0, NotChecked=0, Total=506 [2022-07-22 23:53:10,121 INFO L413 NwaCegarLoop]: 620 mSDtfsCounter, 511 mSDsluCounter, 5439 mSDsCounter, 0 mSdLazyCounter, 2558 mSolverCounterSat, 228 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 1.6s Time, 0 mProtectedPredicate, 0 mProtectedAction, 532 SdHoareTripleChecker+Valid, 6059 SdHoareTripleChecker+Invalid, 2786 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 228 IncrementalHoareTripleChecker+Valid, 2558 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 1.8s IncrementalHoareTripleChecker+Time [2022-07-22 23:53:10,121 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [532 Valid, 6059 Invalid, 2786 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [228 Valid, 2558 Invalid, 0 Unknown, 0 Unchecked, 1.8s Time] [2022-07-22 23:53:10,123 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 2084 states. [2022-07-22 23:53:10,185 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 2084 to 1954. [2022-07-22 23:53:10,188 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1954 states, 1455 states have (on average 1.3484536082474228) internal successors, (1962), 1489 states have internal predecessors, (1962), 364 states have call successors, (364), 121 states have call predecessors, (364), 134 states have return successors, (402), 373 states have call predecessors, (402), 363 states have call successors, (402) [2022-07-22 23:53:10,193 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1954 states to 1954 states and 2728 transitions. [2022-07-22 23:53:10,194 INFO L78 Accepts]: Start accepts. Automaton has 1954 states and 2728 transitions. Word has length 148 [2022-07-22 23:53:10,196 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-22 23:53:10,196 INFO L495 AbstractCegarLoop]: Abstraction has 1954 states and 2728 transitions. [2022-07-22 23:53:10,196 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 16 states, 15 states have (on average 5.866666666666666) internal successors, (88), 11 states have internal predecessors, (88), 3 states have call successors, (19), 4 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 3 states have call successors, (18) [2022-07-22 23:53:10,197 INFO L276 IsEmpty]: Start isEmpty. Operand 1954 states and 2728 transitions. [2022-07-22 23:53:10,202 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 184 [2022-07-22 23:53:10,203 INFO L187 NwaCegarLoop]: Found error trace [2022-07-22 23:53:10,203 INFO L195 NwaCegarLoop]: trace histogram [8, 8, 7, 4, 4, 4, 3, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-22 23:53:10,203 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable4 [2022-07-22 23:53:10,205 INFO L420 AbstractCegarLoop]: === Iteration 6 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-22 23:53:10,205 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-22 23:53:10,205 INFO L85 PathProgramCache]: Analyzing trace with hash -799997024, now seen corresponding path program 1 times [2022-07-22 23:53:10,206 INFO L118 FreeRefinementEngine]: Executing refinement strategy CAMEL [2022-07-22 23:53:10,206 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [323764485] [2022-07-22 23:53:10,206 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-22 23:53:10,206 INFO L127 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2022-07-22 23:53:10,756 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2022-07-22 23:53:10,757 INFO L352 TraceCheck]: Trace is feasible, we will do another trace check, this time with branch encoders. [2022-07-22 23:53:11,004 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2022-07-22 23:53:11,099 INFO L130 FreeRefinementEngine]: Strategy CAMEL found a feasible trace [2022-07-22 23:53:11,100 INFO L271 BasicCegarLoop]: Counterexample is feasible [2022-07-22 23:53:11,100 INFO L805 garLoopResultBuilder]: Registering result UNSAFE for location ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION (0 of 1 remaining) [2022-07-22 23:53:11,102 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable5 [2022-07-22 23:53:11,104 INFO L356 BasicCegarLoop]: Path program histogram: [1, 1, 1, 1, 1, 1] [2022-07-22 23:53:11,110 INFO L176 ceAbstractionStarter]: Computing trace abstraction results [2022-07-22 23:53:11,151 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:11,152 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:11,152 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:11,152 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:11,152 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:11,153 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:11,153 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:11,153 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:11,153 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:11,153 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:11,281 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 22.07 11:53:11 BoogieIcfgContainer [2022-07-22 23:53:11,281 INFO L132 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2022-07-22 23:53:11,282 INFO L113 PluginConnector]: ------------------------Witness Printer---------------------------- [2022-07-22 23:53:11,282 INFO L271 PluginConnector]: Initializing Witness Printer... [2022-07-22 23:53:11,282 INFO L275 PluginConnector]: Witness Printer initialized [2022-07-22 23:53:11,283 INFO L185 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 22.07 11:53:02" (3/4) ... [2022-07-22 23:53:11,285 INFO L140 WitnessPrinter]: No result that supports witness generation found [2022-07-22 23:53:11,285 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2022-07-22 23:53:11,286 INFO L158 Benchmark]: Toolchain (without parser) took 11426.34ms. Allocated memory was 96.5MB in the beginning and 327.2MB in the end (delta: 230.7MB). Free memory was 57.8MB in the beginning and 187.1MB in the end (delta: -129.3MB). Peak memory consumption was 101.1MB. Max. memory is 16.1GB. [2022-07-22 23:53:11,286 INFO L158 Benchmark]: CDTParser took 0.25ms. Allocated memory is still 96.5MB. Free memory is still 53.3MB. There was no memory consumed. Max. memory is 16.1GB. [2022-07-22 23:53:11,286 INFO L158 Benchmark]: CACSL2BoogieTranslator took 1449.65ms. Allocated memory was 96.5MB in the beginning and 117.4MB in the end (delta: 21.0MB). Free memory was 57.6MB in the beginning and 55.7MB in the end (delta: 1.8MB). Peak memory consumption was 41.1MB. Max. memory is 16.1GB. [2022-07-22 23:53:11,287 INFO L158 Benchmark]: Boogie Procedure Inliner took 115.60ms. Allocated memory is still 117.4MB. Free memory was 55.7MB in the beginning and 47.4MB in the end (delta: 8.4MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. [2022-07-22 23:53:11,287 INFO L158 Benchmark]: Boogie Preprocessor took 108.45ms. Allocated memory is still 117.4MB. Free memory was 47.4MB in the beginning and 63.7MB in the end (delta: -16.3MB). Peak memory consumption was 11.0MB. Max. memory is 16.1GB. [2022-07-22 23:53:11,287 INFO L158 Benchmark]: RCFGBuilder took 1094.90ms. Allocated memory was 117.4MB in the beginning and 188.7MB in the end (delta: 71.3MB). Free memory was 63.7MB in the beginning and 130.0MB in the end (delta: -66.3MB). Peak memory consumption was 55.8MB. Max. memory is 16.1GB. [2022-07-22 23:53:11,288 INFO L158 Benchmark]: TraceAbstraction took 8646.80ms. Allocated memory was 188.7MB in the beginning and 327.2MB in the end (delta: 138.4MB). Free memory was 129.0MB in the beginning and 187.1MB in the end (delta: -58.2MB). Peak memory consumption was 197.8MB. Max. memory is 16.1GB. [2022-07-22 23:53:11,288 INFO L158 Benchmark]: Witness Printer took 3.58ms. Allocated memory is still 327.2MB. Free memory is still 187.1MB. There was no memory consumed. Max. memory is 16.1GB. [2022-07-22 23:53:11,290 INFO L339 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.25ms. Allocated memory is still 96.5MB. Free memory is still 53.3MB. There was no memory consumed. Max. memory is 16.1GB. * CACSL2BoogieTranslator took 1449.65ms. Allocated memory was 96.5MB in the beginning and 117.4MB in the end (delta: 21.0MB). Free memory was 57.6MB in the beginning and 55.7MB in the end (delta: 1.8MB). Peak memory consumption was 41.1MB. Max. memory is 16.1GB. * Boogie Procedure Inliner took 115.60ms. Allocated memory is still 117.4MB. Free memory was 55.7MB in the beginning and 47.4MB in the end (delta: 8.4MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. * Boogie Preprocessor took 108.45ms. Allocated memory is still 117.4MB. Free memory was 47.4MB in the beginning and 63.7MB in the end (delta: -16.3MB). Peak memory consumption was 11.0MB. Max. memory is 16.1GB. * RCFGBuilder took 1094.90ms. Allocated memory was 117.4MB in the beginning and 188.7MB in the end (delta: 71.3MB). Free memory was 63.7MB in the beginning and 130.0MB in the end (delta: -66.3MB). Peak memory consumption was 55.8MB. Max. memory is 16.1GB. * TraceAbstraction took 8646.80ms. Allocated memory was 188.7MB in the beginning and 327.2MB in the end (delta: 138.4MB). Free memory was 129.0MB in the beginning and 187.1MB in the end (delta: -58.2MB). Peak memory consumption was 197.8MB. Max. memory is 16.1GB. * Witness Printer took 3.58ms. Allocated memory is still 327.2MB. Free memory is still 187.1MB. There was no memory consumed. Max. memory is 16.1GB. * Results from de.uni_freiburg.informatik.ultimate.boogie.preprocessor: - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: - GenericResult: Unfinished Backtranslation The program execution was not completely translated back. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - StatisticsResult: ErrorAutomatonStatistics NumberErrorTraces: 0, NumberStatementsAllTraces: 0, NumberRelevantStatements: 0, 0.0s ErrorAutomatonConstructionTimeTotal, 0.0s FaulLocalizationTime, NumberStatementsFirstTrace: -1, TraceLengthAvg: 0, 0.0s ErrorAutomatonConstructionTimeAvg, 0.0s ErrorAutomatonDifferenceTimeAvg, 0.0s ErrorAutomatonDifferenceTimeTotal, NumberOfNoEnhancement: 0, NumberOfFiniteEnhancement: 0, NumberOfInfiniteEnhancement: 0 - UnprovableResult [Line: 5554]: Unable to prove that call to reach_error is unreachable Unable to prove that call to reach_error is unreachable Reason: overapproximation of bitwiseOr at line 5123. Possible FailurePath: [L5577] int LDV_IN_INTERRUPT = 1; [L5578] struct sk_buff *proto_group1 ; [L5579] int ldv_state_variable_0 ; [L5580] int ldv_state_variable_3 ; [L5581] int ldv_timer_state_1 = 0; [L5582] int ldv_state_variable_2 ; [L5583] struct net_device *proto_group0 ; [L5584] int ref_cnt ; [L5585] int ldv_state_variable_1 ; [L5586] struct timer_list *ldv_timer_list_1 ; [L5964-L5966] static struct hdlc_proto proto = {0, 0, & cisco_start, & cisco_stop, 0, & cisco_ioctl, & cisco_type_trans, & cisco_rx, 0, & __this_module, 0}; [L5967] static struct header_ops const cisco_header_ops = {& cisco_hard_header, 0, 0, 0, 0}; [L6078] int ldv_retval_0 ; [L6374] Element set_impl[15] ; [L6375] int last_index = 0; [L6509] Set LDV_SKBS ; VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6142] struct ifreq *ldvarg0 ; [L6143] void *tmp ; [L6144] unsigned int ldvarg1 ; [L6145] unsigned int tmp___0 ; [L6146] unsigned short ldvarg4 ; [L6147] unsigned short tmp___1 ; [L6148] struct sk_buff *ldvarg3 ; [L6149] void *tmp___2 ; [L6150] struct net_device *ldvarg5 ; [L6151] void *tmp___3 ; [L6152] void *ldvarg2 ; [L6153] void *tmp___4 ; [L6154] void *ldvarg6 ; [L6155] void *tmp___5 ; [L6156] int tmp___6 ; [L6157] int tmp___7 ; [L6158] int tmp___8 ; [L6159] int tmp___9 ; VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6161] CALL, EXPR ldv_zalloc(40UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=40, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=40, tmp___0=-2] [L6161] RET, EXPR ldv_zalloc(40UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(40UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6161] tmp = ldv_zalloc(40UL) [L6162] ldvarg0 = (struct ifreq *)tmp [L6163] tmp___0 = __VERIFIER_nondet_uint() [L6164] ldvarg1 = tmp___0 [L6165] tmp___1 = __VERIFIER_nondet_ushort() [L6166] ldvarg4 = tmp___1 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg4=48351, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351] [L6167] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=232, tmp___0=-3] [L6167] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg4=48351, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351] [L6167] tmp___2 = ldv_zalloc(232UL) [L6168] ldvarg3 = (struct sk_buff *)tmp___2 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg3={0:0}, ldvarg4=48351, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}] [L6169] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=3264, tmp___0=-5] [L6169] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg3={0:0}, ldvarg4=48351, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}] [L6169] tmp___3 = ldv_zalloc(3264UL) [L6170] ldvarg5 = (struct net_device *)tmp___3 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}] [L6171] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=-6] [L6171] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}] [L6171] tmp___4 = ldv_zalloc(1UL) [L6172] ldvarg2 = tmp___4 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=-8] [L6173] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] tmp___5 = ldv_zalloc(1UL) [L6174] ldvarg6 = tmp___5 [L6175] CALL ldv_initialize() [L6528] CALL ldv_set_init(LDV_SKBS) [L6380] set = set_impl [L6381] last_index = 0 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={18:0}, set={0:0}, set_impl={18:0}] [L6528] RET ldv_set_init(LDV_SKBS) [L6175] RET ldv_initialize() [L6176] ldv_state_variable_1 = 1 [L6177] ref_cnt = 0 [L6178] ldv_state_variable_0 = 1 [L6179] ldv_state_variable_3 = 0 [L6180] ldv_state_variable_2 = 0 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: [L6202] case 1: VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6203] COND TRUE ldv_state_variable_0 == 1 [L6204] CALL, EXPR mod_init() [L6067] FCALL register_hdlc_protocol(& proto) [L6068] return (0); VAL [\result=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6204] RET, EXPR mod_init() [L6204] ldv_retval_0 = mod_init() [L6205] COND TRUE ldv_retval_0 == 0 [L6206] ldv_state_variable_0 = 3 [L6207] ldv_state_variable_2 = 1 [L6208] ldv_state_variable_3 = 1 [L6209] CALL ldv_initialize_hdlc_proto_3() [L6101] void *tmp ; [L6102] void *tmp___0 ; VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6104] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=232, tmp___0=-9] [L6104] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6104] tmp = ldv_zalloc(232UL) [L6105] proto_group1 = (struct sk_buff *)tmp VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L6106] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=3264, tmp___0=-10] [L6106] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L6106] tmp___0 = ldv_zalloc(3264UL) [L6107] proto_group0 = (struct net_device *)tmp___0 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0={0:0}] [L6209] RET ldv_initialize_hdlc_proto_3() [L6212] COND FALSE !(ldv_retval_0 != 0) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=0, tmp___7=1] [L6185] COND TRUE ldv_state_variable_1 != 0 [L6186] CALL choose_timer_1(ldv_timer_list_1) [L6114] LDV_IN_INTERRUPT = 2 [L6115] EXPR timer->data [L6115] EXPR timer->function [L6115] CALL (*(timer->function))(timer->data) [L5877] struct net_device *dev ; [L5878] hdlc_device *hdlc ; [L5879] struct hdlc_device *tmp ; [L5880] struct cisco_state *st ; [L5881] struct cisco_state *tmp___0 ; [L5882] __u32 tmp___1 ; [L5883] __u32 tmp___2 ; [L5885] dev = (struct net_device *)arg VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5886] CALL, EXPR dev_to_hdlc(dev) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5638] void *tmp ; [L5640] CALL, EXPR netdev_priv((struct net_device const *)dev) [L5595] return ((void *)dev + 3264U); VAL [\result={0:21}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, dev={0:-3243}, dev={0:-3243}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5640] RET, EXPR netdev_priv((struct net_device const *)dev) [L5640] tmp = netdev_priv((struct net_device const *)dev) [L5641] return ((struct hdlc_device *)tmp); VAL [\result={0:21}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, dev={0:-3243}, dev={0:-3243}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:21}] [L5886] RET, EXPR dev_to_hdlc(dev) VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, dev_to_hdlc(dev)={0:21}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5886] tmp = dev_to_hdlc(dev) [L5887] hdlc = tmp VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:21}] [L5888] CALL, EXPR state(hdlc) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, hdlc={0:21}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5670] EXPR hdlc->state [L5670] return ((struct cisco_state *)hdlc->state); [L5888] RET, EXPR state(hdlc) VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, state(hdlc)={18:-212}, tmp={0:21}] [L5888] tmp___0 = state(hdlc) [L5889] st = tmp___0 VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, tmp={0:21}, tmp___0={18:-212}] [L5890] CALL spin_lock(& st->lock) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5263] FCALL _raw_spin_lock(& lock->ldv_6338.rlock) [L5890] RET spin_lock(& st->lock) VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, tmp={0:21}, tmp___0={18:-212}] [L5891] EXPR st->up [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L [L5891] EXPR st->last_poll [L5891] EXPR st->settings.timeout [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, st->last_poll=1383413571807847823359175, st->settings.timeout=31, st->up=1383413571807847823359185, st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L=0, tmp={0:21}, tmp___0={18:-212}] [L5891] COND FALSE !(st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L) [L5897] EXPR st->rxseq VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, st->rxseq=19, tmp={0:21}, tmp___0={18:-212}] [L5897] CALL, EXPR __fswab32(st->rxseq) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=19, \result=19, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=19] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=19, \result=19, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=19, val=19] [L5897] RET, EXPR __fswab32(st->rxseq) VAL [\old(arg)=18446744073709548373, __fswab32(st->rxseq)=19, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, st->rxseq=19, tmp={0:21}, tmp___0={18:-212}] [L5897] tmp___1 = __fswab32(st->rxseq) [L5898] EXPR st->txseq [L5898] st->txseq = st->txseq + 1U [L5899] EXPR st->txseq VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, st->txseq=-15, tmp={0:21}, tmp___0={18:-212}, tmp___1=19] [L5899] CALL, EXPR __fswab32(st->txseq) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=-15, \result=-15, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=-15] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=-15, \result=-15, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=4294967281, val=-15] [L5899] RET, EXPR __fswab32(st->txseq) VAL [\old(arg)=18446744073709548373, __fswab32(st->txseq)=-15, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, st->txseq=-15, tmp={0:21}, tmp___0={18:-212}, tmp___1=19] [L5899] tmp___2 = __fswab32(st->txseq) [L5900] CALL cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5695] struct sk_buff *skb ; [L5696] struct cisco_packet *data ; [L5697] __u32 tmp ; [L5698] __u32 tmp___0 ; [L5700] CALL, EXPR ldv_dev_alloc_skb_12(22U) [L6356] struct sk_buff *tmp ; VAL [\old(last_index)=0, \old(length)=22, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6358] CALL, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6512] void *skb ; [L6513] void *tmp___7 ; VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6515] CALL, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND FALSE !(tmp___0 != 0) [L5527] EXPR, FCALL calloc(1UL, size) [L5527] tmp = calloc(1UL, size) [L5528] p = tmp VAL [\old(last_index)=0, \old(size)=248, __this_module={1383413571807847823359192:1383413571807847823359210}, calloc(1UL, size)={-1:0}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={-1:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={-1:0}, tmp___0=0] [L5529] CALL assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(cond)=1, \old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5498] COND FALSE !(!cond) VAL [\old(cond)=1, \old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, cond=1, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5529] RET assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(last_index)=0, \old(size)=248, __this_module={1383413571807847823359192:1383413571807847823359210}, calloc(1UL, size)={-1:0}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={-1:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={-1:0}, tmp___0=0] [L5530] return (p); VAL [\old(last_index)=0, \old(size)=248, \result={-1:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, calloc(1UL, size)={-1:0}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={-1:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={-1:0}, tmp___0=0] [L6515] RET, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(sizeof(struct sk_buff___0 ))={-1:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6515] tmp___7 = ldv_zalloc(sizeof(struct sk_buff___0 )) [L6516] skb = (struct sk_buff___0 *)tmp___7 VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-1:0}, tmp___7={-1:0}] [L6517] COND FALSE !(! skb) [L6520] CALL ldv_set_add(LDV_SKBS, skb) [L6388] int i ; [L6390] i = 0 VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, e={-1:0}, e={-1:0}, i=0, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6391] COND TRUE 1 VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, e={-1:0}, e={-1:0}, i=0, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6392] COND FALSE !(i < last_index) VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, e={-1:0}, e={-1:0}, i=0, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6402] COND TRUE last_index < 15 [L6403] set_impl[last_index] = e [L6404] last_index = last_index + 1 VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, e={-1:0}, e={-1:0}, i=0, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6520] RET ldv_set_add(LDV_SKBS, skb) [L6521] return (skb); VAL [\old(last_index)=0, \result={-1:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-1:0}, tmp___7={-1:0}] [L6358] RET, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, \old(length)=22, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, ldv_skb_alloc()={-1:0}, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6358] tmp = ldv_skb_alloc() [L6359] return (tmp); VAL [\old(last_index)=0, \old(length)=22, \result={-1:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={-1:0}] [L5700] RET, EXPR ldv_dev_alloc_skb_12(22U) [L5700] skb = ldv_dev_alloc_skb_12(22U) [L5701] COND FALSE !((unsigned long )skb == (unsigned long )((struct sk_buff *)0)) [L5706] CALL skb_reserve(skb, 4) [L5475] EXPR skb->data [L5475] skb->data = skb->data + (unsigned long )len [L5476] EXPR skb->tail [L5476] skb->tail = skb->tail + (sk_buff_data_t )len [L5706] RET skb_reserve(skb, 4) [L5707] CALL cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5676] struct hdlc_header *data ; [L5677] __u16 tmp ; [L5679] CALL skb_push(skb, 4U) [L6687] CALL, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(last_index)=0, \old(size)=1, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5502] void *p ; [L5503] void *tmp ; [L5504] int tmp___0 ; [L5506] tmp___0 = __VERIFIER_nondet_int() [L5507] COND TRUE tmp___0 != 0 [L5508] return ((void *)0); VAL [\old(last_index)=0, \old(size)=1, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=-14] [L6687] RET, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(arg1)=4, \old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, arg0={-1:0}, arg0={-1:0}, arg1=4, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_malloc(sizeof(unsigned char))={0:0}, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6687] return ldv_malloc(sizeof(unsigned char)); [L5679] RET skb_push(skb, 4U) [L5680] EXPR skb->data [L5680] data = (struct hdlc_header *)skb->data [L5681] COND TRUE (unsigned int )type == 32821U [L5682] data->address = 143U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={-1:136}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-1:0}, skb={-1:0}, type=32821] [L5686] data->control = 0U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={-1:136}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-1:0}, skb={-1:0}, type=32821] [L5687] CALL, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(val)=32821, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5123] return ((__u16 )((int )((short )((int )val << 8)) | (int )((short )((int )val >> 8)))); VAL [\old(last_index)=0, \old(val)=32821, \result=128, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=32821] [L5687] RET, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __fswab16((int )type)=128, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={-1:136}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-1:0}, skb={-1:0}, type=32821] [L5687] tmp = __fswab16((int )type) [L5688] data->protocol = tmp [L5689] return (4); VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, \result=4, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={-1:136}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-1:0}, skb={-1:0}, tmp=128, type=32821] [L5707] RET cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, \old(par1)=4294967281, \old(par2)=19, \old(type)=2, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U)=4, cisco_header_ops={17:0}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967281, par2=19, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-1:0}, type=2] [L5708] EXPR skb->data [L5708] data = (struct cisco_packet *)skb->data + 4U [L5709] CALL, EXPR __fswab32(type) VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=2] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=2, val=2] [L5709] RET, EXPR __fswab32(type) VAL [\old(last_index)=0, \old(par1)=4294967281, \old(par2)=19, \old(type)=2, __fswab32(type)=2, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, data={-1:208}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967281, par2=19, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-1:0}, type=2] [L5709] tmp = __fswab32(type) [L5710] data->type = tmp [L5711] data->par1 = par1 [L5712] data->par2 = par2 [L5713] data->rel = 65535U VAL [\old(last_index)=0, \old(par1)=4294967281, \old(par2)=19, \old(type)=2, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, data={-1:208}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967281, par2=19, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-1:0}, tmp=2, type=2] [L5714] CALL, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=20, \result=20, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=20] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=20, \result=20, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=20, val=20] [L5714] RET, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, \old(par1)=4294967281, \old(par2)=19, \old(type)=2, __fswab32(((__u32 )jiffies + 75000U) * 4U)=20, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, data={-1:208}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967281, par2=19, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-1:0}, tmp=2, type=2] [L5714] tmp___0 = __fswab32(((__u32 )jiffies + 75000U) * 4U) [L5715] data->time = tmp___0 [L5716] CALL skb_put(skb, 18U) [L6690] EXPR arg0->data [L6690] EXPR arg0->tail [L6690] unsigned char *ret_val = arg0->data + arg0->tail; [L6691] EXPR arg0->tail [L6691] arg0->tail += arg1 [L6692] return ret_val; VAL [\old(arg1)=18, \old(last_index)=0, \result={-1:155}, __this_module={1383413571807847823359192:1383413571807847823359210}, arg0={-1:0}, arg0={-1:0}, arg1=18, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, ret_val={-1:155}, set_impl={18:0}] [L5716] RET skb_put(skb, 18U) [L5717] skb->priority = 7U [L5718] skb->dev = dev [L5719] CALL skb_reset_network_header(skb) [L5483] EXPR skb->data [L5483] EXPR skb->head [L5483] skb->network_header = (int )((__u16 )((long )skb->data)) - (int )((__u16 )((long )skb->head)) [L5719] RET skb_reset_network_header(skb) [L5720] CALL dev_queue_xmit(skb) [L6643] return __VERIFIER_nondet_int(); [L5720] RET dev_queue_xmit(skb) [L5900] RET cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, tmp={0:21}, tmp___0={18:-212}, tmp___1=19, tmp___2=4294967281] [L5901] CALL spin_unlock(& st->lock) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5270] FCALL _raw_spin_unlock(& lock->ldv_6338.rlock) [L5901] RET spin_unlock(& st->lock) VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, tmp={0:21}, tmp___0={18:-212}, tmp___1=19, tmp___2=4294967281] [L5902] EXPR st->settings.interval [L5902] st->timer.expires = (unsigned long )(st->settings.interval * 250U) + (unsigned long )jiffies [L5903] st->timer.function = & cisco_timer [L5904] st->timer.data = arg VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, tmp={0:21}, tmp___0={18:-212}, tmp___1=19, tmp___2=4294967281] [L5905] FCALL add_timer(& st->timer) VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, tmp={0:21}, tmp___0={18:-212}, tmp___1=19, tmp___2=4294967281] [L6115] RET (*(timer->function))(timer->data) [L6116] LDV_IN_INTERRUPT = 1 [L6117] ldv_timer_state_1 = 2 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, timer={0:0}, timer={0:0}] [L6186] RET choose_timer_1(ldv_timer_list_1) [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6195] COND TRUE ldv_state_variable_0 == 3 && ref_cnt == 0 [L6196] CALL mod_exit() [L6074] FCALL unregister_hdlc_protocol(& proto) [L6196] RET mod_exit() [L6197] ldv_state_variable_0 = 2 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6315] CALL ldv_check_final_state() [L6579] int tmp___7 ; [L6581] CALL, EXPR ldv_set_is_empty(LDV_SKBS) [L6470] return (last_index == 0); VAL [\result=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6581] RET, EXPR ldv_set_is_empty(LDV_SKBS) [L6581] tmp___7 = ldv_set_is_empty(LDV_SKBS) [L6582] COND FALSE !(\read(tmp___7)) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp___7=0] [L6584] CALL ldv_error() VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5554] reach_error() VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] - StatisticsResult: Ultimate Automizer benchmark data CFG has 33 procedures, 489 locations, 1 error locations. Started 1 CEGAR loops. OverallTime: 8.4s, OverallIterations: 6, TraceHistogramMax: 8, PathProgramHistogramMax: 1, EmptinessCheckTime: 0.0s, AutomataDifference: 5.1s, DeadEndRemovalTime: 0.0s, HoareAnnotationTime: 0.0s, InitialAbstractionConstructionTime: 0.0s, HoareTripleCheckerStatistics: 0 mSolverCounterUnknown, 3918 SdHoareTripleChecker+Valid, 4.3s IncrementalHoareTripleChecker+Time, 0 mSdLazyCounter, 3675 mSDsluCounter, 14177 SdHoareTripleChecker+Invalid, 3.6s Time, 0 mProtectedAction, 0 SdHoareTripleChecker+Unchecked, 0 IncrementalHoareTripleChecker+Unchecked, 10763 mSDsCounter, 1028 IncrementalHoareTripleChecker+Valid, 0 mProtectedPredicate, 4485 IncrementalHoareTripleChecker+Invalid, 5513 SdHoareTripleChecker+Unknown, 0 mSolverCounterNotChecked, 1028 mSolverCounterUnsat, 3414 mSDtfsCounter, 4485 mSolverCounterSat, 0.1s SdHoareTripleChecker+Time, 0 IncrementalHoareTripleChecker+Unknown, PredicateUnifierStatistics: 0 DeclaredPredicates, 295 GetRequests, 251 SyntacticMatches, 3 SemanticMatches, 41 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 50 ImplicationChecksByTransitivity, 0.4s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=1954occurred in iteration=5, InterpolantAutomatonStates: 37, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s DumpTime, AutomataMinimizationStatistics: 0.3s AutomataMinimizationTime, 5 MinimizatonAttempts, 506 StatesRemovedByMinimization, 5 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TRACE_CHECK: 0.1s SsaConstructionTime, 0.8s SatisfiabilityAnalysisTime, 1.2s InterpolantComputationTime, 781 NumberOfCodeBlocks, 781 NumberOfCodeBlocksAsserted, 7 NumberOfCheckSat, 592 ConstructedInterpolants, 0 QuantifiedInterpolants, 1365 SizeOfPredicates, 2 NumberOfNonLiveVariables, 961 ConjunctsInSsa, 17 ConjunctsInUnsatCore, 6 InterpolantComputations, 5 PerfectInterpolantSequences, 540/544 InterpolantCoveringCapability, INVARIANT_SYNTHESIS: No data available, INTERPOLANT_CONSOLIDATION: No data available, ABSTRACT_INTERPRETATION: No data available, PDR: No data available, ACCELERATED_INTERPOLATION: No data available, SIFA: No data available, ReuseStatistics: No data available RESULT: Ultimate could not prove your program: unable to determine feasibility of some traces [2022-07-22 23:53:11,336 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Forceful destruction successful, exit code 0 Received shutdown request... --- End real Ultimate output --- Execution finished normally Using bit-precise analysis Retrying with bit-precise analysis ### Bit-precise run ### Calling Ultimate with: /usr/bin/java -Dosgi.configuration.area=/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/config -Xmx15G -Xms4m -jar /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/org.eclipse.equinox.launcher_1.5.800.v20200727-1323.jar -data @noDefault -ultimatedata /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data -tc /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/AutomizerReach.xml -i ../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i -s /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Bitvector.epf --cacsl2boogietranslator.entry.function main --witnessprinter.witness.directory /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux --witnessprinter.witness.filename witness.graphml --witnessprinter.write.witness.besides.input.file false --witnessprinter.graph.data.specification CHECK( init(main()), LTL(G ! call(reach_error())) ) --witnessprinter.graph.data.producer Automizer --witnessprinter.graph.data.architecture 64bit --witnessprinter.graph.data.programhash aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 --- Real Ultimate output --- This is Ultimate 0.2.2-?-791161d [2022-07-22 23:53:13,071 INFO L177 SettingsManager]: Resetting all preferences to default values... [2022-07-22 23:53:13,078 INFO L181 SettingsManager]: Resetting UltimateCore preferences to default values [2022-07-22 23:53:13,110 INFO L184 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2022-07-22 23:53:13,112 INFO L181 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2022-07-22 23:53:13,113 INFO L181 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2022-07-22 23:53:13,119 INFO L181 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2022-07-22 23:53:13,122 INFO L181 SettingsManager]: Resetting LassoRanker preferences to default values [2022-07-22 23:53:13,124 INFO L181 SettingsManager]: Resetting Reaching Definitions preferences to default values [2022-07-22 23:53:13,125 INFO L181 SettingsManager]: Resetting SyntaxChecker preferences to default values [2022-07-22 23:53:13,126 INFO L181 SettingsManager]: Resetting Sifa preferences to default values [2022-07-22 23:53:13,126 INFO L184 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2022-07-22 23:53:13,127 INFO L181 SettingsManager]: Resetting LTL2Aut preferences to default values [2022-07-22 23:53:13,127 INFO L181 SettingsManager]: Resetting PEA to Boogie preferences to default values [2022-07-22 23:53:13,128 INFO L181 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2022-07-22 23:53:13,129 INFO L181 SettingsManager]: Resetting ChcToBoogie preferences to default values [2022-07-22 23:53:13,129 INFO L181 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2022-07-22 23:53:13,130 INFO L181 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2022-07-22 23:53:13,131 INFO L181 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2022-07-22 23:53:13,132 INFO L181 SettingsManager]: Resetting CodeCheck preferences to default values [2022-07-22 23:53:13,133 INFO L181 SettingsManager]: Resetting HornVerifier preferences to default values [2022-07-22 23:53:13,148 INFO L181 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2022-07-22 23:53:13,148 INFO L181 SettingsManager]: Resetting RCFGBuilder preferences to default values [2022-07-22 23:53:13,149 INFO L181 SettingsManager]: Resetting Referee preferences to default values [2022-07-22 23:53:13,150 INFO L181 SettingsManager]: Resetting TraceAbstraction preferences to default values [2022-07-22 23:53:13,151 INFO L184 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2022-07-22 23:53:13,152 INFO L184 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2022-07-22 23:53:13,152 INFO L181 SettingsManager]: Resetting TreeAutomizer preferences to default values [2022-07-22 23:53:13,152 INFO L181 SettingsManager]: Resetting IcfgToChc preferences to default values [2022-07-22 23:53:13,153 INFO L181 SettingsManager]: Resetting IcfgTransformer preferences to default values [2022-07-22 23:53:13,153 INFO L184 SettingsManager]: ReqToTest provides no preferences, ignoring... [2022-07-22 23:53:13,154 INFO L181 SettingsManager]: Resetting Boogie Printer preferences to default values [2022-07-22 23:53:13,155 INFO L181 SettingsManager]: Resetting ChcSmtPrinter preferences to default values [2022-07-22 23:53:13,156 INFO L181 SettingsManager]: Resetting ReqPrinter preferences to default values [2022-07-22 23:53:13,157 INFO L181 SettingsManager]: Resetting Witness Printer preferences to default values [2022-07-22 23:53:13,158 INFO L184 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2022-07-22 23:53:13,158 INFO L181 SettingsManager]: Resetting CDTParser preferences to default values [2022-07-22 23:53:13,159 INFO L184 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2022-07-22 23:53:13,159 INFO L184 SettingsManager]: ReqParser provides no preferences, ignoring... [2022-07-22 23:53:13,159 INFO L181 SettingsManager]: Resetting SmtParser preferences to default values [2022-07-22 23:53:13,160 INFO L181 SettingsManager]: Resetting Witness Parser preferences to default values [2022-07-22 23:53:13,161 INFO L188 SettingsManager]: Finished resetting all preferences to default values... [2022-07-22 23:53:13,165 INFO L101 SettingsManager]: Beginning loading settings from /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Bitvector.epf [2022-07-22 23:53:13,189 INFO L113 SettingsManager]: Loading preferences was successful [2022-07-22 23:53:13,190 INFO L115 SettingsManager]: Preferences different from defaults after loading the file: [2022-07-22 23:53:13,190 INFO L136 SettingsManager]: Preferences of UltimateCore differ from their defaults: [2022-07-22 23:53:13,190 INFO L138 SettingsManager]: * Log level for class=de.uni_freiburg.informatik.ultimate.lib.smtlibutils.quantifier.QuantifierPusher=ERROR; [2022-07-22 23:53:13,191 INFO L136 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2022-07-22 23:53:13,191 INFO L138 SettingsManager]: * Ignore calls to procedures called more than once=ONLY_FOR_SEQUENTIAL_PROGRAMS [2022-07-22 23:53:13,191 INFO L136 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2022-07-22 23:53:13,192 INFO L138 SettingsManager]: * Create parallel compositions if possible=false [2022-07-22 23:53:13,192 INFO L138 SettingsManager]: * Use SBE=true [2022-07-22 23:53:13,192 INFO L136 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2022-07-22 23:53:13,192 INFO L138 SettingsManager]: * Check division by zero=IGNORE [2022-07-22 23:53:13,193 INFO L138 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2022-07-22 23:53:13,193 INFO L138 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2022-07-22 23:53:13,193 INFO L138 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2022-07-22 23:53:13,193 INFO L138 SettingsManager]: * Adapt memory model on pointer casts if necessary=true [2022-07-22 23:53:13,193 INFO L138 SettingsManager]: * Use bitvectors instead of ints=true [2022-07-22 23:53:13,193 INFO L138 SettingsManager]: * Memory model=HoenickeLindenmann_4ByteResolution [2022-07-22 23:53:13,193 INFO L138 SettingsManager]: * Check if freed pointer was valid=false [2022-07-22 23:53:13,194 INFO L138 SettingsManager]: * Use constant arrays=true [2022-07-22 23:53:13,194 INFO L138 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2022-07-22 23:53:13,194 INFO L136 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2022-07-22 23:53:13,194 INFO L138 SettingsManager]: * Size of a code block=SequenceOfStatements [2022-07-22 23:53:13,194 INFO L138 SettingsManager]: * SMT solver=External_DefaultMode [2022-07-22 23:53:13,194 INFO L138 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2022-07-22 23:53:13,194 INFO L136 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2022-07-22 23:53:13,195 INFO L138 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2022-07-22 23:53:13,195 INFO L138 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2022-07-22 23:53:13,195 INFO L138 SettingsManager]: * Trace refinement strategy=WOLF [2022-07-22 23:53:13,195 INFO L138 SettingsManager]: * Command for external solver=cvc4 --incremental --print-success --lang smt [2022-07-22 23:53:13,195 INFO L138 SettingsManager]: * Apply one-shot large block encoding in concurrent analysis=false [2022-07-22 23:53:13,195 INFO L138 SettingsManager]: * Automaton type used in concurrency analysis=PETRI_NET [2022-07-22 23:53:13,196 INFO L138 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true [2022-07-22 23:53:13,196 INFO L138 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode [2022-07-22 23:53:13,196 INFO L138 SettingsManager]: * Logic for external solver=AUFBV WARNING: An illegal reflective access operation has occurred WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 (file:/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/com.sun.xml.bind_2.2.0.v201505121915.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int) WARNING: Please consider reporting this to the maintainers of com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations WARNING: All illegal access operations will be denied in a future release Applying setting for plugin de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: Entry function -> main Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness directory -> /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness filename -> witness.graphml Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Write witness besides input file -> false Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data specification -> CHECK( init(main()), LTL(G ! call(reach_error())) ) Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data producer -> Automizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data architecture -> 64bit Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data programhash -> aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 [2022-07-22 23:53:13,463 INFO L75 nceAwareModelManager]: Repository-Root is: /tmp [2022-07-22 23:53:13,477 INFO L261 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2022-07-22 23:53:13,479 INFO L217 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2022-07-22 23:53:13,480 INFO L271 PluginConnector]: Initializing CDTParser... [2022-07-22 23:53:13,480 INFO L275 PluginConnector]: CDTParser initialized [2022-07-22 23:53:13,481 INFO L432 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2022-07-22 23:53:13,523 INFO L220 CDTParser]: Created temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/06471ac92/9f83c85d0d174094862b7584fe06f58d/FLAGd2bf2b0fd [2022-07-22 23:53:14,162 INFO L306 CDTParser]: Found 1 translation units. [2022-07-22 23:53:14,162 INFO L160 CDTParser]: Scanning /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2022-07-22 23:53:14,190 INFO L349 CDTParser]: About to delete temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/06471ac92/9f83c85d0d174094862b7584fe06f58d/FLAGd2bf2b0fd [2022-07-22 23:53:14,556 INFO L357 CDTParser]: Successfully deleted /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/06471ac92/9f83c85d0d174094862b7584fe06f58d [2022-07-22 23:53:14,563 INFO L299 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2022-07-22 23:53:14,565 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2022-07-22 23:53:14,567 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2022-07-22 23:53:14,567 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2022-07-22 23:53:14,570 INFO L275 PluginConnector]: CACSL2BoogieTranslator initialized [2022-07-22 23:53:14,570 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 22.07 11:53:14" (1/1) ... [2022-07-22 23:53:14,571 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@5f63ee79 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:14, skipping insertion in model container [2022-07-22 23:53:14,571 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 22.07 11:53:14" (1/1) ... [2022-07-22 23:53:14,578 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2022-07-22 23:53:14,653 INFO L178 MainTranslator]: Built tables and reachable declarations [2022-07-22 23:53:15,223 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2022-07-22 23:53:15,431 INFO L210 PostProcessor]: Analyzing one entry point: main [2022-07-22 23:53:15,452 INFO L200 MainTranslator]: Restarting translation with changed settings: SettingsChange [mNewPreferredMemoryModel=HoenickeLindenmann_1ByteResolution] [2022-07-22 23:53:15,470 INFO L178 MainTranslator]: Built tables and reachable declarations [2022-07-22 23:53:15,564 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2022-07-22 23:53:15,626 INFO L210 PostProcessor]: Analyzing one entry point: main [2022-07-22 23:53:15,635 INFO L203 MainTranslator]: Completed pre-run [2022-07-22 23:53:15,743 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2022-07-22 23:53:15,811 INFO L210 PostProcessor]: Analyzing one entry point: main [2022-07-22 23:53:15,852 INFO L208 MainTranslator]: Completed translation [2022-07-22 23:53:15,852 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:15 WrapperNode [2022-07-22 23:53:15,853 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2022-07-22 23:53:15,854 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2022-07-22 23:53:15,854 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2022-07-22 23:53:15,854 INFO L275 PluginConnector]: Boogie Procedure Inliner initialized [2022-07-22 23:53:15,867 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:15" (1/1) ... [2022-07-22 23:53:15,927 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:15" (1/1) ... [2022-07-22 23:53:15,991 INFO L137 Inliner]: procedures = 158, calls = 357, calls flagged for inlining = 63, calls inlined = 60, statements flattened = 1390 [2022-07-22 23:53:15,991 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2022-07-22 23:53:15,992 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2022-07-22 23:53:15,992 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2022-07-22 23:53:15,992 INFO L275 PluginConnector]: Boogie Preprocessor initialized [2022-07-22 23:53:15,998 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:15" (1/1) ... [2022-07-22 23:53:15,998 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:15" (1/1) ... [2022-07-22 23:53:16,017 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:15" (1/1) ... [2022-07-22 23:53:16,017 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:15" (1/1) ... [2022-07-22 23:53:16,060 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:15" (1/1) ... [2022-07-22 23:53:16,079 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:15" (1/1) ... [2022-07-22 23:53:16,091 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:15" (1/1) ... [2022-07-22 23:53:16,097 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2022-07-22 23:53:16,098 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2022-07-22 23:53:16,098 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2022-07-22 23:53:16,098 INFO L275 PluginConnector]: RCFGBuilder initialized [2022-07-22 23:53:16,099 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:15" (1/1) ... [2022-07-22 23:53:16,103 INFO L173 SolverBuilder]: Constructing external solver with command: z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2022-07-22 23:53:16,112 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 [2022-07-22 23:53:16,136 INFO L229 MonitoredProcess]: Starting monitored process 1 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) [2022-07-22 23:53:16,159 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Waiting until timeout for monitored process [2022-07-22 23:53:16,214 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab32 [2022-07-22 23:53:16,214 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab32 [2022-07-22 23:53:16,215 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE1 [2022-07-22 23:53:16,215 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE8 [2022-07-22 23:53:16,215 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE4 [2022-07-22 23:53:16,215 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~$Pointer$ [2022-07-22 23:53:16,215 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE2 [2022-07-22 23:53:16,215 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$ [2022-07-22 23:53:16,215 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_stop [2022-07-22 23:53:16,215 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_stop [2022-07-22 23:53:16,216 INFO L130 BoogieDeclarations]: Found specification of procedure state [2022-07-22 23:53:16,216 INFO L138 BoogieDeclarations]: Found implementation of procedure state [2022-07-22 23:53:16,216 INFO L130 BoogieDeclarations]: Found specification of procedure dev_to_hdlc [2022-07-22 23:53:16,216 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_to_hdlc [2022-07-22 23:53:16,216 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_ioctl [2022-07-22 23:53:16,216 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_ioctl [2022-07-22 23:53:16,216 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_rx [2022-07-22 23:53:16,216 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_rx [2022-07-22 23:53:16,217 INFO L130 BoogieDeclarations]: Found specification of procedure debug_lockdep_rcu_enabled [2022-07-22 23:53:16,217 INFO L138 BoogieDeclarations]: Found implementation of procedure debug_lockdep_rcu_enabled [2022-07-22 23:53:16,217 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_type_trans [2022-07-22 23:53:16,217 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_type_trans [2022-07-22 23:53:16,217 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_malloc [2022-07-22 23:53:16,217 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_malloc [2022-07-22 23:53:16,217 INFO L130 BoogieDeclarations]: Found specification of procedure netif_dormant_on [2022-07-22 23:53:16,218 INFO L138 BoogieDeclarations]: Found implementation of procedure netif_dormant_on [2022-07-22 23:53:16,218 INFO L130 BoogieDeclarations]: Found specification of procedure rcu_is_watching [2022-07-22 23:53:16,218 INFO L138 BoogieDeclarations]: Found implementation of procedure rcu_is_watching [2022-07-22 23:53:16,218 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_skb_alloc [2022-07-22 23:53:16,229 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_skb_alloc [2022-07-22 23:53:16,229 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_error [2022-07-22 23:53:16,229 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_error [2022-07-22 23:53:16,229 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE4 [2022-07-22 23:53:16,229 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE2 [2022-07-22 23:53:16,229 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE1 [2022-07-22 23:53:16,229 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE8 [2022-07-22 23:53:16,230 INFO L130 BoogieDeclarations]: Found specification of procedure ldv__builtin_expect [2022-07-22 23:53:16,230 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv__builtin_expect [2022-07-22 23:53:16,230 INFO L130 BoogieDeclarations]: Found specification of procedure assume_abort_if_not [2022-07-22 23:53:16,230 INFO L138 BoogieDeclarations]: Found implementation of procedure assume_abort_if_not [2022-07-22 23:53:16,230 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnHeap [2022-07-22 23:53:16,230 INFO L130 BoogieDeclarations]: Found specification of procedure spinlock_check [2022-07-22 23:53:16,230 INFO L138 BoogieDeclarations]: Found implementation of procedure spinlock_check [2022-07-22 23:53:16,230 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_hard_header [2022-07-22 23:53:16,231 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_hard_header [2022-07-22 23:53:16,231 INFO L130 BoogieDeclarations]: Found specification of procedure dev_kfree_skb_any [2022-07-22 23:53:16,231 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_kfree_skb_any [2022-07-22 23:53:16,231 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocInit [2022-07-22 23:53:16,232 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnStack [2022-07-22 23:53:16,232 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2022-07-22 23:53:16,232 INFO L130 BoogieDeclarations]: Found specification of procedure lockdep_rcu_suspicious [2022-07-22 23:53:16,232 INFO L138 BoogieDeclarations]: Found implementation of procedure lockdep_rcu_suspicious [2022-07-22 23:53:16,233 INFO L130 BoogieDeclarations]: Found specification of procedure __bad_percpu_size [2022-07-22 23:53:16,233 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE8 [2022-07-22 23:53:16,233 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE2 [2022-07-22 23:53:16,234 INFO L130 BoogieDeclarations]: Found specification of procedure reg_timer_1 [2022-07-22 23:53:16,234 INFO L138 BoogieDeclarations]: Found implementation of procedure reg_timer_1 [2022-07-22 23:53:16,234 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE4 [2022-07-22 23:53:16,234 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_to_user [2022-07-22 23:53:16,234 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_to_user [2022-07-22 23:53:16,235 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2022-07-22 23:53:16,235 INFO L130 BoogieDeclarations]: Found specification of procedure add_timer [2022-07-22 23:53:16,235 INFO L138 BoogieDeclarations]: Found implementation of procedure add_timer [2022-07-22 23:53:16,235 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock_irqrestore [2022-07-22 23:53:16,235 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock_irqrestore [2022-07-22 23:53:16,235 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE8 [2022-07-22 23:53:16,235 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE1 [2022-07-22 23:53:16,235 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE2 [2022-07-22 23:53:16,236 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.dealloc [2022-07-22 23:53:16,236 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE4 [2022-07-22 23:53:16,236 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$ [2022-07-22 23:53:16,236 INFO L130 BoogieDeclarations]: Found specification of procedure might_fault [2022-07-22 23:53:16,236 INFO L138 BoogieDeclarations]: Found implementation of procedure might_fault [2022-07-22 23:53:16,236 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~intINTTYPE1 [2022-07-22 23:53:16,236 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_keepalive_send [2022-07-22 23:53:16,237 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_keepalive_send [2022-07-22 23:53:16,237 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab16 [2022-07-22 23:53:16,237 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab16 [2022-07-22 23:53:16,237 INFO L130 BoogieDeclarations]: Found specification of procedure _raw_spin_lock_irqsave [2022-07-22 23:53:16,237 INFO L138 BoogieDeclarations]: Found implementation of procedure _raw_spin_lock_irqsave [2022-07-22 23:53:16,237 INFO L130 BoogieDeclarations]: Found specification of procedure spin_lock [2022-07-22 23:53:16,237 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_lock [2022-07-22 23:53:16,238 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock [2022-07-22 23:53:16,238 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock [2022-07-22 23:53:16,238 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE1 [2022-07-22 23:53:16,248 INFO L130 BoogieDeclarations]: Found specification of procedure linkwatch_fire_event [2022-07-22 23:53:16,248 INFO L138 BoogieDeclarations]: Found implementation of procedure linkwatch_fire_event [2022-07-22 23:53:16,249 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_zalloc [2022-07-22 23:53:16,249 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_zalloc [2022-07-22 23:53:16,249 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_from_user [2022-07-22 23:53:16,249 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_from_user [2022-07-22 23:53:16,249 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2022-07-22 23:53:16,250 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2022-07-22 23:53:16,545 INFO L234 CfgBuilder]: Building ICFG [2022-07-22 23:53:16,546 INFO L260 CfgBuilder]: Building CFG for each procedure with an implementation [2022-07-22 23:53:16,607 INFO L764 $ProcedureCfgBuilder]: dead code at ProgramPoint ldv_stopFINAL: assume true; [2022-07-22 23:53:25,270 INFO L275 CfgBuilder]: Performing block encoding [2022-07-22 23:53:25,290 INFO L294 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2022-07-22 23:53:25,292 INFO L299 CfgBuilder]: Removed 1 assume(true) statements. [2022-07-22 23:53:25,296 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 22.07 11:53:25 BoogieIcfgContainer [2022-07-22 23:53:25,296 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2022-07-22 23:53:25,298 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2022-07-22 23:53:25,298 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2022-07-22 23:53:25,300 INFO L275 PluginConnector]: TraceAbstraction initialized [2022-07-22 23:53:25,301 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 22.07 11:53:14" (1/3) ... [2022-07-22 23:53:25,302 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@19da20f6 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 22.07 11:53:25, skipping insertion in model container [2022-07-22 23:53:25,302 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 22.07 11:53:15" (2/3) ... [2022-07-22 23:53:25,302 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@19da20f6 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 22.07 11:53:25, skipping insertion in model container [2022-07-22 23:53:25,302 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 22.07 11:53:25" (3/3) ... [2022-07-22 23:53:25,305 INFO L111 eAbstractionObserver]: Analyzing ICFG 205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2022-07-22 23:53:25,318 INFO L201 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2022-07-22 23:53:25,319 INFO L160 ceAbstractionStarter]: Applying trace abstraction to program that has 1 error locations. [2022-07-22 23:53:25,397 INFO L356 AbstractCegarLoop]: ======== Iteration 0 == of CEGAR loop == AllErrorsAtOnce ======== [2022-07-22 23:53:25,404 INFO L357 AbstractCegarLoop]: Settings: SEPARATE_VIOLATION_CHECK=true, mInterprocedural=true, mMaxIterations=1000000, mWatchIteration=1000000, mArtifact=RCFG, mInterpolation=FPandBP, mInterpolantAutomaton=STRAIGHT_LINE, mDumpAutomata=false, mAutomataFormat=ATS_NUMERATE, mDumpPath=., mDeterminiation=PREDICATE_ABSTRACTION, mMinimize=MINIMIZE_SEVPA, mHoare=true, mAutomataTypeConcurrency=PETRI_NET, mHoareTripleChecks=INCREMENTAL, mHoareAnnotationPositions=LoopsAndPotentialCycles, mDumpOnlyReuseAutomata=false, mLimitTraceHistogram=0, mErrorLocTimeLimit=0, mLimitPathProgramCount=0, mCollectInterpolantStatistics=true, mHeuristicEmptinessCheck=false, mHeuristicEmptinessCheckAStarHeuristic=ZERO, mHeuristicEmptinessCheckAStarHeuristicRandomSeed=1337, mHeuristicEmptinessCheckSmtFeatureScoringMethod=DAGSIZE, mSMTFeatureExtraction=false, mSMTFeatureExtractionDumpPath=., mOverrideInterpolantAutomaton=false, mMcrInterpolantMethod=WP, mPorIndependenceSettings=de.uni_freiburg.informatik.ultimate.lib.tracecheckerutils.partialorder.independence.IndependenceSettings@19464fae, mLbeIndependenceSettings=de.uni_freiburg.informatik.ultimate.lib.tracecheckerutils.partialorder.independence.IndependenceSettings@2c3694e [2022-07-22 23:53:25,404 INFO L358 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2022-07-22 23:53:25,411 INFO L276 IsEmpty]: Start isEmpty. Operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) [2022-07-22 23:53:25,423 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 48 [2022-07-22 23:53:25,423 INFO L187 NwaCegarLoop]: Found error trace [2022-07-22 23:53:25,424 INFO L195 NwaCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-22 23:53:25,425 INFO L420 AbstractCegarLoop]: === Iteration 1 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-22 23:53:25,428 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-22 23:53:25,433 INFO L85 PathProgramCache]: Analyzing trace with hash -796223239, now seen corresponding path program 1 times [2022-07-22 23:53:25,445 INFO L118 FreeRefinementEngine]: Executing refinement strategy WOLF [2022-07-22 23:53:25,445 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [1784154882] [2022-07-22 23:53:25,445 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-22 23:53:25,446 INFO L173 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2022-07-22 23:53:25,446 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2022-07-22 23:53:25,461 INFO L229 MonitoredProcess]: Starting monitored process 2 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2022-07-22 23:53:25,462 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (2)] Waiting until timeout for monitored process [2022-07-22 23:53:25,730 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:25,738 INFO L263 TraceCheckSpWp]: Trace formula consists of 242 conjuncts, 2 conjunts are in the unsatisfiable core [2022-07-22 23:53:25,743 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2022-07-22 23:53:25,826 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2022-07-22 23:53:25,827 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2022-07-22 23:53:25,827 INFO L136 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2022-07-22 23:53:25,827 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [1784154882] [2022-07-22 23:53:25,828 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleMathsat [1784154882] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-22 23:53:25,828 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-22 23:53:25,828 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2022-07-22 23:53:25,829 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [519137256] [2022-07-22 23:53:25,830 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-22 23:53:25,833 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 3 states [2022-07-22 23:53:25,834 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2022-07-22 23:53:25,875 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2022-07-22 23:53:25,876 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2022-07-22 23:53:25,878 INFO L87 Difference]: Start difference. First operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) Second operand has 3 states, 3 states have (on average 8.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-22 23:53:26,057 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-22 23:53:26,058 INFO L93 Difference]: Finished difference Result 1423 states and 2029 transitions. [2022-07-22 23:53:26,060 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2022-07-22 23:53:26,061 INFO L78 Accepts]: Start accepts. Automaton has has 3 states, 3 states have (on average 8.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 47 [2022-07-22 23:53:26,062 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-22 23:53:26,079 INFO L225 Difference]: With dead ends: 1423 [2022-07-22 23:53:26,083 INFO L226 Difference]: Without dead ends: 924 [2022-07-22 23:53:26,095 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 46 GetRequests, 45 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2022-07-22 23:53:26,100 INFO L413 NwaCegarLoop]: 767 mSDtfsCounter, 628 mSDsluCounter, 661 mSDsCounter, 0 mSdLazyCounter, 12 mSolverCounterSat, 3 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.0s Time, 0 mProtectedPredicate, 0 mProtectedAction, 628 SdHoareTripleChecker+Valid, 1428 SdHoareTripleChecker+Invalid, 15 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 3 IncrementalHoareTripleChecker+Valid, 12 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.1s IncrementalHoareTripleChecker+Time [2022-07-22 23:53:26,100 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [628 Valid, 1428 Invalid, 15 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [3 Valid, 12 Invalid, 0 Unknown, 0 Unchecked, 0.1s Time] [2022-07-22 23:53:26,113 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 924 states. [2022-07-22 23:53:26,174 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 924 to 924. [2022-07-22 23:53:26,176 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 924 states, 685 states have (on average 1.3562043795620438) internal successors, (929), 699 states have internal predecessors, (929), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2022-07-22 23:53:26,182 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 924 states to 924 states and 1284 transitions. [2022-07-22 23:53:26,183 INFO L78 Accepts]: Start accepts. Automaton has 924 states and 1284 transitions. Word has length 47 [2022-07-22 23:53:26,187 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-22 23:53:26,187 INFO L495 AbstractCegarLoop]: Abstraction has 924 states and 1284 transitions. [2022-07-22 23:53:26,188 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 3 states, 3 states have (on average 8.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-22 23:53:26,188 INFO L276 IsEmpty]: Start isEmpty. Operand 924 states and 1284 transitions. [2022-07-22 23:53:26,190 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 51 [2022-07-22 23:53:26,192 INFO L187 NwaCegarLoop]: Found error trace [2022-07-22 23:53:26,192 INFO L195 NwaCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-22 23:53:26,207 INFO L552 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (2)] Ended with exit code 0 [2022-07-22 23:53:26,404 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 2 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2022-07-22 23:53:26,405 INFO L420 AbstractCegarLoop]: === Iteration 2 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-22 23:53:26,405 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-22 23:53:26,406 INFO L85 PathProgramCache]: Analyzing trace with hash 566714884, now seen corresponding path program 1 times [2022-07-22 23:53:26,406 INFO L118 FreeRefinementEngine]: Executing refinement strategy WOLF [2022-07-22 23:53:26,406 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [1658386687] [2022-07-22 23:53:26,406 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-22 23:53:26,407 INFO L173 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2022-07-22 23:53:26,407 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2022-07-22 23:53:26,410 INFO L229 MonitoredProcess]: Starting monitored process 3 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2022-07-22 23:53:26,414 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (3)] Waiting until timeout for monitored process [2022-07-22 23:53:26,643 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:26,650 INFO L263 TraceCheckSpWp]: Trace formula consists of 246 conjuncts, 3 conjunts are in the unsatisfiable core [2022-07-22 23:53:26,652 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2022-07-22 23:53:26,707 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2022-07-22 23:53:26,707 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2022-07-22 23:53:26,707 INFO L136 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2022-07-22 23:53:26,707 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [1658386687] [2022-07-22 23:53:26,707 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleMathsat [1658386687] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-22 23:53:26,707 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-22 23:53:26,707 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2022-07-22 23:53:26,708 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1389485265] [2022-07-22 23:53:26,708 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-22 23:53:26,709 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 4 states [2022-07-22 23:53:26,709 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2022-07-22 23:53:26,709 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2022-07-22 23:53:26,709 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2022-07-22 23:53:26,709 INFO L87 Difference]: Start difference. First operand 924 states and 1284 transitions. Second operand has 4 states, 4 states have (on average 6.75) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-22 23:53:26,947 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-22 23:53:26,947 INFO L93 Difference]: Finished difference Result 1833 states and 2547 transitions. [2022-07-22 23:53:26,948 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2022-07-22 23:53:26,948 INFO L78 Accepts]: Start accepts. Automaton has has 4 states, 4 states have (on average 6.75) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 50 [2022-07-22 23:53:26,948 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-22 23:53:26,952 INFO L225 Difference]: With dead ends: 1833 [2022-07-22 23:53:26,952 INFO L226 Difference]: Without dead ends: 923 [2022-07-22 23:53:26,955 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 51 GetRequests, 48 SyntacticMatches, 0 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2022-07-22 23:53:26,956 INFO L413 NwaCegarLoop]: 782 mSDtfsCounter, 794 mSDsluCounter, 671 mSDsCounter, 0 mSdLazyCounter, 36 mSolverCounterSat, 37 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.1s Time, 0 mProtectedPredicate, 0 mProtectedAction, 794 SdHoareTripleChecker+Valid, 1453 SdHoareTripleChecker+Invalid, 73 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 37 IncrementalHoareTripleChecker+Valid, 36 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.2s IncrementalHoareTripleChecker+Time [2022-07-22 23:53:26,956 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [794 Valid, 1453 Invalid, 73 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [37 Valid, 36 Invalid, 0 Unknown, 0 Unchecked, 0.2s Time] [2022-07-22 23:53:26,957 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 923 states. [2022-07-22 23:53:26,985 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 923 to 923. [2022-07-22 23:53:26,986 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 923 states, 684 states have (on average 1.3523391812865497) internal successors, (925), 698 states have internal predecessors, (925), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2022-07-22 23:53:26,991 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 923 states to 923 states and 1280 transitions. [2022-07-22 23:53:26,991 INFO L78 Accepts]: Start accepts. Automaton has 923 states and 1280 transitions. Word has length 50 [2022-07-22 23:53:26,992 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-22 23:53:26,992 INFO L495 AbstractCegarLoop]: Abstraction has 923 states and 1280 transitions. [2022-07-22 23:53:26,992 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 4 states, 4 states have (on average 6.75) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-22 23:53:26,992 INFO L276 IsEmpty]: Start isEmpty. Operand 923 states and 1280 transitions. [2022-07-22 23:53:26,995 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 72 [2022-07-22 23:53:26,996 INFO L187 NwaCegarLoop]: Found error trace [2022-07-22 23:53:26,996 INFO L195 NwaCegarLoop]: trace histogram [7, 7, 7, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-22 23:53:27,007 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (3)] Forceful destruction successful, exit code 0 [2022-07-22 23:53:27,205 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 3 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2022-07-22 23:53:27,206 INFO L420 AbstractCegarLoop]: === Iteration 3 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-22 23:53:27,206 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-22 23:53:27,206 INFO L85 PathProgramCache]: Analyzing trace with hash -965053755, now seen corresponding path program 1 times [2022-07-22 23:53:27,207 INFO L118 FreeRefinementEngine]: Executing refinement strategy WOLF [2022-07-22 23:53:27,207 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [1407942873] [2022-07-22 23:53:27,207 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-22 23:53:27,207 INFO L173 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2022-07-22 23:53:27,207 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2022-07-22 23:53:27,208 INFO L229 MonitoredProcess]: Starting monitored process 4 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2022-07-22 23:53:27,210 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (4)] Waiting until timeout for monitored process [2022-07-22 23:53:27,467 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:27,475 INFO L263 TraceCheckSpWp]: Trace formula consists of 304 conjuncts, 4 conjunts are in the unsatisfiable core [2022-07-22 23:53:27,477 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2022-07-22 23:53:27,673 INFO L134 CoverageAnalysis]: Checked inductivity of 89 backedges. 40 proven. 0 refuted. 0 times theorem prover too weak. 49 trivial. 0 not checked. [2022-07-22 23:53:27,673 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2022-07-22 23:53:27,673 INFO L136 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2022-07-22 23:53:27,673 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [1407942873] [2022-07-22 23:53:27,673 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleMathsat [1407942873] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-22 23:53:27,673 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-22 23:53:27,673 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [] total 5 [2022-07-22 23:53:27,673 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1490423430] [2022-07-22 23:53:27,673 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-22 23:53:27,674 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2022-07-22 23:53:27,674 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2022-07-22 23:53:27,674 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2022-07-22 23:53:27,674 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2022-07-22 23:53:27,674 INFO L87 Difference]: Start difference. First operand 923 states and 1280 transitions. Second operand has 5 states, 5 states have (on average 7.4) internal successors, (37), 5 states have internal predecessors, (37), 3 states have call successors, (8), 3 states have call predecessors, (8), 2 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2022-07-22 23:53:27,871 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-22 23:53:27,871 INFO L93 Difference]: Finished difference Result 2738 states and 3820 transitions. [2022-07-22 23:53:27,872 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2022-07-22 23:53:27,872 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 7.4) internal successors, (37), 5 states have internal predecessors, (37), 3 states have call successors, (8), 3 states have call predecessors, (8), 2 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) Word has length 71 [2022-07-22 23:53:27,873 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-22 23:53:27,884 INFO L225 Difference]: With dead ends: 2738 [2022-07-22 23:53:27,884 INFO L226 Difference]: Without dead ends: 1824 [2022-07-22 23:53:27,888 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 72 GetRequests, 67 SyntacticMatches, 0 SemanticMatches, 5 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=17, Invalid=25, Unknown=0, NotChecked=0, Total=42 [2022-07-22 23:53:27,889 INFO L413 NwaCegarLoop]: 751 mSDtfsCounter, 627 mSDsluCounter, 2142 mSDsCounter, 0 mSdLazyCounter, 21 mSolverCounterSat, 2 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.1s Time, 0 mProtectedPredicate, 0 mProtectedAction, 627 SdHoareTripleChecker+Valid, 2893 SdHoareTripleChecker+Invalid, 23 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 2 IncrementalHoareTripleChecker+Valid, 21 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.1s IncrementalHoareTripleChecker+Time [2022-07-22 23:53:27,889 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [627 Valid, 2893 Invalid, 23 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [2 Valid, 21 Invalid, 0 Unknown, 0 Unchecked, 0.1s Time] [2022-07-22 23:53:27,892 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1824 states. [2022-07-22 23:53:27,947 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1824 to 1824. [2022-07-22 23:53:27,950 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1824 states, 1353 states have (on average 1.3540280857354028) internal successors, (1832), 1381 states have internal predecessors, (1832), 350 states have call successors, (350), 121 states have call predecessors, (350), 120 states have return successors, (359), 349 states have call predecessors, (359), 349 states have call successors, (359) [2022-07-22 23:53:27,959 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1824 states to 1824 states and 2541 transitions. [2022-07-22 23:53:27,959 INFO L78 Accepts]: Start accepts. Automaton has 1824 states and 2541 transitions. Word has length 71 [2022-07-22 23:53:27,960 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-22 23:53:27,960 INFO L495 AbstractCegarLoop]: Abstraction has 1824 states and 2541 transitions. [2022-07-22 23:53:27,960 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 7.4) internal successors, (37), 5 states have internal predecessors, (37), 3 states have call successors, (8), 3 states have call predecessors, (8), 2 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2022-07-22 23:53:27,960 INFO L276 IsEmpty]: Start isEmpty. Operand 1824 states and 2541 transitions. [2022-07-22 23:53:27,967 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 142 [2022-07-22 23:53:27,967 INFO L187 NwaCegarLoop]: Found error trace [2022-07-22 23:53:27,968 INFO L195 NwaCegarLoop]: trace histogram [8, 8, 8, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-22 23:53:27,999 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (4)] Forceful destruction successful, exit code 0 [2022-07-22 23:53:28,177 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 4 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2022-07-22 23:53:28,178 INFO L420 AbstractCegarLoop]: === Iteration 4 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-22 23:53:28,178 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-22 23:53:28,178 INFO L85 PathProgramCache]: Analyzing trace with hash -574025911, now seen corresponding path program 1 times [2022-07-22 23:53:28,179 INFO L118 FreeRefinementEngine]: Executing refinement strategy WOLF [2022-07-22 23:53:28,179 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [1475565275] [2022-07-22 23:53:28,179 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-22 23:53:28,179 INFO L173 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2022-07-22 23:53:28,179 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2022-07-22 23:53:28,181 INFO L229 MonitoredProcess]: Starting monitored process 5 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2022-07-22 23:53:28,182 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (5)] Waiting until timeout for monitored process [2022-07-22 23:53:28,585 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:28,615 INFO L263 TraceCheckSpWp]: Trace formula consists of 608 conjuncts, 9 conjunts are in the unsatisfiable core [2022-07-22 23:53:28,623 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2022-07-22 23:53:28,740 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 104 trivial. 0 not checked. [2022-07-22 23:53:28,740 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2022-07-22 23:53:28,741 INFO L136 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2022-07-22 23:53:28,741 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [1475565275] [2022-07-22 23:53:28,741 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleMathsat [1475565275] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-22 23:53:28,741 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-22 23:53:28,741 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [] total 5 [2022-07-22 23:53:28,741 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1609784441] [2022-07-22 23:53:28,741 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-22 23:53:28,742 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2022-07-22 23:53:28,742 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2022-07-22 23:53:28,742 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2022-07-22 23:53:28,742 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2022-07-22 23:53:28,742 INFO L87 Difference]: Start difference. First operand 1824 states and 2541 transitions. Second operand has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2022-07-22 23:53:28,871 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-22 23:53:28,871 INFO L93 Difference]: Finished difference Result 3658 states and 5130 transitions. [2022-07-22 23:53:28,872 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2022-07-22 23:53:28,872 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) Word has length 141 [2022-07-22 23:53:28,872 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-22 23:53:28,882 INFO L225 Difference]: With dead ends: 3658 [2022-07-22 23:53:28,882 INFO L226 Difference]: Without dead ends: 1848 [2022-07-22 23:53:28,889 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 140 GetRequests, 137 SyntacticMatches, 0 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2022-07-22 23:53:28,890 INFO L413 NwaCegarLoop]: 658 mSDtfsCounter, 2 mSDsluCounter, 1961 mSDsCounter, 0 mSdLazyCounter, 19 mSolverCounterSat, 1 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.1s Time, 0 mProtectedPredicate, 0 mProtectedAction, 2 SdHoareTripleChecker+Valid, 2619 SdHoareTripleChecker+Invalid, 20 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 1 IncrementalHoareTripleChecker+Valid, 19 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.1s IncrementalHoareTripleChecker+Time [2022-07-22 23:53:28,890 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [2 Valid, 2619 Invalid, 20 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [1 Valid, 19 Invalid, 0 Unknown, 0 Unchecked, 0.1s Time] [2022-07-22 23:53:28,892 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1848 states. [2022-07-22 23:53:28,944 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1848 to 1844. [2022-07-22 23:53:28,947 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1844 states, 1367 states have (on average 1.3504023408924652) internal successors, (1846), 1397 states have internal predecessors, (1846), 350 states have call successors, (350), 121 states have call predecessors, (350), 126 states have return successors, (374), 353 states have call predecessors, (374), 349 states have call successors, (374) [2022-07-22 23:53:28,956 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1844 states to 1844 states and 2570 transitions. [2022-07-22 23:53:28,957 INFO L78 Accepts]: Start accepts. Automaton has 1844 states and 2570 transitions. Word has length 141 [2022-07-22 23:53:28,958 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-22 23:53:28,958 INFO L495 AbstractCegarLoop]: Abstraction has 1844 states and 2570 transitions. [2022-07-22 23:53:28,958 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2022-07-22 23:53:28,958 INFO L276 IsEmpty]: Start isEmpty. Operand 1844 states and 2570 transitions. [2022-07-22 23:53:28,963 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 149 [2022-07-22 23:53:28,963 INFO L187 NwaCegarLoop]: Found error trace [2022-07-22 23:53:28,964 INFO L195 NwaCegarLoop]: trace histogram [8, 8, 7, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-22 23:53:29,001 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (5)] Forceful destruction successful, exit code 0 [2022-07-22 23:53:29,201 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 5 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2022-07-22 23:53:29,201 INFO L420 AbstractCegarLoop]: === Iteration 5 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-22 23:53:29,202 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-22 23:53:29,202 INFO L85 PathProgramCache]: Analyzing trace with hash -1293113785, now seen corresponding path program 1 times [2022-07-22 23:53:29,203 INFO L118 FreeRefinementEngine]: Executing refinement strategy WOLF [2022-07-22 23:53:29,203 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [407035381] [2022-07-22 23:53:29,203 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-22 23:53:29,203 INFO L173 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2022-07-22 23:53:29,203 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2022-07-22 23:53:29,220 INFO L229 MonitoredProcess]: Starting monitored process 6 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2022-07-22 23:53:29,222 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (6)] Waiting until timeout for monitored process [2022-07-22 23:53:29,611 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-22 23:53:29,641 INFO L263 TraceCheckSpWp]: Trace formula consists of 634 conjuncts, 22 conjunts are in the unsatisfiable core [2022-07-22 23:53:29,644 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2022-07-22 23:53:30,181 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 104 trivial. 0 not checked. [2022-07-22 23:53:30,182 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2022-07-22 23:53:30,182 INFO L136 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2022-07-22 23:53:30,182 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [407035381] [2022-07-22 23:53:30,182 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleMathsat [407035381] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-22 23:53:30,182 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-22 23:53:30,182 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [12] imperfect sequences [] total 12 [2022-07-22 23:53:30,182 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1990856511] [2022-07-22 23:53:30,182 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-22 23:53:30,182 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 12 states [2022-07-22 23:53:30,183 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2022-07-22 23:53:30,183 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 12 interpolants. [2022-07-22 23:53:30,183 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=21, Invalid=111, Unknown=0, NotChecked=0, Total=132 [2022-07-22 23:53:30,183 INFO L87 Difference]: Start difference. First operand 1844 states and 2570 transitions. Second operand has 12 states, 12 states have (on average 7.333333333333333) internal successors, (88), 9 states have internal predecessors, (88), 2 states have call successors, (19), 2 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 2 states have call successors, (18) [2022-07-22 23:53:33,397 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-22 23:53:33,397 INFO L93 Difference]: Finished difference Result 3746 states and 5240 transitions. [2022-07-22 23:53:33,398 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 13 states. [2022-07-22 23:53:33,398 INFO L78 Accepts]: Start accepts. Automaton has has 12 states, 12 states have (on average 7.333333333333333) internal successors, (88), 9 states have internal predecessors, (88), 2 states have call successors, (19), 2 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 2 states have call successors, (18) Word has length 148 [2022-07-22 23:53:33,399 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-22 23:53:33,407 INFO L225 Difference]: With dead ends: 3746 [2022-07-22 23:53:33,407 INFO L226 Difference]: Without dead ends: 1916 [2022-07-22 23:53:33,413 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 152 GetRequests, 138 SyntacticMatches, 0 SemanticMatches, 14 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 6 ImplicationChecksByTransitivity, 0.6s TimeCoverageRelationStatistics Valid=37, Invalid=203, Unknown=0, NotChecked=0, Total=240 [2022-07-22 23:53:33,414 INFO L413 NwaCegarLoop]: 670 mSDtfsCounter, 36 mSDsluCounter, 6616 mSDsCounter, 0 mSdLazyCounter, 187 mSolverCounterSat, 8 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 2.7s Time, 0 mProtectedPredicate, 0 mProtectedAction, 39 SdHoareTripleChecker+Valid, 7286 SdHoareTripleChecker+Invalid, 195 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 8 IncrementalHoareTripleChecker+Valid, 187 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 2.9s IncrementalHoareTripleChecker+Time [2022-07-22 23:53:33,415 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [39 Valid, 7286 Invalid, 195 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [8 Valid, 187 Invalid, 0 Unknown, 0 Unchecked, 2.9s Time] [2022-07-22 23:53:33,417 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1916 states. [2022-07-22 23:53:33,484 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1916 to 1884. [2022-07-22 23:53:33,487 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1884 states, 1397 states have (on average 1.340014316392269) internal successors, (1872), 1427 states have internal predecessors, (1872), 356 states have call successors, (356), 121 states have call predecessors, (356), 130 states have return successors, (386), 363 states have call predecessors, (386), 355 states have call successors, (386) [2022-07-22 23:53:33,496 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1884 states to 1884 states and 2614 transitions. [2022-07-22 23:53:33,497 INFO L78 Accepts]: Start accepts. Automaton has 1884 states and 2614 transitions. Word has length 148 [2022-07-22 23:53:33,498 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-22 23:53:33,498 INFO L495 AbstractCegarLoop]: Abstraction has 1884 states and 2614 transitions. [2022-07-22 23:53:33,498 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 12 states, 12 states have (on average 7.333333333333333) internal successors, (88), 9 states have internal predecessors, (88), 2 states have call successors, (19), 2 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 2 states have call successors, (18) [2022-07-22 23:53:33,498 INFO L276 IsEmpty]: Start isEmpty. Operand 1884 states and 2614 transitions. [2022-07-22 23:53:33,504 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 184 [2022-07-22 23:53:33,504 INFO L187 NwaCegarLoop]: Found error trace [2022-07-22 23:53:33,504 INFO L195 NwaCegarLoop]: trace histogram [8, 8, 7, 4, 4, 4, 3, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-22 23:53:33,518 INFO L552 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (6)] Ended with exit code 0 [2022-07-22 23:53:33,717 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 6 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2022-07-22 23:53:33,718 INFO L420 AbstractCegarLoop]: === Iteration 6 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-22 23:53:33,718 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-22 23:53:33,718 INFO L85 PathProgramCache]: Analyzing trace with hash -669328497, now seen corresponding path program 1 times [2022-07-22 23:53:33,720 INFO L118 FreeRefinementEngine]: Executing refinement strategy WOLF [2022-07-22 23:53:33,720 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [1660590746] [2022-07-22 23:53:33,720 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-22 23:53:33,720 INFO L173 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2022-07-22 23:53:33,720 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2022-07-22 23:53:33,721 INFO L229 MonitoredProcess]: Starting monitored process 7 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2022-07-22 23:53:33,723 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (7)] Waiting until timeout for monitored process [2022-07-22 23:53:35,585 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2022-07-22 23:53:35,585 INFO L352 TraceCheck]: Trace is feasible, we will do another trace check, this time with branch encoders. [2022-07-22 23:53:37,178 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2022-07-22 23:53:37,507 INFO L130 FreeRefinementEngine]: Strategy WOLF found a feasible trace [2022-07-22 23:53:37,508 INFO L271 BasicCegarLoop]: Counterexample is feasible [2022-07-22 23:53:37,508 INFO L805 garLoopResultBuilder]: Registering result UNSAFE for location ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION (0 of 1 remaining) [2022-07-22 23:53:37,555 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (7)] Forceful destruction successful, exit code 0 [2022-07-22 23:53:37,734 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 7 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2022-07-22 23:53:37,737 INFO L356 BasicCegarLoop]: Path program histogram: [1, 1, 1, 1, 1, 1] [2022-07-22 23:53:37,740 INFO L176 ceAbstractionStarter]: Computing trace abstraction results [2022-07-22 23:53:37,791 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:37,791 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:37,792 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:37,792 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:37,792 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:37,792 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:37,792 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:37,792 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:37,792 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:37,792 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:37,929 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 22.07 11:53:37 BoogieIcfgContainer [2022-07-22 23:53:37,929 INFO L132 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2022-07-22 23:53:37,930 INFO L113 PluginConnector]: ------------------------Witness Printer---------------------------- [2022-07-22 23:53:37,930 INFO L271 PluginConnector]: Initializing Witness Printer... [2022-07-22 23:53:37,930 INFO L275 PluginConnector]: Witness Printer initialized [2022-07-22 23:53:37,931 INFO L185 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 22.07 11:53:25" (3/4) ... [2022-07-22 23:53:37,932 INFO L131 WitnessPrinter]: Generating witness for reachability counterexample [2022-07-22 23:53:37,947 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:37,948 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:37,948 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:37,948 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:37,948 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:37,948 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:37,949 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:37,949 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:37,949 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:37,949 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-22 23:53:38,080 INFO L141 WitnessManager]: Wrote witness to /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/witness.graphml [2022-07-22 23:53:38,081 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2022-07-22 23:53:38,081 INFO L158 Benchmark]: Toolchain (without parser) took 23516.07ms. Allocated memory was 60.8MB in the beginning and 199.2MB in the end (delta: 138.4MB). Free memory was 33.6MB in the beginning and 73.0MB in the end (delta: -39.4MB). Peak memory consumption was 97.3MB. Max. memory is 16.1GB. [2022-07-22 23:53:38,081 INFO L158 Benchmark]: CDTParser took 0.16ms. Allocated memory is still 60.8MB. Free memory was 43.3MB in the beginning and 43.3MB in the end (delta: 49.4kB). There was no memory consumed. Max. memory is 16.1GB. [2022-07-22 23:53:38,082 INFO L158 Benchmark]: CACSL2BoogieTranslator took 1286.10ms. Allocated memory was 60.8MB in the beginning and 115.3MB in the end (delta: 54.5MB). Free memory was 33.3MB in the beginning and 63.3MB in the end (delta: -30.0MB). Peak memory consumption was 46.9MB. Max. memory is 16.1GB. [2022-07-22 23:53:38,082 INFO L158 Benchmark]: Boogie Procedure Inliner took 137.68ms. Allocated memory is still 115.3MB. Free memory was 63.3MB in the beginning and 55.4MB in the end (delta: 7.9MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. [2022-07-22 23:53:38,082 INFO L158 Benchmark]: Boogie Preprocessor took 105.80ms. Allocated memory is still 115.3MB. Free memory was 55.4MB in the beginning and 46.6MB in the end (delta: 8.8MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. [2022-07-22 23:53:38,083 INFO L158 Benchmark]: RCFGBuilder took 9198.54ms. Allocated memory was 115.3MB in the beginning and 165.7MB in the end (delta: 50.3MB). Free memory was 46.1MB in the beginning and 115.1MB in the end (delta: -69.0MB). Peak memory consumption was 30.7MB. Max. memory is 16.1GB. [2022-07-22 23:53:38,083 INFO L158 Benchmark]: TraceAbstraction took 12631.40ms. Allocated memory was 165.7MB in the beginning and 199.2MB in the end (delta: 33.6MB). Free memory was 115.1MB in the beginning and 110.7MB in the end (delta: 4.4MB). Peak memory consumption was 109.2MB. Max. memory is 16.1GB. [2022-07-22 23:53:38,083 INFO L158 Benchmark]: Witness Printer took 150.85ms. Allocated memory is still 199.2MB. Free memory was 110.7MB in the beginning and 73.0MB in the end (delta: 37.7MB). Peak memory consumption was 37.7MB. Max. memory is 16.1GB. [2022-07-22 23:53:38,085 INFO L339 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.16ms. Allocated memory is still 60.8MB. Free memory was 43.3MB in the beginning and 43.3MB in the end (delta: 49.4kB). There was no memory consumed. Max. memory is 16.1GB. * CACSL2BoogieTranslator took 1286.10ms. Allocated memory was 60.8MB in the beginning and 115.3MB in the end (delta: 54.5MB). Free memory was 33.3MB in the beginning and 63.3MB in the end (delta: -30.0MB). Peak memory consumption was 46.9MB. Max. memory is 16.1GB. * Boogie Procedure Inliner took 137.68ms. Allocated memory is still 115.3MB. Free memory was 63.3MB in the beginning and 55.4MB in the end (delta: 7.9MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. * Boogie Preprocessor took 105.80ms. Allocated memory is still 115.3MB. Free memory was 55.4MB in the beginning and 46.6MB in the end (delta: 8.8MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. * RCFGBuilder took 9198.54ms. Allocated memory was 115.3MB in the beginning and 165.7MB in the end (delta: 50.3MB). Free memory was 46.1MB in the beginning and 115.1MB in the end (delta: -69.0MB). Peak memory consumption was 30.7MB. Max. memory is 16.1GB. * TraceAbstraction took 12631.40ms. Allocated memory was 165.7MB in the beginning and 199.2MB in the end (delta: 33.6MB). Free memory was 115.1MB in the beginning and 110.7MB in the end (delta: 4.4MB). Peak memory consumption was 109.2MB. Max. memory is 16.1GB. * Witness Printer took 150.85ms. Allocated memory is still 199.2MB. Free memory was 110.7MB in the beginning and 73.0MB in the end (delta: 37.7MB). Peak memory consumption was 37.7MB. Max. memory is 16.1GB. * Results from de.uni_freiburg.informatik.ultimate.boogie.preprocessor: - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: - GenericResult: Unfinished Backtranslation The program execution was not completely translated back. - GenericResult: Unfinished Backtranslation The program execution was not completely translated back. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - StatisticsResult: ErrorAutomatonStatistics NumberErrorTraces: 0, NumberStatementsAllTraces: 0, NumberRelevantStatements: 0, 0.0s ErrorAutomatonConstructionTimeTotal, 0.0s FaulLocalizationTime, NumberStatementsFirstTrace: -1, TraceLengthAvg: 0, 0.0s ErrorAutomatonConstructionTimeAvg, 0.0s ErrorAutomatonDifferenceTimeAvg, 0.0s ErrorAutomatonDifferenceTimeTotal, NumberOfNoEnhancement: 0, NumberOfFiniteEnhancement: 0, NumberOfInfiniteEnhancement: 0 - CounterExampleResult [Line: 5554]: a call to reach_error is reachable a call to reach_error is reachable We found a FailurePath: [L5577] int LDV_IN_INTERRUPT = 1; [L5578] struct sk_buff *proto_group1 ; [L5579] int ldv_state_variable_0 ; [L5580] int ldv_state_variable_3 ; [L5581] int ldv_timer_state_1 = 0; [L5582] int ldv_state_variable_2 ; [L5583] struct net_device *proto_group0 ; [L5584] int ref_cnt ; [L5585] int ldv_state_variable_1 ; [L5586] struct timer_list *ldv_timer_list_1 ; [L5964-L5966] static struct hdlc_proto proto = {0, 0, & cisco_start, & cisco_stop, 0, & cisco_ioctl, & cisco_type_trans, & cisco_rx, 0, & __this_module, 0}; [L5967] static struct header_ops const cisco_header_ops = {& cisco_hard_header, 0, 0, 0, 0}; [L6078] int ldv_retval_0 ; [L6374] Element set_impl[15] ; [L6375] int last_index = 0; [L6509] Set LDV_SKBS ; VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6142] struct ifreq *ldvarg0 ; [L6143] void *tmp ; [L6144] unsigned int ldvarg1 ; [L6145] unsigned int tmp___0 ; [L6146] unsigned short ldvarg4 ; [L6147] unsigned short tmp___1 ; [L6148] struct sk_buff *ldvarg3 ; [L6149] void *tmp___2 ; [L6150] struct net_device *ldvarg5 ; [L6151] void *tmp___3 ; [L6152] void *ldvarg2 ; [L6153] void *tmp___4 ; [L6154] void *ldvarg6 ; [L6155] void *tmp___5 ; [L6156] int tmp___6 ; [L6157] int tmp___7 ; [L6158] int tmp___8 ; [L6159] int tmp___9 ; VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6161] CALL, EXPR ldv_zalloc(40UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=40, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=40, tmp___0=2147483648] [L6161] RET, EXPR ldv_zalloc(40UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(40UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6161] tmp = ldv_zalloc(40UL) [L6162] ldvarg0 = (struct ifreq *)tmp [L6163] tmp___0 = __VERIFIER_nondet_uint() [L6164] ldvarg1 = tmp___0 [L6165] tmp___1 = __VERIFIER_nondet_ushort() [L6166] ldvarg4 = tmp___1 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg4=5, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5] [L6167] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=232, tmp___0=2147483648] [L6167] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg4=5, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5] [L6167] tmp___2 = ldv_zalloc(232UL) [L6168] ldvarg3 = (struct sk_buff *)tmp___2 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}] [L6169] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=3264, tmp___0=2147483648] [L6169] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}] [L6169] tmp___3 = ldv_zalloc(3264UL) [L6170] ldvarg5 = (struct net_device *)tmp___3 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}] [L6171] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=2147483648] [L6171] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}] [L6171] tmp___4 = ldv_zalloc(1UL) [L6172] ldvarg2 = tmp___4 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=2147483648] [L6173] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] tmp___5 = ldv_zalloc(1UL) [L6174] ldvarg6 = tmp___5 [L6175] CALL ldv_initialize() [L6528] CALL ldv_set_init(LDV_SKBS) [L6380] set = set_impl [L6381] last_index = 0 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={18:0}, set={0:0}, set_impl={18:0}] [L6528] RET ldv_set_init(LDV_SKBS) [L6175] RET ldv_initialize() [L6176] ldv_state_variable_1 = 1 [L6177] ref_cnt = 0 [L6178] ldv_state_variable_0 = 1 [L6179] ldv_state_variable_3 = 0 [L6180] ldv_state_variable_2 = 0 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: [L6202] case 1: VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6203] COND TRUE ldv_state_variable_0 == 1 [L6204] CALL, EXPR mod_init() [L6067] FCALL register_hdlc_protocol(& proto) [L6068] return (0); VAL [\result=0, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6204] RET, EXPR mod_init() [L6204] ldv_retval_0 = mod_init() [L6205] COND TRUE ldv_retval_0 == 0 [L6206] ldv_state_variable_0 = 3 [L6207] ldv_state_variable_2 = 1 [L6208] ldv_state_variable_3 = 1 [L6209] CALL ldv_initialize_hdlc_proto_3() [L6101] void *tmp ; [L6102] void *tmp___0 ; VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6104] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=232, tmp___0=2147483648] [L6104] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6104] tmp = ldv_zalloc(232UL) [L6105] proto_group1 = (struct sk_buff *)tmp VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L6106] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=3264, tmp___0=2147483648] [L6106] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L6106] tmp___0 = ldv_zalloc(3264UL) [L6107] proto_group0 = (struct net_device *)tmp___0 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0={0:0}] [L6209] RET ldv_initialize_hdlc_proto_3() [L6212] COND FALSE !(ldv_retval_0 != 0) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=0, tmp___7=1] [L6185] COND TRUE ldv_state_variable_1 != 0 [L6186] CALL choose_timer_1(ldv_timer_list_1) [L6114] LDV_IN_INTERRUPT = 2 [L6115] EXPR timer->data [L6115] EXPR timer->function [L6115] CALL (*(timer->function))(timer->data) [L5877] struct net_device *dev ; [L5878] hdlc_device *hdlc ; [L5879] struct hdlc_device *tmp ; [L5880] struct cisco_state *st ; [L5881] struct cisco_state *tmp___0 ; [L5882] __u32 tmp___1 ; [L5883] __u32 tmp___2 ; [L5885] dev = (struct net_device *)arg VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5886] CALL, EXPR dev_to_hdlc(dev) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5638] void *tmp ; [L5640] CALL, EXPR netdev_priv((struct net_device const *)dev) [L5595] return ((void *)dev + 3264U); VAL [\result={0:3264}, __this_module={0:0}, cisco_header_ops={17:0}, dev={0:0}, dev={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5640] RET, EXPR netdev_priv((struct net_device const *)dev) [L5640] tmp = netdev_priv((struct net_device const *)dev) [L5641] return ((struct hdlc_device *)tmp); VAL [\result={0:3264}, __this_module={0:0}, cisco_header_ops={17:0}, dev={0:0}, dev={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:3264}] [L5886] RET, EXPR dev_to_hdlc(dev) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, dev_to_hdlc(dev)={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5886] tmp = dev_to_hdlc(dev) [L5887] hdlc = tmp VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:3264}] [L5888] CALL, EXPR state(hdlc) VAL [__this_module={0:0}, cisco_header_ops={17:0}, hdlc={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5670] EXPR hdlc->state [L5670] return ((struct cisco_state *)hdlc->state); [L5888] RET, EXPR state(hdlc) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, state(hdlc)={0:0}, tmp={0:3264}] [L5888] tmp___0 = state(hdlc) [L5889] st = tmp___0 VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}] [L5890] CALL spin_lock(& st->lock) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5263] FCALL _raw_spin_lock(& lock->ldv_6338.rlock) [L5890] RET spin_lock(& st->lock) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}] [L5891] EXPR st->up [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L [L5891] EXPR st->last_poll [L5891] EXPR st->settings.timeout [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->last_poll=0, st->settings.timeout=0, st->up=2, st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L=0, tmp={0:3264}, tmp___0={0:0}] [L5891] COND FALSE !(st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L) [L5897] EXPR st->rxseq VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->rxseq=0, tmp={0:3264}, tmp___0={0:0}] [L5897] CALL, EXPR __fswab32(st->rxseq) VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=0] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=0, val=0] [L5897] RET, EXPR __fswab32(st->rxseq) VAL [\old(arg)=0, __fswab32(st->rxseq)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->rxseq=0, tmp={0:3264}, tmp___0={0:0}] [L5897] tmp___1 = __fswab32(st->rxseq) [L5898] EXPR st->txseq [L5898] st->txseq = st->txseq + 1U [L5899] EXPR st->txseq VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->txseq=0, tmp={0:3264}, tmp___0={0:0}, tmp___1=0] [L5899] CALL, EXPR __fswab32(st->txseq) VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=0] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=0, val=0] [L5899] RET, EXPR __fswab32(st->txseq) VAL [\old(arg)=0, __fswab32(st->txseq)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->txseq=0, tmp={0:3264}, tmp___0={0:0}, tmp___1=0] [L5899] tmp___2 = __fswab32(st->txseq) [L5900] CALL cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5695] struct sk_buff *skb ; [L5696] struct cisco_packet *data ; [L5697] __u32 tmp ; [L5698] __u32 tmp___0 ; [L5700] CALL, EXPR ldv_dev_alloc_skb_12(22U) [L6356] struct sk_buff *tmp ; VAL [\old(last_index)=0, \old(length)=22, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6358] CALL, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6512] void *skb ; [L6513] void *tmp___7 ; VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6515] CALL, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND FALSE !(tmp___0 != 0) [L5527] EXPR, FCALL calloc(1UL, size) [L5527] tmp = calloc(1UL, size) [L5528] p = tmp VAL [\old(last_index)=0, \old(size)=248, __this_module={0:0}, calloc(1UL, size)={4611686018427387905:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={4611686018427387905:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={4611686018427387905:0}, tmp___0=0] [L5529] CALL assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(cond)=1, \old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5498] COND FALSE !(!cond) VAL [\old(cond)=1, \old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, cond=1, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5529] RET assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(last_index)=0, \old(size)=248, __this_module={0:0}, calloc(1UL, size)={4611686018427387905:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={4611686018427387905:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={4611686018427387905:0}, tmp___0=0] [L5530] return (p); VAL [\old(last_index)=0, \old(size)=248, \result={4611686018427387905:0}, __this_module={0:0}, calloc(1UL, size)={4611686018427387905:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={4611686018427387905:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={4611686018427387905:0}, tmp___0=0] [L6515] RET, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(sizeof(struct sk_buff___0 ))={4611686018427387905:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6515] tmp___7 = ldv_zalloc(sizeof(struct sk_buff___0 )) [L6516] skb = (struct sk_buff___0 *)tmp___7 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, tmp___7={4611686018427387905:0}] [L6517] COND FALSE !(! skb) [L6520] CALL ldv_set_add(LDV_SKBS, skb) [L6388] int i ; [L6390] i = 0 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, e={4611686018427387905:0}, e={4611686018427387905:0}, i=0, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6391] COND TRUE 1 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, e={4611686018427387905:0}, e={4611686018427387905:0}, i=0, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6392] COND FALSE !(i < last_index) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, e={4611686018427387905:0}, e={4611686018427387905:0}, i=0, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6402] COND TRUE last_index < 15 [L6403] set_impl[last_index] = e [L6404] last_index = last_index + 1 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, e={4611686018427387905:0}, e={4611686018427387905:0}, i=0, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6520] RET ldv_set_add(LDV_SKBS, skb) [L6521] return (skb); VAL [\old(last_index)=0, \result={4611686018427387905:0}, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, tmp___7={4611686018427387905:0}] [L6358] RET, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, \old(length)=22, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, ldv_skb_alloc()={4611686018427387905:0}, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6358] tmp = ldv_skb_alloc() [L6359] return (tmp); VAL [\old(last_index)=0, \old(length)=22, \result={4611686018427387905:0}, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={4611686018427387905:0}] [L5700] RET, EXPR ldv_dev_alloc_skb_12(22U) [L5700] skb = ldv_dev_alloc_skb_12(22U) [L5701] COND FALSE !((unsigned long )skb == (unsigned long )((struct sk_buff *)0)) [L5706] CALL skb_reserve(skb, 4) [L5475] EXPR skb->data [L5475] skb->data = skb->data + (unsigned long )len [L5476] EXPR skb->tail [L5476] skb->tail = skb->tail + (sk_buff_data_t )len [L5706] RET skb_reserve(skb, 4) [L5707] CALL cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5676] struct hdlc_header *data ; [L5677] __u16 tmp ; [L5679] CALL skb_push(skb, 4U) [L6687] CALL, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(last_index)=0, \old(size)=1, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5502] void *p ; [L5503] void *tmp ; [L5504] int tmp___0 ; [L5506] tmp___0 = __VERIFIER_nondet_int() [L5507] COND TRUE tmp___0 != 0 [L5508] return ((void *)0); VAL [\old(last_index)=0, \old(size)=1, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=2147483648] [L6687] RET, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(arg1)=4, \old(last_index)=0, __this_module={0:0}, arg0={4611686018427387905:0}, arg0={4611686018427387905:0}, arg1=4, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_malloc(sizeof(unsigned char))={0:0}, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6687] return ldv_malloc(sizeof(unsigned char)); [L5679] RET skb_push(skb, 4U) [L5680] EXPR skb->data [L5680] data = (struct hdlc_header *)skb->data [L5681] COND TRUE (unsigned int )type == 32821U [L5682] data->address = 143U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={0:0}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={0:0}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={4611686018427387905:0}, skb={4611686018427387905:0}, type=32821] [L5686] data->control = 0U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={0:0}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={0:0}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={4611686018427387905:0}, skb={4611686018427387905:0}, type=32821] [L5687] CALL, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(val)=32821, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5123] return ((__u16 )((int )((short )((int )val << 8)) | (int )((short )((int )val >> 8)))); VAL [\old(last_index)=0, \old(val)=32821, \result=13696, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=32821] [L5687] RET, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __fswab16((int )type)=13696, __this_module={0:0}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={0:0}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={4611686018427387905:0}, skb={4611686018427387905:0}, type=32821] [L5687] tmp = __fswab16((int )type) [L5688] data->protocol = tmp [L5689] return (4); VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, \result=4, __this_module={0:0}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={0:0}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={4611686018427387905:0}, skb={4611686018427387905:0}, tmp=13696, type=32821] [L5707] RET cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, \old(par1)=0, \old(par2)=0, \old(type)=2, __this_module={0:0}, cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U)=4, cisco_header_ops={17:0}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=0, par2=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, type=2] [L5708] EXPR skb->data [L5708] data = (struct cisco_packet *)skb->data + 4U [L5709] CALL, EXPR __fswab32(type) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=2] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=2, val=2] [L5709] RET, EXPR __fswab32(type) VAL [\old(last_index)=0, \old(par1)=0, \old(par2)=0, \old(type)=2, __fswab32(type)=2, __this_module={0:0}, cisco_header_ops={17:0}, data={0:72}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=0, par2=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, type=2] [L5709] tmp = __fswab32(type) [L5710] data->type = tmp [L5711] data->par1 = par1 [L5712] data->par2 = par2 [L5713] data->rel = 65535U VAL [\old(last_index)=0, \old(par1)=0, \old(par2)=0, \old(type)=2, __this_module={0:0}, cisco_header_ops={17:0}, data={0:72}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=0, par2=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, tmp=2, type=2] [L5714] CALL, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=300000, \result=300000, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=300000] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=300000, \result=300000, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=300000, val=300000] [L5714] RET, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, \old(par1)=0, \old(par2)=0, \old(type)=2, __fswab32(((__u32 )jiffies + 75000U) * 4U)=300000, __this_module={0:0}, cisco_header_ops={17:0}, data={0:72}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=0, par2=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, tmp=2, type=2] [L5714] tmp___0 = __fswab32(((__u32 )jiffies + 75000U) * 4U) [L5715] data->time = tmp___0 [L5716] CALL skb_put(skb, 18U) [L6690] EXPR arg0->data [L6690] EXPR arg0->tail [L6690] unsigned char *ret_val = arg0->data + arg0->tail; [L6691] EXPR arg0->tail [L6691] arg0->tail += arg1 [L6692] return ret_val; VAL [\old(arg1)=18, \old(last_index)=0, \result={0:4}, __this_module={0:0}, arg0={4611686018427387905:0}, arg0={4611686018427387905:0}, arg1=18, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, ret_val={0:4}, set_impl={18:0}] [L5716] RET skb_put(skb, 18U) [L5717] skb->priority = 7U [L5718] skb->dev = dev [L5719] CALL skb_reset_network_header(skb) [L5483] EXPR skb->data [L5483] EXPR skb->head [L5483] skb->network_header = (int )((__u16 )((long )skb->data)) - (int )((__u16 )((long )skb->head)) [L5719] RET skb_reset_network_header(skb) [L5720] CALL dev_queue_xmit(skb) [L6643] return __VERIFIER_nondet_int(); [L5720] RET dev_queue_xmit(skb) [L5900] RET cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}, tmp___1=0, tmp___2=0] [L5901] CALL spin_unlock(& st->lock) VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5270] FCALL _raw_spin_unlock(& lock->ldv_6338.rlock) [L5901] RET spin_unlock(& st->lock) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}, tmp___1=0, tmp___2=0] [L5902] EXPR st->settings.interval [L5902] st->timer.expires = (unsigned long )(st->settings.interval * 250U) + (unsigned long )jiffies [L5903] st->timer.function = & cisco_timer [L5904] st->timer.data = arg VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}, tmp___1=0, tmp___2=0] [L5905] FCALL add_timer(& st->timer) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}, tmp___1=0, tmp___2=0] [L6115] RET (*(timer->function))(timer->data) [L6116] LDV_IN_INTERRUPT = 1 [L6117] ldv_timer_state_1 = 2 VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, timer={0:0}, timer={0:0}] [L6186] RET choose_timer_1(ldv_timer_list_1) [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6195] COND TRUE ldv_state_variable_0 == 3 && ref_cnt == 0 [L6196] CALL mod_exit() [L6074] FCALL unregister_hdlc_protocol(& proto) [L6196] RET mod_exit() [L6197] ldv_state_variable_0 = 2 VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6315] CALL ldv_check_final_state() [L6579] int tmp___7 ; [L6581] CALL, EXPR ldv_set_is_empty(LDV_SKBS) [L6470] return (last_index == 0); VAL [\result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6581] RET, EXPR ldv_set_is_empty(LDV_SKBS) [L6581] tmp___7 = ldv_set_is_empty(LDV_SKBS) [L6582] COND FALSE !(\read(tmp___7)) VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp___7=0] [L6584] CALL ldv_error() VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5554] reach_error() VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] - StatisticsResult: Ultimate Automizer benchmark data CFG has 33 procedures, 489 locations, 1 error locations. Started 1 CEGAR loops. OverallTime: 12.4s, OverallIterations: 6, TraceHistogramMax: 8, PathProgramHistogramMax: 1, EmptinessCheckTime: 0.0s, AutomataDifference: 4.1s, DeadEndRemovalTime: 0.0s, HoareAnnotationTime: 0.0s, InitialAbstractionConstructionTime: 0.0s, HoareTripleCheckerStatistics: 0 mSolverCounterUnknown, 2090 SdHoareTripleChecker+Valid, 3.3s IncrementalHoareTripleChecker+Time, 0 mSdLazyCounter, 2087 mSDsluCounter, 15679 SdHoareTripleChecker+Invalid, 3.0s Time, 0 mProtectedAction, 0 SdHoareTripleChecker+Unchecked, 0 IncrementalHoareTripleChecker+Unchecked, 12051 mSDsCounter, 51 IncrementalHoareTripleChecker+Valid, 0 mProtectedPredicate, 275 IncrementalHoareTripleChecker+Invalid, 326 SdHoareTripleChecker+Unknown, 0 mSolverCounterNotChecked, 51 mSolverCounterUnsat, 3628 mSDtfsCounter, 275 mSolverCounterSat, 0.0s SdHoareTripleChecker+Time, 0 IncrementalHoareTripleChecker+Unknown, PredicateUnifierStatistics: 0 DeclaredPredicates, 461 GetRequests, 435 SyntacticMatches, 0 SemanticMatches, 26 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 6 ImplicationChecksByTransitivity, 0.8s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=1884occurred in iteration=5, InterpolantAutomatonStates: 30, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s DumpTime, AutomataMinimizationStatistics: 0.3s AutomataMinimizationTime, 5 MinimizatonAttempts, 36 StatesRemovedByMinimization, 2 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TRACE_CHECK: 0.2s SsaConstructionTime, 2.3s SatisfiabilityAnalysisTime, 1.1s InterpolantComputationTime, 640 NumberOfCodeBlocks, 640 NumberOfCodeBlocksAsserted, 6 NumberOfCheckSat, 452 ConstructedInterpolants, 0 QuantifiedInterpolants, 646 SizeOfPredicates, 16 NumberOfNonLiveVariables, 2034 ConjunctsInSsa, 40 ConjunctsInUnsatCore, 5 InterpolantComputations, 5 PerfectInterpolantSequences, 419/419 InterpolantCoveringCapability, INVARIANT_SYNTHESIS: No data available, INTERPOLANT_CONSOLIDATION: No data available, ABSTRACT_INTERPRETATION: No data available, PDR: No data available, ACCELERATED_INTERPOLATION: No data available, SIFA: No data available, ReuseStatistics: No data available RESULT: Ultimate proved your program to be incorrect! [2022-07-22 23:53:38,145 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Forceful destruction successful, exit code 0 Received shutdown request... --- End real Ultimate output --- Execution finished normally Writing output log to file Ultimate.log Writing human readable error path to file UltimateCounterExample.errorpath Result: FALSE