./Ultimate.py --spec ../sv-benchmarks/c/properties/unreach-call.prp --file ../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i --full-output --architecture 64bit -------------------------------------------------------------------------------- Checking for ERROR reachability Using default analysis Version f4b24e32 Calling Ultimate with: /usr/bin/java -Dosgi.configuration.area=/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/config -Xmx15G -Xms4m -jar /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/org.eclipse.equinox.launcher_1.5.800.v20200727-1323.jar -data @noDefault -ultimatedata /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data -tc /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/AutomizerReach.xml -i ../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i -s /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Default.epf --cacsl2boogietranslator.entry.function main --witnessprinter.witness.directory /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux --witnessprinter.witness.filename witness.graphml --witnessprinter.write.witness.besides.input.file false --witnessprinter.graph.data.specification CHECK( init(main()), LTL(G ! call(reach_error())) ) --witnessprinter.graph.data.producer Automizer --witnessprinter.graph.data.architecture 64bit --witnessprinter.graph.data.programhash aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 --- Real Ultimate output --- This is Ultimate 0.2.2-?-f4b24e3 [2022-07-14 00:17:28,025 INFO L177 SettingsManager]: Resetting all preferences to default values... [2022-07-14 00:17:28,026 INFO L181 SettingsManager]: Resetting UltimateCore preferences to default values [2022-07-14 00:17:28,054 INFO L184 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2022-07-14 00:17:28,054 INFO L181 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2022-07-14 00:17:28,056 INFO L181 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2022-07-14 00:17:28,059 INFO L181 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2022-07-14 00:17:28,064 INFO L181 SettingsManager]: Resetting LassoRanker preferences to default values [2022-07-14 00:17:28,066 INFO L181 SettingsManager]: Resetting Reaching Definitions preferences to default values [2022-07-14 00:17:28,072 INFO L181 SettingsManager]: Resetting SyntaxChecker preferences to default values [2022-07-14 00:17:28,073 INFO L181 SettingsManager]: Resetting Sifa preferences to default values [2022-07-14 00:17:28,075 INFO L184 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2022-07-14 00:17:28,076 INFO L181 SettingsManager]: Resetting LTL2Aut preferences to default values [2022-07-14 00:17:28,078 INFO L181 SettingsManager]: Resetting PEA to Boogie preferences to default values [2022-07-14 00:17:28,080 INFO L181 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2022-07-14 00:17:28,081 INFO L181 SettingsManager]: Resetting ChcToBoogie preferences to default values [2022-07-14 00:17:28,082 INFO L181 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2022-07-14 00:17:28,084 INFO L181 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2022-07-14 00:17:28,088 INFO L181 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2022-07-14 00:17:28,093 INFO L181 SettingsManager]: Resetting CodeCheck preferences to default values [2022-07-14 00:17:28,096 INFO L181 SettingsManager]: Resetting HornVerifier preferences to default values [2022-07-14 00:17:28,097 INFO L181 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2022-07-14 00:17:28,097 INFO L181 SettingsManager]: Resetting RCFGBuilder preferences to default values [2022-07-14 00:17:28,098 INFO L181 SettingsManager]: Resetting Referee preferences to default values [2022-07-14 00:17:28,100 INFO L181 SettingsManager]: Resetting TraceAbstraction preferences to default values [2022-07-14 00:17:28,104 INFO L184 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2022-07-14 00:17:28,104 INFO L184 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2022-07-14 00:17:28,105 INFO L181 SettingsManager]: Resetting TreeAutomizer preferences to default values [2022-07-14 00:17:28,106 INFO L181 SettingsManager]: Resetting IcfgToChc preferences to default values [2022-07-14 00:17:28,107 INFO L181 SettingsManager]: Resetting IcfgTransformer preferences to default values [2022-07-14 00:17:28,108 INFO L184 SettingsManager]: ReqToTest provides no preferences, ignoring... [2022-07-14 00:17:28,108 INFO L181 SettingsManager]: Resetting Boogie Printer preferences to default values [2022-07-14 00:17:28,110 INFO L181 SettingsManager]: Resetting ChcSmtPrinter preferences to default values [2022-07-14 00:17:28,110 INFO L181 SettingsManager]: Resetting ReqPrinter preferences to default values [2022-07-14 00:17:28,111 INFO L181 SettingsManager]: Resetting Witness Printer preferences to default values [2022-07-14 00:17:28,112 INFO L184 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2022-07-14 00:17:28,112 INFO L181 SettingsManager]: Resetting CDTParser preferences to default values [2022-07-14 00:17:28,113 INFO L184 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2022-07-14 00:17:28,113 INFO L184 SettingsManager]: ReqParser provides no preferences, ignoring... [2022-07-14 00:17:28,113 INFO L181 SettingsManager]: Resetting SmtParser preferences to default values [2022-07-14 00:17:28,114 INFO L181 SettingsManager]: Resetting Witness Parser preferences to default values [2022-07-14 00:17:28,116 INFO L188 SettingsManager]: Finished resetting all preferences to default values... [2022-07-14 00:17:28,117 INFO L101 SettingsManager]: Beginning loading settings from /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Default.epf [2022-07-14 00:17:28,153 INFO L113 SettingsManager]: Loading preferences was successful [2022-07-14 00:17:28,154 INFO L115 SettingsManager]: Preferences different from defaults after loading the file: [2022-07-14 00:17:28,154 INFO L136 SettingsManager]: Preferences of UltimateCore differ from their defaults: [2022-07-14 00:17:28,154 INFO L138 SettingsManager]: * Log level for class=de.uni_freiburg.informatik.ultimate.lib.smtlibutils.quantifier.QuantifierPusher=ERROR; [2022-07-14 00:17:28,155 INFO L136 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2022-07-14 00:17:28,155 INFO L138 SettingsManager]: * Ignore calls to procedures called more than once=ONLY_FOR_SEQUENTIAL_PROGRAMS [2022-07-14 00:17:28,156 INFO L136 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2022-07-14 00:17:28,156 INFO L138 SettingsManager]: * Create parallel compositions if possible=false [2022-07-14 00:17:28,156 INFO L138 SettingsManager]: * Use SBE=true [2022-07-14 00:17:28,157 INFO L136 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2022-07-14 00:17:28,157 INFO L138 SettingsManager]: * Overapproximate operations on floating types=true [2022-07-14 00:17:28,158 INFO L138 SettingsManager]: * Check division by zero=IGNORE [2022-07-14 00:17:28,158 INFO L138 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2022-07-14 00:17:28,158 INFO L138 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2022-07-14 00:17:28,158 INFO L138 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2022-07-14 00:17:28,158 INFO L138 SettingsManager]: * Check if freed pointer was valid=false [2022-07-14 00:17:28,159 INFO L138 SettingsManager]: * Use constant arrays=true [2022-07-14 00:17:28,159 INFO L138 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2022-07-14 00:17:28,159 INFO L136 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2022-07-14 00:17:28,160 INFO L138 SettingsManager]: * Size of a code block=SequenceOfStatements [2022-07-14 00:17:28,160 INFO L138 SettingsManager]: * SMT solver=External_DefaultMode [2022-07-14 00:17:28,161 INFO L138 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2022-07-14 00:17:28,161 INFO L136 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2022-07-14 00:17:28,161 INFO L138 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2022-07-14 00:17:28,161 INFO L138 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2022-07-14 00:17:28,161 INFO L138 SettingsManager]: * Trace refinement strategy=CAMEL [2022-07-14 00:17:28,162 INFO L138 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in [2022-07-14 00:17:28,162 INFO L138 SettingsManager]: * Apply one-shot large block encoding in concurrent analysis=false [2022-07-14 00:17:28,162 INFO L138 SettingsManager]: * Automaton type used in concurrency analysis=PETRI_NET [2022-07-14 00:17:28,162 INFO L138 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true [2022-07-14 00:17:28,163 INFO L138 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode WARNING: An illegal reflective access operation has occurred WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 (file:/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/com.sun.xml.bind_2.2.0.v201505121915.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int) WARNING: Please consider reporting this to the maintainers of com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations WARNING: All illegal access operations will be denied in a future release Applying setting for plugin de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: Entry function -> main Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness directory -> /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness filename -> witness.graphml Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Write witness besides input file -> false Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data specification -> CHECK( init(main()), LTL(G ! call(reach_error())) ) Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data producer -> Automizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data architecture -> 64bit Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data programhash -> aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 [2022-07-14 00:17:28,414 INFO L75 nceAwareModelManager]: Repository-Root is: /tmp [2022-07-14 00:17:28,443 INFO L261 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2022-07-14 00:17:28,445 INFO L217 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2022-07-14 00:17:28,446 INFO L271 PluginConnector]: Initializing CDTParser... [2022-07-14 00:17:28,446 INFO L275 PluginConnector]: CDTParser initialized [2022-07-14 00:17:28,448 INFO L432 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2022-07-14 00:17:28,503 INFO L220 CDTParser]: Created temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/314204d4d/e6b3bac4a71940e0ad8d92707f35e94f/FLAGeb74d21c5 [2022-07-14 00:17:29,184 INFO L306 CDTParser]: Found 1 translation units. [2022-07-14 00:17:29,187 INFO L160 CDTParser]: Scanning /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2022-07-14 00:17:29,234 INFO L349 CDTParser]: About to delete temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/314204d4d/e6b3bac4a71940e0ad8d92707f35e94f/FLAGeb74d21c5 [2022-07-14 00:17:29,347 INFO L357 CDTParser]: Successfully deleted /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/314204d4d/e6b3bac4a71940e0ad8d92707f35e94f [2022-07-14 00:17:29,350 INFO L299 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2022-07-14 00:17:29,351 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2022-07-14 00:17:29,352 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2022-07-14 00:17:29,352 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2022-07-14 00:17:29,357 INFO L275 PluginConnector]: CACSL2BoogieTranslator initialized [2022-07-14 00:17:29,358 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 14.07 12:17:29" (1/1) ... [2022-07-14 00:17:29,359 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@5fc87443 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:29, skipping insertion in model container [2022-07-14 00:17:29,359 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 14.07 12:17:29" (1/1) ... [2022-07-14 00:17:29,364 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2022-07-14 00:17:29,437 INFO L178 MainTranslator]: Built tables and reachable declarations [2022-07-14 00:17:30,177 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2022-07-14 00:17:30,474 INFO L210 PostProcessor]: Analyzing one entry point: main [2022-07-14 00:17:30,494 INFO L203 MainTranslator]: Completed pre-run [2022-07-14 00:17:30,642 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2022-07-14 00:17:30,709 INFO L210 PostProcessor]: Analyzing one entry point: main [2022-07-14 00:17:30,746 INFO L208 MainTranslator]: Completed translation [2022-07-14 00:17:30,746 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:30 WrapperNode [2022-07-14 00:17:30,747 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2022-07-14 00:17:30,748 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2022-07-14 00:17:30,748 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2022-07-14 00:17:30,748 INFO L275 PluginConnector]: Boogie Procedure Inliner initialized [2022-07-14 00:17:30,754 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:30" (1/1) ... [2022-07-14 00:17:30,803 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:30" (1/1) ... [2022-07-14 00:17:30,875 INFO L137 Inliner]: procedures = 146, calls = 357, calls flagged for inlining = 63, calls inlined = 60, statements flattened = 1425 [2022-07-14 00:17:30,876 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2022-07-14 00:17:30,876 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2022-07-14 00:17:30,876 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2022-07-14 00:17:30,876 INFO L275 PluginConnector]: Boogie Preprocessor initialized [2022-07-14 00:17:30,884 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:30" (1/1) ... [2022-07-14 00:17:30,885 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:30" (1/1) ... [2022-07-14 00:17:30,894 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:30" (1/1) ... [2022-07-14 00:17:30,901 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:30" (1/1) ... [2022-07-14 00:17:30,999 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:30" (1/1) ... [2022-07-14 00:17:31,005 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:30" (1/1) ... [2022-07-14 00:17:31,022 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:30" (1/1) ... [2022-07-14 00:17:31,040 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2022-07-14 00:17:31,048 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2022-07-14 00:17:31,048 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2022-07-14 00:17:31,048 INFO L275 PluginConnector]: RCFGBuilder initialized [2022-07-14 00:17:31,050 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:30" (1/1) ... [2022-07-14 00:17:31,056 INFO L173 SolverBuilder]: Constructing external solver with command: z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2022-07-14 00:17:31,065 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 [2022-07-14 00:17:31,076 INFO L229 MonitoredProcess]: Starting monitored process 1 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) [2022-07-14 00:17:31,097 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Waiting until timeout for monitored process [2022-07-14 00:17:31,112 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab32 [2022-07-14 00:17:31,113 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab32 [2022-07-14 00:17:31,113 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~int [2022-07-14 00:17:31,113 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~$Pointer$ [2022-07-14 00:17:31,113 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$ [2022-07-14 00:17:31,113 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_stop [2022-07-14 00:17:31,113 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_stop [2022-07-14 00:17:31,113 INFO L130 BoogieDeclarations]: Found specification of procedure read~int [2022-07-14 00:17:31,114 INFO L130 BoogieDeclarations]: Found specification of procedure state [2022-07-14 00:17:31,114 INFO L138 BoogieDeclarations]: Found implementation of procedure state [2022-07-14 00:17:31,114 INFO L130 BoogieDeclarations]: Found specification of procedure dev_to_hdlc [2022-07-14 00:17:31,114 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_to_hdlc [2022-07-14 00:17:31,114 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_ioctl [2022-07-14 00:17:31,114 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_ioctl [2022-07-14 00:17:31,114 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_rx [2022-07-14 00:17:31,114 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_rx [2022-07-14 00:17:31,115 INFO L130 BoogieDeclarations]: Found specification of procedure debug_lockdep_rcu_enabled [2022-07-14 00:17:31,115 INFO L138 BoogieDeclarations]: Found implementation of procedure debug_lockdep_rcu_enabled [2022-07-14 00:17:31,115 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_type_trans [2022-07-14 00:17:31,116 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_type_trans [2022-07-14 00:17:31,116 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_malloc [2022-07-14 00:17:31,116 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_malloc [2022-07-14 00:17:31,116 INFO L130 BoogieDeclarations]: Found specification of procedure netif_dormant_on [2022-07-14 00:17:31,116 INFO L138 BoogieDeclarations]: Found implementation of procedure netif_dormant_on [2022-07-14 00:17:31,116 INFO L130 BoogieDeclarations]: Found specification of procedure rcu_is_watching [2022-07-14 00:17:31,116 INFO L138 BoogieDeclarations]: Found implementation of procedure rcu_is_watching [2022-07-14 00:17:31,117 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_skb_alloc [2022-07-14 00:17:31,117 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_skb_alloc [2022-07-14 00:17:31,117 INFO L130 BoogieDeclarations]: Found specification of procedure write~int [2022-07-14 00:17:31,117 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_error [2022-07-14 00:17:31,117 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_error [2022-07-14 00:17:31,117 INFO L130 BoogieDeclarations]: Found specification of procedure ldv__builtin_expect [2022-07-14 00:17:31,117 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv__builtin_expect [2022-07-14 00:17:31,118 INFO L130 BoogieDeclarations]: Found specification of procedure assume_abort_if_not [2022-07-14 00:17:31,118 INFO L138 BoogieDeclarations]: Found implementation of procedure assume_abort_if_not [2022-07-14 00:17:31,118 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnHeap [2022-07-14 00:17:31,118 INFO L130 BoogieDeclarations]: Found specification of procedure spinlock_check [2022-07-14 00:17:31,118 INFO L138 BoogieDeclarations]: Found implementation of procedure spinlock_check [2022-07-14 00:17:31,118 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_hard_header [2022-07-14 00:17:31,119 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_hard_header [2022-07-14 00:17:31,119 INFO L130 BoogieDeclarations]: Found specification of procedure dev_kfree_skb_any [2022-07-14 00:17:31,119 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_kfree_skb_any [2022-07-14 00:17:31,119 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocInit [2022-07-14 00:17:31,119 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnStack [2022-07-14 00:17:31,119 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2022-07-14 00:17:31,119 INFO L130 BoogieDeclarations]: Found specification of procedure lockdep_rcu_suspicious [2022-07-14 00:17:31,120 INFO L138 BoogieDeclarations]: Found implementation of procedure lockdep_rcu_suspicious [2022-07-14 00:17:31,120 INFO L130 BoogieDeclarations]: Found specification of procedure __bad_percpu_size [2022-07-14 00:17:31,120 INFO L130 BoogieDeclarations]: Found specification of procedure reg_timer_1 [2022-07-14 00:17:31,120 INFO L138 BoogieDeclarations]: Found implementation of procedure reg_timer_1 [2022-07-14 00:17:31,120 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_to_user [2022-07-14 00:17:31,121 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_to_user [2022-07-14 00:17:31,121 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2022-07-14 00:17:31,121 INFO L130 BoogieDeclarations]: Found specification of procedure add_timer [2022-07-14 00:17:31,121 INFO L138 BoogieDeclarations]: Found implementation of procedure add_timer [2022-07-14 00:17:31,121 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock_irqrestore [2022-07-14 00:17:31,122 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock_irqrestore [2022-07-14 00:17:31,123 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.dealloc [2022-07-14 00:17:31,123 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$ [2022-07-14 00:17:31,123 INFO L130 BoogieDeclarations]: Found specification of procedure might_fault [2022-07-14 00:17:31,124 INFO L138 BoogieDeclarations]: Found implementation of procedure might_fault [2022-07-14 00:17:31,124 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_keepalive_send [2022-07-14 00:17:31,124 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_keepalive_send [2022-07-14 00:17:31,124 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab16 [2022-07-14 00:17:31,125 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab16 [2022-07-14 00:17:31,125 INFO L130 BoogieDeclarations]: Found specification of procedure _raw_spin_lock_irqsave [2022-07-14 00:17:31,125 INFO L138 BoogieDeclarations]: Found implementation of procedure _raw_spin_lock_irqsave [2022-07-14 00:17:31,125 INFO L130 BoogieDeclarations]: Found specification of procedure spin_lock [2022-07-14 00:17:31,125 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_lock [2022-07-14 00:17:31,125 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock [2022-07-14 00:17:31,126 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock [2022-07-14 00:17:31,126 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int [2022-07-14 00:17:31,126 INFO L130 BoogieDeclarations]: Found specification of procedure linkwatch_fire_event [2022-07-14 00:17:31,126 INFO L138 BoogieDeclarations]: Found implementation of procedure linkwatch_fire_event [2022-07-14 00:17:31,127 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~int [2022-07-14 00:17:31,127 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_zalloc [2022-07-14 00:17:31,127 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_zalloc [2022-07-14 00:17:31,127 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_from_user [2022-07-14 00:17:31,127 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_from_user [2022-07-14 00:17:31,127 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2022-07-14 00:17:31,127 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2022-07-14 00:17:31,460 INFO L234 CfgBuilder]: Building ICFG [2022-07-14 00:17:31,462 INFO L260 CfgBuilder]: Building CFG for each procedure with an implementation [2022-07-14 00:17:31,731 INFO L764 $ProcedureCfgBuilder]: dead code at ProgramPoint ldv_stopFINAL: assume true; [2022-07-14 00:17:32,447 INFO L275 CfgBuilder]: Performing block encoding [2022-07-14 00:17:32,458 INFO L294 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2022-07-14 00:17:32,458 INFO L299 CfgBuilder]: Removed 1 assume(true) statements. [2022-07-14 00:17:32,461 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 14.07 12:17:32 BoogieIcfgContainer [2022-07-14 00:17:32,461 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2022-07-14 00:17:32,463 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2022-07-14 00:17:32,463 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2022-07-14 00:17:32,469 INFO L275 PluginConnector]: TraceAbstraction initialized [2022-07-14 00:17:32,470 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 14.07 12:17:29" (1/3) ... [2022-07-14 00:17:32,471 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@1e0d0994 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 14.07 12:17:32, skipping insertion in model container [2022-07-14 00:17:32,471 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:30" (2/3) ... [2022-07-14 00:17:32,471 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@1e0d0994 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 14.07 12:17:32, skipping insertion in model container [2022-07-14 00:17:32,472 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 14.07 12:17:32" (3/3) ... [2022-07-14 00:17:32,473 INFO L111 eAbstractionObserver]: Analyzing ICFG 205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2022-07-14 00:17:32,487 INFO L201 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2022-07-14 00:17:32,488 INFO L160 ceAbstractionStarter]: Applying trace abstraction to program that has 1 error locations. [2022-07-14 00:17:32,574 INFO L356 AbstractCegarLoop]: ======== Iteration 0 == of CEGAR loop == AllErrorsAtOnce ======== [2022-07-14 00:17:32,581 INFO L357 AbstractCegarLoop]: Settings: SEPARATE_VIOLATION_CHECK=true, mInterprocedural=true, mMaxIterations=1000000, mWatchIteration=1000000, mArtifact=RCFG, mInterpolation=FPandBP, mInterpolantAutomaton=STRAIGHT_LINE, mDumpAutomata=false, mAutomataFormat=ATS_NUMERATE, mDumpPath=., mDeterminiation=PREDICATE_ABSTRACTION, mMinimize=MINIMIZE_SEVPA, mHoare=true, mAutomataTypeConcurrency=PETRI_NET, mHoareTripleChecks=INCREMENTAL, mHoareAnnotationPositions=LoopsAndPotentialCycles, mDumpOnlyReuseAutomata=false, mLimitTraceHistogram=0, mErrorLocTimeLimit=0, mLimitPathProgramCount=0, mCollectInterpolantStatistics=true, mHeuristicEmptinessCheck=false, mHeuristicEmptinessCheckAStarHeuristic=ZERO, mHeuristicEmptinessCheckAStarHeuristicRandomSeed=1337, mHeuristicEmptinessCheckSmtFeatureScoringMethod=DAGSIZE, mSMTFeatureExtraction=false, mSMTFeatureExtractionDumpPath=., mOverrideInterpolantAutomaton=false, mMcrInterpolantMethod=WP, mPorIndependenceSettings=de.uni_freiburg.informatik.ultimate.lib.tracecheckerutils.partialorder.independence.IndependenceSettings@50fae45, mLbeIndependenceSettings=de.uni_freiburg.informatik.ultimate.lib.tracecheckerutils.partialorder.independence.IndependenceSettings@79c30de6 [2022-07-14 00:17:32,582 INFO L358 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2022-07-14 00:17:32,590 INFO L276 IsEmpty]: Start isEmpty. Operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) [2022-07-14 00:17:32,607 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 48 [2022-07-14 00:17:32,607 INFO L187 NwaCegarLoop]: Found error trace [2022-07-14 00:17:32,609 INFO L195 NwaCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-14 00:17:32,609 INFO L420 AbstractCegarLoop]: === Iteration 1 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-14 00:17:32,615 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-14 00:17:32,616 INFO L85 PathProgramCache]: Analyzing trace with hash 742124414, now seen corresponding path program 1 times [2022-07-14 00:17:32,624 INFO L118 FreeRefinementEngine]: Executing refinement strategy CAMEL [2022-07-14 00:17:32,625 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [1146660388] [2022-07-14 00:17:32,625 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-14 00:17:32,626 INFO L127 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2022-07-14 00:17:32,839 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:33,021 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2022-07-14 00:17:33,027 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:33,044 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2022-07-14 00:17:33,051 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:33,064 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2022-07-14 00:17:33,067 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:33,073 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2022-07-14 00:17:33,078 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:33,086 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2022-07-14 00:17:33,089 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:33,095 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2022-07-14 00:17:33,096 INFO L136 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2022-07-14 00:17:33,096 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [1146660388] [2022-07-14 00:17:33,101 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [1146660388] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-14 00:17:33,101 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-14 00:17:33,101 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2022-07-14 00:17:33,103 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [83762985] [2022-07-14 00:17:33,103 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-14 00:17:33,107 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 4 states [2022-07-14 00:17:33,108 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2022-07-14 00:17:33,134 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2022-07-14 00:17:33,135 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2022-07-14 00:17:33,138 INFO L87 Difference]: Start difference. First operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) Second operand has 4 states, 4 states have (on average 6.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-14 00:17:34,207 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-14 00:17:34,208 INFO L93 Difference]: Finished difference Result 1541 states and 2218 transitions. [2022-07-14 00:17:34,209 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2022-07-14 00:17:34,210 INFO L78 Accepts]: Start accepts. Automaton has has 4 states, 4 states have (on average 6.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 47 [2022-07-14 00:17:34,211 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-14 00:17:34,227 INFO L225 Difference]: With dead ends: 1541 [2022-07-14 00:17:34,228 INFO L226 Difference]: Without dead ends: 1042 [2022-07-14 00:17:34,235 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 15 GetRequests, 12 SyntacticMatches, 0 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2022-07-14 00:17:34,238 INFO L413 NwaCegarLoop]: 705 mSDtfsCounter, 1084 mSDsluCounter, 751 mSDsCounter, 0 mSdLazyCounter, 466 mSolverCounterSat, 283 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.8s Time, 0 mProtectedPredicate, 0 mProtectedAction, 1162 SdHoareTripleChecker+Valid, 1456 SdHoareTripleChecker+Invalid, 749 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 283 IncrementalHoareTripleChecker+Valid, 466 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.9s IncrementalHoareTripleChecker+Time [2022-07-14 00:17:34,239 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [1162 Valid, 1456 Invalid, 749 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [283 Valid, 466 Invalid, 0 Unknown, 0 Unchecked, 0.9s Time] [2022-07-14 00:17:34,256 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1042 states. [2022-07-14 00:17:34,354 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1042 to 924. [2022-07-14 00:17:34,357 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 924 states, 685 states have (on average 1.3562043795620438) internal successors, (929), 699 states have internal predecessors, (929), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2022-07-14 00:17:34,363 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 924 states to 924 states and 1284 transitions. [2022-07-14 00:17:34,365 INFO L78 Accepts]: Start accepts. Automaton has 924 states and 1284 transitions. Word has length 47 [2022-07-14 00:17:34,365 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-14 00:17:34,365 INFO L495 AbstractCegarLoop]: Abstraction has 924 states and 1284 transitions. [2022-07-14 00:17:34,366 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 4 states, 4 states have (on average 6.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-14 00:17:34,366 INFO L276 IsEmpty]: Start isEmpty. Operand 924 states and 1284 transitions. [2022-07-14 00:17:34,369 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 51 [2022-07-14 00:17:34,369 INFO L187 NwaCegarLoop]: Found error trace [2022-07-14 00:17:34,369 INFO L195 NwaCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-14 00:17:34,369 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable0 [2022-07-14 00:17:34,370 INFO L420 AbstractCegarLoop]: === Iteration 2 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-14 00:17:34,370 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-14 00:17:34,370 INFO L85 PathProgramCache]: Analyzing trace with hash -2097093995, now seen corresponding path program 1 times [2022-07-14 00:17:34,371 INFO L118 FreeRefinementEngine]: Executing refinement strategy CAMEL [2022-07-14 00:17:34,371 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [602101321] [2022-07-14 00:17:34,371 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-14 00:17:34,371 INFO L127 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2022-07-14 00:17:34,397 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:34,451 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2022-07-14 00:17:34,454 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:34,459 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2022-07-14 00:17:34,461 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:34,466 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2022-07-14 00:17:34,467 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:34,475 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2022-07-14 00:17:34,477 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:34,481 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2022-07-14 00:17:34,483 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:34,488 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2022-07-14 00:17:34,488 INFO L136 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2022-07-14 00:17:34,488 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [602101321] [2022-07-14 00:17:34,488 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [602101321] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-14 00:17:34,489 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-14 00:17:34,489 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [] total 5 [2022-07-14 00:17:34,489 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [886670606] [2022-07-14 00:17:34,489 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-14 00:17:34,490 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2022-07-14 00:17:34,491 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2022-07-14 00:17:34,491 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2022-07-14 00:17:34,491 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2022-07-14 00:17:34,492 INFO L87 Difference]: Start difference. First operand 924 states and 1284 transitions. Second operand has 5 states, 5 states have (on average 5.4) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-14 00:17:35,249 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-14 00:17:35,249 INFO L93 Difference]: Finished difference Result 1951 states and 2732 transitions. [2022-07-14 00:17:35,250 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2022-07-14 00:17:35,250 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 5.4) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 50 [2022-07-14 00:17:35,250 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-14 00:17:35,256 INFO L225 Difference]: With dead ends: 1951 [2022-07-14 00:17:35,257 INFO L226 Difference]: Without dead ends: 1041 [2022-07-14 00:17:35,260 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 18 GetRequests, 13 SyntacticMatches, 0 SemanticMatches, 5 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 1 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=15, Invalid=27, Unknown=0, NotChecked=0, Total=42 [2022-07-14 00:17:35,261 INFO L413 NwaCegarLoop]: 740 mSDtfsCounter, 987 mSDsluCounter, 829 mSDsCounter, 0 mSdLazyCounter, 439 mSolverCounterSat, 247 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.6s Time, 0 mProtectedPredicate, 0 mProtectedAction, 1049 SdHoareTripleChecker+Valid, 1569 SdHoareTripleChecker+Invalid, 686 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 247 IncrementalHoareTripleChecker+Valid, 439 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.7s IncrementalHoareTripleChecker+Time [2022-07-14 00:17:35,262 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [1049 Valid, 1569 Invalid, 686 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [247 Valid, 439 Invalid, 0 Unknown, 0 Unchecked, 0.7s Time] [2022-07-14 00:17:35,263 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1041 states. [2022-07-14 00:17:35,332 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1041 to 923. [2022-07-14 00:17:35,334 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 923 states, 684 states have (on average 1.3523391812865497) internal successors, (925), 698 states have internal predecessors, (925), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2022-07-14 00:17:35,340 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 923 states to 923 states and 1280 transitions. [2022-07-14 00:17:35,341 INFO L78 Accepts]: Start accepts. Automaton has 923 states and 1280 transitions. Word has length 50 [2022-07-14 00:17:35,342 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-14 00:17:35,342 INFO L495 AbstractCegarLoop]: Abstraction has 923 states and 1280 transitions. [2022-07-14 00:17:35,342 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 5.4) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-14 00:17:35,342 INFO L276 IsEmpty]: Start isEmpty. Operand 923 states and 1280 transitions. [2022-07-14 00:17:35,351 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 72 [2022-07-14 00:17:35,352 INFO L187 NwaCegarLoop]: Found error trace [2022-07-14 00:17:35,352 INFO L195 NwaCegarLoop]: trace histogram [7, 7, 7, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-14 00:17:35,352 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable1 [2022-07-14 00:17:35,353 INFO L420 AbstractCegarLoop]: === Iteration 3 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-14 00:17:35,353 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-14 00:17:35,353 INFO L85 PathProgramCache]: Analyzing trace with hash 171125928, now seen corresponding path program 1 times [2022-07-14 00:17:35,354 INFO L118 FreeRefinementEngine]: Executing refinement strategy CAMEL [2022-07-14 00:17:35,354 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [671028597] [2022-07-14 00:17:35,354 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-14 00:17:35,354 INFO L127 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2022-07-14 00:17:35,396 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:35,466 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2022-07-14 00:17:35,468 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:35,471 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2022-07-14 00:17:35,472 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:35,478 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2022-07-14 00:17:35,480 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:35,483 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2022-07-14 00:17:35,484 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:35,487 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2022-07-14 00:17:35,489 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:35,492 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 44 [2022-07-14 00:17:35,496 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:35,501 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 50 [2022-07-14 00:17:35,504 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:35,513 INFO L134 CoverageAnalysis]: Checked inductivity of 89 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 89 trivial. 0 not checked. [2022-07-14 00:17:35,514 INFO L136 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2022-07-14 00:17:35,514 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [671028597] [2022-07-14 00:17:35,514 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [671028597] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-14 00:17:35,514 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-14 00:17:35,514 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [6] imperfect sequences [] total 6 [2022-07-14 00:17:35,515 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1111131522] [2022-07-14 00:17:35,515 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-14 00:17:35,515 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 6 states [2022-07-14 00:17:35,516 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2022-07-14 00:17:35,518 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 6 interpolants. [2022-07-14 00:17:35,518 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=9, Invalid=21, Unknown=0, NotChecked=0, Total=30 [2022-07-14 00:17:35,519 INFO L87 Difference]: Start difference. First operand 923 states and 1280 transitions. Second operand has 6 states, 6 states have (on average 5.666666666666667) internal successors, (34), 5 states have internal predecessors, (34), 3 states have call successors, (8), 2 states have call predecessors, (8), 1 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2022-07-14 00:17:36,830 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-14 00:17:36,831 INFO L93 Difference]: Finished difference Result 2974 states and 4185 transitions. [2022-07-14 00:17:36,831 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 7 states. [2022-07-14 00:17:36,831 INFO L78 Accepts]: Start accepts. Automaton has has 6 states, 6 states have (on average 5.666666666666667) internal successors, (34), 5 states have internal predecessors, (34), 3 states have call successors, (8), 2 states have call predecessors, (8), 1 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) Word has length 71 [2022-07-14 00:17:36,832 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-14 00:17:36,845 INFO L225 Difference]: With dead ends: 2974 [2022-07-14 00:17:36,845 INFO L226 Difference]: Without dead ends: 2060 [2022-07-14 00:17:36,850 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 23 GetRequests, 16 SyntacticMatches, 0 SemanticMatches, 7 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 2 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=23, Invalid=49, Unknown=0, NotChecked=0, Total=72 [2022-07-14 00:17:36,856 INFO L413 NwaCegarLoop]: 692 mSDtfsCounter, 1091 mSDsluCounter, 1785 mSDsCounter, 0 mSdLazyCounter, 1001 mSolverCounterSat, 269 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.9s Time, 0 mProtectedPredicate, 0 mProtectedAction, 1173 SdHoareTripleChecker+Valid, 2477 SdHoareTripleChecker+Invalid, 1270 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 269 IncrementalHoareTripleChecker+Valid, 1001 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 1.2s IncrementalHoareTripleChecker+Time [2022-07-14 00:17:36,858 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [1173 Valid, 2477 Invalid, 1270 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [269 Valid, 1001 Invalid, 0 Unknown, 0 Unchecked, 1.2s Time] [2022-07-14 00:17:36,861 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 2060 states. [2022-07-14 00:17:36,941 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 2060 to 1924. [2022-07-14 00:17:36,945 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1924 states, 1437 states have (on average 1.3625608907446067) internal successors, (1958), 1469 states have internal predecessors, (1958), 358 states have call successors, (358), 121 states have call predecessors, (358), 128 states have return successors, (381), 363 states have call predecessors, (381), 357 states have call successors, (381) [2022-07-14 00:17:36,957 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1924 states to 1924 states and 2697 transitions. [2022-07-14 00:17:36,958 INFO L78 Accepts]: Start accepts. Automaton has 1924 states and 2697 transitions. Word has length 71 [2022-07-14 00:17:36,958 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-14 00:17:36,958 INFO L495 AbstractCegarLoop]: Abstraction has 1924 states and 2697 transitions. [2022-07-14 00:17:36,959 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 6 states, 6 states have (on average 5.666666666666667) internal successors, (34), 5 states have internal predecessors, (34), 3 states have call successors, (8), 2 states have call predecessors, (8), 1 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2022-07-14 00:17:36,959 INFO L276 IsEmpty]: Start isEmpty. Operand 1924 states and 2697 transitions. [2022-07-14 00:17:36,966 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 142 [2022-07-14 00:17:36,966 INFO L187 NwaCegarLoop]: Found error trace [2022-07-14 00:17:36,966 INFO L195 NwaCegarLoop]: trace histogram [8, 8, 8, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-14 00:17:36,967 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable2 [2022-07-14 00:17:36,967 INFO L420 AbstractCegarLoop]: === Iteration 4 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-14 00:17:36,968 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-14 00:17:36,968 INFO L85 PathProgramCache]: Analyzing trace with hash 1729160309, now seen corresponding path program 1 times [2022-07-14 00:17:36,968 INFO L118 FreeRefinementEngine]: Executing refinement strategy CAMEL [2022-07-14 00:17:36,968 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [1985279038] [2022-07-14 00:17:36,968 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-14 00:17:36,969 INFO L127 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2022-07-14 00:17:37,010 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:37,080 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2022-07-14 00:17:37,084 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:37,091 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2022-07-14 00:17:37,096 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:37,109 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2022-07-14 00:17:37,111 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:37,115 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2022-07-14 00:17:37,116 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:37,121 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2022-07-14 00:17:37,123 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:37,126 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 37 [2022-07-14 00:17:37,127 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:37,133 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 43 [2022-07-14 00:17:37,134 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:37,138 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 48 [2022-07-14 00:17:37,139 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:37,142 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 57 [2022-07-14 00:17:37,144 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:37,147 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 63 [2022-07-14 00:17:37,148 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:37,160 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 69 [2022-07-14 00:17:37,177 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:37,198 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2022-07-14 00:17:37,215 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:37,277 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2022-07-14 00:17:37,282 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:37,305 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 91 [2022-07-14 00:17:37,306 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:37,309 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 97 [2022-07-14 00:17:37,310 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:37,313 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 114 [2022-07-14 00:17:37,315 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:37,318 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 120 [2022-07-14 00:17:37,320 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:37,324 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 14 proven. 4 refuted. 0 times theorem prover too weak. 107 trivial. 0 not checked. [2022-07-14 00:17:37,324 INFO L136 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2022-07-14 00:17:37,324 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [1985279038] [2022-07-14 00:17:37,324 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [1985279038] provided 0 perfect and 1 imperfect interpolant sequences [2022-07-14 00:17:37,325 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleZ3 [1303979010] [2022-07-14 00:17:37,325 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-14 00:17:37,325 INFO L173 SolverBuilder]: Constructing external solver with command: z3 -smt2 -in SMTLIB2_COMPLIANT=true [2022-07-14 00:17:37,325 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 [2022-07-14 00:17:37,327 INFO L229 MonitoredProcess]: Starting monitored process 2 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true (exit command is (exit), workingDir is null) [2022-07-14 00:17:37,361 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true (2)] Waiting until timeout for monitored process [2022-07-14 00:17:37,643 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:37,649 INFO L263 TraceCheckSpWp]: Trace formula consists of 961 conjuncts, 17 conjunts are in the unsatisfiable core [2022-07-14 00:17:37,658 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2022-07-14 00:17:37,753 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 62 proven. 0 refuted. 0 times theorem prover too weak. 63 trivial. 0 not checked. [2022-07-14 00:17:37,754 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2022-07-14 00:17:37,754 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleZ3 [1303979010] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-14 00:17:37,754 INFO L184 FreeRefinementEngine]: Found 1 perfect and 1 imperfect interpolant sequences. [2022-07-14 00:17:37,754 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [7] total 7 [2022-07-14 00:17:37,755 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [257800062] [2022-07-14 00:17:37,755 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-14 00:17:37,755 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2022-07-14 00:17:37,756 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2022-07-14 00:17:37,756 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2022-07-14 00:17:37,756 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=12, Invalid=30, Unknown=0, NotChecked=0, Total=42 [2022-07-14 00:17:37,757 INFO L87 Difference]: Start difference. First operand 1924 states and 2697 transitions. Second operand has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2022-07-14 00:17:37,919 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-14 00:17:37,919 INFO L93 Difference]: Finished difference Result 3838 states and 5422 transitions. [2022-07-14 00:17:37,920 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2022-07-14 00:17:37,920 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) Word has length 141 [2022-07-14 00:17:37,921 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-14 00:17:37,930 INFO L225 Difference]: With dead ends: 3838 [2022-07-14 00:17:37,931 INFO L226 Difference]: Without dead ends: 1928 [2022-07-14 00:17:37,937 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 181 GetRequests, 173 SyntacticMatches, 3 SemanticMatches, 5 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 6 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=12, Invalid=30, Unknown=0, NotChecked=0, Total=42 [2022-07-14 00:17:37,937 INFO L413 NwaCegarLoop]: 658 mSDtfsCounter, 2 mSDsluCounter, 1961 mSDsCounter, 0 mSdLazyCounter, 19 mSolverCounterSat, 1 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.0s Time, 0 mProtectedPredicate, 0 mProtectedAction, 2 SdHoareTripleChecker+Valid, 2619 SdHoareTripleChecker+Invalid, 20 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 1 IncrementalHoareTripleChecker+Valid, 19 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.0s IncrementalHoareTripleChecker+Time [2022-07-14 00:17:37,938 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [2 Valid, 2619 Invalid, 20 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [1 Valid, 19 Invalid, 0 Unknown, 0 Unchecked, 0.0s Time] [2022-07-14 00:17:37,940 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1928 states. [2022-07-14 00:17:37,995 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1928 to 1924. [2022-07-14 00:17:37,999 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1924 states, 1433 states have (on average 1.357990230286113) internal successors, (1946), 1467 states have internal predecessors, (1946), 358 states have call successors, (358), 121 states have call predecessors, (358), 132 states have return successors, (392), 365 states have call predecessors, (392), 357 states have call successors, (392) [2022-07-14 00:17:38,009 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1924 states to 1924 states and 2696 transitions. [2022-07-14 00:17:38,010 INFO L78 Accepts]: Start accepts. Automaton has 1924 states and 2696 transitions. Word has length 141 [2022-07-14 00:17:38,011 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-14 00:17:38,011 INFO L495 AbstractCegarLoop]: Abstraction has 1924 states and 2696 transitions. [2022-07-14 00:17:38,011 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2022-07-14 00:17:38,011 INFO L276 IsEmpty]: Start isEmpty. Operand 1924 states and 2696 transitions. [2022-07-14 00:17:38,017 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 149 [2022-07-14 00:17:38,017 INFO L187 NwaCegarLoop]: Found error trace [2022-07-14 00:17:38,017 INFO L195 NwaCegarLoop]: trace histogram [8, 8, 7, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-14 00:17:38,044 INFO L552 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true (2)] Ended with exit code 0 [2022-07-14 00:17:38,239 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable3,2 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true [2022-07-14 00:17:38,240 INFO L420 AbstractCegarLoop]: === Iteration 5 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-14 00:17:38,240 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-14 00:17:38,240 INFO L85 PathProgramCache]: Analyzing trace with hash 568539780, now seen corresponding path program 1 times [2022-07-14 00:17:38,240 INFO L118 FreeRefinementEngine]: Executing refinement strategy CAMEL [2022-07-14 00:17:38,240 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [1254793418] [2022-07-14 00:17:38,241 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-14 00:17:38,241 INFO L127 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2022-07-14 00:17:38,330 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:38,419 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2022-07-14 00:17:38,421 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:38,428 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2022-07-14 00:17:38,431 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:38,436 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2022-07-14 00:17:38,438 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:38,440 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2022-07-14 00:17:38,442 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:38,445 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2022-07-14 00:17:38,446 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:38,449 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 44 [2022-07-14 00:17:38,450 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:38,454 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 50 [2022-07-14 00:17:38,455 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:38,458 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 61 [2022-07-14 00:17:38,459 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:38,462 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 67 [2022-07-14 00:17:38,464 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:38,466 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 72 [2022-07-14 00:17:38,468 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:38,470 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 81 [2022-07-14 00:17:38,472 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:38,474 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 87 [2022-07-14 00:17:38,475 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:38,488 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 93 [2022-07-14 00:17:38,503 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:38,580 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2022-07-14 00:17:38,593 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:38,701 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2022-07-14 00:17:38,715 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:38,824 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 3 [2022-07-14 00:17:38,827 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:38,868 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 122 [2022-07-14 00:17:38,869 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:38,872 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 128 [2022-07-14 00:17:38,873 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:17:38,880 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 104 trivial. 0 not checked. [2022-07-14 00:17:38,880 INFO L136 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2022-07-14 00:17:38,880 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [1254793418] [2022-07-14 00:17:38,880 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [1254793418] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-14 00:17:38,881 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-14 00:17:38,881 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [16] imperfect sequences [] total 16 [2022-07-14 00:17:38,881 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [2082083392] [2022-07-14 00:17:38,881 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-14 00:17:38,883 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 16 states [2022-07-14 00:17:38,883 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2022-07-14 00:17:38,883 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 16 interpolants. [2022-07-14 00:17:38,883 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=31, Invalid=209, Unknown=0, NotChecked=0, Total=240 [2022-07-14 00:17:38,884 INFO L87 Difference]: Start difference. First operand 1924 states and 2696 transitions. Second operand has 16 states, 15 states have (on average 5.866666666666666) internal successors, (88), 11 states have internal predecessors, (88), 3 states have call successors, (19), 4 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 3 states have call successors, (18) [2022-07-14 00:17:42,165 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-14 00:17:42,165 INFO L93 Difference]: Finished difference Result 3994 states and 5630 transitions. [2022-07-14 00:17:42,166 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 15 states. [2022-07-14 00:17:42,166 INFO L78 Accepts]: Start accepts. Automaton has has 16 states, 15 states have (on average 5.866666666666666) internal successors, (88), 11 states have internal predecessors, (88), 3 states have call successors, (19), 4 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 3 states have call successors, (18) Word has length 148 [2022-07-14 00:17:42,169 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-14 00:17:42,201 INFO L225 Difference]: With dead ends: 3994 [2022-07-14 00:17:42,202 INFO L226 Difference]: Without dead ends: 2084 [2022-07-14 00:17:42,211 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 58 GetRequests, 37 SyntacticMatches, 0 SemanticMatches, 21 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 41 ImplicationChecksByTransitivity, 0.3s TimeCoverageRelationStatistics Valid=69, Invalid=437, Unknown=0, NotChecked=0, Total=506 [2022-07-14 00:17:42,212 INFO L413 NwaCegarLoop]: 620 mSDtfsCounter, 511 mSDsluCounter, 5439 mSDsCounter, 0 mSdLazyCounter, 2558 mSolverCounterSat, 228 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 2.5s Time, 0 mProtectedPredicate, 0 mProtectedAction, 532 SdHoareTripleChecker+Valid, 6059 SdHoareTripleChecker+Invalid, 2786 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 228 IncrementalHoareTripleChecker+Valid, 2558 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 3.0s IncrementalHoareTripleChecker+Time [2022-07-14 00:17:42,212 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [532 Valid, 6059 Invalid, 2786 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [228 Valid, 2558 Invalid, 0 Unknown, 0 Unchecked, 3.0s Time] [2022-07-14 00:17:42,230 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 2084 states. [2022-07-14 00:17:42,339 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 2084 to 1954. [2022-07-14 00:17:42,344 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1954 states, 1455 states have (on average 1.3484536082474228) internal successors, (1962), 1489 states have internal predecessors, (1962), 364 states have call successors, (364), 121 states have call predecessors, (364), 134 states have return successors, (402), 373 states have call predecessors, (402), 363 states have call successors, (402) [2022-07-14 00:17:42,353 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1954 states to 1954 states and 2728 transitions. [2022-07-14 00:17:42,354 INFO L78 Accepts]: Start accepts. Automaton has 1954 states and 2728 transitions. Word has length 148 [2022-07-14 00:17:42,356 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-14 00:17:42,356 INFO L495 AbstractCegarLoop]: Abstraction has 1954 states and 2728 transitions. [2022-07-14 00:17:42,356 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 16 states, 15 states have (on average 5.866666666666666) internal successors, (88), 11 states have internal predecessors, (88), 3 states have call successors, (19), 4 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 3 states have call successors, (18) [2022-07-14 00:17:42,356 INFO L276 IsEmpty]: Start isEmpty. Operand 1954 states and 2728 transitions. [2022-07-14 00:17:42,381 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 184 [2022-07-14 00:17:42,381 INFO L187 NwaCegarLoop]: Found error trace [2022-07-14 00:17:42,381 INFO L195 NwaCegarLoop]: trace histogram [8, 8, 7, 4, 4, 4, 3, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-14 00:17:42,382 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable4 [2022-07-14 00:17:42,382 INFO L420 AbstractCegarLoop]: === Iteration 6 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-14 00:17:42,382 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-14 00:17:42,383 INFO L85 PathProgramCache]: Analyzing trace with hash -799997024, now seen corresponding path program 1 times [2022-07-14 00:17:42,383 INFO L118 FreeRefinementEngine]: Executing refinement strategy CAMEL [2022-07-14 00:17:42,383 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [2098781599] [2022-07-14 00:17:42,383 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-14 00:17:42,383 INFO L127 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2022-07-14 00:17:43,664 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2022-07-14 00:17:43,665 INFO L352 TraceCheck]: Trace is feasible, we will do another trace check, this time with branch encoders. [2022-07-14 00:17:44,018 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2022-07-14 00:17:44,143 INFO L130 FreeRefinementEngine]: Strategy CAMEL found a feasible trace [2022-07-14 00:17:44,143 INFO L271 BasicCegarLoop]: Counterexample is feasible [2022-07-14 00:17:44,144 INFO L805 garLoopResultBuilder]: Registering result UNSAFE for location ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION (0 of 1 remaining) [2022-07-14 00:17:44,146 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable5 [2022-07-14 00:17:44,149 INFO L356 BasicCegarLoop]: Path program histogram: [1, 1, 1, 1, 1, 1] [2022-07-14 00:17:44,152 INFO L176 ceAbstractionStarter]: Computing trace abstraction results [2022-07-14 00:17:44,215 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:17:44,216 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:17:44,217 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:17:44,217 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:17:44,217 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:17:44,218 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:17:44,218 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:17:44,218 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:17:44,218 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:17:44,218 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:17:44,465 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 14.07 12:17:44 BoogieIcfgContainer [2022-07-14 00:17:44,465 INFO L132 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2022-07-14 00:17:44,466 INFO L113 PluginConnector]: ------------------------Witness Printer---------------------------- [2022-07-14 00:17:44,466 INFO L271 PluginConnector]: Initializing Witness Printer... [2022-07-14 00:17:44,466 INFO L275 PluginConnector]: Witness Printer initialized [2022-07-14 00:17:44,467 INFO L185 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 14.07 12:17:32" (3/4) ... [2022-07-14 00:17:44,478 INFO L140 WitnessPrinter]: No result that supports witness generation found [2022-07-14 00:17:44,478 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2022-07-14 00:17:44,478 INFO L158 Benchmark]: Toolchain (without parser) took 15127.66ms. Allocated memory was 92.3MB in the beginning and 415.2MB in the end (delta: 323.0MB). Free memory was 66.3MB in the beginning and 290.9MB in the end (delta: -224.6MB). Peak memory consumption was 97.0MB. Max. memory is 16.1GB. [2022-07-14 00:17:44,479 INFO L158 Benchmark]: CDTParser took 0.22ms. Allocated memory is still 92.3MB. Free memory is still 68.0MB. There was no memory consumed. Max. memory is 16.1GB. [2022-07-14 00:17:44,479 INFO L158 Benchmark]: CACSL2BoogieTranslator took 1395.13ms. Allocated memory was 92.3MB in the beginning and 130.0MB in the end (delta: 37.7MB). Free memory was 66.2MB in the beginning and 62.4MB in the end (delta: 3.8MB). Peak memory consumption was 65.7MB. Max. memory is 16.1GB. [2022-07-14 00:17:44,479 INFO L158 Benchmark]: Boogie Procedure Inliner took 128.01ms. Allocated memory is still 130.0MB. Free memory was 62.4MB in the beginning and 54.0MB in the end (delta: 8.4MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. [2022-07-14 00:17:44,480 INFO L158 Benchmark]: Boogie Preprocessor took 170.54ms. Allocated memory is still 130.0MB. Free memory was 54.0MB in the beginning and 78.8MB in the end (delta: -24.9MB). Peak memory consumption was 15.6MB. Max. memory is 16.1GB. [2022-07-14 00:17:44,480 INFO L158 Benchmark]: RCFGBuilder took 1413.59ms. Allocated memory was 130.0MB in the beginning and 230.7MB in the end (delta: 100.7MB). Free memory was 78.8MB in the beginning and 134.4MB in the end (delta: -55.6MB). Peak memory consumption was 45.3MB. Max. memory is 16.1GB. [2022-07-14 00:17:44,480 INFO L158 Benchmark]: TraceAbstraction took 12002.58ms. Allocated memory was 230.7MB in the beginning and 415.2MB in the end (delta: 184.5MB). Free memory was 133.4MB in the beginning and 290.9MB in the end (delta: -157.6MB). Peak memory consumption was 166.0MB. Max. memory is 16.1GB. [2022-07-14 00:17:44,481 INFO L158 Benchmark]: Witness Printer took 12.15ms. Allocated memory is still 415.2MB. Free memory is still 290.9MB. There was no memory consumed. Max. memory is 16.1GB. [2022-07-14 00:17:44,483 INFO L339 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.22ms. Allocated memory is still 92.3MB. Free memory is still 68.0MB. There was no memory consumed. Max. memory is 16.1GB. * CACSL2BoogieTranslator took 1395.13ms. Allocated memory was 92.3MB in the beginning and 130.0MB in the end (delta: 37.7MB). Free memory was 66.2MB in the beginning and 62.4MB in the end (delta: 3.8MB). Peak memory consumption was 65.7MB. Max. memory is 16.1GB. * Boogie Procedure Inliner took 128.01ms. Allocated memory is still 130.0MB. Free memory was 62.4MB in the beginning and 54.0MB in the end (delta: 8.4MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. * Boogie Preprocessor took 170.54ms. Allocated memory is still 130.0MB. Free memory was 54.0MB in the beginning and 78.8MB in the end (delta: -24.9MB). Peak memory consumption was 15.6MB. Max. memory is 16.1GB. * RCFGBuilder took 1413.59ms. Allocated memory was 130.0MB in the beginning and 230.7MB in the end (delta: 100.7MB). Free memory was 78.8MB in the beginning and 134.4MB in the end (delta: -55.6MB). Peak memory consumption was 45.3MB. Max. memory is 16.1GB. * TraceAbstraction took 12002.58ms. Allocated memory was 230.7MB in the beginning and 415.2MB in the end (delta: 184.5MB). Free memory was 133.4MB in the beginning and 290.9MB in the end (delta: -157.6MB). Peak memory consumption was 166.0MB. Max. memory is 16.1GB. * Witness Printer took 12.15ms. Allocated memory is still 415.2MB. Free memory is still 290.9MB. There was no memory consumed. Max. memory is 16.1GB. * Results from de.uni_freiburg.informatik.ultimate.boogie.preprocessor: - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: - GenericResult: Unfinished Backtranslation The program execution was not completely translated back. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - StatisticsResult: ErrorAutomatonStatistics NumberErrorTraces: 0, NumberStatementsAllTraces: 0, NumberRelevantStatements: 0, 0.0s ErrorAutomatonConstructionTimeTotal, 0.0s FaulLocalizationTime, NumberStatementsFirstTrace: -1, TraceLengthAvg: 0, 0.0s ErrorAutomatonConstructionTimeAvg, 0.0s ErrorAutomatonDifferenceTimeAvg, 0.0s ErrorAutomatonDifferenceTimeTotal, NumberOfNoEnhancement: 0, NumberOfFiniteEnhancement: 0, NumberOfInfiniteEnhancement: 0 - UnprovableResult [Line: 5554]: Unable to prove that call to reach_error is unreachable Unable to prove that call to reach_error is unreachable Reason: overapproximation of bitwiseOr at line 5123. Possible FailurePath: [L5577] int LDV_IN_INTERRUPT = 1; [L5578] struct sk_buff *proto_group1 ; [L5579] int ldv_state_variable_0 ; [L5580] int ldv_state_variable_3 ; [L5581] int ldv_timer_state_1 = 0; [L5582] int ldv_state_variable_2 ; [L5583] struct net_device *proto_group0 ; [L5584] int ref_cnt ; [L5585] int ldv_state_variable_1 ; [L5586] struct timer_list *ldv_timer_list_1 ; [L5964-L5966] static struct hdlc_proto proto = {0, 0, & cisco_start, & cisco_stop, 0, & cisco_ioctl, & cisco_type_trans, & cisco_rx, 0, & __this_module, 0}; [L5967] static struct header_ops const cisco_header_ops = {& cisco_hard_header, 0, 0, 0, 0}; [L6078] int ldv_retval_0 ; [L6374] Element set_impl[15] ; [L6375] int last_index = 0; [L6509] Set LDV_SKBS ; VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6142] struct ifreq *ldvarg0 ; [L6143] void *tmp ; [L6144] unsigned int ldvarg1 ; [L6145] unsigned int tmp___0 ; [L6146] unsigned short ldvarg4 ; [L6147] unsigned short tmp___1 ; [L6148] struct sk_buff *ldvarg3 ; [L6149] void *tmp___2 ; [L6150] struct net_device *ldvarg5 ; [L6151] void *tmp___3 ; [L6152] void *ldvarg2 ; [L6153] void *tmp___4 ; [L6154] void *ldvarg6 ; [L6155] void *tmp___5 ; [L6156] int tmp___6 ; [L6157] int tmp___7 ; [L6158] int tmp___8 ; [L6159] int tmp___9 ; VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6161] CALL, EXPR ldv_zalloc(40UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=40, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=40, tmp___0=-2] [L6161] RET, EXPR ldv_zalloc(40UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(40UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6161] tmp = ldv_zalloc(40UL) [L6162] ldvarg0 = (struct ifreq *)tmp [L6163] tmp___0 = __VERIFIER_nondet_uint() [L6164] ldvarg1 = tmp___0 [L6165] tmp___1 = __VERIFIER_nondet_ushort() [L6166] ldvarg4 = tmp___1 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg4=48351, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351] [L6167] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=232, tmp___0=-3] [L6167] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg4=48351, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351] [L6167] tmp___2 = ldv_zalloc(232UL) [L6168] ldvarg3 = (struct sk_buff *)tmp___2 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg3={0:0}, ldvarg4=48351, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}] [L6169] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=3264, tmp___0=-5] [L6169] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg3={0:0}, ldvarg4=48351, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}] [L6169] tmp___3 = ldv_zalloc(3264UL) [L6170] ldvarg5 = (struct net_device *)tmp___3 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}] [L6171] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=-6] [L6171] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}] [L6171] tmp___4 = ldv_zalloc(1UL) [L6172] ldvarg2 = tmp___4 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=-8] [L6173] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] tmp___5 = ldv_zalloc(1UL) [L6174] ldvarg6 = tmp___5 [L6175] CALL ldv_initialize() [L6528] CALL ldv_set_init(LDV_SKBS) [L6380] set = set_impl [L6381] last_index = 0 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={18:0}, set_impl={18:0}] [L6528] RET ldv_set_init(LDV_SKBS) [L6175] RET ldv_initialize() [L6176] ldv_state_variable_1 = 1 [L6177] ref_cnt = 0 [L6178] ldv_state_variable_0 = 1 [L6179] ldv_state_variable_3 = 0 [L6180] ldv_state_variable_2 = 0 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: [L6202] case 1: VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6203] COND TRUE ldv_state_variable_0 == 1 [L6204] CALL, EXPR mod_init() [L6067] FCALL register_hdlc_protocol(& proto) [L6068] return (0); VAL [\result=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6204] RET, EXPR mod_init() [L6204] ldv_retval_0 = mod_init() [L6205] COND TRUE ldv_retval_0 == 0 [L6206] ldv_state_variable_0 = 3 [L6207] ldv_state_variable_2 = 1 [L6208] ldv_state_variable_3 = 1 [L6209] CALL ldv_initialize_hdlc_proto_3() [L6101] void *tmp ; [L6102] void *tmp___0 ; VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6104] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=232, tmp___0=-9] [L6104] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6104] tmp = ldv_zalloc(232UL) [L6105] proto_group1 = (struct sk_buff *)tmp VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L6106] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=3264, tmp___0=-10] [L6106] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L6106] tmp___0 = ldv_zalloc(3264UL) [L6107] proto_group0 = (struct net_device *)tmp___0 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0={0:0}] [L6209] RET ldv_initialize_hdlc_proto_3() [L6212] COND FALSE !(ldv_retval_0 != 0) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=0, tmp___7=1] [L6185] COND TRUE ldv_state_variable_1 != 0 [L6186] CALL choose_timer_1(ldv_timer_list_1) [L6114] LDV_IN_INTERRUPT = 2 [L6115] EXPR timer->data [L6115] EXPR timer->function [L6115] CALL (*(timer->function))(timer->data) [L5877] struct net_device *dev ; [L5878] hdlc_device *hdlc ; [L5879] struct hdlc_device *tmp ; [L5880] struct cisco_state *st ; [L5881] struct cisco_state *tmp___0 ; [L5882] __u32 tmp___1 ; [L5883] __u32 tmp___2 ; [L5885] dev = (struct net_device *)arg VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5886] CALL, EXPR dev_to_hdlc(dev) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5638] void *tmp ; [L5640] CALL, EXPR netdev_priv((struct net_device const *)dev) [L5595] return ((void *)dev + 3264U); VAL [\result={0:21}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, dev={0:-3243}, dev={0:-3243}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5640] RET, EXPR netdev_priv((struct net_device const *)dev) [L5640] tmp = netdev_priv((struct net_device const *)dev) [L5641] return ((struct hdlc_device *)tmp); VAL [\result={0:21}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, dev={0:-3243}, dev={0:-3243}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:21}] [L5886] RET, EXPR dev_to_hdlc(dev) VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, dev_to_hdlc(dev)={0:21}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5886] tmp = dev_to_hdlc(dev) [L5887] hdlc = tmp VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:21}] [L5888] CALL, EXPR state(hdlc) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, hdlc={0:21}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5670] EXPR hdlc->state [L5670] return ((struct cisco_state *)hdlc->state); [L5888] RET, EXPR state(hdlc) VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, state(hdlc)={18:-212}, tmp={0:21}] [L5888] tmp___0 = state(hdlc) [L5889] st = tmp___0 VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, tmp={0:21}, tmp___0={18:-212}] [L5890] CALL spin_lock(& st->lock) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5263] FCALL _raw_spin_lock(& lock->ldv_6338.rlock) [L5890] RET spin_lock(& st->lock) VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, tmp={0:21}, tmp___0={18:-212}] [L5891] EXPR st->up [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L [L5891] EXPR st->last_poll [L5891] EXPR st->settings.timeout [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, st->last_poll=1383413571807847823359175, st->settings.timeout=31, st->up=1383413571807847823359185, st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L=0, tmp={0:21}, tmp___0={18:-212}] [L5891] COND FALSE !(st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L) [L5897] EXPR st->rxseq VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, st->rxseq=19, tmp={0:21}, tmp___0={18:-212}] [L5897] CALL, EXPR __fswab32(st->rxseq) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=19, \result=19, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=19] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=19, \result=19, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=19, val=19] [L5897] RET, EXPR __fswab32(st->rxseq) VAL [\old(arg)=18446744073709548373, __fswab32(st->rxseq)=19, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, st->rxseq=19, tmp={0:21}, tmp___0={18:-212}] [L5897] tmp___1 = __fswab32(st->rxseq) [L5898] EXPR st->txseq [L5898] st->txseq = st->txseq + 1U [L5899] EXPR st->txseq VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, st->txseq=-15, tmp={0:21}, tmp___0={18:-212}, tmp___1=19] [L5899] CALL, EXPR __fswab32(st->txseq) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=-15, \result=-15, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=-15] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=-15, \result=-15, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=4294967281, val=-15] [L5899] RET, EXPR __fswab32(st->txseq) VAL [\old(arg)=18446744073709548373, __fswab32(st->txseq)=-15, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, st->txseq=-15, tmp={0:21}, tmp___0={18:-212}, tmp___1=19] [L5899] tmp___2 = __fswab32(st->txseq) [L5900] CALL cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5695] struct sk_buff *skb ; [L5696] struct cisco_packet *data ; [L5697] __u32 tmp ; [L5698] __u32 tmp___0 ; [L5700] CALL, EXPR ldv_dev_alloc_skb_12(22U) [L6356] struct sk_buff *tmp ; VAL [\old(last_index)=0, \old(length)=22, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6358] CALL, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6512] void *skb ; [L6513] void *tmp___7 ; VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6515] CALL, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND FALSE !(tmp___0 != 0) [L5527] EXPR, FCALL calloc(1UL, size) [L5527] tmp = calloc(1UL, size) [L5528] p = tmp VAL [\old(last_index)=0, \old(size)=248, __this_module={1383413571807847823359192:1383413571807847823359210}, calloc(1UL, size)={-1:0}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={-1:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={-1:0}, tmp___0=0] [L5529] CALL assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(cond)=1, \old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5498] COND FALSE !(!cond) VAL [\old(cond)=1, \old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, cond=1, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5529] RET assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(last_index)=0, \old(size)=248, __this_module={1383413571807847823359192:1383413571807847823359210}, calloc(1UL, size)={-1:0}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={-1:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={-1:0}, tmp___0=0] [L5530] return (p); VAL [\old(last_index)=0, \old(size)=248, \result={-1:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, calloc(1UL, size)={-1:0}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={-1:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={-1:0}, tmp___0=0] [L6515] RET, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(sizeof(struct sk_buff___0 ))={-1:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6515] tmp___7 = ldv_zalloc(sizeof(struct sk_buff___0 )) [L6516] skb = (struct sk_buff___0 *)tmp___7 VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-1:0}, tmp___7={-1:0}] [L6517] COND FALSE !(! skb) [L6520] CALL ldv_set_add(LDV_SKBS, skb) [L6388] int i ; [L6390] i = 0 VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, e={-1:0}, e={-1:0}, i=0, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6391] COND TRUE 1 VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, e={-1:0}, e={-1:0}, i=0, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6392] COND FALSE !(i < last_index) VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, e={-1:0}, e={-1:0}, i=0, jiffies=18446744073709476621, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6402] COND TRUE last_index < 15 [L6403] set_impl[last_index] = e [L6404] last_index = last_index + 1 VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, e={-1:0}, e={-1:0}, i=0, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6520] RET ldv_set_add(LDV_SKBS, skb) [L6521] return (skb); VAL [\old(last_index)=0, \result={-1:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-1:0}, tmp___7={-1:0}] [L6358] RET, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, \old(length)=22, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, ldv_skb_alloc()={-1:0}, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6358] tmp = ldv_skb_alloc() [L6359] return (tmp); VAL [\old(last_index)=0, \old(length)=22, \result={-1:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={-1:0}] [L5700] RET, EXPR ldv_dev_alloc_skb_12(22U) [L5700] skb = ldv_dev_alloc_skb_12(22U) [L5701] COND FALSE !((unsigned long )skb == (unsigned long )((struct sk_buff *)0)) [L5706] CALL skb_reserve(skb, 4) [L5475] EXPR skb->data [L5475] skb->data = skb->data + (unsigned long )len [L5476] EXPR skb->tail [L5476] skb->tail = skb->tail + (sk_buff_data_t )len [L5706] RET skb_reserve(skb, 4) [L5707] CALL cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5676] struct hdlc_header *data ; [L5677] __u16 tmp ; [L5679] CALL skb_push(skb, 4U) [L6687] CALL, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(last_index)=0, \old(size)=1, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5502] void *p ; [L5503] void *tmp ; [L5504] int tmp___0 ; [L5506] tmp___0 = __VERIFIER_nondet_int() [L5507] COND TRUE tmp___0 != 0 [L5508] return ((void *)0); VAL [\old(last_index)=0, \old(size)=1, \result={0:0}, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=-14] [L6687] RET, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(arg1)=4, \old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, arg0={-1:0}, arg0={-1:0}, arg1=4, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_malloc(sizeof(unsigned char))={0:0}, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6687] return ldv_malloc(sizeof(unsigned char)); [L5679] RET skb_push(skb, 4U) [L5680] EXPR skb->data [L5680] data = (struct hdlc_header *)skb->data [L5681] COND TRUE (unsigned int )type == 32821U [L5682] data->address = 143U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={-1:136}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-1:0}, skb={-1:0}, type=32821] [L5686] data->control = 0U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={-1:136}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-1:0}, skb={-1:0}, type=32821] [L5687] CALL, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(val)=32821, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5123] return ((__u16 )((int )((short )((int )val << 8)) | (int )((short )((int )val >> 8)))); VAL [\old(last_index)=0, \old(val)=32821, \result=128, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=32821] [L5687] RET, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __fswab16((int )type)=128, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={-1:136}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-1:0}, skb={-1:0}, type=32821] [L5687] tmp = __fswab16((int )type) [L5688] data->protocol = tmp [L5689] return (4); VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, \result=4, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={-1:136}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-1:0}, skb={-1:0}, tmp=128, type=32821] [L5707] RET cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, \old(par1)=4294967281, \old(par2)=19, \old(type)=2, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U)=4, cisco_header_ops={17:0}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967281, par2=19, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-1:0}, type=2] [L5708] EXPR skb->data [L5708] data = (struct cisco_packet *)skb->data + 4U [L5709] CALL, EXPR __fswab32(type) VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=2] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=2, val=2] [L5709] RET, EXPR __fswab32(type) VAL [\old(last_index)=0, \old(par1)=4294967281, \old(par2)=19, \old(type)=2, __fswab32(type)=2, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, data={-1:208}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967281, par2=19, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-1:0}, type=2] [L5709] tmp = __fswab32(type) [L5710] data->type = tmp [L5711] data->par1 = par1 [L5712] data->par2 = par2 [L5713] data->rel = 65535U VAL [\old(last_index)=0, \old(par1)=4294967281, \old(par2)=19, \old(type)=2, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, data={-1:208}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967281, par2=19, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-1:0}, tmp=2, type=2] [L5714] CALL, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=20, \result=20, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=20] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=20, \result=20, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=20, val=20] [L5714] RET, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, \old(par1)=4294967281, \old(par2)=19, \old(type)=2, __fswab32(((__u32 )jiffies + 75000U) * 4U)=20, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, data={-1:208}, dev={0:-3243}, dev={0:-3243}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967281, par2=19, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-1:0}, tmp=2, type=2] [L5714] tmp___0 = __fswab32(((__u32 )jiffies + 75000U) * 4U) [L5715] data->time = tmp___0 [L5716] CALL skb_put(skb, 18U) [L6690] EXPR arg0->data [L6690] EXPR arg0->tail [L6690] unsigned char *ret_val = arg0->data + arg0->tail; [L6691] EXPR arg0->tail [L6691] arg0->tail += arg1 [L6692] return ret_val; VAL [\old(arg1)=18, \old(last_index)=0, \result={-1:155}, __this_module={1383413571807847823359192:1383413571807847823359210}, arg0={-1:0}, arg0={-1:0}, arg1=18, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, ret_val={-1:155}, set_impl={18:0}] [L5716] RET skb_put(skb, 18U) [L5717] skb->priority = 7U [L5718] skb->dev = dev [L5719] CALL skb_reset_network_header(skb) [L5483] EXPR skb->data [L5483] EXPR skb->head [L5483] skb->network_header = (int )((__u16 )((long )skb->data)) - (int )((__u16 )((long )skb->head)) [L5719] RET skb_reset_network_header(skb) [L5720] CALL dev_queue_xmit(skb) [L6643] return __VERIFIER_nondet_int(); [L5720] RET dev_queue_xmit(skb) [L5900] RET cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, tmp={0:21}, tmp___0={18:-212}, tmp___1=19, tmp___2=4294967281] [L5901] CALL spin_unlock(& st->lock) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5270] FCALL _raw_spin_unlock(& lock->ldv_6338.rlock) [L5901] RET spin_unlock(& st->lock) VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, tmp={0:21}, tmp___0={18:-212}, tmp___1=19, tmp___2=4294967281] [L5902] EXPR st->settings.interval [L5902] st->timer.expires = (unsigned long )(st->settings.interval * 250U) + (unsigned long )jiffies [L5903] st->timer.function = & cisco_timer [L5904] st->timer.data = arg VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, tmp={0:21}, tmp___0={18:-212}, tmp___1=19, tmp___2=4294967281] [L5905] FCALL add_timer(& st->timer) VAL [\old(arg)=18446744073709548373, __this_module={1383413571807847823359192:1383413571807847823359210}, arg=18446744073709548373, cisco_header_ops={17:0}, dev={0:-3243}, hdlc={0:21}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18:-212}, tmp={0:21}, tmp___0={18:-212}, tmp___1=19, tmp___2=4294967281] [L6115] RET (*(timer->function))(timer->data) [L6116] LDV_IN_INTERRUPT = 1 [L6117] ldv_timer_state_1 = 2 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, timer={0:0}, timer={0:0}] [L6186] RET choose_timer_1(ldv_timer_list_1) [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6195] COND TRUE ldv_state_variable_0 == 3 && ref_cnt == 0 [L6196] CALL mod_exit() [L6074] FCALL unregister_hdlc_protocol(& proto) [L6196] RET mod_exit() [L6197] ldv_state_variable_0 = 2 VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=4294884565, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=48351, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294884565, tmp___1=48351, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6315] CALL ldv_check_final_state() [L6579] int tmp___7 ; [L6581] CALL, EXPR ldv_set_is_empty(LDV_SKBS) [L6470] return (last_index == 0); VAL [\result=0, __this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6581] RET, EXPR ldv_set_is_empty(LDV_SKBS) [L6581] tmp___7 = ldv_set_is_empty(LDV_SKBS) [L6582] COND FALSE !(\read(tmp___7)) VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp___7=0] [L6584] CALL ldv_error() VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5554] reach_error() VAL [__this_module={1383413571807847823359192:1383413571807847823359210}, cisco_header_ops={17:0}, jiffies=18446744073709476621, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] - StatisticsResult: Ultimate Automizer benchmark data CFG has 33 procedures, 489 locations, 1 error locations. Started 1 CEGAR loops. OverallTime: 11.6s, OverallIterations: 6, TraceHistogramMax: 8, PathProgramHistogramMax: 1, EmptinessCheckTime: 0.1s, AutomataDifference: 6.8s, DeadEndRemovalTime: 0.0s, HoareAnnotationTime: 0.0s, InitialAbstractionConstructionTime: 0.0s, HoareTripleCheckerStatistics: 0 mSolverCounterUnknown, 3918 SdHoareTripleChecker+Valid, 5.7s IncrementalHoareTripleChecker+Time, 0 mSdLazyCounter, 3675 mSDsluCounter, 14180 SdHoareTripleChecker+Invalid, 4.8s Time, 0 mProtectedAction, 0 SdHoareTripleChecker+Unchecked, 0 IncrementalHoareTripleChecker+Unchecked, 10765 mSDsCounter, 1028 IncrementalHoareTripleChecker+Valid, 0 mProtectedPredicate, 4483 IncrementalHoareTripleChecker+Invalid, 5511 SdHoareTripleChecker+Unknown, 0 mSolverCounterNotChecked, 1028 mSolverCounterUnsat, 3415 mSDtfsCounter, 4483 mSolverCounterSat, 0.1s SdHoareTripleChecker+Time, 0 IncrementalHoareTripleChecker+Unknown, PredicateUnifierStatistics: 0 DeclaredPredicates, 295 GetRequests, 251 SyntacticMatches, 3 SemanticMatches, 41 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 50 ImplicationChecksByTransitivity, 0.4s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=1954occurred in iteration=5, InterpolantAutomatonStates: 37, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s DumpTime, AutomataMinimizationStatistics: 0.5s AutomataMinimizationTime, 5 MinimizatonAttempts, 506 StatesRemovedByMinimization, 5 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TRACE_CHECK: 0.1s SsaConstructionTime, 1.5s SatisfiabilityAnalysisTime, 1.4s InterpolantComputationTime, 781 NumberOfCodeBlocks, 781 NumberOfCodeBlocksAsserted, 7 NumberOfCheckSat, 592 ConstructedInterpolants, 0 QuantifiedInterpolants, 1364 SizeOfPredicates, 2 NumberOfNonLiveVariables, 961 ConjunctsInSsa, 17 ConjunctsInUnsatCore, 6 InterpolantComputations, 5 PerfectInterpolantSequences, 540/544 InterpolantCoveringCapability, INVARIANT_SYNTHESIS: No data available, INTERPOLANT_CONSOLIDATION: No data available, ABSTRACT_INTERPRETATION: No data available, PDR: No data available, ACCELERATED_INTERPOLATION: No data available, SIFA: No data available, ReuseStatistics: No data available RESULT: Ultimate could not prove your program: unable to determine feasibility of some traces [2022-07-14 00:17:44,547 INFO L552 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Ended with exit code 0 Received shutdown request... --- End real Ultimate output --- Execution finished normally Using bit-precise analysis Retrying with bit-precise analysis ### Bit-precise run ### Calling Ultimate with: /usr/bin/java -Dosgi.configuration.area=/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/config -Xmx15G -Xms4m -jar /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/org.eclipse.equinox.launcher_1.5.800.v20200727-1323.jar -data @noDefault -ultimatedata /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data -tc /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/AutomizerReach.xml -i ../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i -s /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Bitvector.epf --cacsl2boogietranslator.entry.function main --witnessprinter.witness.directory /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux --witnessprinter.witness.filename witness.graphml --witnessprinter.write.witness.besides.input.file false --witnessprinter.graph.data.specification CHECK( init(main()), LTL(G ! call(reach_error())) ) --witnessprinter.graph.data.producer Automizer --witnessprinter.graph.data.architecture 64bit --witnessprinter.graph.data.programhash aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 --- Real Ultimate output --- This is Ultimate 0.2.2-?-f4b24e3 [2022-07-14 00:17:48,133 INFO L177 SettingsManager]: Resetting all preferences to default values... [2022-07-14 00:17:48,145 INFO L181 SettingsManager]: Resetting UltimateCore preferences to default values [2022-07-14 00:17:48,200 INFO L184 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2022-07-14 00:17:48,200 INFO L181 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2022-07-14 00:17:48,202 INFO L181 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2022-07-14 00:17:48,205 INFO L181 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2022-07-14 00:17:48,208 INFO L181 SettingsManager]: Resetting LassoRanker preferences to default values [2022-07-14 00:17:48,210 INFO L181 SettingsManager]: Resetting Reaching Definitions preferences to default values [2022-07-14 00:17:48,214 INFO L181 SettingsManager]: Resetting SyntaxChecker preferences to default values [2022-07-14 00:17:48,238 INFO L181 SettingsManager]: Resetting Sifa preferences to default values [2022-07-14 00:17:48,243 INFO L184 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2022-07-14 00:17:48,243 INFO L181 SettingsManager]: Resetting LTL2Aut preferences to default values [2022-07-14 00:17:48,245 INFO L181 SettingsManager]: Resetting PEA to Boogie preferences to default values [2022-07-14 00:17:48,246 INFO L181 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2022-07-14 00:17:48,247 INFO L181 SettingsManager]: Resetting ChcToBoogie preferences to default values [2022-07-14 00:17:48,249 INFO L181 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2022-07-14 00:17:48,250 INFO L181 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2022-07-14 00:17:48,252 INFO L181 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2022-07-14 00:17:48,253 INFO L181 SettingsManager]: Resetting CodeCheck preferences to default values [2022-07-14 00:17:48,272 INFO L181 SettingsManager]: Resetting HornVerifier preferences to default values [2022-07-14 00:17:48,273 INFO L181 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2022-07-14 00:17:48,275 INFO L181 SettingsManager]: Resetting RCFGBuilder preferences to default values [2022-07-14 00:17:48,276 INFO L181 SettingsManager]: Resetting Referee preferences to default values [2022-07-14 00:17:48,278 INFO L181 SettingsManager]: Resetting TraceAbstraction preferences to default values [2022-07-14 00:17:48,283 INFO L184 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2022-07-14 00:17:48,286 INFO L184 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2022-07-14 00:17:48,286 INFO L181 SettingsManager]: Resetting TreeAutomizer preferences to default values [2022-07-14 00:17:48,287 INFO L181 SettingsManager]: Resetting IcfgToChc preferences to default values [2022-07-14 00:17:48,288 INFO L181 SettingsManager]: Resetting IcfgTransformer preferences to default values [2022-07-14 00:17:48,289 INFO L184 SettingsManager]: ReqToTest provides no preferences, ignoring... [2022-07-14 00:17:48,289 INFO L181 SettingsManager]: Resetting Boogie Printer preferences to default values [2022-07-14 00:17:48,291 INFO L181 SettingsManager]: Resetting ChcSmtPrinter preferences to default values [2022-07-14 00:17:48,291 INFO L181 SettingsManager]: Resetting ReqPrinter preferences to default values [2022-07-14 00:17:48,293 INFO L181 SettingsManager]: Resetting Witness Printer preferences to default values [2022-07-14 00:17:48,294 INFO L184 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2022-07-14 00:17:48,294 INFO L181 SettingsManager]: Resetting CDTParser preferences to default values [2022-07-14 00:17:48,295 INFO L184 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2022-07-14 00:17:48,295 INFO L184 SettingsManager]: ReqParser provides no preferences, ignoring... [2022-07-14 00:17:48,295 INFO L181 SettingsManager]: Resetting SmtParser preferences to default values [2022-07-14 00:17:48,298 INFO L181 SettingsManager]: Resetting Witness Parser preferences to default values [2022-07-14 00:17:48,301 INFO L188 SettingsManager]: Finished resetting all preferences to default values... [2022-07-14 00:17:48,307 INFO L101 SettingsManager]: Beginning loading settings from /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Bitvector.epf [2022-07-14 00:17:48,368 INFO L113 SettingsManager]: Loading preferences was successful [2022-07-14 00:17:48,369 INFO L115 SettingsManager]: Preferences different from defaults after loading the file: [2022-07-14 00:17:48,369 INFO L136 SettingsManager]: Preferences of UltimateCore differ from their defaults: [2022-07-14 00:17:48,370 INFO L138 SettingsManager]: * Log level for class=de.uni_freiburg.informatik.ultimate.lib.smtlibutils.quantifier.QuantifierPusher=ERROR; [2022-07-14 00:17:48,370 INFO L136 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2022-07-14 00:17:48,371 INFO L138 SettingsManager]: * Ignore calls to procedures called more than once=ONLY_FOR_SEQUENTIAL_PROGRAMS [2022-07-14 00:17:48,371 INFO L136 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2022-07-14 00:17:48,372 INFO L138 SettingsManager]: * Create parallel compositions if possible=false [2022-07-14 00:17:48,372 INFO L138 SettingsManager]: * Use SBE=true [2022-07-14 00:17:48,373 INFO L136 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2022-07-14 00:17:48,373 INFO L138 SettingsManager]: * Check division by zero=IGNORE [2022-07-14 00:17:48,373 INFO L138 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2022-07-14 00:17:48,373 INFO L138 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2022-07-14 00:17:48,374 INFO L138 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2022-07-14 00:17:48,374 INFO L138 SettingsManager]: * Adapt memory model on pointer casts if necessary=true [2022-07-14 00:17:48,374 INFO L138 SettingsManager]: * Use bitvectors instead of ints=true [2022-07-14 00:17:48,374 INFO L138 SettingsManager]: * Memory model=HoenickeLindenmann_4ByteResolution [2022-07-14 00:17:48,374 INFO L138 SettingsManager]: * Check if freed pointer was valid=false [2022-07-14 00:17:48,375 INFO L138 SettingsManager]: * Use constant arrays=true [2022-07-14 00:17:48,375 INFO L138 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2022-07-14 00:17:48,375 INFO L136 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2022-07-14 00:17:48,375 INFO L138 SettingsManager]: * Size of a code block=SequenceOfStatements [2022-07-14 00:17:48,376 INFO L138 SettingsManager]: * SMT solver=External_DefaultMode [2022-07-14 00:17:48,376 INFO L138 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2022-07-14 00:17:48,376 INFO L136 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2022-07-14 00:17:48,376 INFO L138 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2022-07-14 00:17:48,376 INFO L138 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2022-07-14 00:17:48,376 INFO L138 SettingsManager]: * Trace refinement strategy=WOLF [2022-07-14 00:17:48,377 INFO L138 SettingsManager]: * Command for external solver=cvc4 --incremental --print-success --lang smt [2022-07-14 00:17:48,377 INFO L138 SettingsManager]: * Apply one-shot large block encoding in concurrent analysis=false [2022-07-14 00:17:48,377 INFO L138 SettingsManager]: * Automaton type used in concurrency analysis=PETRI_NET [2022-07-14 00:17:48,377 INFO L138 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true [2022-07-14 00:17:48,378 INFO L138 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode [2022-07-14 00:17:48,378 INFO L138 SettingsManager]: * Logic for external solver=AUFBV WARNING: An illegal reflective access operation has occurred WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 (file:/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/com.sun.xml.bind_2.2.0.v201505121915.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int) WARNING: Please consider reporting this to the maintainers of com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations WARNING: All illegal access operations will be denied in a future release Applying setting for plugin de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: Entry function -> main Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness directory -> /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness filename -> witness.graphml Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Write witness besides input file -> false Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data specification -> CHECK( init(main()), LTL(G ! call(reach_error())) ) Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data producer -> Automizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data architecture -> 64bit Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data programhash -> aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 [2022-07-14 00:17:49,016 INFO L75 nceAwareModelManager]: Repository-Root is: /tmp [2022-07-14 00:17:49,044 INFO L261 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2022-07-14 00:17:49,047 INFO L217 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2022-07-14 00:17:49,048 INFO L271 PluginConnector]: Initializing CDTParser... [2022-07-14 00:17:49,051 INFO L275 PluginConnector]: CDTParser initialized [2022-07-14 00:17:49,052 INFO L432 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2022-07-14 00:17:49,182 INFO L220 CDTParser]: Created temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/654c24c48/95652c843ec74a939bcc0a7d3e52bddd/FLAG328b51c43 [2022-07-14 00:17:50,373 INFO L306 CDTParser]: Found 1 translation units. [2022-07-14 00:17:50,374 INFO L160 CDTParser]: Scanning /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2022-07-14 00:17:50,411 INFO L349 CDTParser]: About to delete temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/654c24c48/95652c843ec74a939bcc0a7d3e52bddd/FLAG328b51c43 [2022-07-14 00:17:50,432 INFO L357 CDTParser]: Successfully deleted /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/654c24c48/95652c843ec74a939bcc0a7d3e52bddd [2022-07-14 00:17:50,435 INFO L299 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2022-07-14 00:17:50,437 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2022-07-14 00:17:50,441 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2022-07-14 00:17:50,455 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2022-07-14 00:17:50,459 INFO L275 PluginConnector]: CACSL2BoogieTranslator initialized [2022-07-14 00:17:50,460 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 14.07 12:17:50" (1/1) ... [2022-07-14 00:17:50,460 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@5ebe7392 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:50, skipping insertion in model container [2022-07-14 00:17:50,461 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 14.07 12:17:50" (1/1) ... [2022-07-14 00:17:50,467 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2022-07-14 00:17:50,661 INFO L178 MainTranslator]: Built tables and reachable declarations [2022-07-14 00:17:51,947 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2022-07-14 00:17:52,388 INFO L210 PostProcessor]: Analyzing one entry point: main [2022-07-14 00:17:52,419 INFO L200 MainTranslator]: Restarting translation with changed settings: SettingsChange [mNewPreferredMemoryModel=HoenickeLindenmann_1ByteResolution] [2022-07-14 00:17:52,448 INFO L178 MainTranslator]: Built tables and reachable declarations [2022-07-14 00:17:52,591 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2022-07-14 00:17:52,675 INFO L210 PostProcessor]: Analyzing one entry point: main [2022-07-14 00:17:52,703 INFO L203 MainTranslator]: Completed pre-run [2022-07-14 00:17:52,918 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2022-07-14 00:17:53,027 INFO L210 PostProcessor]: Analyzing one entry point: main [2022-07-14 00:17:53,090 INFO L208 MainTranslator]: Completed translation [2022-07-14 00:17:53,090 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:53 WrapperNode [2022-07-14 00:17:53,091 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2022-07-14 00:17:53,096 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2022-07-14 00:17:53,097 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2022-07-14 00:17:53,097 INFO L275 PluginConnector]: Boogie Procedure Inliner initialized [2022-07-14 00:17:53,113 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:53" (1/1) ... [2022-07-14 00:17:53,194 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:53" (1/1) ... [2022-07-14 00:17:53,295 INFO L137 Inliner]: procedures = 158, calls = 357, calls flagged for inlining = 63, calls inlined = 60, statements flattened = 1390 [2022-07-14 00:17:53,298 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2022-07-14 00:17:53,300 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2022-07-14 00:17:53,300 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2022-07-14 00:17:53,300 INFO L275 PluginConnector]: Boogie Preprocessor initialized [2022-07-14 00:17:53,307 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:53" (1/1) ... [2022-07-14 00:17:53,308 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:53" (1/1) ... [2022-07-14 00:17:53,330 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:53" (1/1) ... [2022-07-14 00:17:53,331 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:53" (1/1) ... [2022-07-14 00:17:53,388 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:53" (1/1) ... [2022-07-14 00:17:53,402 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:53" (1/1) ... [2022-07-14 00:17:53,422 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:53" (1/1) ... [2022-07-14 00:17:53,442 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2022-07-14 00:17:53,449 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2022-07-14 00:17:53,450 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2022-07-14 00:17:53,450 INFO L275 PluginConnector]: RCFGBuilder initialized [2022-07-14 00:17:53,451 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:53" (1/1) ... [2022-07-14 00:17:53,457 INFO L173 SolverBuilder]: Constructing external solver with command: z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2022-07-14 00:17:53,467 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 [2022-07-14 00:17:53,485 INFO L229 MonitoredProcess]: Starting monitored process 1 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) [2022-07-14 00:17:53,531 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Waiting until timeout for monitored process [2022-07-14 00:17:53,597 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab32 [2022-07-14 00:17:53,598 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab32 [2022-07-14 00:17:53,599 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE1 [2022-07-14 00:17:53,602 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE8 [2022-07-14 00:17:53,602 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE4 [2022-07-14 00:17:53,603 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~$Pointer$ [2022-07-14 00:17:53,604 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE2 [2022-07-14 00:17:53,604 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$ [2022-07-14 00:17:53,604 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_stop [2022-07-14 00:17:53,604 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_stop [2022-07-14 00:17:53,604 INFO L130 BoogieDeclarations]: Found specification of procedure state [2022-07-14 00:17:53,604 INFO L138 BoogieDeclarations]: Found implementation of procedure state [2022-07-14 00:17:53,604 INFO L130 BoogieDeclarations]: Found specification of procedure dev_to_hdlc [2022-07-14 00:17:53,605 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_to_hdlc [2022-07-14 00:17:53,605 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_ioctl [2022-07-14 00:17:53,605 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_ioctl [2022-07-14 00:17:53,605 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_rx [2022-07-14 00:17:53,605 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_rx [2022-07-14 00:17:53,605 INFO L130 BoogieDeclarations]: Found specification of procedure debug_lockdep_rcu_enabled [2022-07-14 00:17:53,606 INFO L138 BoogieDeclarations]: Found implementation of procedure debug_lockdep_rcu_enabled [2022-07-14 00:17:53,606 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_type_trans [2022-07-14 00:17:53,606 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_type_trans [2022-07-14 00:17:53,606 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_malloc [2022-07-14 00:17:53,607 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_malloc [2022-07-14 00:17:53,607 INFO L130 BoogieDeclarations]: Found specification of procedure netif_dormant_on [2022-07-14 00:17:53,607 INFO L138 BoogieDeclarations]: Found implementation of procedure netif_dormant_on [2022-07-14 00:17:53,607 INFO L130 BoogieDeclarations]: Found specification of procedure rcu_is_watching [2022-07-14 00:17:53,607 INFO L138 BoogieDeclarations]: Found implementation of procedure rcu_is_watching [2022-07-14 00:17:53,607 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_skb_alloc [2022-07-14 00:17:53,607 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_skb_alloc [2022-07-14 00:17:53,608 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_error [2022-07-14 00:17:53,608 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_error [2022-07-14 00:17:53,608 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE4 [2022-07-14 00:17:53,608 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE2 [2022-07-14 00:17:53,608 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE1 [2022-07-14 00:17:53,609 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE8 [2022-07-14 00:17:53,609 INFO L130 BoogieDeclarations]: Found specification of procedure ldv__builtin_expect [2022-07-14 00:17:53,609 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv__builtin_expect [2022-07-14 00:17:53,609 INFO L130 BoogieDeclarations]: Found specification of procedure assume_abort_if_not [2022-07-14 00:17:53,609 INFO L138 BoogieDeclarations]: Found implementation of procedure assume_abort_if_not [2022-07-14 00:17:53,609 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnHeap [2022-07-14 00:17:53,610 INFO L130 BoogieDeclarations]: Found specification of procedure spinlock_check [2022-07-14 00:17:53,610 INFO L138 BoogieDeclarations]: Found implementation of procedure spinlock_check [2022-07-14 00:17:53,610 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_hard_header [2022-07-14 00:17:53,610 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_hard_header [2022-07-14 00:17:53,610 INFO L130 BoogieDeclarations]: Found specification of procedure dev_kfree_skb_any [2022-07-14 00:17:53,610 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_kfree_skb_any [2022-07-14 00:17:53,611 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocInit [2022-07-14 00:17:53,611 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnStack [2022-07-14 00:17:53,611 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2022-07-14 00:17:53,612 INFO L130 BoogieDeclarations]: Found specification of procedure lockdep_rcu_suspicious [2022-07-14 00:17:53,612 INFO L138 BoogieDeclarations]: Found implementation of procedure lockdep_rcu_suspicious [2022-07-14 00:17:53,612 INFO L130 BoogieDeclarations]: Found specification of procedure __bad_percpu_size [2022-07-14 00:17:53,613 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE8 [2022-07-14 00:17:53,613 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE2 [2022-07-14 00:17:53,613 INFO L130 BoogieDeclarations]: Found specification of procedure reg_timer_1 [2022-07-14 00:17:53,613 INFO L138 BoogieDeclarations]: Found implementation of procedure reg_timer_1 [2022-07-14 00:17:53,614 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE4 [2022-07-14 00:17:53,614 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_to_user [2022-07-14 00:17:53,614 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_to_user [2022-07-14 00:17:53,615 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2022-07-14 00:17:53,615 INFO L130 BoogieDeclarations]: Found specification of procedure add_timer [2022-07-14 00:17:53,615 INFO L138 BoogieDeclarations]: Found implementation of procedure add_timer [2022-07-14 00:17:53,615 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock_irqrestore [2022-07-14 00:17:53,615 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock_irqrestore [2022-07-14 00:17:53,615 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE8 [2022-07-14 00:17:53,615 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE1 [2022-07-14 00:17:53,616 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE2 [2022-07-14 00:17:53,616 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.dealloc [2022-07-14 00:17:53,616 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE4 [2022-07-14 00:17:53,616 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$ [2022-07-14 00:17:53,616 INFO L130 BoogieDeclarations]: Found specification of procedure might_fault [2022-07-14 00:17:53,616 INFO L138 BoogieDeclarations]: Found implementation of procedure might_fault [2022-07-14 00:17:53,616 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~intINTTYPE1 [2022-07-14 00:17:53,617 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_keepalive_send [2022-07-14 00:17:53,617 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_keepalive_send [2022-07-14 00:17:53,617 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab16 [2022-07-14 00:17:53,617 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab16 [2022-07-14 00:17:53,617 INFO L130 BoogieDeclarations]: Found specification of procedure _raw_spin_lock_irqsave [2022-07-14 00:17:53,617 INFO L138 BoogieDeclarations]: Found implementation of procedure _raw_spin_lock_irqsave [2022-07-14 00:17:53,618 INFO L130 BoogieDeclarations]: Found specification of procedure spin_lock [2022-07-14 00:17:53,618 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_lock [2022-07-14 00:17:53,618 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock [2022-07-14 00:17:53,618 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock [2022-07-14 00:17:53,619 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE1 [2022-07-14 00:17:53,619 INFO L130 BoogieDeclarations]: Found specification of procedure linkwatch_fire_event [2022-07-14 00:17:53,619 INFO L138 BoogieDeclarations]: Found implementation of procedure linkwatch_fire_event [2022-07-14 00:17:53,620 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_zalloc [2022-07-14 00:17:53,620 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_zalloc [2022-07-14 00:17:53,620 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_from_user [2022-07-14 00:17:53,620 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_from_user [2022-07-14 00:17:53,620 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2022-07-14 00:17:53,621 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2022-07-14 00:17:54,001 INFO L234 CfgBuilder]: Building ICFG [2022-07-14 00:17:54,003 INFO L260 CfgBuilder]: Building CFG for each procedure with an implementation [2022-07-14 00:17:54,072 INFO L764 $ProcedureCfgBuilder]: dead code at ProgramPoint ldv_stopFINAL: assume true; [2022-07-14 00:18:06,139 INFO L275 CfgBuilder]: Performing block encoding [2022-07-14 00:18:06,160 INFO L294 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2022-07-14 00:18:06,161 INFO L299 CfgBuilder]: Removed 1 assume(true) statements. [2022-07-14 00:18:06,166 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 14.07 12:18:06 BoogieIcfgContainer [2022-07-14 00:18:06,166 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2022-07-14 00:18:06,168 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2022-07-14 00:18:06,168 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2022-07-14 00:18:06,170 INFO L275 PluginConnector]: TraceAbstraction initialized [2022-07-14 00:18:06,171 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 14.07 12:17:50" (1/3) ... [2022-07-14 00:18:06,172 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@3fa763b0 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 14.07 12:18:06, skipping insertion in model container [2022-07-14 00:18:06,172 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.07 12:17:53" (2/3) ... [2022-07-14 00:18:06,172 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@3fa763b0 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 14.07 12:18:06, skipping insertion in model container [2022-07-14 00:18:06,172 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 14.07 12:18:06" (3/3) ... [2022-07-14 00:18:06,176 INFO L111 eAbstractionObserver]: Analyzing ICFG 205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2022-07-14 00:18:06,189 INFO L201 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2022-07-14 00:18:06,190 INFO L160 ceAbstractionStarter]: Applying trace abstraction to program that has 1 error locations. [2022-07-14 00:18:06,308 INFO L356 AbstractCegarLoop]: ======== Iteration 0 == of CEGAR loop == AllErrorsAtOnce ======== [2022-07-14 00:18:06,318 INFO L357 AbstractCegarLoop]: Settings: SEPARATE_VIOLATION_CHECK=true, mInterprocedural=true, mMaxIterations=1000000, mWatchIteration=1000000, mArtifact=RCFG, mInterpolation=FPandBP, mInterpolantAutomaton=STRAIGHT_LINE, mDumpAutomata=false, mAutomataFormat=ATS_NUMERATE, mDumpPath=., mDeterminiation=PREDICATE_ABSTRACTION, mMinimize=MINIMIZE_SEVPA, mHoare=true, mAutomataTypeConcurrency=PETRI_NET, mHoareTripleChecks=INCREMENTAL, mHoareAnnotationPositions=LoopsAndPotentialCycles, mDumpOnlyReuseAutomata=false, mLimitTraceHistogram=0, mErrorLocTimeLimit=0, mLimitPathProgramCount=0, mCollectInterpolantStatistics=true, mHeuristicEmptinessCheck=false, mHeuristicEmptinessCheckAStarHeuristic=ZERO, mHeuristicEmptinessCheckAStarHeuristicRandomSeed=1337, mHeuristicEmptinessCheckSmtFeatureScoringMethod=DAGSIZE, mSMTFeatureExtraction=false, mSMTFeatureExtractionDumpPath=., mOverrideInterpolantAutomaton=false, mMcrInterpolantMethod=WP, mPorIndependenceSettings=de.uni_freiburg.informatik.ultimate.lib.tracecheckerutils.partialorder.independence.IndependenceSettings@265cada5, mLbeIndependenceSettings=de.uni_freiburg.informatik.ultimate.lib.tracecheckerutils.partialorder.independence.IndependenceSettings@620a572 [2022-07-14 00:18:06,322 INFO L358 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2022-07-14 00:18:06,334 INFO L276 IsEmpty]: Start isEmpty. Operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) [2022-07-14 00:18:06,356 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 48 [2022-07-14 00:18:06,357 INFO L187 NwaCegarLoop]: Found error trace [2022-07-14 00:18:06,357 INFO L195 NwaCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-14 00:18:06,358 INFO L420 AbstractCegarLoop]: === Iteration 1 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-14 00:18:06,368 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-14 00:18:06,369 INFO L85 PathProgramCache]: Analyzing trace with hash -796223239, now seen corresponding path program 1 times [2022-07-14 00:18:06,390 INFO L118 FreeRefinementEngine]: Executing refinement strategy WOLF [2022-07-14 00:18:06,397 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [176125295] [2022-07-14 00:18:06,397 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-14 00:18:06,399 INFO L173 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2022-07-14 00:18:06,399 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2022-07-14 00:18:06,416 INFO L229 MonitoredProcess]: Starting monitored process 2 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2022-07-14 00:18:06,471 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (2)] Waiting until timeout for monitored process [2022-07-14 00:18:06,880 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:18:06,903 INFO L263 TraceCheckSpWp]: Trace formula consists of 242 conjuncts, 2 conjunts are in the unsatisfiable core [2022-07-14 00:18:06,908 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2022-07-14 00:18:07,018 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2022-07-14 00:18:07,018 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2022-07-14 00:18:07,019 INFO L136 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2022-07-14 00:18:07,019 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [176125295] [2022-07-14 00:18:07,020 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleMathsat [176125295] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-14 00:18:07,020 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-14 00:18:07,020 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2022-07-14 00:18:07,022 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1576536866] [2022-07-14 00:18:07,025 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-14 00:18:07,030 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 3 states [2022-07-14 00:18:07,030 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2022-07-14 00:18:07,102 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2022-07-14 00:18:07,103 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2022-07-14 00:18:07,107 INFO L87 Difference]: Start difference. First operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) Second operand has 3 states, 3 states have (on average 8.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-14 00:18:07,427 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-14 00:18:07,428 INFO L93 Difference]: Finished difference Result 1423 states and 2029 transitions. [2022-07-14 00:18:07,431 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2022-07-14 00:18:07,432 INFO L78 Accepts]: Start accepts. Automaton has has 3 states, 3 states have (on average 8.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 47 [2022-07-14 00:18:07,433 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-14 00:18:07,454 INFO L225 Difference]: With dead ends: 1423 [2022-07-14 00:18:07,454 INFO L226 Difference]: Without dead ends: 924 [2022-07-14 00:18:07,462 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 46 GetRequests, 45 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2022-07-14 00:18:07,466 INFO L413 NwaCegarLoop]: 767 mSDtfsCounter, 628 mSDsluCounter, 661 mSDsCounter, 0 mSdLazyCounter, 12 mSolverCounterSat, 3 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.1s Time, 0 mProtectedPredicate, 0 mProtectedAction, 628 SdHoareTripleChecker+Valid, 1428 SdHoareTripleChecker+Invalid, 15 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 3 IncrementalHoareTripleChecker+Valid, 12 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.1s IncrementalHoareTripleChecker+Time [2022-07-14 00:18:07,466 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [628 Valid, 1428 Invalid, 15 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [3 Valid, 12 Invalid, 0 Unknown, 0 Unchecked, 0.1s Time] [2022-07-14 00:18:07,485 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 924 states. [2022-07-14 00:18:07,585 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 924 to 924. [2022-07-14 00:18:07,589 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 924 states, 685 states have (on average 1.3562043795620438) internal successors, (929), 699 states have internal predecessors, (929), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2022-07-14 00:18:07,597 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 924 states to 924 states and 1284 transitions. [2022-07-14 00:18:07,599 INFO L78 Accepts]: Start accepts. Automaton has 924 states and 1284 transitions. Word has length 47 [2022-07-14 00:18:07,600 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-14 00:18:07,600 INFO L495 AbstractCegarLoop]: Abstraction has 924 states and 1284 transitions. [2022-07-14 00:18:07,600 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 3 states, 3 states have (on average 8.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-14 00:18:07,600 INFO L276 IsEmpty]: Start isEmpty. Operand 924 states and 1284 transitions. [2022-07-14 00:18:07,634 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 51 [2022-07-14 00:18:07,634 INFO L187 NwaCegarLoop]: Found error trace [2022-07-14 00:18:07,634 INFO L195 NwaCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-14 00:18:07,660 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (2)] Forceful destruction successful, exit code 0 [2022-07-14 00:18:07,835 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 2 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2022-07-14 00:18:07,835 INFO L420 AbstractCegarLoop]: === Iteration 2 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-14 00:18:07,836 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-14 00:18:07,836 INFO L85 PathProgramCache]: Analyzing trace with hash 566714884, now seen corresponding path program 1 times [2022-07-14 00:18:07,837 INFO L118 FreeRefinementEngine]: Executing refinement strategy WOLF [2022-07-14 00:18:07,837 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [1763464419] [2022-07-14 00:18:07,837 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-14 00:18:07,837 INFO L173 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2022-07-14 00:18:07,837 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2022-07-14 00:18:07,850 INFO L229 MonitoredProcess]: Starting monitored process 3 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2022-07-14 00:18:07,854 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (3)] Waiting until timeout for monitored process [2022-07-14 00:18:08,280 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:18:08,290 INFO L263 TraceCheckSpWp]: Trace formula consists of 246 conjuncts, 3 conjunts are in the unsatisfiable core [2022-07-14 00:18:08,293 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2022-07-14 00:18:08,358 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2022-07-14 00:18:08,359 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2022-07-14 00:18:08,359 INFO L136 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2022-07-14 00:18:08,375 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [1763464419] [2022-07-14 00:18:08,376 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleMathsat [1763464419] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-14 00:18:08,376 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-14 00:18:08,376 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2022-07-14 00:18:08,376 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [528506265] [2022-07-14 00:18:08,377 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-14 00:18:08,378 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 4 states [2022-07-14 00:18:08,379 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2022-07-14 00:18:08,379 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2022-07-14 00:18:08,380 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2022-07-14 00:18:08,380 INFO L87 Difference]: Start difference. First operand 924 states and 1284 transitions. Second operand has 4 states, 4 states have (on average 6.75) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-14 00:18:08,825 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-14 00:18:08,825 INFO L93 Difference]: Finished difference Result 1833 states and 2547 transitions. [2022-07-14 00:18:08,826 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2022-07-14 00:18:08,826 INFO L78 Accepts]: Start accepts. Automaton has has 4 states, 4 states have (on average 6.75) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 50 [2022-07-14 00:18:08,827 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-14 00:18:08,836 INFO L225 Difference]: With dead ends: 1833 [2022-07-14 00:18:08,836 INFO L226 Difference]: Without dead ends: 923 [2022-07-14 00:18:08,842 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 51 GetRequests, 48 SyntacticMatches, 0 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2022-07-14 00:18:08,843 INFO L413 NwaCegarLoop]: 782 mSDtfsCounter, 794 mSDsluCounter, 671 mSDsCounter, 0 mSdLazyCounter, 36 mSolverCounterSat, 37 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.3s Time, 0 mProtectedPredicate, 0 mProtectedAction, 794 SdHoareTripleChecker+Valid, 1453 SdHoareTripleChecker+Invalid, 73 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 37 IncrementalHoareTripleChecker+Valid, 36 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.3s IncrementalHoareTripleChecker+Time [2022-07-14 00:18:08,843 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [794 Valid, 1453 Invalid, 73 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [37 Valid, 36 Invalid, 0 Unknown, 0 Unchecked, 0.3s Time] [2022-07-14 00:18:08,847 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 923 states. [2022-07-14 00:18:08,895 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 923 to 923. [2022-07-14 00:18:08,898 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 923 states, 684 states have (on average 1.3523391812865497) internal successors, (925), 698 states have internal predecessors, (925), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2022-07-14 00:18:08,904 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 923 states to 923 states and 1280 transitions. [2022-07-14 00:18:08,905 INFO L78 Accepts]: Start accepts. Automaton has 923 states and 1280 transitions. Word has length 50 [2022-07-14 00:18:08,906 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-14 00:18:08,906 INFO L495 AbstractCegarLoop]: Abstraction has 923 states and 1280 transitions. [2022-07-14 00:18:08,906 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 4 states, 4 states have (on average 6.75) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2022-07-14 00:18:08,906 INFO L276 IsEmpty]: Start isEmpty. Operand 923 states and 1280 transitions. [2022-07-14 00:18:08,915 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 72 [2022-07-14 00:18:08,916 INFO L187 NwaCegarLoop]: Found error trace [2022-07-14 00:18:08,917 INFO L195 NwaCegarLoop]: trace histogram [7, 7, 7, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-14 00:18:08,931 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (3)] Forceful destruction successful, exit code 0 [2022-07-14 00:18:09,129 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 3 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2022-07-14 00:18:09,130 INFO L420 AbstractCegarLoop]: === Iteration 3 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-14 00:18:09,130 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-14 00:18:09,130 INFO L85 PathProgramCache]: Analyzing trace with hash -965053755, now seen corresponding path program 1 times [2022-07-14 00:18:09,131 INFO L118 FreeRefinementEngine]: Executing refinement strategy WOLF [2022-07-14 00:18:09,131 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [532388530] [2022-07-14 00:18:09,131 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-14 00:18:09,131 INFO L173 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2022-07-14 00:18:09,131 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2022-07-14 00:18:09,155 INFO L229 MonitoredProcess]: Starting monitored process 4 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2022-07-14 00:18:09,172 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (4)] Waiting until timeout for monitored process [2022-07-14 00:18:09,553 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:18:09,578 INFO L263 TraceCheckSpWp]: Trace formula consists of 304 conjuncts, 4 conjunts are in the unsatisfiable core [2022-07-14 00:18:09,581 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2022-07-14 00:18:09,865 INFO L134 CoverageAnalysis]: Checked inductivity of 89 backedges. 40 proven. 0 refuted. 0 times theorem prover too weak. 49 trivial. 0 not checked. [2022-07-14 00:18:09,865 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2022-07-14 00:18:09,865 INFO L136 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2022-07-14 00:18:09,865 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [532388530] [2022-07-14 00:18:09,866 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleMathsat [532388530] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-14 00:18:09,866 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-14 00:18:09,866 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [] total 5 [2022-07-14 00:18:09,866 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [746159823] [2022-07-14 00:18:09,866 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-14 00:18:09,866 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2022-07-14 00:18:09,867 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2022-07-14 00:18:09,867 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2022-07-14 00:18:09,867 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2022-07-14 00:18:09,867 INFO L87 Difference]: Start difference. First operand 923 states and 1280 transitions. Second operand has 5 states, 5 states have (on average 7.4) internal successors, (37), 5 states have internal predecessors, (37), 3 states have call successors, (8), 3 states have call predecessors, (8), 2 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2022-07-14 00:18:10,278 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-14 00:18:10,293 INFO L93 Difference]: Finished difference Result 2738 states and 3820 transitions. [2022-07-14 00:18:10,294 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2022-07-14 00:18:10,294 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 7.4) internal successors, (37), 5 states have internal predecessors, (37), 3 states have call successors, (8), 3 states have call predecessors, (8), 2 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) Word has length 71 [2022-07-14 00:18:10,294 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-14 00:18:10,308 INFO L225 Difference]: With dead ends: 2738 [2022-07-14 00:18:10,323 INFO L226 Difference]: Without dead ends: 1824 [2022-07-14 00:18:10,332 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 72 GetRequests, 67 SyntacticMatches, 0 SemanticMatches, 5 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=17, Invalid=25, Unknown=0, NotChecked=0, Total=42 [2022-07-14 00:18:10,335 INFO L413 NwaCegarLoop]: 751 mSDtfsCounter, 627 mSDsluCounter, 2142 mSDsCounter, 0 mSdLazyCounter, 21 mSolverCounterSat, 2 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.2s Time, 0 mProtectedPredicate, 0 mProtectedAction, 627 SdHoareTripleChecker+Valid, 2893 SdHoareTripleChecker+Invalid, 23 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 2 IncrementalHoareTripleChecker+Valid, 21 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.3s IncrementalHoareTripleChecker+Time [2022-07-14 00:18:10,336 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [627 Valid, 2893 Invalid, 23 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [2 Valid, 21 Invalid, 0 Unknown, 0 Unchecked, 0.3s Time] [2022-07-14 00:18:10,339 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1824 states. [2022-07-14 00:18:10,488 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1824 to 1824. [2022-07-14 00:18:10,507 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1824 states, 1353 states have (on average 1.3540280857354028) internal successors, (1832), 1381 states have internal predecessors, (1832), 350 states have call successors, (350), 121 states have call predecessors, (350), 120 states have return successors, (359), 349 states have call predecessors, (359), 349 states have call successors, (359) [2022-07-14 00:18:10,516 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1824 states to 1824 states and 2541 transitions. [2022-07-14 00:18:10,532 INFO L78 Accepts]: Start accepts. Automaton has 1824 states and 2541 transitions. Word has length 71 [2022-07-14 00:18:10,534 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-14 00:18:10,534 INFO L495 AbstractCegarLoop]: Abstraction has 1824 states and 2541 transitions. [2022-07-14 00:18:10,534 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 7.4) internal successors, (37), 5 states have internal predecessors, (37), 3 states have call successors, (8), 3 states have call predecessors, (8), 2 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2022-07-14 00:18:10,534 INFO L276 IsEmpty]: Start isEmpty. Operand 1824 states and 2541 transitions. [2022-07-14 00:18:10,545 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 142 [2022-07-14 00:18:10,545 INFO L187 NwaCegarLoop]: Found error trace [2022-07-14 00:18:10,546 INFO L195 NwaCegarLoop]: trace histogram [8, 8, 8, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-14 00:18:10,599 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (4)] Forceful destruction successful, exit code 0 [2022-07-14 00:18:10,799 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 4 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2022-07-14 00:18:10,800 INFO L420 AbstractCegarLoop]: === Iteration 4 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-14 00:18:10,800 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-14 00:18:10,800 INFO L85 PathProgramCache]: Analyzing trace with hash -574025911, now seen corresponding path program 1 times [2022-07-14 00:18:10,801 INFO L118 FreeRefinementEngine]: Executing refinement strategy WOLF [2022-07-14 00:18:10,801 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [1427837579] [2022-07-14 00:18:10,801 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-14 00:18:10,801 INFO L173 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2022-07-14 00:18:10,802 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2022-07-14 00:18:10,806 INFO L229 MonitoredProcess]: Starting monitored process 5 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2022-07-14 00:18:10,885 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (5)] Waiting until timeout for monitored process [2022-07-14 00:18:11,414 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:18:11,450 INFO L263 TraceCheckSpWp]: Trace formula consists of 608 conjuncts, 9 conjunts are in the unsatisfiable core [2022-07-14 00:18:11,456 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2022-07-14 00:18:11,688 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 104 trivial. 0 not checked. [2022-07-14 00:18:11,688 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2022-07-14 00:18:11,688 INFO L136 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2022-07-14 00:18:11,688 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [1427837579] [2022-07-14 00:18:11,688 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleMathsat [1427837579] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-14 00:18:11,688 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-14 00:18:11,689 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [] total 5 [2022-07-14 00:18:11,689 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [128537705] [2022-07-14 00:18:11,689 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-14 00:18:11,689 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2022-07-14 00:18:11,689 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2022-07-14 00:18:11,690 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2022-07-14 00:18:11,690 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2022-07-14 00:18:11,690 INFO L87 Difference]: Start difference. First operand 1824 states and 2541 transitions. Second operand has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2022-07-14 00:18:11,953 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-14 00:18:11,954 INFO L93 Difference]: Finished difference Result 3658 states and 5130 transitions. [2022-07-14 00:18:11,956 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2022-07-14 00:18:11,956 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) Word has length 141 [2022-07-14 00:18:11,957 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-14 00:18:11,968 INFO L225 Difference]: With dead ends: 3658 [2022-07-14 00:18:11,968 INFO L226 Difference]: Without dead ends: 1848 [2022-07-14 00:18:11,977 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 140 GetRequests, 137 SyntacticMatches, 0 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2022-07-14 00:18:11,979 INFO L413 NwaCegarLoop]: 658 mSDtfsCounter, 2 mSDsluCounter, 1961 mSDsCounter, 0 mSdLazyCounter, 19 mSolverCounterSat, 1 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.2s Time, 0 mProtectedPredicate, 0 mProtectedAction, 2 SdHoareTripleChecker+Valid, 2619 SdHoareTripleChecker+Invalid, 20 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 1 IncrementalHoareTripleChecker+Valid, 19 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.2s IncrementalHoareTripleChecker+Time [2022-07-14 00:18:11,980 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [2 Valid, 2619 Invalid, 20 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [1 Valid, 19 Invalid, 0 Unknown, 0 Unchecked, 0.2s Time] [2022-07-14 00:18:11,983 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1848 states. [2022-07-14 00:18:12,091 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1848 to 1844. [2022-07-14 00:18:12,096 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1844 states, 1367 states have (on average 1.3504023408924652) internal successors, (1846), 1397 states have internal predecessors, (1846), 350 states have call successors, (350), 121 states have call predecessors, (350), 126 states have return successors, (374), 353 states have call predecessors, (374), 349 states have call successors, (374) [2022-07-14 00:18:12,109 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1844 states to 1844 states and 2570 transitions. [2022-07-14 00:18:12,110 INFO L78 Accepts]: Start accepts. Automaton has 1844 states and 2570 transitions. Word has length 141 [2022-07-14 00:18:12,113 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-14 00:18:12,113 INFO L495 AbstractCegarLoop]: Abstraction has 1844 states and 2570 transitions. [2022-07-14 00:18:12,114 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2022-07-14 00:18:12,114 INFO L276 IsEmpty]: Start isEmpty. Operand 1844 states and 2570 transitions. [2022-07-14 00:18:12,125 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 149 [2022-07-14 00:18:12,126 INFO L187 NwaCegarLoop]: Found error trace [2022-07-14 00:18:12,126 INFO L195 NwaCegarLoop]: trace histogram [8, 8, 7, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-14 00:18:12,155 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (5)] Forceful destruction successful, exit code 0 [2022-07-14 00:18:12,349 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 5 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2022-07-14 00:18:12,349 INFO L420 AbstractCegarLoop]: === Iteration 5 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-14 00:18:12,349 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-14 00:18:12,350 INFO L85 PathProgramCache]: Analyzing trace with hash -1293113785, now seen corresponding path program 1 times [2022-07-14 00:18:12,351 INFO L118 FreeRefinementEngine]: Executing refinement strategy WOLF [2022-07-14 00:18:12,351 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [166233463] [2022-07-14 00:18:12,351 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-14 00:18:12,351 INFO L173 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2022-07-14 00:18:12,351 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2022-07-14 00:18:12,367 INFO L229 MonitoredProcess]: Starting monitored process 6 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2022-07-14 00:18:12,404 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (6)] Waiting until timeout for monitored process [2022-07-14 00:18:13,042 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2022-07-14 00:18:13,080 INFO L263 TraceCheckSpWp]: Trace formula consists of 634 conjuncts, 22 conjunts are in the unsatisfiable core [2022-07-14 00:18:13,084 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2022-07-14 00:18:14,025 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 104 trivial. 0 not checked. [2022-07-14 00:18:14,026 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2022-07-14 00:18:14,026 INFO L136 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2022-07-14 00:18:14,026 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [166233463] [2022-07-14 00:18:14,026 INFO L157 FreeRefinementEngine]: IpTcStrategyModuleMathsat [166233463] provided 1 perfect and 0 imperfect interpolant sequences [2022-07-14 00:18:14,026 INFO L184 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2022-07-14 00:18:14,026 INFO L197 FreeRefinementEngine]: Number of different interpolants: perfect sequences [12] imperfect sequences [] total 12 [2022-07-14 00:18:14,027 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [352936530] [2022-07-14 00:18:14,027 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2022-07-14 00:18:14,027 INFO L571 AbstractCegarLoop]: INTERPOLANT automaton has 12 states [2022-07-14 00:18:14,027 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2022-07-14 00:18:14,028 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 12 interpolants. [2022-07-14 00:18:14,028 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=21, Invalid=111, Unknown=0, NotChecked=0, Total=132 [2022-07-14 00:18:14,028 INFO L87 Difference]: Start difference. First operand 1844 states and 2570 transitions. Second operand has 12 states, 12 states have (on average 7.333333333333333) internal successors, (88), 9 states have internal predecessors, (88), 2 states have call successors, (19), 2 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 2 states have call successors, (18) [2022-07-14 00:18:17,048 WARN L534 Checker$ProtectedHtc]: IncrementalHoareTripleChecker took 1.04s for a HTC check with result INVALID. Formula has sorts [Array, Bool, BitVec], hasArrays=true, hasNonlinArith=false, quantifiers [] [2022-07-14 00:18:20,436 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2022-07-14 00:18:20,436 INFO L93 Difference]: Finished difference Result 3746 states and 5240 transitions. [2022-07-14 00:18:20,438 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 13 states. [2022-07-14 00:18:20,438 INFO L78 Accepts]: Start accepts. Automaton has has 12 states, 12 states have (on average 7.333333333333333) internal successors, (88), 9 states have internal predecessors, (88), 2 states have call successors, (19), 2 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 2 states have call successors, (18) Word has length 148 [2022-07-14 00:18:20,439 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2022-07-14 00:18:20,454 INFO L225 Difference]: With dead ends: 3746 [2022-07-14 00:18:20,455 INFO L226 Difference]: Without dead ends: 1916 [2022-07-14 00:18:20,463 INFO L412 NwaCegarLoop]: 0 DeclaredPredicates, 152 GetRequests, 138 SyntacticMatches, 0 SemanticMatches, 14 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 6 ImplicationChecksByTransitivity, 0.9s TimeCoverageRelationStatistics Valid=37, Invalid=203, Unknown=0, NotChecked=0, Total=240 [2022-07-14 00:18:20,464 INFO L413 NwaCegarLoop]: 669 mSDtfsCounter, 36 mSDsluCounter, 6606 mSDsCounter, 0 mSdLazyCounter, 187 mSolverCounterSat, 8 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 5.5s Time, 0 mProtectedPredicate, 0 mProtectedAction, 39 SdHoareTripleChecker+Valid, 7275 SdHoareTripleChecker+Invalid, 195 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.1s SdHoareTripleChecker+Time, 8 IncrementalHoareTripleChecker+Valid, 187 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 5.9s IncrementalHoareTripleChecker+Time [2022-07-14 00:18:20,464 INFO L414 NwaCegarLoop]: SdHoareTripleChecker [39 Valid, 7275 Invalid, 195 Unknown, 0 Unchecked, 0.1s Time], IncrementalHoareTripleChecker [8 Valid, 187 Invalid, 0 Unknown, 0 Unchecked, 5.9s Time] [2022-07-14 00:18:20,466 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1916 states. [2022-07-14 00:18:20,568 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1916 to 1884. [2022-07-14 00:18:20,573 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1884 states, 1397 states have (on average 1.340014316392269) internal successors, (1872), 1427 states have internal predecessors, (1872), 356 states have call successors, (356), 121 states have call predecessors, (356), 130 states have return successors, (386), 363 states have call predecessors, (386), 355 states have call successors, (386) [2022-07-14 00:18:20,597 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1884 states to 1884 states and 2614 transitions. [2022-07-14 00:18:20,598 INFO L78 Accepts]: Start accepts. Automaton has 1884 states and 2614 transitions. Word has length 148 [2022-07-14 00:18:20,600 INFO L84 Accepts]: Finished accepts. word is rejected. [2022-07-14 00:18:20,602 INFO L495 AbstractCegarLoop]: Abstraction has 1884 states and 2614 transitions. [2022-07-14 00:18:20,603 INFO L496 AbstractCegarLoop]: INTERPOLANT automaton has has 12 states, 12 states have (on average 7.333333333333333) internal successors, (88), 9 states have internal predecessors, (88), 2 states have call successors, (19), 2 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 2 states have call successors, (18) [2022-07-14 00:18:20,603 INFO L276 IsEmpty]: Start isEmpty. Operand 1884 states and 2614 transitions. [2022-07-14 00:18:20,611 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 184 [2022-07-14 00:18:20,611 INFO L187 NwaCegarLoop]: Found error trace [2022-07-14 00:18:20,612 INFO L195 NwaCegarLoop]: trace histogram [8, 8, 7, 4, 4, 4, 3, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2022-07-14 00:18:20,641 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (6)] Forceful destruction successful, exit code 0 [2022-07-14 00:18:20,831 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 6 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2022-07-14 00:18:20,832 INFO L420 AbstractCegarLoop]: === Iteration 6 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2022-07-14 00:18:20,832 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2022-07-14 00:18:20,833 INFO L85 PathProgramCache]: Analyzing trace with hash -669328497, now seen corresponding path program 1 times [2022-07-14 00:18:20,834 INFO L118 FreeRefinementEngine]: Executing refinement strategy WOLF [2022-07-14 00:18:20,834 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [1482995916] [2022-07-14 00:18:20,834 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2022-07-14 00:18:20,834 INFO L173 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2022-07-14 00:18:20,834 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2022-07-14 00:18:20,837 INFO L229 MonitoredProcess]: Starting monitored process 7 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2022-07-14 00:18:20,866 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (7)] Waiting until timeout for monitored process [2022-07-14 00:18:23,800 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2022-07-14 00:18:23,802 INFO L352 TraceCheck]: Trace is feasible, we will do another trace check, this time with branch encoders. [2022-07-14 00:18:26,154 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2022-07-14 00:18:26,811 INFO L130 FreeRefinementEngine]: Strategy WOLF found a feasible trace [2022-07-14 00:18:26,811 INFO L271 BasicCegarLoop]: Counterexample is feasible [2022-07-14 00:18:26,812 INFO L805 garLoopResultBuilder]: Registering result UNSAFE for location ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION (0 of 1 remaining) [2022-07-14 00:18:26,894 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (7)] Forceful destruction successful, exit code 0 [2022-07-14 00:18:27,035 WARN L477 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 7 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2022-07-14 00:18:27,039 INFO L356 BasicCegarLoop]: Path program histogram: [1, 1, 1, 1, 1, 1] [2022-07-14 00:18:27,044 INFO L176 ceAbstractionStarter]: Computing trace abstraction results [2022-07-14 00:18:27,123 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:18:27,134 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:18:27,147 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:18:27,148 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:18:27,148 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:18:27,149 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:18:27,149 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:18:27,149 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:18:27,149 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:18:27,149 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:18:27,428 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 14.07 12:18:27 BoogieIcfgContainer [2022-07-14 00:18:27,428 INFO L132 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2022-07-14 00:18:27,428 INFO L113 PluginConnector]: ------------------------Witness Printer---------------------------- [2022-07-14 00:18:27,429 INFO L271 PluginConnector]: Initializing Witness Printer... [2022-07-14 00:18:27,429 INFO L275 PluginConnector]: Witness Printer initialized [2022-07-14 00:18:27,429 INFO L185 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 14.07 12:18:06" (3/4) ... [2022-07-14 00:18:27,435 INFO L131 WitnessPrinter]: Generating witness for reachability counterexample [2022-07-14 00:18:27,476 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:18:27,477 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:18:27,477 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:18:27,477 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:18:27,478 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:18:27,478 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:18:27,478 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:18:27,478 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:18:27,478 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:18:27,479 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2022-07-14 00:18:27,647 INFO L141 WitnessManager]: Wrote witness to /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/witness.graphml [2022-07-14 00:18:27,647 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2022-07-14 00:18:27,648 INFO L158 Benchmark]: Toolchain (without parser) took 37211.10ms. Allocated memory was 65.0MB in the beginning and 255.9MB in the end (delta: 190.8MB). Free memory was 35.5MB in the beginning and 108.7MB in the end (delta: -73.2MB). Peak memory consumption was 117.2MB. Max. memory is 16.1GB. [2022-07-14 00:18:27,648 INFO L158 Benchmark]: CDTParser took 0.18ms. Allocated memory is still 65.0MB. Free memory was 46.3MB in the beginning and 46.2MB in the end (delta: 45.7kB). There was no memory consumed. Max. memory is 16.1GB. [2022-07-14 00:18:27,648 INFO L158 Benchmark]: CACSL2BoogieTranslator took 2654.28ms. Allocated memory was 65.0MB in the beginning and 146.8MB in the end (delta: 81.8MB). Free memory was 35.4MB in the beginning and 68.7MB in the end (delta: -33.3MB). Peak memory consumption was 48.8MB. Max. memory is 16.1GB. [2022-07-14 00:18:27,649 INFO L158 Benchmark]: Boogie Procedure Inliner took 202.24ms. Allocated memory is still 146.8MB. Free memory was 68.7MB in the beginning and 92.2MB in the end (delta: -23.5MB). Peak memory consumption was 10.7MB. Max. memory is 16.1GB. [2022-07-14 00:18:27,649 INFO L158 Benchmark]: Boogie Preprocessor took 148.47ms. Allocated memory is still 146.8MB. Free memory was 92.2MB in the beginning and 83.1MB in the end (delta: 9.1MB). Peak memory consumption was 10.5MB. Max. memory is 16.1GB. [2022-07-14 00:18:27,649 INFO L158 Benchmark]: RCFGBuilder took 12717.20ms. Allocated memory is still 146.8MB. Free memory was 83.1MB in the beginning and 52.7MB in the end (delta: 30.4MB). Peak memory consumption was 37.9MB. Max. memory is 16.1GB. [2022-07-14 00:18:27,650 INFO L158 Benchmark]: TraceAbstraction took 21260.17ms. Allocated memory was 146.8MB in the beginning and 255.9MB in the end (delta: 109.1MB). Free memory was 52.2MB in the beginning and 146.6MB in the end (delta: -94.5MB). Peak memory consumption was 99.5MB. Max. memory is 16.1GB. [2022-07-14 00:18:27,650 INFO L158 Benchmark]: Witness Printer took 218.93ms. Allocated memory is still 255.9MB. Free memory was 146.6MB in the beginning and 108.7MB in the end (delta: 37.9MB). Peak memory consumption was 37.7MB. Max. memory is 16.1GB. [2022-07-14 00:18:27,651 INFO L339 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.18ms. Allocated memory is still 65.0MB. Free memory was 46.3MB in the beginning and 46.2MB in the end (delta: 45.7kB). There was no memory consumed. Max. memory is 16.1GB. * CACSL2BoogieTranslator took 2654.28ms. Allocated memory was 65.0MB in the beginning and 146.8MB in the end (delta: 81.8MB). Free memory was 35.4MB in the beginning and 68.7MB in the end (delta: -33.3MB). Peak memory consumption was 48.8MB. Max. memory is 16.1GB. * Boogie Procedure Inliner took 202.24ms. Allocated memory is still 146.8MB. Free memory was 68.7MB in the beginning and 92.2MB in the end (delta: -23.5MB). Peak memory consumption was 10.7MB. Max. memory is 16.1GB. * Boogie Preprocessor took 148.47ms. Allocated memory is still 146.8MB. Free memory was 92.2MB in the beginning and 83.1MB in the end (delta: 9.1MB). Peak memory consumption was 10.5MB. Max. memory is 16.1GB. * RCFGBuilder took 12717.20ms. Allocated memory is still 146.8MB. Free memory was 83.1MB in the beginning and 52.7MB in the end (delta: 30.4MB). Peak memory consumption was 37.9MB. Max. memory is 16.1GB. * TraceAbstraction took 21260.17ms. Allocated memory was 146.8MB in the beginning and 255.9MB in the end (delta: 109.1MB). Free memory was 52.2MB in the beginning and 146.6MB in the end (delta: -94.5MB). Peak memory consumption was 99.5MB. Max. memory is 16.1GB. * Witness Printer took 218.93ms. Allocated memory is still 255.9MB. Free memory was 146.6MB in the beginning and 108.7MB in the end (delta: 37.9MB). Peak memory consumption was 37.7MB. Max. memory is 16.1GB. * Results from de.uni_freiburg.informatik.ultimate.boogie.preprocessor: - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: - GenericResult: Unfinished Backtranslation The program execution was not completely translated back. - GenericResult: Unfinished Backtranslation The program execution was not completely translated back. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - StatisticsResult: ErrorAutomatonStatistics NumberErrorTraces: 0, NumberStatementsAllTraces: 0, NumberRelevantStatements: 0, 0.0s ErrorAutomatonConstructionTimeTotal, 0.0s FaulLocalizationTime, NumberStatementsFirstTrace: -1, TraceLengthAvg: 0, 0.0s ErrorAutomatonConstructionTimeAvg, 0.0s ErrorAutomatonDifferenceTimeAvg, 0.0s ErrorAutomatonDifferenceTimeTotal, NumberOfNoEnhancement: 0, NumberOfFiniteEnhancement: 0, NumberOfInfiniteEnhancement: 0 - CounterExampleResult [Line: 5554]: a call to reach_error is reachable a call to reach_error is reachable We found a FailurePath: [L5577] int LDV_IN_INTERRUPT = 1; [L5578] struct sk_buff *proto_group1 ; [L5579] int ldv_state_variable_0 ; [L5580] int ldv_state_variable_3 ; [L5581] int ldv_timer_state_1 = 0; [L5582] int ldv_state_variable_2 ; [L5583] struct net_device *proto_group0 ; [L5584] int ref_cnt ; [L5585] int ldv_state_variable_1 ; [L5586] struct timer_list *ldv_timer_list_1 ; [L5964-L5966] static struct hdlc_proto proto = {0, 0, & cisco_start, & cisco_stop, 0, & cisco_ioctl, & cisco_type_trans, & cisco_rx, 0, & __this_module, 0}; [L5967] static struct header_ops const cisco_header_ops = {& cisco_hard_header, 0, 0, 0, 0}; [L6078] int ldv_retval_0 ; [L6374] Element set_impl[15] ; [L6375] int last_index = 0; [L6509] Set LDV_SKBS ; VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6142] struct ifreq *ldvarg0 ; [L6143] void *tmp ; [L6144] unsigned int ldvarg1 ; [L6145] unsigned int tmp___0 ; [L6146] unsigned short ldvarg4 ; [L6147] unsigned short tmp___1 ; [L6148] struct sk_buff *ldvarg3 ; [L6149] void *tmp___2 ; [L6150] struct net_device *ldvarg5 ; [L6151] void *tmp___3 ; [L6152] void *ldvarg2 ; [L6153] void *tmp___4 ; [L6154] void *ldvarg6 ; [L6155] void *tmp___5 ; [L6156] int tmp___6 ; [L6157] int tmp___7 ; [L6158] int tmp___8 ; [L6159] int tmp___9 ; VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6161] CALL, EXPR ldv_zalloc(40UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=40, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=40, tmp___0=2147483648] [L6161] RET, EXPR ldv_zalloc(40UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(40UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6161] tmp = ldv_zalloc(40UL) [L6162] ldvarg0 = (struct ifreq *)tmp [L6163] tmp___0 = __VERIFIER_nondet_uint() [L6164] ldvarg1 = tmp___0 [L6165] tmp___1 = __VERIFIER_nondet_ushort() [L6166] ldvarg4 = tmp___1 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg4=5, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5] [L6167] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=232, tmp___0=2147483648] [L6167] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg4=5, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5] [L6167] tmp___2 = ldv_zalloc(232UL) [L6168] ldvarg3 = (struct sk_buff *)tmp___2 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}] [L6169] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=3264, tmp___0=2147483648] [L6169] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}] [L6169] tmp___3 = ldv_zalloc(3264UL) [L6170] ldvarg5 = (struct net_device *)tmp___3 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}] [L6171] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=2147483648] [L6171] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}] [L6171] tmp___4 = ldv_zalloc(1UL) [L6172] ldvarg2 = tmp___4 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=2147483648] [L6173] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] tmp___5 = ldv_zalloc(1UL) [L6174] ldvarg6 = tmp___5 [L6175] CALL ldv_initialize() [L6528] CALL ldv_set_init(LDV_SKBS) [L6380] set = set_impl [L6381] last_index = 0 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={18:0}, set_impl={18:0}] [L6528] RET ldv_set_init(LDV_SKBS) [L6175] RET ldv_initialize() [L6176] ldv_state_variable_1 = 1 [L6177] ref_cnt = 0 [L6178] ldv_state_variable_0 = 1 [L6179] ldv_state_variable_3 = 0 [L6180] ldv_state_variable_2 = 0 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: [L6202] case 1: VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6203] COND TRUE ldv_state_variable_0 == 1 [L6204] CALL, EXPR mod_init() [L6067] FCALL register_hdlc_protocol(& proto) [L6068] return (0); VAL [\result=0, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6204] RET, EXPR mod_init() [L6204] ldv_retval_0 = mod_init() [L6205] COND TRUE ldv_retval_0 == 0 [L6206] ldv_state_variable_0 = 3 [L6207] ldv_state_variable_2 = 1 [L6208] ldv_state_variable_3 = 1 [L6209] CALL ldv_initialize_hdlc_proto_3() [L6101] void *tmp ; [L6102] void *tmp___0 ; VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6104] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=232, tmp___0=2147483648] [L6104] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6104] tmp = ldv_zalloc(232UL) [L6105] proto_group1 = (struct sk_buff *)tmp VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L6106] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=3264, tmp___0=2147483648] [L6106] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L6106] tmp___0 = ldv_zalloc(3264UL) [L6107] proto_group0 = (struct net_device *)tmp___0 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0={0:0}] [L6209] RET ldv_initialize_hdlc_proto_3() [L6212] COND FALSE !(ldv_retval_0 != 0) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=0, tmp___7=1] [L6185] COND TRUE ldv_state_variable_1 != 0 [L6186] CALL choose_timer_1(ldv_timer_list_1) [L6114] LDV_IN_INTERRUPT = 2 [L6115] EXPR timer->data [L6115] EXPR timer->function [L6115] CALL (*(timer->function))(timer->data) [L5877] struct net_device *dev ; [L5878] hdlc_device *hdlc ; [L5879] struct hdlc_device *tmp ; [L5880] struct cisco_state *st ; [L5881] struct cisco_state *tmp___0 ; [L5882] __u32 tmp___1 ; [L5883] __u32 tmp___2 ; [L5885] dev = (struct net_device *)arg VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5886] CALL, EXPR dev_to_hdlc(dev) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5638] void *tmp ; [L5640] CALL, EXPR netdev_priv((struct net_device const *)dev) [L5595] return ((void *)dev + 3264U); VAL [\result={0:3264}, __this_module={0:0}, cisco_header_ops={17:0}, dev={0:0}, dev={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5640] RET, EXPR netdev_priv((struct net_device const *)dev) [L5640] tmp = netdev_priv((struct net_device const *)dev) [L5641] return ((struct hdlc_device *)tmp); VAL [\result={0:3264}, __this_module={0:0}, cisco_header_ops={17:0}, dev={0:0}, dev={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:3264}] [L5886] RET, EXPR dev_to_hdlc(dev) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, dev_to_hdlc(dev)={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5886] tmp = dev_to_hdlc(dev) [L5887] hdlc = tmp VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:3264}] [L5888] CALL, EXPR state(hdlc) VAL [__this_module={0:0}, cisco_header_ops={17:0}, hdlc={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5670] EXPR hdlc->state [L5670] return ((struct cisco_state *)hdlc->state); [L5888] RET, EXPR state(hdlc) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, state(hdlc)={0:0}, tmp={0:3264}] [L5888] tmp___0 = state(hdlc) [L5889] st = tmp___0 VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}] [L5890] CALL spin_lock(& st->lock) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5263] FCALL _raw_spin_lock(& lock->ldv_6338.rlock) [L5890] RET spin_lock(& st->lock) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}] [L5891] EXPR st->up [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L [L5891] EXPR st->last_poll [L5891] EXPR st->settings.timeout [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->last_poll=0, st->settings.timeout=0, st->up=2, st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L=0, tmp={0:3264}, tmp___0={0:0}] [L5891] COND FALSE !(st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L) [L5897] EXPR st->rxseq VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->rxseq=0, tmp={0:3264}, tmp___0={0:0}] [L5897] CALL, EXPR __fswab32(st->rxseq) VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=0] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=0, val=0] [L5897] RET, EXPR __fswab32(st->rxseq) VAL [\old(arg)=0, __fswab32(st->rxseq)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->rxseq=0, tmp={0:3264}, tmp___0={0:0}] [L5897] tmp___1 = __fswab32(st->rxseq) [L5898] EXPR st->txseq [L5898] st->txseq = st->txseq + 1U [L5899] EXPR st->txseq VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->txseq=0, tmp={0:3264}, tmp___0={0:0}, tmp___1=0] [L5899] CALL, EXPR __fswab32(st->txseq) VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=0] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=0, val=0] [L5899] RET, EXPR __fswab32(st->txseq) VAL [\old(arg)=0, __fswab32(st->txseq)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->txseq=0, tmp={0:3264}, tmp___0={0:0}, tmp___1=0] [L5899] tmp___2 = __fswab32(st->txseq) [L5900] CALL cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5695] struct sk_buff *skb ; [L5696] struct cisco_packet *data ; [L5697] __u32 tmp ; [L5698] __u32 tmp___0 ; [L5700] CALL, EXPR ldv_dev_alloc_skb_12(22U) [L6356] struct sk_buff *tmp ; VAL [\old(last_index)=0, \old(length)=22, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6358] CALL, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6512] void *skb ; [L6513] void *tmp___7 ; VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6515] CALL, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND FALSE !(tmp___0 != 0) [L5527] EXPR, FCALL calloc(1UL, size) [L5527] tmp = calloc(1UL, size) [L5528] p = tmp VAL [\old(last_index)=0, \old(size)=248, __this_module={0:0}, calloc(1UL, size)={4611686018427387905:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={4611686018427387905:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={4611686018427387905:0}, tmp___0=0] [L5529] CALL assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(cond)=1, \old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5498] COND FALSE !(!cond) VAL [\old(cond)=1, \old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, cond=1, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5529] RET assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(last_index)=0, \old(size)=248, __this_module={0:0}, calloc(1UL, size)={4611686018427387905:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={4611686018427387905:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={4611686018427387905:0}, tmp___0=0] [L5530] return (p); VAL [\old(last_index)=0, \old(size)=248, \result={4611686018427387905:0}, __this_module={0:0}, calloc(1UL, size)={4611686018427387905:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={4611686018427387905:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={4611686018427387905:0}, tmp___0=0] [L6515] RET, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(sizeof(struct sk_buff___0 ))={4611686018427387905:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6515] tmp___7 = ldv_zalloc(sizeof(struct sk_buff___0 )) [L6516] skb = (struct sk_buff___0 *)tmp___7 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, tmp___7={4611686018427387905:0}] [L6517] COND FALSE !(! skb) [L6520] CALL ldv_set_add(LDV_SKBS, skb) [L6388] int i ; [L6390] i = 0 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, e={4611686018427387905:0}, e={4611686018427387905:0}, i=0, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6391] COND TRUE 1 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, e={4611686018427387905:0}, e={4611686018427387905:0}, i=0, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6392] COND FALSE !(i < last_index) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, e={4611686018427387905:0}, e={4611686018427387905:0}, i=0, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6402] COND TRUE last_index < 15 [L6403] set_impl[last_index] = e [L6404] last_index = last_index + 1 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, e={4611686018427387905:0}, e={4611686018427387905:0}, i=0, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6520] RET ldv_set_add(LDV_SKBS, skb) [L6521] return (skb); VAL [\old(last_index)=0, \result={4611686018427387905:0}, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, tmp___7={4611686018427387905:0}] [L6358] RET, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, \old(length)=22, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, ldv_skb_alloc()={4611686018427387905:0}, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6358] tmp = ldv_skb_alloc() [L6359] return (tmp); VAL [\old(last_index)=0, \old(length)=22, \result={4611686018427387905:0}, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={4611686018427387905:0}] [L5700] RET, EXPR ldv_dev_alloc_skb_12(22U) [L5700] skb = ldv_dev_alloc_skb_12(22U) [L5701] COND FALSE !((unsigned long )skb == (unsigned long )((struct sk_buff *)0)) [L5706] CALL skb_reserve(skb, 4) [L5475] EXPR skb->data [L5475] skb->data = skb->data + (unsigned long )len [L5476] EXPR skb->tail [L5476] skb->tail = skb->tail + (sk_buff_data_t )len [L5706] RET skb_reserve(skb, 4) [L5707] CALL cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5676] struct hdlc_header *data ; [L5677] __u16 tmp ; [L5679] CALL skb_push(skb, 4U) [L6687] CALL, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(last_index)=0, \old(size)=1, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5502] void *p ; [L5503] void *tmp ; [L5504] int tmp___0 ; [L5506] tmp___0 = __VERIFIER_nondet_int() [L5507] COND TRUE tmp___0 != 0 [L5508] return ((void *)0); VAL [\old(last_index)=0, \old(size)=1, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=2147483648] [L6687] RET, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(arg1)=4, \old(last_index)=0, __this_module={0:0}, arg0={4611686018427387905:0}, arg0={4611686018427387905:0}, arg1=4, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_malloc(sizeof(unsigned char))={0:0}, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6687] return ldv_malloc(sizeof(unsigned char)); [L5679] RET skb_push(skb, 4U) [L5680] EXPR skb->data [L5680] data = (struct hdlc_header *)skb->data [L5681] COND TRUE (unsigned int )type == 32821U [L5682] data->address = 143U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={0:0}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={0:0}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={4611686018427387905:0}, skb={4611686018427387905:0}, type=32821] [L5686] data->control = 0U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={0:0}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={0:0}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={4611686018427387905:0}, skb={4611686018427387905:0}, type=32821] [L5687] CALL, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(val)=32821, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5123] return ((__u16 )((int )((short )((int )val << 8)) | (int )((short )((int )val >> 8)))); VAL [\old(last_index)=0, \old(val)=32821, \result=13696, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=32821] [L5687] RET, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __fswab16((int )type)=13696, __this_module={0:0}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={0:0}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={4611686018427387905:0}, skb={4611686018427387905:0}, type=32821] [L5687] tmp = __fswab16((int )type) [L5688] data->protocol = tmp [L5689] return (4); VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, \result=4, __this_module={0:0}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={0:0}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={4611686018427387905:0}, skb={4611686018427387905:0}, tmp=13696, type=32821] [L5707] RET cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, \old(par1)=0, \old(par2)=0, \old(type)=2, __this_module={0:0}, cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U)=4, cisco_header_ops={17:0}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=0, par2=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, type=2] [L5708] EXPR skb->data [L5708] data = (struct cisco_packet *)skb->data + 4U [L5709] CALL, EXPR __fswab32(type) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=2] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=2, val=2] [L5709] RET, EXPR __fswab32(type) VAL [\old(last_index)=0, \old(par1)=0, \old(par2)=0, \old(type)=2, __fswab32(type)=2, __this_module={0:0}, cisco_header_ops={17:0}, data={0:72}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=0, par2=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, type=2] [L5709] tmp = __fswab32(type) [L5710] data->type = tmp [L5711] data->par1 = par1 [L5712] data->par2 = par2 [L5713] data->rel = 65535U VAL [\old(last_index)=0, \old(par1)=0, \old(par2)=0, \old(type)=2, __this_module={0:0}, cisco_header_ops={17:0}, data={0:72}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=0, par2=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, tmp=2, type=2] [L5714] CALL, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=300000, \result=300000, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=300000] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=300000, \result=300000, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=300000, val=300000] [L5714] RET, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, \old(par1)=0, \old(par2)=0, \old(type)=2, __fswab32(((__u32 )jiffies + 75000U) * 4U)=300000, __this_module={0:0}, cisco_header_ops={17:0}, data={0:72}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=0, par2=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, tmp=2, type=2] [L5714] tmp___0 = __fswab32(((__u32 )jiffies + 75000U) * 4U) [L5715] data->time = tmp___0 [L5716] CALL skb_put(skb, 18U) [L6690] EXPR arg0->data [L6690] EXPR arg0->tail [L6690] unsigned char *ret_val = arg0->data + arg0->tail; [L6691] EXPR arg0->tail [L6691] arg0->tail += arg1 [L6692] return ret_val; VAL [\old(arg1)=18, \old(last_index)=0, \result={0:4}, __this_module={0:0}, arg0={4611686018427387905:0}, arg0={4611686018427387905:0}, arg1=18, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, ret_val={0:4}, set_impl={18:0}] [L5716] RET skb_put(skb, 18U) [L5717] skb->priority = 7U [L5718] skb->dev = dev [L5719] CALL skb_reset_network_header(skb) [L5483] EXPR skb->data [L5483] EXPR skb->head [L5483] skb->network_header = (int )((__u16 )((long )skb->data)) - (int )((__u16 )((long )skb->head)) [L5719] RET skb_reset_network_header(skb) [L5720] CALL dev_queue_xmit(skb) [L6643] return __VERIFIER_nondet_int(); [L5720] RET dev_queue_xmit(skb) [L5900] RET cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}, tmp___1=0, tmp___2=0] [L5901] CALL spin_unlock(& st->lock) VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5270] FCALL _raw_spin_unlock(& lock->ldv_6338.rlock) [L5901] RET spin_unlock(& st->lock) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}, tmp___1=0, tmp___2=0] [L5902] EXPR st->settings.interval [L5902] st->timer.expires = (unsigned long )(st->settings.interval * 250U) + (unsigned long )jiffies [L5903] st->timer.function = & cisco_timer [L5904] st->timer.data = arg VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}, tmp___1=0, tmp___2=0] [L5905] FCALL add_timer(& st->timer) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}, tmp___1=0, tmp___2=0] [L6115] RET (*(timer->function))(timer->data) [L6116] LDV_IN_INTERRUPT = 1 [L6117] ldv_timer_state_1 = 2 VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, timer={0:0}, timer={0:0}] [L6186] RET choose_timer_1(ldv_timer_list_1) [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6195] COND TRUE ldv_state_variable_0 == 3 && ref_cnt == 0 [L6196] CALL mod_exit() [L6074] FCALL unregister_hdlc_protocol(& proto) [L6196] RET mod_exit() [L6197] ldv_state_variable_0 = 2 VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6315] CALL ldv_check_final_state() [L6579] int tmp___7 ; [L6581] CALL, EXPR ldv_set_is_empty(LDV_SKBS) [L6470] return (last_index == 0); VAL [\result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6581] RET, EXPR ldv_set_is_empty(LDV_SKBS) [L6581] tmp___7 = ldv_set_is_empty(LDV_SKBS) [L6582] COND FALSE !(\read(tmp___7)) VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp___7=0] [L6584] CALL ldv_error() VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5554] reach_error() VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] - StatisticsResult: Ultimate Automizer benchmark data CFG has 33 procedures, 489 locations, 1 error locations. Started 1 CEGAR loops. OverallTime: 20.8s, OverallIterations: 6, TraceHistogramMax: 8, PathProgramHistogramMax: 1, EmptinessCheckTime: 0.1s, AutomataDifference: 8.1s, DeadEndRemovalTime: 0.0s, HoareAnnotationTime: 0.0s, InitialAbstractionConstructionTime: 0.0s, HoareTripleCheckerStatistics: 0 mSolverCounterUnknown, 2090 SdHoareTripleChecker+Valid, 6.7s IncrementalHoareTripleChecker+Time, 0 mSdLazyCounter, 2087 mSDsluCounter, 15668 SdHoareTripleChecker+Invalid, 6.2s Time, 0 mProtectedAction, 0 SdHoareTripleChecker+Unchecked, 0 IncrementalHoareTripleChecker+Unchecked, 12041 mSDsCounter, 51 IncrementalHoareTripleChecker+Valid, 0 mProtectedPredicate, 275 IncrementalHoareTripleChecker+Invalid, 326 SdHoareTripleChecker+Unknown, 0 mSolverCounterNotChecked, 51 mSolverCounterUnsat, 3627 mSDtfsCounter, 275 mSolverCounterSat, 0.1s SdHoareTripleChecker+Time, 0 IncrementalHoareTripleChecker+Unknown, PredicateUnifierStatistics: 0 DeclaredPredicates, 461 GetRequests, 435 SyntacticMatches, 0 SemanticMatches, 26 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 6 ImplicationChecksByTransitivity, 1.1s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=1884occurred in iteration=5, InterpolantAutomatonStates: 30, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s DumpTime, AutomataMinimizationStatistics: 0.6s AutomataMinimizationTime, 5 MinimizatonAttempts, 36 StatesRemovedByMinimization, 2 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TRACE_CHECK: 0.5s SsaConstructionTime, 3.6s SatisfiabilityAnalysisTime, 1.8s InterpolantComputationTime, 640 NumberOfCodeBlocks, 640 NumberOfCodeBlocksAsserted, 6 NumberOfCheckSat, 452 ConstructedInterpolants, 0 QuantifiedInterpolants, 646 SizeOfPredicates, 16 NumberOfNonLiveVariables, 2034 ConjunctsInSsa, 40 ConjunctsInUnsatCore, 5 InterpolantComputations, 5 PerfectInterpolantSequences, 419/419 InterpolantCoveringCapability, INVARIANT_SYNTHESIS: No data available, INTERPOLANT_CONSOLIDATION: No data available, ABSTRACT_INTERPRETATION: No data available, PDR: No data available, ACCELERATED_INTERPOLATION: No data available, SIFA: No data available, ReuseStatistics: No data available RESULT: Ultimate proved your program to be incorrect! [2022-07-14 00:18:27,727 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Forceful destruction successful, exit code 0 Received shutdown request... --- End real Ultimate output --- Execution finished normally Writing output log to file Ultimate.log Writing human readable error path to file UltimateCounterExample.errorpath Result: FALSE